STIGQter: STIG Summary: Cloud Linux AlmaLinux OS 9 Security Technical Implementation Guide Version: 1 Release: 7 Benchmark Date: 01 Jul 2026:

AlmaLinux OS 9 must enforce password complexity rules for the root account.

DISA Rule

SV-269388r1155272_rule

Vulnerability Number

V-269388

Group Title

SRG-OS-000069-GPOS-00037

Rule Version

ALMA-09-036100

Severity

CAT II

CCI(s)

• CCI-004066 - For password-based authentication, enforce organization-defined composition and complexity rules.

Weight

10

Fix Recommendation

Configure AlmaLinux OS 9 to enforce password complexity on the root account.

Add or update the following line in /etc/security/pwquality.conf:

enforce_for_root

Note: Unlike most Linux tools, pam_pwquality does not override its defaults with those in a drop-in file, so edit /etc/security/pwquality.conf and not use a file in /etc/security/pwquality.conf.d/ or comment out the setting in /etc/security/pwquality.conf if using a drop-in file.

Check Contents

Verify AlmaLinux OS 9 enforces password complexity rules for the root account.

Check if root user is required to use complex passwords with the following command:

$ grep -r enforce_for_root /etc/security/pwquality.conf*

/etc/security/pwquality.conf:# enforce_for_root
/etc/security/pwquality.conf.d/stig.conf:enforce_for_root

If "enforce_for_root" is commented or missing, this is a finding.

Vulnerability Number

V-269388

Documentable

False

Rule Version

ALMA-09-036100

Severity Override Guidance

Verify AlmaLinux OS 9 enforces password complexity rules for the root account.

Check if root user is required to use complex passwords with the following command:

$ grep -r enforce_for_root /etc/security/pwquality.conf*

/etc/security/pwquality.conf:# enforce_for_root
/etc/security/pwquality.conf.d/stig.conf:enforce_for_root

If "enforce_for_root" is commented or missing, this is a finding.

Check Content Reference

M

Target Key

5664