STIGQter: STIG Summary: Cloud Linux AlmaLinux OS 9 Security Technical Implementation Guide Version: 1 Release: 7 Benchmark Date: 01 Jul 2026:

AlmaLinux OS 9 must disable account identifiers (individuals, groups, roles, and devices) after 35 days of inactivity.

DISA Rule

SV-269384r1050267_rule

Vulnerability Number

V-269384

Group Title

SRG-OS-000118-GPOS-00060

Rule Version

ALMA-09-035660

Severity

CAT II

CCI(s)

• CCI-000366 - Implement the security configuration settings.

Weight

10

Fix Recommendation

Configure AlmaLinux OS 9 to disable account identifiers after 35 days of inactivity after the password expiration.

Run the following command to change the configuration for useradd:

$ useradd -D -f 35

The recommendation is 35 days, but a lower value is acceptable.

Check Contents

Verify that AlmaLinux OS 9 account identifiers (individuals, groups, roles, and devices) are disabled after 35 days of inactivity with the following command:

$ useradd -D | grep INACTIVE

INACTIVE=35

If the value of "INACTIVE" is set to "-1", a value greater than "35", or is missing, this is a finding.

Vulnerability Number

V-269384

Documentable

False

Rule Version

ALMA-09-035660

Severity Override Guidance

Verify that AlmaLinux OS 9 account identifiers (individuals, groups, roles, and devices) are disabled after 35 days of inactivity with the following command:

$ useradd -D | grep INACTIVE

INACTIVE=35

If the value of "INACTIVE" is set to "-1", a value greater than "35", or is missing, this is a finding.

Check Content Reference

M

Target Key

5664