Red Hat Enterprise Linux 9 Security Technical Implementation Guide

The Red Hat Enterprise Linux 9 Security Technical Implementation Guide (V2 R9) has 445 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

445STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V2 · R9

ArchivedPublished Wed Jul 01 2026

RHEL 9 user account passwords must have a 60-day maximum password lifetime restriction.

Red Hat Enterprise Linux 9 Security Technical Implementation Guide

Assessment Title

Rule Text

RHEL 9 user account passwords must have a 60-day maximum password lifetime restriction.

Description

Discussion Text

Any password, no matter how complex, can eventually be cracked; therefore, passwords need to be changed periodically. If RHEL 9 does not limit the lifetime of passwords and force users to change their passwords, there is the risk that RHEL 9 passwords could be compromised.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-258042

Rule

SV-258042r1045133_rule

Severity

medium

Rule Version

RHEL-09-411015

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Verify the maximum time period for existing passwords is restricted to 60 days with the following commands:

$ sudo awk -F: '$5 > 60 {printf "%s %d\n", $1, $5}' /etc/shadow

$ sudo awk -F: '$5 <= 0 {printf "%s %d\n", $1, $5}' /etc/shadow

If any results are returned that are not associated with a system account, this is a finding.

Implementation Procedure

Fix Text

Configure noncompliant accounts to enforce a 60-day maximum password lifetime restriction.

passwd -x 60 [user]

STIG check 256 of 445 in the Red Hat Enterprise Linux 9 STIG checklist

← Previous · V-258041RHEL 9 user account passwords for new users or password changes must have a 60-day maximum password lifetime restriction in /etc/login.defs.Next · V-258043 →All RHEL 9 local interactive user accounts must be assigned a home directory upon creation.