STIGQter: STIG Summary: Red Hat Enterprise Linux 10 Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Jul 2026:

RHEL 10 must be configured to use a FIPS 140-3-approved cryptographic hashing algorithm for system authentication by ensuring that the pam_unix.so module is configured in the "system-auth" file.

DISA Rule

SV-281219r1166609_rule

Vulnerability Number

V-281219

Group Title

SRG-OS-000073-GPOS-00041

Rule Version

RHEL-10-600710

Severity

CAT II

CCI(s)

CCI-004062 - For password-based authentication, store passwords using an approved salted key derivation function, preferably using a keyed hash.
CCI-000803 - Implement mechanisms for authentication to a cryptographic module that meet the requirements of applicable laws, Executive Orders, directives, policies, regulations, standards, and guidance for such authentication.

Weight

Fix Recommendation

Configure RHEL 10 to use a FIPS 140-3-approved cryptographic hashing algorithm for system authentication in "/etc/pam.d/system-auth" via the "pam_unix.so" module.

Edit/modify the following line in the "/etc/pam.d/system-auth" file to include the sha512 option for pam_unix.so:

password sufficient pam_unix.so sha512

Check Contents

Verify RHEL 10 is configured to use a FIPS 140-3-approved cryptographic hashing algorithm in "/etc/pam.d/system-auth" via the pam_unix.so module with the following command:

$ sudo grep "^password.*pam_unix.so.*sha512" /etc/pam.d/system-auth
password sufficient pam_unix.so sha512

If "sha512" is missing, or the line is commented out, this is a finding.

Vulnerability Number

V-281219

Documentable

False

Rule Version

RHEL-10-600710

Severity Override Guidance

Check Content Reference

Target Key

5733