STIGQter: STIG Summary: Red Hat Enterprise Linux 10 Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Jul 2026:

RHEL 10 must be configured so that password-auth uses a sufficient number of hashing rounds.

DISA Rule

SV-281220r1166612_rule

Vulnerability Number

V-281220

Group Title

SRG-OS-000073-GPOS-00041

Rule Version

RHEL-10-600720

Severity

CAT II

CCI(s)

• CCI-004062 - For password-based authentication, store passwords using an approved salted key derivation function, preferably using a keyed hash.
• CCI-000803 - Implement mechanisms for authentication to a cryptographic module that meet the requirements of applicable laws, Executive Orders, directives, policies, regulations, standards, and guidance for such authentication.

Weight

10

Fix Recommendation

Configure RHEL 10 to use "100000" hashing rounds for hashing passwords.

Add or modify the following line in "/etc/pam.d/password-auth" and set "rounds" to "100000":

password sufficient pam_unix.so sha512 rounds=100000

Check Contents

Verify RHEL 10 is configured to use a sufficient number of rounds for password hashing with the following command:

$ sudo grep rounds /etc/pam.d/password-auth
password sufficient pam_unix.so sha512 rounds=100000

If the setting is not configured or "rounds" is less than "100000", this a finding.

Vulnerability Number

V-281220

Documentable

False

Rule Version

RHEL-10-600720

Severity Override Guidance

Verify RHEL 10 is configured to use a sufficient number of rounds for password hashing with the following command:

$ sudo grep rounds /etc/pam.d/password-auth
password sufficient pam_unix.so sha512 rounds=100000

If the setting is not configured or "rounds" is less than "100000", this a finding.

Check Content Reference

M

Target Key

5733