STIGQter: STIG Summary: Red Hat Enterprise Linux 10 Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Jul 2026:

RHEL 10 must ensure that the pam_unix.so module is configured in the password-auth file to use a FIPS 140-3-approved cryptographic hashing algorithm for system authentication.

DISA Rule

SV-281217r1195450_rule

Vulnerability Number

V-281217

Group Title

SRG-OS-000073-GPOS-00041

Rule Version

RHEL-10-600650

Severity

CAT II

CCI(s)

• CCI-004062 - For password-based authentication, store passwords using an approved salted key derivation function, preferably using a keyed hash.
• CCI-000803 - Implement mechanisms for authentication to a cryptographic module that meet the requirements of applicable laws, Executive Orders, directives, policies, regulations, standards, and guidance for such authentication.

Weight

10

Fix Recommendation

Configure RHEL 10 to use the sha512 cryptographic hashing algorithm for local account passwords.

Edit/modify the following line in the "/etc/pam.d/password-auth" file to include the sha512 option for pam_unix.so:

password sufficient pam_unix.so sha512

Check Contents

Verify RHEL 10 configures the pam_unix.so module to use sha512 in "/etc/pam.d/password-auth" with the following command:

$ sudo grep "^password.*pam_unix.so.*sha512" /etc/pam.d/password-auth
password sufficient pam_unix.so sha512

If "sha512" is missing, or the line is commented out, this is a finding.

Vulnerability Number

V-281217

Documentable

False

Rule Version

RHEL-10-600650

Severity Override Guidance

Verify RHEL 10 configures the pam_unix.so module to use sha512 in "/etc/pam.d/password-auth" with the following command:

$ sudo grep "^password.*pam_unix.so.*sha512" /etc/pam.d/password-auth
password sufficient pam_unix.so sha512

If "sha512" is missing, or the line is commented out, this is a finding.

Check Content Reference

M

Target Key

5733