Verify AlmaLinux OS 9 is configured to limit the "pwquality" retry option to "3". Check for the use of the "pwquality" retry option in the PAM auth files with the following command: $ grep pam_pwquality.so /etc/pam.d/system-auth /etc/pam.d/password-auth /etc/pam.d/system-auth:password required pam_pwquality.so retry=3 /etc/pam.d/password-auth:password required pam_pwquality.so retry=3 If the value of "retry" is set to "0" or greater than "3", or is missing from either, this is a finding. If the system administrator (SA) can demonstrate that the required configuration is contained in a PAM configuration file included or substacked from the system-auth file, this is not a finding.