Red Hat Enterprise Linux 8 Security Technical Implementation Guide

The Red Hat Enterprise Linux 8 Security Technical Implementation Guide (V2 R9) has 371 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

371STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V2 · R9

CurrentPublished Wed Sep 30 2026

RHEL 8 must prevent the use of dictionary words for passwords.

Red Hat Enterprise Linux 8 Security Technical Implementation Guide

Assessment Title

Rule Text

RHEL 8 must prevent the use of dictionary words for passwords.

Description

Discussion Text

If RHEL 8 allows the user to select passwords based on dictionary words, this increases the chances of password compromise by increasing the opportunity for successful guesses, and brute-force attacks.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-230377

Rule

SV-230377r1017188_rule

Severity

medium

Rule Version

RHEL-08-020300

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Verify RHEL 8 prevents the use of dictionary words for passwords.

Determine if the field "dictcheck" is set with the following command:

$ sudo grep -r dictcheck /etc/security/pwquality.conf*

/etc/security/pwquality.conf:dictcheck=1

If the "dictcheck" parameter is not set to "1", or is commented out, this is a finding.
If conflicting results are returned, this is a finding.

Implementation Procedure

Fix Text

Configure RHEL 8 to prevent the use of dictionary words for passwords.

Add or update the following line in the "/etc/security/pwquality.conf" file or a configuration file in the /etc/pwquality.conf.d/ directory to contain the "dictcheck" parameter:

dictcheck=1

Remove any configurations that conflict with the above value.

STIG check 143 of 371 in the Red Hat Enterprise Linux 8 STIG checklist

← Previous · V-230376RHEL 8 must prohibit the use of cached authentications after one day.Next · V-230378 →RHEL 8 must enforce a delay of at least four seconds between logon prompts following a failed logon attempt.