STIGQter: STIG Summary: Cloud Linux AlmaLinux OS 9 Security Technical Implementation Guide Version: 1 Release: 7 Benchmark Date: 01 Jul 2026:

AlmaLinux OS 9 PAM must be configured to use a sufficient number of password hashing rounds.

DISA Rule

SV-269398r1050281_rule

Vulnerability Number

V-269398

Group Title

SRG-OS-000073-GPOS-00041

Rule Version

ALMA-09-037200

Severity

CAT I

CCI(s)

CCI-004062 - For password-based authentication, store passwords using an approved salted key derivation function, preferably using a keyed hash.

Weight

Fix Recommendation

Configure AlmaLinux OS 9 to use at least 100000 hashing rounds for hashing passwords.

Add or modify the following line in "/etc/pam.d/password-auth" and "/etc/pam.d/system-auth" and set "rounds" to "100000" or higher:

password sufficient pam_unix.so sha512 rounds=100000

Check Contents

Verify the number of rounds for the password hashing algorithm is configured with the following command:

$ grep rounds /etc/pam.d/password-auth /etc/pam.d/system-auth

/etc/pam.d/password-auth:password sufficient pam_unix.so sha512 shadow rounds=100000 use_authtok
/etc/pam.d/system-auth:password sufficient pam_unix.so sha512 shadow rounds=100000 use_authtok

If a matching line is not returned in both files, or "rounds" is less than "100000", this a finding.

Add/modify the appropriate sections of the "/etc/pam.d/password-auth" file to match the following lines, ensuring that the "preauth" line is listed before pam_unix.so

Vulnerability Number

V-269398

Documentable

False

Rule Version

ALMA-09-037200

Severity Override Guidance

Check Content Reference

Target Key

5664