STIGQter: STIG Summary: Red Hat Enterprise Linux 10 Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Jul 2026:

RHEL 10 must employ FIPS 140-3-approved cryptographic hashing algorithms for all stored passwords.

DISA Rule

SV-281221r1208797_rule

Vulnerability Number

V-281221

Group Title

SRG-OS-000073-GPOS-00041

Rule Version

RHEL-10-600730

Severity

CAT I

CCI(s)

CCI-004062 - For password-based authentication, store passwords using an approved salted key derivation function, preferably using a keyed hash.
CCI-000803 - Implement mechanisms for authentication to a cryptographic module that meet the requirements of applicable laws, Executive Orders, directives, policies, regulations, standards, and guidance for such authentication.

Weight

Fix Recommendation

Configure RHEL 10 to employ FIPS 140-3-approved cryptographic hashing algorithms for all stored passwords.

Lock all interactive user accounts not using SHA-512 hashing until the passwords can be regenerated with SHA-512.

Check Contents

Verify RHEL 10 employs FIPS 140-3-approved cryptographic hashing algorithms for all stored passwords for interactive user accounts with the following command:

$ sudo cut -d: -f1,2 /etc/shadow
nsauser:$6$kcOnRq/5$NUEYPuyL.wghQwWssXRcLRFiiru7f5JPV6GaJhNC2aK5F3PZpE/BCCtwrxRc/AInKMNX3CdMw11m9STiql12f/

Password hashes "!" or "*" indicate inactive accounts not available for login and are not evaluated.

If any interactive user password hash does not begin with "$6", this is a finding.

Vulnerability Number

V-281221

Documentable

False

Rule Version

RHEL-10-600730

Severity Override Guidance

Check Content Reference

Target Key

5733