OpenControls Logo

STIG Viewer

STIGViewer Support

AlmaLinux OS 9 must ensure the password complexity module in the system-auth file is configured for three retries or less.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-269387ALMA-09-035990SV-269387r1050270_ruleCCI-004066medium
Description
AlmaLinux OS 9 uses "pwquality" as a mechanism to enforce password complexity. This is set in both: /etc/pam.d/password-auth /etc/pam.d/system-auth By limiting the number of attempts to meet the pwquality module complexity requirements before returning with an error, the system will audit abnormal attempts at password changes.
STIGDate
Cloud Linux AlmaLinux OS 9 Security Technical Implementation Guide2026-02-27

Related Frameworks

1 mapping across 4 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (3) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

IAC-10Authenticator Management
0.50
IAC-10.1Password-Based Authentication
0.50
IAC-10.4Automated Support For Password Strength
0.50
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (61) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-10Concurrent Session Control
1.00
AC-12Session Termination
1.00
AC-17(10)Authenticate Remote Commands
1.00
AC-2(1)Automated System Account Management
1.00
AC-2(10)Shared and Group Account Credential Change
1.00
AC-2(11)Usage Conditions
1.00
AC-2(2)Automated Temporary and Emergency Account Management
1.00
AC-2(3)Disable Accounts
1.00
AC-2(4)Automated Audit Actions
1.00
AC-3Access Enforcement
1.00

+51 more (top 10 by confidence shown)

NIST 800-1710 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (4) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

3.5.10
1.00
3.5.7
1.00
3.5.8
1.00
3.5.9
1.00
CCI1 mapping
CCI-004066
1.00

Details

Check Text (C-269387r1050270_chk)

Verify AlmaLinux OS 9 is configured to limit the "pwquality" retry option to "3". Check for the use of the "pwquality" retry option in the PAM auth files with the following command: $ grep pam_pwquality.so /etc/pam.d/system-auth /etc/pam.d/password-auth /etc/pam.d/system-auth:password required pam_pwquality.so retry=3 /etc/pam.d/password-auth:password required pam_pwquality.so retry=3 If the value of "retry" is set to "0" or greater than "3", or is missing from either, this is a finding. If the system administrator (SA) can demonstrate that the required configuration is contained in a PAM configuration file included or substacked from the system-auth file, this is not a finding.

Fix Text (F-73319r1049602_fix)

Configure AlmaLinux OS 9 to limit the "pwquality" retry option to "3". Add the following line to the "/etc/pam.d/system-auth" and "/etc/pam.d/password-auth" files (or modify the line to have the required value): password required pam_pwquality.so retry=3