Red Hat Enterprise Linux 10 Security Technical Implementation Guide

The Red Hat Enterprise Linux 10 Security Technical Implementation Guide (V1 R3) has 435 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

435STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V1 · R3

CurrentPublished Wed Sep 30 2026

RHEL 10 must, for user account passwords, have a 180-day maximum password lifetime restriction

Red Hat Enterprise Linux 10 Security Technical Implementation Guide

Assessment Title

Rule Text

RHEL 10 must, for user account passwords, have a 180-day maximum password lifetime restriction

Description

Discussion Text

Any password, no matter how complex, can eventually be cracked; therefore, passwords need to be changed periodically. If RHEL 10 does not limit the lifetime of passwords and force users to change their passwords, there is the risk that RHEL 10 passwords could be compromised.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-281170

Rule

SV-281170r1273591_rule

Severity

medium

Rule Version

RHEL-10-600110

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Verify RHEL 10 enforces a 180-day maximum time period for existing user account passwords with the following commands:

$ sudo awk -F: '$5 > 180 {print $1 " " $5}' /etc/shadow

$ sudo awk -F: '$5 <= 0 {print $1 " " $5}' /etc/shadow

If any results are returned that are not associated with a system account, this is a finding.

Implementation Procedure

Fix Text

Configure RHEL 10 to enforce a 180-day maximum password lifetime restriction on user account passwords.

Set the 180-day maximum password lifetime restriction with the following command:

$ sudo passwd -x 180 [user]

STIG check 238 of 435 in the Red Hat Enterprise Linux 10 STIG checklist

← Previous · V-281169RHEL 10 user account passwords for new users or password changes must have a 180-day maximum password lifetime restriction in /etc/login.defs.Next · V-281171 →RHEL 10 must assign a home directory for local interactive user accounts upon creation.