Notes on getting Rocky 9 and Ubuntu 24.04 compliant with DISA STIGs

Rocky_8_STIG_notes.md

Rocky 8 STIG notes

Red Hat Enterprise Linux 8 Security Technical Implementation Guide :: Version 1, Release: 14 Benchmark Date: 24 Apr 2024

Updated on 2024-07-02

Utilities

All fix and check commands must be run as root.

The fix snippets listed later make use of the following helper functions:

# paste this block in before running the later fix commands

utils.add_if_missing() {
    [[ $# -eq 2 ]] || return
    [[ $1 != "${1%/*}" && ! -d ${1%/*} ]] && mkdir -p "${1%/*}"
    grep -qsF -- "$2" "$1" || printf '%s\n' "$2" >>"$1"
}

utils.set_sysctl_option() {
    [[ $# -eq 2 ]] || return
    [[ $(sysctl -n "$1") == "$2" ]] ||
        utils.add_if_missing /etc/sysctl.d/99-sysctl.conf "$1 = $2"
}

utils.set_ssh_option() {
    [[ $# -eq 1 ]] || return
    grep -qrsE -- "^$1" /etc/ssh/sshd_config /etc/ssh/sshd_config.d/* ||
        utils.add_if_missing /etc/ssh/sshd_config.d/99-stig.conf "$1"
}

utils.blacklist_kernel_module() {
    [[ $# -eq 1 ]] || return
    utils.add_if_missing "/etc/modprobe.d/$1.conf" \
        "$(printf 'install %s /bin/false\nblacklist %s' "$1" "$1")"
}

utils.add_audit_rule() {
    [[ $# -eq 1 ]] || return
    grep -qrs -- "$1" /etc/audit/audit.rules /etc/audit/rules.d/* ||
        utils.add_if_missing /etc/audit/rules.d/stig.rules "$1"
}

utils.add_kernel_cmdline() {
    [[ $# -eq 1 ]] || return
    awk -i inplace -v p="$1" '
        /CMDLINE/ && $0 !~ p {gsub(/(["'\''])$/, " "p"&")} 1
    ' /etc/default/grub
    grubby --update-kernel=ALL --args="$1"
}

utils.ensure_package_installed() {
    [[ $# -eq 1 ]] || return
    rpm --quiet -q $1 || dnf -qy install $1
}

utils.ensure_package_removed() {
    [[ $# -eq 1 ]] || return
    rpm --quiet -q $1 && dnf -qy remove $1
}

utils.get_config_option() {
    [[ $# -ge 2 ]] || return
    local c='#' a d i=0 r1 r2
    while [[ $# -gt 2 ]]; do
        [[ $1 == -d ]] && d=$2 && shift 2
        [[ $1 == -i ]] && i=1 && shift
    done
    [[ $# -eq 2 ]] || return
    [[ $i -eq 1 ]] && a=$c c=''
    r1="^[ \t]*(|${c:-}+.*)$"
    r2="^[ \t${a:-}]*${2}[ \t]*${d:-[ \t]+}[ \t]*([^${c:-$a}]*).*$"
    awk -v r1="$r1" -v r2="$r2" '$0 !~ r1 && $0 ~ r2 {match($0, r2, m);
        gsub(/^[ \t]*|[ \t]*$/, "", m[1]); print m[1]; exit}' "$1"
}

utils.set_config_option() {
    [[ $# -ge 3 ]] || return
    local a c='#' a d i o r1 r2
    while [[ $# -gt 3 ]]; do
        [[ $1 == -a ]] && a=1 && shift
        [[ $1 == -d ]] && d=$2 && shift 2
        [[ $1 == -i ]] && i='-i' && shift
    done
    [[ $# -eq 3 ]] || return
    [[ -f $1 ]] && o=$(utils.get_config_option -d "$d" ${i:-} "$1" "$2")
    [[ ${a:-} || ! ${o:-} ]] &&
        utils.add_if_missing "$1" "${2}${d:- }${3}" && return
    [[ ${i:-} ]] && a=$c c=''
    r1="^[ \t]*(|${c:-}+.*)$"
    r2="^([ \t${a:-}]*)(${2}[ \t]*${d:-[ \t]+}[ \t]*)([^${c:-$a}]*)(.*)$"
    awk -i inplace -v r1="$r1" -v r2="$r2" -v new="$3" '
        $0 !~ r1 && $0 ~ r2 && c == 0 {
            match($0, r2, m); gsub($0, m[2] new m[4]); c = 1
        } 1' "$1"
}

CAT I Checks

V-230221

RHEL 8 must be a vendor-supported release.

. /etc/os-release && echo $NAME $VERSION  # RHEL 8.x

V-230223

RHEL 8 must implement NIST FIPS-validated cryptography for the following: To provision digital signatures, to generate cryptographic hashes, and to protect data requiring data-at-rest protections in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.

fips-mode-setup --enable

V-230234

RHEL 8 operating systems booted with United Extensible Firmware Interface (UEFI) must require authentication upon booting into single-user mode and maintenance.

grub2-set-password
# Follow the prompts to set password

V-230235

RHEL 8 operating systems booted with a BIOS must require authentication upon booting into single-user and maintenance modes.

# Not applicable on UEFI systems

V-230264

RHEL 8 must prevent the installation of software, patches, service packs, device drivers, or operating system components from a repository without verification they have been digitally signed using a certificate that is issued by a Certificate Authority (CA) that is recognized and approved by the organization.

sed -i 's/gpgcheck\s*=.*/gpgcheck=1/g' /etc/yum.repos.d/*

V-230265

RHEL 8 must prevent the installation of software, patches, service packs, device drivers, or operating system components of local packages without verification they have been digitally signed using a certificate that is issued by a Certificate Authority (CA) that is recognized and approved by the organization.

utils.set_config_option -d = /etc/dnf/dnf.conf localpkg_gpgcheck 1

V-230283

There must be no shosts.equiv files on the RHEL 8 operating system.

find / -name shosts.equiv -delete

V-230284

There must be no .shosts files on the RHEL 8 operating system.

find / -name '*.shosts' -delete

V-230329

Unattended or automatic logon via the RHEL 8 graphical user interface must not be allowed.

# no graphical interface installed

V-230380

RHEL 8 must not allow accounts configured with blank or null passwords.

utils.set_ssh_option 'PermitEmptyPasswords no'

V-230487

RHEL 8 must not have the telnet-server package installed.

utils.ensure_package_removed telnet-server

V-230492

RHEL 8 must not have the rsh-server package installed.

utils.ensure_package_removed rsh-server

V-230529

The x86 Ctrl-Alt-Delete key sequence must be disabled on RHEL 8.

systemctl mask --now ctrl-alt-del.target

V-230530

The x86 Ctrl-Alt-Delete key sequence in RHEL 8 must be disabled if a graphical user interface is installed.

# no graphical interface installed

V-230531

The systemd Ctrl-Alt-Delete burst key sequence in RHEL 8 must be disabled.

utils.add_if_missing /etc/systemd/system.conf.d/stig.conf 'CtrlAltDelBurstAction=none'

V-230533

The Trivial File Transfer Protocol (TFTP) server package must not be installed if not required for RHEL 8 operational support.

utils.ensure_package_removed tftp-server

V-230534

The root account must be the only account having unrestricted access to the RHEL 8 system.

awk -F: '$3 == 0 {print $1}' /etc/passwd # only root

V-230558

A File Transfer Protocol (FTP) server package must not be installed unless mission essential on RHEL 8.

utils.ensure_package_removed vsftpd

V-244540

RHEL 8 must not allow blank or null passwords in the system-auth file.

# Rule not reviewed

V-244541

RHEL 8 must not allow blank or null passwords in the password-auth file.

# Rule not reviewed

V-251706

The RHEL 8 operating system must not have accounts configured with blank or null passwords.

# Configured correctly by default
awk -F: '!$2 {print $1}' /etc/shadow

CAT II Checks

V-230222

RHEL 8 vendor packaged system security patches and updates must be installed and up to date.

dnf -y update

V-230224

All RHEL 8 local disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at rest protection.

# Not applicable to VMs

V-230225

RHEL 8 must display the Standard Mandatory DOD Notice and Consent Banner before granting local or remote access to the system via a ssh logon.

utils.set_ssh_option 'Banner /etc/issue'

V-230226

RHEL 8 must display the Standard Mandatory DoD Notice and Consent Banner before granting local or remote access to the system via a graphical user logon.

# no graphical interface installed

V-230227

RHEL 8 must display the Standard Mandatory DoD Notice and Consent Banner before granting local or remote access to the system via a command line user logon.

cat <<'EOF' >/etc/issue
US Department of Defense Warning Statement

You are accessing a U.S. Government (USG) Information System (IS) that is
provided for USG-authorized use only. By using this IS (which includes any
device attached to this IS), you consent to the following conditions:

-The USG routinely intercepts and monitors communications on this IS for
purposes including, but not limited to, penetration testing, COMSEC monitoring,
network operations and defense, personnel misconduct (PM), law enforcement
(LE), and counterintelligence (CI) investigations.

-At any time, the USG may inspect and seize data stored on this IS.

-Communications using, or data stored on, this IS are not private, are subject
to routine monitoring, interception, and search, and may be disclosed or used
for any USG-authorized purpose.

-This IS includes security measures (e.g., authentication and access controls)
to protect USG interests -- not for your personal benefit or privacy.

-Notwithstanding the above, using this IS does not constitute consent to PM, LE
or CI investigative searching or monitoring of the content of privileged
communications, or work product, related to personal representation or services
by attorneys, psychotherapists, or clergy, and their assistants. Such
communications and work product are private and confidential. See User
Agreement for details.
EOF

V-230228

All RHEL 8 remote access methods must be monitored.

utils.add_if_missing /etc/rsyslog.d/stig.conf 'auth.*;authpriv.*;daemon.* /var/log/secure'

V-230229

RHEL 8, for PKI-based authentication, must validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor.

# Rule not reviewed

V-230230

RHEL 8, for certificate-based authentication, must enforce authorized access to the corresponding private key.

# no key files in baseline

V-230231

RHEL 8 must encrypt all stored passwords with a FIPS 140-2 approved cryptographic hashing algorithm.

utils.set_config_option /etc/login.defs ENCRYPT_METHOD SHA512

V-230232

RHEL 8 must employ FIPS 140-2 approved cryptographic hashing algorithms for all stored passwords.

# configured correctly by default
awk -F: '$2 !~ /[!\*]+/ {print $2}' /etc/shadow

V-230233

The RHEL 8 shadow password suite must be configured to use a sufficient number of hashing rounds.

utils.set_config_option /etc/login.defs SHA_CRYPT_MIN_ROUNDS 5000

V-230236

RHEL 8 operating systems must require authentication upon booting into rescue mode.

# set by default
grep sulogin /usr/lib/systemd/system/rescue.service

V-230237

The RHEL 8 pam_unix.so module must be configured in the password-auth file to use a FIPS 140-2 approved cryptographic hashing algorithm for system authentication.

# Rule not reviewed

V-230238

RHEL 8 must prevent system daemons from using Kerberos for authentication.

# No keytabs installed by default
ls -al /etc/*.keytab

V-230239

The krb5-workstation package must not be installed on RHEL 8.

utils.ensure_package_removed krb5-workstation

V-230240

RHEL 8 must use a Linux Security Module configured to enforce limits on system services.

sed -i 's/SELINUX\s*=.*/SELINUX=enforcing/g' /etc/selinux/config

V-230243

A sticky bit must be set on all RHEL 8 public directories to prevent unauthorized and unintended information transferred via shared system resources.

# permissions correct by default
find / -type d -perm -0002 ! -perm -1000

V-230244

RHEL 8 must be configured so that all network connections associated with SSH traffic terminate after becoming unresponsive.

utils.set_ssh_option 'ClientAliveCountMax 1'

V-230245

The RHEL 8 /var/log/messages file must have mode 0640 or less permissive.

# permissions correct by default
ls -la /var/log/messages

V-230246

The RHEL 8 /var/log/messages file must be owned by root.

# permissions correct by default
ls -la /var/log/messages

V-230247

The RHEL 8 /var/log/messages file must be group-owned by root.

# permissions correct by default
ls -la /var/log/messages

V-230248

The RHEL 8 /var/log directory must have mode 0755 or less permissive.

# permissions correct by default
ls -ld /var/log

V-230249

The RHEL 8 /var/log directory must be owned by root.

# permissions correct by default
ls -ld /var/log

V-230250

The RHEL 8 /var/log directory must be group-owned by root.

# permissions correct by default
ls -ld /var/log

V-230251

The RHEL 8 SSH server must be configured to use only Message Authentication Codes (MACs) employing FIPS 140-2 validated cryptographic hash algorithms.

# configured by default
grep MACs /etc/crypto-policies/back-ends/openssh.config

V-230252

The RHEL 8 operating system must implement DoD-approved encryption to protect the confidentiality of SSH server connections.

# configured by default
grep Ciphers /etc/crypto-policies/back-ends/openssh.config

V-230254

The RHEL 8 operating system must implement DoD-approved encryption in the OpenSSL package.

fips-mode-setup --enable

V-230255

The RHEL 8 operating system must implement DoD-approved TLS encryption in the OpenSSL package.

update-crypto-policies --show  # FIPS

V-230256

The RHEL 8 operating system must implement DoD-approved TLS encryption in the GnuTLS package.

update-crypto-policies --show  # FIPS

V-230257

RHEL 8 system commands must have mode 755 or less permissive.

# permissions correct by default
find -L /usr{/local,}/{s,}bin /usr/libexec -perm /022 -exec ls -l {} \;

V-230258

RHEL 8 system commands must be owned by root.

# permissions correct by default
find -L /usr{/local,}/{s,}bin /usr/libexec ! -user root -exec ls -l {} \;

V-230259

RHEL 8 system commands must be group-owned by root or a system account.

# permissions correct by default
find -L /usr{/local,}/{s,}bin /usr/libexec ! -group root -exec ls -l {} \;

V-230260

RHEL 8 library files must have mode 755 or less permissive.

# permissions correct by default
find -L /usr/lib{64,} -perm /022 -type f -exec ls -l {} \;

V-230261

RHEL 8 library files must be owned by root.

# permissions correct by default
find -L /usr/lib{64,} ! -user root -type f -exec ls -l {} \;

V-230262

RHEL 8 library files must be group-owned by root or a system account.

# permissions correct by default
find -L /usr/lib{64,} ! -group root -type f -exec ls -l {} \;

V-230263

The RHEL 8 file integrity tool must notify the system administrator when changes to the baseline configuration or anomalies in the operation of any security functions are discovered within an organizationally defined frequency.

cat <<'EOF' >/etc/cron.daily/aide
#!/bin/bash
/usr/sbin/aide --check | /bin/mail -s "$HOSTNAME - Daily aide integrity check run" [email protected]
EOF

V-230266

RHEL 8 must prevent the loading of a new kernel for later execution.

utils.set_sysctl_option kernel.kexec_load_disabled 1

V-230267

RHEL 8 must enable kernel parameters to enforce discretionary access control on symlinks.

utils.set_sysctl_option fs.protected_symlinks 1

V-230268

RHEL 8 must enable kernel parameters to enforce discretionary access control on hardlinks.

utils.set_sysctl_option fs.protected_hardlinks 1

V-230271

RHEL 8 must require users to provide a password for privilege escalation.

# configured correctly by default
grep -ri nopasswd /etc/sudoers /etc/sudoers.d/*

V-230272

RHEL 8 must require users to reauthenticate for privilege escalation.

# Configured correctly by default
grep -ir '!authenticate' /etc/sudoers /etc/sudoers.d/*

V-230273

RHEL 8 must have the packages required for multifactor authentication installed.

utils.ensure_package_installed openssl-pkcs11

V-230274

RHEL 8 must implement certificate status checking for multifactor authentication.

# Rule not reviewed

V-230275

RHEL 8 must accept Personal Identity Verification (PIV) credentials.

utils.ensure_package_installed opensc

V-230276

RHEL 8 must implement non-executable data to protect its memory from unauthorized code execution.

# enabled by default
dmesg | grep '[NX|DX]*protection'

V-230277

RHEL 8 must clear the page allocator to prevent use-after-free attacks.

utils.add_kernel_cmdline 'page_poison=1'

V-230278

RHEL 8 must disable virtual syscalls.

utils.add_kernel_cmdline 'vsyscall=none'

V-230279

RHEL 8 must clear SLUB/SLAB objects to prevent use-after-free attacks.

utils.add_kernel_cmdline 'slub_debug=P'

V-230280

RHEL 8 must implement address space layout randomization (ASLR) to protect its memory from unauthorized code execution.

utils.set_sysctl_option kernel.randomize_va_space 2

V-230282

RHEL 8 must enable the SELinux targeted policy.

# Targeted policy is default
grep SELINUXTYPE /etc/selinux/config

V-230286

The RHEL 8 SSH public host key files must have mode 0644 or less permissive.

# permissions correct by default
ls -l /etc/ssh/*.pub

V-230287

The RHEL 8 SSH private host key files must have mode 0640 or less permissive.

# permissions correct by default
ls -l /etc/ssh/*_key

V-230288

The RHEL 8 SSH daemon must perform strict mode checking of home directory configuration files.

utils.set_ssh_option 'StrictModes yes'

V-230290

The RHEL 8 SSH daemon must not allow authentication using known host’s authentication.

utils.set_ssh_option 'IgnoreUserKnownHosts yes'

V-230291

The RHEL 8 SSH daemon must not allow Kerberos authentication, except to fulfill documented and validated mission requirements.

utils.set_ssh_option 'KerberosAuthentication no'

V-230295

A separate RHEL 8 filesystem must be used for the /tmp directory.

# Already implemented during install
mountpoint /tmp

V-230296

RHEL 8 must not permit direct logons to the root account using remote access via SSH.

utils.set_ssh_option 'PermitRootLogin no'

V-230298

The rsyslog service must be running in RHEL 8.

# enabled by default
systemctl -q is-active rsyslog || systemctl enable --now rsyslog

V-230299

RHEL 8 must prevent files with the setuid and setgid bit set from being executed on file systems that contain user home directories.

# Already implemented during install
mount | grep /home

V-230300

RHEL 8 must prevent files with the setuid and setgid bit set from being executed on the /boot directory.

# Already implemented during install
mount | grep /home

V-230301

RHEL 8 must prevent special devices on non-root local partitions.

mount | awk '$1 ~ /\/dev/ && $6 !~ /nodev/'

V-230302

RHEL 8 must prevent code from being executed on file systems that contain user home directories.

# Already implemented during install
mount | grep /home

V-230303

RHEL 8 must prevent special devices on file systems that are used with removable media.

# no removable media mounts present

V-230304

RHEL 8 must prevent code from being executed on file systems that are used with removable media.

# no removable media mounts present

V-230305

RHEL 8 must prevent files with the setuid and setgid bit set from being executed on file systems that are used with removable media.

# no removable media mounts present

V-230306

RHEL 8 must prevent code from being executed on file systems that are imported via Network File System (NFS).

# no NFS mounts present

V-230307

RHEL 8 must prevent special devices on file systems that are imported via Network File System (NFS).

# no NFS mounts present

V-230308

RHEL 8 must prevent files with the setuid and setgid bit set from being executed on file systems that are imported via Network File System (NFS).

# no NFS mounts present

V-230309

Local RHEL 8 initialization files must not execute world-writable programs.

# correctly configured by default
find /home -perm -002 -type f -name ".[^.]*" -exec ls -ld {} \;

V-230310

RHEL 8 must disable kernel dumps unless needed.

systemctl mask --now kdump

V-230311

RHEL 8 must disable the kernel.core_pattern.

utils.set_sysctl_option kernel.core_pattern '|/bin/false'

V-230312

RHEL 8 must disable acquiring, saving, and processing core dumps.

systemctl mask --now systemd-coredump.socket

V-230313

RHEL 8 must disable core dumps for all users.

utils.add_if_missing /etc/security/limits.d/stig.conf '* hard core 0'

V-230314

RHEL 8 must disable storing core dumps.

utils.add_if_missing /etc/systemd/coredump.conf.d/stig.conf 'Storage=none'

V-230315

RHEL 8 must disable core dump backtraces.

utils.add_if_missing /etc/systemd/coredump.conf.d/stig.conf 'ProcessSizeMax=0'

V-230316

For RHEL 8 systems using Domain Name Servers (DNS) resolution, at least two name servers must be configured.

# nameservers set via DHCP
grep nameserver /etc/resolv.conf

V-230317

Executable search paths within the initialization files of all local interactive RHEL 8 users must only contain paths that resolve to the system default or the users home directory.

# correctly configured by default
grep -si path= /home/*/.*

V-230318

All RHEL 8 world-writable directories must be owned by root, sys, bin, or an application user.

# permissions correct by default
df --local -P | awk '{if (NR!=1) print $6}' |
    xargs -I_ find _ -xdev -type d -perm -0002 -uid +0 -print

V-230319

All RHEL 8 world-writable directories must be group-owned by root, sys, bin, or an application group.

# permissions correct by default
df --local -P | awk '{if (NR!=1) print $6}' |
    xargs -I_ find _ -xdev -type d -perm -0002 -gid +0 -print

V-230320

All RHEL 8 local interactive users must have a home directory assigned in the /etc/passwd file.

# correctly configured by default
awk -F: '$3 >= 1000 && $7 !~ /nologin/ {print $1, $3, $6}' /etc/passwd

V-230321

All RHEL 8 local interactive user home directories must have mode 0750 or less permissive.

awk -F: '$3 >= 1000 && $7 !~ /nologin/ {print $6}' /etc/passwd |
    xargs -l chmod 0750

V-230322

All RHEL 8 local interactive user home directories must be group-owned by the home directory owner’s primary group.

# correctly configured by default
awk -F: '$3 >= 1000 && $7 !~ /nologin/ {print $6}' /etc/passwd

V-230323

All RHEL 8 local interactive user home directories defined in the /etc/passwd file must exist.

# correctly configured by default
pwck -r

V-230324

All RHEL 8 local interactive user accounts must be assigned a home directory upon creation.

utils.set_config_option /etc/login.defs CREATE_HOME yes

V-230325

All RHEL 8 local initialization files must have mode 0740 or less permissive.

awk -F: '$3 >= 1000 && $7 !~ /nologin/ {print $6}' /etc/passwd |
    xargs -I_ find _ -maxdepth 1 -exec chmod g-w,o-rwx "{}" \;

V-230326

All RHEL 8 local files and directories must have a valid owner.

# All ownership valid in the baseline
df --local -P | awk '{if (NR!=1) print $6}' | xargs -I_ find _ -xdev -nouser

V-230327

All RHEL 8 local files and directories must have a valid group owner.

# All ownership valid in the baseline
df --local -P | awk '{if (NR!=1) print $6}' | xargs -I_ find _ -xdev -nogroup

V-230328

A separate RHEL 8 filesystem must be used for user home directories (such as /home or an equivalent).

# Already implemented during install
mountpoint /home

V-230330

RHEL 8 must not allow users to override SSH environment variables.

utils.set_ssh_option 'PermitUserEnvironment no'

V-230331

RHEL 8 temporary user accounts must be provisioned with an expiration time of 72 hours or less.

# no temp accounts exist by default

V-230332

RHEL 8 must automatically lock an account when three unsuccessful logon attempts occur.

# Rule not reviewed

V-230333

RHEL 8 must automatically lock an account when three unsuccessful logon attempts occur.

utils.set_config_option -i -d = /etc/security/faillock.conf deny 3

V-230334

RHEL 8 must automatically lock an account when three unsuccessful logon attempts occur during a 15-minute time period.

# Rule not reviewed

V-230335

RHEL 8 must automatically lock an account when three unsuccessful logon attempts occur during a 15-minute time period.

utils.set_config_option -i -d = /etc/security/faillock.conf fail_interval 900

V-230336

RHEL 8 must automatically lock an account until the locked account is released by an administrator when three unsuccessful logon attempts occur during a 15-minute time period.

# Rule not reviewed

V-230337

RHEL 8 must automatically lock an account until the locked account is released by an administrator when three unsuccessful logon attempts occur during a 15-minute time period.

utils.set_config_option -i -d = /etc/security/faillock.conf unlock_time 0

V-230338

RHEL 8 must ensure account lockouts persist.

# Rule not reviewed

V-230339

RHEL 8 must ensure account lockouts persist.

utils.set_config_option -i -d = /etc/security/faillock.conf dir /var/log/faillock

V-230340

RHEL 8 must prevent system messages from being presented when three unsuccessful logon attempts occur.

# Rule not reviewed

V-230341

RHEL 8 must prevent system messages from being presented when three unsuccessful logon attempts occur.

utils.set_config_option -i /etc/security/faillock.conf silent ''

V-230342

RHEL 8 must log user name information when unsuccessful logon attempts occur.

# Rule not reviewed

V-230343

RHEL 8 must log user name information when unsuccessful logon attempts occur.

utils.set_config_option -i /etc/security/faillock.conf audit ''

V-230344

RHEL 8 must include root when automatically locking an account until the locked account is released by an administrator when three unsuccessful logon attempts occur during a 15-minute time period.

# Rule not reviewed

V-230345

RHEL 8 must include root when automatically locking an account until the locked account is released by an administrator when three unsuccessful logon attempts occur during a 15-minute time period.

utils.set_config_option -i /etc/security/faillock.conf even_deny_root ''

V-230347

RHEL 8 must enable a user session lock until that user re-establishes access using established identification and authentication procedures for graphical user sessions.

# no graphical interface installed

V-230348

RHEL 8 must enable a user session lock until that user re-establishes access using established identification and authentication procedures for command line sessions.

utils.add_if_missing /etc/tmux.conf 'set -g lock-command vlock'
utils.add_if_missing /etc/tmux.conf 'bind X lock-session'

V-230349

RHEL 8 must ensure session control is automatically started at shell initialization.

cat <<'EOF' >/etc/profile.d/tmux.sh
#!/bin/bash
[[ -n $PS1 && -z $TMUX && -z $DISPLAY && ! $(pstree -s $$) =~ tmux|sudo ]] && exec tmux new -As0
EOF

V-230351

RHEL 8 must be able to initiate directly a session lock for all connection types using smartcard when the smartcard is removed.

# no graphical interface installed

V-230352

RHEL 8 must automatically lock graphical user sessions after 15 minutes of inactivity.

# no graphical interface installed

V-230353

RHEL 8 must automatically lock command line user sessions after 15 minutes of inactivity.

utils.add_if_missing /etc/tmux.conf 'set -g lock-after-time 900'

V-230354

RHEL 8 must prevent a user from overriding the session lock-delay setting for the graphical user interface.

# no graphical interface installed

V-230355

RHEL 8 must map the authenticated identity to the user or group account for PKI-based authentication.

# Rule not reviewed

V-230356

RHEL 8 must ensure the password complexity module is enabled in the password-auth file.

# Rule not reviewed

V-230357

RHEL 8 must enforce password complexity by requiring that at least one uppercase character be used.

utils.set_config_option -i -d = /etc/security/pwquality.conf ucredit '-1'

V-230358

RHEL 8 must enforce password complexity by requiring that at least one lower-case character be used.

utils.set_config_option -i -d = /etc/security/pwquality.conf lcredit '-1'

V-230359

RHEL 8 must enforce password complexity by requiring that at least one numeric character be used.

utils.set_config_option -i -d = /etc/security/pwquality.conf dcredit '-1'

V-230360

RHEL 8 must require the maximum number of repeating characters of the same character class be limited to four when passwords are changed.

utils.set_config_option -i -d = /etc/security/pwquality.conf maxclassrepeat 4

V-230361

RHEL 8 must require the maximum number of repeating characters be limited to three when passwords are changed.

utils.set_config_option -i -d = /etc/security/pwquality.conf maxrepeat 3

V-230362

RHEL 8 must require the change of at least four character classes when passwords are changed.

utils.set_config_option -i -d = /etc/security/pwquality.conf minclass 4

V-230363

RHEL 8 must require the change of at least 8 characters when passwords are changed.

utils.set_config_option -i -d = /etc/security/pwquality.conf difok 8

V-230364

RHEL 8 passwords must have a 24 hours/1 day minimum password lifetime restriction in /etc/shadow.

# Set correctly on the default account
awk -F: '$3 >= 1000 && $3 < 65534 {print $1}' /etc/passwd |
    xargs -I{} awk -F: -v u="{}" '$1 == u {print $1 " " $4}' /etc/shadow

V-230365

RHEL 8 passwords for new users or password changes must have a 24 hours/1 day minimum password lifetime restriction in /etc/login.defs.

utils.set_config_option /etc/login.defs PASS_MIN_DAYS 1

V-230366

RHEL 8 user account passwords must have a 60-day maximum password lifetime restriction.

utils.set_config_option /etc/login.defs PASS_MAX_DAYS 60

V-230367

RHEL 8 user account passwords must be configured so that existing passwords are restricted to a 60-day maximum lifetime.

# correctly configured by default
awk -F: '$5 <= 0 {print $1 "" "" $5}' /etc/shadow

V-230368

RHEL 8 must be configured in the password-auth file to prohibit password reuse for a minimum of five generations.

# Rule not reviewed

V-230369

RHEL 8 passwords must have a minimum of 15 characters.

utils.set_config_option -i -d = /etc/security/pwquality.conf minlen '15'

V-230370

RHEL 8 passwords for new users must have a minimum of 15 characters.

utils.set_config_option /etc/login.defs PASS_MIN_LEN 15

V-230371

RHEL 8 duplicate User IDs (UIDs) must not exist for interactive users.

# correctly configured by default
awk -F ":" 'list[$3]++ {print $1, $3}' /etc/passwd

V-230372

RHEL 8 must implement smart card logon for multifactor authentication for access to interactive accounts.

# Rule not reviewed

V-230373

RHEL 8 account identifiers (individuals, groups, roles, and devices) must be disabled after 35 days of inactivity.

useradd -D -f 35

V-230374

RHEL 8 must automatically expire temporary accounts within 72 hours.

# no temp accounts exist by default

V-230375

All RHEL 8 passwords must contain at least one special character.

utils.set_config_option -i -d = /etc/security/pwquality.conf ocredit '-1'

V-230376

RHEL 8 must prohibit the use of cached authentications after one day.

# Rule not reviewed

V-230377

RHEL 8 must prevent the use of dictionary words for passwords.

utils.set_config_option -i -d = /etc/security/pwquality.conf dictcheck 1

V-230378

RHEL 8 must enforce a delay of at least four seconds between logon prompts following a failed logon attempt.

utils.set_config_option /etc/login.defs FAIL_DELAY 4

V-230379

RHEL 8 must not have unnecessary accounts.

# correctly configured by default
awk -F: '$3 >= 1000 && $7 !~ /nologin/ {print $6}' /etc/passwd

V-230382

RHEL 8 must display the date and time of the last successful account logon upon an SSH logon.

utils.set_ssh_option 'PrintLastLog yes'

V-230383

RHEL 8 must define default permissions for all authenticated users in such a way that the user can only read and modify their own files.

utils.set_config_option /etc/login.defs UMASK 077

V-230384

RHEL 8 must set the umask value to 077 for all local interactive user accounts.

# no umask in user profiles by default

V-230385

RHEL 8 must define default permissions for logon and non-logon shells.

utils.add_if_missing /etc/profile.d/umask.sh 'umask 077'
utils.add_if_missing /etc/profile.d/umask.csh 'umask 077'

V-230386

The RHEL 8 audit system must be configured to audit the execution of privileged functions and prevent all software from executing at higher privilege levels than users executing the software.

utils.add_audit_rule -a always,exit -F arch=b32 -S execve -C uid!=euid -F euid=0 -k execpriv
utils.add_audit_rule -a always,exit -F arch=b64 -S execve -C uid!=euid -F euid=0 -k execpriv
utils.add_audit_rule -a always,exit -F arch=b32 -S execve -C gid!=egid -F egid=0 -k execpriv
utils.add_audit_rule -a always,exit -F arch=b64 -S execve -C gid!=egid -F egid=0 -k execpriv

V-230387

Cron logging must be implemented in RHEL 8.

# configured correctly by default
grep -s cron /etc/rsyslog.conf /etc/rsyslog.d/*.conf

V-230388

The RHEL 8 System Administrator (SA) and Information System Security Officer (ISSO) (at a minimum) must be alerted of an audit processing failure event.

utils.set_config_option -d = /etc/audit/auditd.conf action_mail_acct root

V-230389

The RHEL 8 Information System Security Officer (ISSO) and System Administrator (SA) (at a minimum) must have mail aliases to be notified of an audit processing failure.

# Postfix package is not installed

V-230390

The RHEL 8 System must take appropriate action when an audit processing failure occurs.

utils.set_config_option -d = /etc/audit/auditd.conf disk_error_action SYSLOG

V-230392

The RHEL 8 audit system must take appropriate action when the audit storage volume is full.

utils.set_config_option -d = /etc/audit/auditd.conf disk_full_action SYSLOG

V-230393

The RHEL 8 audit system must audit local events.

utils.set_config_option -d = /etc/audit/auditd.conf local_events yes

V-230394

RHEL 8 must label all off-loaded audit logs before sending them to the central log server.

utils.set_config_option -d = /etc/audit/auditd.conf name_format hostname

V-230396

RHEL 8 audit logs must have a mode of 0600 or less permissive to prevent unauthorized read access.

# permissions correct by default
ls -l /var/log/audit/audit.log

V-230397

RHEL 8 audit logs must be owned by root to prevent unauthorized read access.

# permissions correct by default
ls -l /var/log/audit/audit.log

V-230398

RHEL 8 audit logs must be group-owned by root to prevent unauthorized read access.

# permissions correct by default
ls -l /var/log/audit/audit.log

V-230399

RHEL 8 audit log directory must be owned by root to prevent unauthorized read access.

# permissions correct by default
ls -ld /var/log/audit

V-230400

RHEL 8 audit log directory must be group-owned by root to prevent unauthorized read access.

# permissions correct by default
ls -ld /var/log/audit

V-230401

RHEL 8 audit log directory must have a mode of 0700 or less permissive to prevent unauthorized read access.

# permissions correct by default
ls -ld /var/log/audit

V-230402

RHEL 8 audit system must protect auditing rules from unauthorized change.

utils.add_audit_rule '-e 2'

V-230403

RHEL 8 audit system must protect logon UIDs from unauthorized change.

utils.add_audit_rule '--loginuid-immutable'

V-230404

RHEL 8 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/shadow.

utils.add_audit_rule '-w /etc/shadow -p wa -k identity'

V-230405

RHEL 8 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/security/opasswd.

utils.add_audit_rule '-w /etc/security/opasswd -p wa -k identity'

V-230406

RHEL 8 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/passwd.

utils.add_audit_rule '-w /etc/passwd -p wa -k identity'

V-230407

RHEL 8 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/gshadow.

utils.add_audit_rule '-w /etc/gshadow -p wa -k identity'

V-230408

RHEL 8 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/group.

utils.add_audit_rule '-w /etc/group -p wa -k identity'

V-230409

RHEL 8 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/sudoers.

utils.add_audit_rule '-w /etc/sudoers -p wa -k identity'

V-230410

RHEL 8 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/sudoers.d/.

utils.add_audit_rule '-w /etc/sudoers.d/ -p wa -k identity'

V-230411

The RHEL 8 audit package must be installed.

utils.ensure_package_installed audit

V-230412

Successful/unsuccessful uses of the su command in RHEL 8 must generate an audit record.

utils.add_audit_rule '-a always,exit -F path=/usr/bin/su -F perm=x -F auid>=1000 -F auid!=unset -k privileged-priv_change'

V-230413

The RHEL 8 audit system must be configured to audit any usage of the setxattr, fsetxattr, lsetxattr, removexattr, fremovexattr, and lremovexattr system calls.

utils.add_audit_rule '-a always,exit -F arch=b32 -S setxattr,fsetxattr,lsetxattr,removexattr,fremovexattr,lremovexattr -F auid>=1000 -F auid!=unset -k perm_mod'
utils.add_audit_rule '-a always,exit -F arch=b64 -S setxattr,fsetxattr,lsetxattr,removexattr,fremovexattr,lremovexattr -F auid>=1000 -F auid!=unset -k perm_mod'
utils.add_audit_rule '-a always,exit -F arch=b32 -S setxattr,fsetxattr,lsetxattr,removexattr,fremovexattr,lremovexattr -F auid=0 -k perm_mod'
utils.add_audit_rule '-a always,exit -F arch=b64 -S setxattr,fsetxattr,lsetxattr,removexattr,fremovexattr,lremovexattr -F auid=0 -k perm_mod'

V-230418

Successful/unsuccessful uses of the chage command in RHEL 8 must generate an audit record.

utils.add_audit_rule '-a always,exit -F path=/usr/bin/chage -F perm=x -F auid>=1000 -F auid!=unset -k privileged-chage'

V-230419

Successful/unsuccessful uses of the chcon command in RHEL 8 must generate an audit record.

utils.add_audit_rule '-a always,exit -F path=/usr/bin/chcon -F perm=x -F auid>=1000 -F auid!=unset -k perm_mod'

V-230421

Successful/unsuccessful uses of the ssh-agent in RHEL 8 must generate an audit record.

utils.add_audit_rule '-a always,exit -F path=/usr/bin/ssh-agent -F perm=x -F auid>=1000 -F auid!=unset -k privileged-ssh'

V-230422

Successful/unsuccessful uses of the passwd command in RHEL 8 must generate an audit record.

utils.add_audit_rule '-a always,exit -F path=/usr/bin/passwd -F perm=x -F auid>=1000 -F auid!=unset -k privileged-passwd'

V-230423

Successful/unsuccessful uses of the mount command in RHEL 8 must generate an audit record.

utils.add_audit_rule '-a always,exit -F path=/usr/bin/mount -F perm=x -F auid>=1000 -F auid!=unset -k privileged-mount'

V-230424

Successful/unsuccessful uses of the umount command in RHEL 8 must generate an audit record.

utils.add_audit_rule '-a always,exit -F path=/usr/bin/umount -F perm=x -F auid>=1000 -F auid!=unset -k privileged-mount'

V-230425

Successful/unsuccessful uses of the mount syscall in RHEL 8 must generate an audit record.

utils.add_audit_rule '-a always,exit -F arch=b32 -S mount -F auid>=1000 -F auid!=unset -k privileged-mount'
utils.add_audit_rule '-a always,exit -F arch=b64 -S mount -F auid>=1000 -F auid!=unset -k privileged-mount'

V-230426

Successful/unsuccessful uses of the unix_update in RHEL 8 must generate an audit record.

utils.add_audit_rule '-a always,exit -F path=/usr/sbin/unix_update -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update'

V-230427

Successful/unsuccessful uses of postdrop in RHEL 8 must generate an audit record.

utils.add_audit_rule '-a always,exit -F path=/usr/sbin/postdrop -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update'

V-230428

Successful/unsuccessful uses of postqueue in RHEL 8 must generate an audit record.

utils.add_audit_rule '-a always,exit -F path=/usr/sbin/postqueue -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update'

V-230429

Successful/unsuccessful uses of semanage in RHEL 8 must generate an audit record.

utils.add_audit_rule '-a always,exit -F path=/usr/sbin/semanage -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update'

V-230430

Successful/unsuccessful uses of setfiles in RHEL 8 must generate an audit record.

utils.add_audit_rule '-a always,exit -F path=/usr/sbin/setfiles -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update'

V-230431

Successful/unsuccessful uses of userhelper in RHEL 8 must generate an audit record.

utils.add_audit_rule '-a always,exit -F path=/usr/sbin/userhelper -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update'

V-230432

Successful/unsuccessful uses of setsebool in RHEL 8 must generate an audit record.

utils.add_audit_rule '-a always,exit -F path=/usr/sbin/setsebool -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update'

V-230433

Successful/unsuccessful uses of unix_chkpwd in RHEL 8 must generate an audit record.

utils.add_audit_rule '-a always,exit -F path=/usr/sbin/unix_chkpwd -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update'

V-230434

Successful/unsuccessful uses of the ssh-keysign in RHEL 8 must generate an audit record.

utils.add_audit_rule '-a always,exit -F path=/usr/libexec/openssh/ssh-keysign -F perm=x -F auid>=1000 -F auid!=unset -k privileged-ssh'

V-230435

Successful/unsuccessful uses of the setfacl command in RHEL 8 must generate an audit record.

utils.add_audit_rule '-a always,exit -F path=/usr/bin/setfacl -F perm=x -F auid>=1000 -F auid!=unset -k perm_mod'

V-230436

Successful/unsuccessful uses of the pam_timestamp_check command in RHEL 8 must generate an audit record.

utils.add_audit_rule '-a always,exit -F path=/usr/sbin/pam_timestamp_check -F perm=x -F auid>=1000 -F auid!=unset -k privileged-pam_timestamp_check'

V-230437

Successful/unsuccessful uses of the newgrp command in RHEL 8 must generate an audit record.

utils.add_audit_rule '-a always,exit -F path=/usr/bin/newgrp -F perm=x -F auid>=1000 -F auid!=unset -k priv_cmd'

V-230438

Successful/unsuccessful uses of the init_module and finit_module system calls in RHEL 8 must generate an audit record.

utils.add_audit_rule '-a always,exit -F arch=b32 -S init_module,finit_module -F auid>=1000 -F auid!=unset -k module_chng'
utils.add_audit_rule '-a always,exit -F arch=b64 -S init_module,finit_module -F auid>=1000 -F auid!=unset -k module_chng'

V-230439

Successful/unsuccessful uses of the rename, unlink, rmdir, renameat, and unlinkat system calls in RHEL 8 must generate an audit record.

utils.add_audit_rule '-a always,exit -F arch=b32 -S rename,unlink,rmdir,renameat,unlinkat -F auid>=1000 -F auid!=unset -k delete'
utils.add_audit_rule '-a always,exit -F arch=b64 -S rename,unlink,rmdir,renameat,unlinkat -F auid>=1000 -F auid!=unset -k delete'

V-230444

Successful/unsuccessful uses of the gpasswd command in RHEL 8 must generate an audit record.

utils.add_audit_rule '-a always,exit -F path=/usr/bin/gpasswd -F perm=x -F auid>=1000 -F auid!=unset -k privileged-gpasswd'

V-230446

Successful/unsuccessful uses of the delete_module command in RHEL 8 must generate an audit record.

utils.add_audit_rule '-a always,exit -F arch=b32 -S delete_module -F auid>=1000 -F auid!=unset -k module_chng'
utils.add_audit_rule '-a always,exit -F arch=b64 -S delete_module -F auid>=1000 -F auid!=unset -k module_chng'

V-230447

Successful/unsuccessful uses of the crontab command in RHEL 8 must generate an audit record.

utils.add_audit_rule '-a always,exit -F path=/usr/bin/crontab -F perm=x -F auid>=1000 -F auid!=unset -k privileged-crontab'

V-230448

Successful/unsuccessful uses of the chsh command in RHEL 8 must generate an audit record.

utils.add_audit_rule '-a always,exit -F path=/usr/bin/chsh -F perm=x -F auid>=1000 -F auid!=unset -k priv_cmd'

V-230449

Successful/unsuccessful uses of the truncate, ftruncate, creat, open, openat, and open_by_handle_at system calls in RHEL 8 must generate an audit record.

utils.add_audit_rule '-a always,exit -F arch=b32 -S truncate,ftruncate,creat,open,openat,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -k perm_access'
utils.add_audit_rule '-a always,exit -F arch=b64 -S truncate,ftruncate,creat,open,openat,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -k perm_access'
utils.add_audit_rule '-a always,exit -F arch=b32 -S truncate,ftruncate,creat,open,openat,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -k perm_access'
utils.add_audit_rule '-a always,exit -F arch=b64 -S truncate,ftruncate,creat,open,openat,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -k perm_access'

V-230455

Successful/unsuccessful uses of the chown, fchown, fchownat, and lchown system calls in RHEL 8 must generate an audit record.

utils.add_audit_rule '-a always,exit -F arch=b32 -S chown,fchown,fchownat,lchown -F auid>=1000 -F auid!=unset -k perm_mod'
utils.add_audit_rule '-a always,exit -F arch=b64 -S chown,fchown,fchownat,lchown -F auid>=1000 -F auid!=unset -k perm_mod'

V-230456

Successful/unsuccessful uses of the chmod, fchmod, and fchmodat system calls in RHEL 8 must generate an audit record.

utils.add_audit_rule '-a always,exit -F arch=b32 -S chmod,fchmod,fchmodat -F auid>=1000 -F auid!=unset -k perm_mod'
utils.add_audit_rule '-a always,exit -F arch=b64 -S chmod,fchmod,fchmodat -F auid>=1000 -F auid!=unset -k perm_mod'

V-230462

Successful/unsuccessful uses of the sudo command in RHEL 8 must generate an audit record.

utils.add_audit_rule '-a always,exit -F path=/usr/bin/sudo -F perm=x -F auid>=1000 -F auid!=unset -k priv_cmd'

V-230463

Successful/unsuccessful uses of the usermod command in RHEL 8 must generate an audit record.

utils.add_audit_rule '-a always,exit -F path=/usr/sbin/usermod -F perm=x -F auid>=1000 -F auid!=unset -k privileged-usermod'

V-230464

Successful/unsuccessful uses of the chacl command in RHEL 8 must generate an audit record.

utils.add_audit_rule '-a always,exit -F path=/usr/bin/chacl -F perm=x -F auid>=1000 -F auid!=unset -k perm_mod'

V-230465

Successful/unsuccessful uses of the kmod command in RHEL 8 must generate an audit record.

utils.add_audit_rule '-a always,exit -F path=/usr/bin/kmod -F perm=x -F auid>=1000 -F auid!=unset -k modules'

V-230466

Successful/unsuccessful modifications to the faillock log file in RHEL 8 must generate an audit record.

utils.add_audit_rule '-w /var/log/faillock -p wa -k logins'

V-230467

Successful/unsuccessful modifications to the lastlog file in RHEL 8 must generate an audit record.

utils.add_audit_rule '-w /var/log/lastlog -p wa -k logins'

V-230471

RHEL 8 must allow only the Information System Security Manager (ISSM) (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited.

# permissions correct by default
ls -l /etc/audit/auditd.conf /etc/audit/rules.d/*.rules

V-230472

RHEL 8 audit tools must have a mode of 0755 or less permissive.

# permissions correct by default
ls -la /sbin/{auditctl,aureport,ausearch,autrace,auditd,rsyslogd,augenrules}

V-230473

RHEL 8 audit tools must be owned by root.

# permissions correct by default
ls -la /sbin/{auditctl,aureport,ausearch,autrace,auditd,rsyslogd,augenrules}

V-230474

RHEL 8 audit tools must be group-owned by root.

# permissions correct by default
ls -la /sbin/{auditctl,aureport,ausearch,autrace,auditd,rsyslogd,augenrules}

V-230475

RHEL 8 must use cryptographic mechanisms to protect the integrity of audit tools.

cat <<'EOF' >>/etc/aide.conf
# STIG V-258137
/usr/sbin/auditctl p+i+n+u+g+s+b+acl+xattrs+sha512
/usr/sbin/auditd p+i+n+u+g+s+b+acl+xattrs+sha512
/usr/sbin/ausearch p+i+n+u+g+s+b+acl+xattrs+sha512
/usr/sbin/aureport p+i+n+u+g+s+b+acl+xattrs+sha512
/usr/sbin/autrace p+i+n+u+g+s+b+acl+xattrs+sha512
/usr/sbin/augenrules p+i+n+u+g+s+b+acl+xattrs+sha512
EOF

V-230476

RHEL 8 must allocate audit record storage capacity to store at least one week of audit records, when audit records are not immediately sent to a central audit record storage facility.

df -h /var/log/audit

V-230477

RHEL 8 must have the packages required for offloading audit logs installed.

utils.ensure_package_installed rsyslog

V-230478

RHEL 8 must have the packages required for encrypting offloaded audit logs installed.

utils.ensure_package_installed rsyslog-gnutls

V-230479

The RHEL 8 audit records must be off-loaded onto a different system or storage media from the system being audited.

# Rule not reviewed

V-230480

RHEL 8 must take appropriate action when the internal event queue is full.

utils.set_config_option -d = /etc/audit/auditd.conf overflow_action syslog

V-230481

RHEL 8 must encrypt the transfer of audit records off-loaded onto a different system or media from the system being audited.

# Rule not reviewed

V-230482

RHEL 8 must authenticate the remote logging server for off-loading audit logs.

# Rule not reviewed

V-230483

RHEL 8 must take action when allocated audit record storage volume reaches 75 percent of the repository maximum audit record storage capacity.

utils.set_config_option -d = /etc/audit/auditd.conf space_left '25%'

V-230484

RHEL 8 must securely compare internal information system clocks at least every 24 hours with a server synchronized to an authoritative time source, such as the United States Naval Observatory (USNO) time servers, or a time server designated for the appropriate DoD network (NIPRNet/SIPRNet), and/or the Global Positioning System (GPS).

# Point to domain controllers
sed -i '/^server/d' /etc/chrony.conf
utils.add_if_missing /etc/chrony.conf 'server time.home.cpt.local iburst maxpoll 16'
utils.add_if_missing /etc/chrony.conf 'server time.kitX.cpt.local iburst maxpoll 16'

V-230488

RHEL 8 must not have any automated bug reporting tools installed.

utils.ensure_package_removed abrt*

V-230489

RHEL 8 must not have the sendmail package installed.

utils.ensure_package_removed sendmail

V-230493

RHEL 8 must cover or disable the built-in or attached camera when not in use.

# no camera installed

V-230500

RHEL 8 must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services, as defined in the Ports, Protocols, and Services Management (PPSM) Category Assignments List (CAL) and vulnerability assessments.

# only necessary services enabled by default
firewall-cmd --list-all

V-230502

The RHEL 8 file system automounter must be disabled unless required.

# not installed in baseline

V-230503

RHEL 8 must be configured to disable USB mass storage.

# storage controller disabled on baseline vm anyway
utils.blacklist_kernel_module usb-storage

V-230504

A RHEL 8 firewall must employ a deny-all, allow-by-exception policy for allowing connections to other systems.

# Correct zone for servers is work zone
firewall-cmd --list-all

V-230505

A firewall must be installed on RHEL 8.

utils.ensure_package_installed firewalld

V-230506

RHEL 8 wireless network adapters must be disabled.

# no wireless radios in a VM

V-230507

RHEL 8 Bluetooth must be disabled.

utils.blacklist_kernel_module bluetooth

V-230508

RHEL 8 must mount /dev/shm with the nodev option.

# Implemented by default
mount | grep /dev/shm

V-230509

RHEL 8 must mount /dev/shm with the nosuid option.

# Implemented by default
mount | grep /dev/shm

V-230510

RHEL 8 must mount /dev/shm with the noexec option.

# Implemented during install
mount | grep /dev/shm

V-230511

RHEL 8 must mount /tmp with the nodev option.

# Implemented during install
mount | grep /tmp

V-230512

RHEL 8 must mount /tmp with the nosuid option.

# Implemented during install
mount | grep /tmp

V-230513

RHEL 8 must mount /tmp with the noexec option.

# Implemented during install
mount | grep /tmp

V-230514

RHEL 8 must mount /var/log with the nodev option.

# Implemented during install
mount | grep /var/log

V-230515

RHEL 8 must mount /var/log with the nosuid option.

# Implemented during install
mount | grep /var/log

V-230516

RHEL 8 must mount /var/log with the noexec option.

# Implemented during install
mount | grep /var/log

V-230517

RHEL 8 must mount /var/log/audit with the nodev option.

# Implemented during install
mount | grep /var/log/audit

V-230518

RHEL 8 must mount /var/log/audit with the nosuid option.

# Implemented during install
mount | grep /var/log/audit

V-230519

RHEL 8 must mount /var/log/audit with the noexec option.

# Implemented during install
mount | grep /var/log/audit

V-230520

RHEL 8 must mount /var/tmp with the nodev option.

# Implemented during install
mount | grep /var/tmp

V-230521

RHEL 8 must mount /var/tmp with the nosuid option.

# Implemented during install
mount | grep /var/tmp

V-230522

RHEL 8 must mount /var/tmp with the noexec option.

# Implemented during install
mount | grep /var/tmp

V-230523

The RHEL 8 fapolicy module must be installed.

utils.ensure_package_installed fapolicyd

V-230524

RHEL 8 must block unauthorized peripherals before establishing a connection.

# no USB controller present in VM

V-230525

A firewall must be able to protect against or limit the effects of Denial of Service (DoS) attacks by ensuring RHEL 8 can implement rate-limiting measures on impacted network interfaces.

utils.set_config_option -i -d = /etc/firewalld/firewalld.conf FirewallBackend nftables

V-230526

All RHEL 8 networked systems must have and implement SSH to protect the confidentiality and integrity of transmitted and received information, as well as information during preparation for transmission.

# enabled by default
systemctl -q is-active sshd || systemctl enable --now sshd

V-230527

RHEL 8 must force a frequent session key renegotiation for SSH connections to the server.

utils.set_ssh_option 'RekeyLimit 1G 1h'

V-230532

The debug-shell systemd service must be disabled on RHEL 8.

# disabled by default
systemctl -q is-active debug-shell && systemctl disable --now debug-shell

V-230535

RHEL 8 must prevent IPv6 Internet Control Message Protocol (ICMP) redirect messages from being accepted.

utils.set_sysctl_option net.ipv6.conf.default.accept_redirects 0

V-230536

RHEL 8 must not send Internet Control Message Protocol (ICMP) redirects.

utils.set_sysctl_option net.ipv4.conf.all.send_redirects 0

V-230537

RHEL 8 must not respond to Internet Control Message Protocol (ICMP) echoes sent to a broadcast address.

utils.set_sysctl_option net.ipv4.icmp_echo_ignore_broadcasts 1

V-230538

RHEL 8 must not forward IPv6 source-routed packets.

utils.set_sysctl_option net.ipv6.conf.all.accept_source_route 0

V-230539

RHEL 8 must not forward IPv6 source-routed packets by default.

utils.set_sysctl_option net.ipv6.conf.default.accept_source_route 0

V-230540

RHEL 8 must not enable IPv6 packet forwarding unless the system is a router.

utils.set_sysctl_option net.ipv6.conf.all.forwarding 0

V-230541

RHEL 8 must not accept router advertisements on all IPv6 interfaces.

utils.set_sysctl_option net.ipv6.conf.all.accept_ra 0

V-230542

RHEL 8 must not accept router advertisements on all IPv6 interfaces by default.

utils.set_sysctl_option net.ipv6.conf.default.accept_ra 0

V-230543

RHEL 8 must not allow interfaces to perform Internet Control Message Protocol (ICMP) redirects by default.

utils.set_sysctl_option net.ipv4.conf.default.send_redirects 0

V-230544

RHEL 8 must ignore IPv6 Internet Control Message Protocol (ICMP) redirect messages.

utils.set_sysctl_option net.ipv6.conf.all.accept_redirects 0

V-230545

RHEL 8 must disable access to network bpf syscall from unprivileged processes.

utils.set_sysctl_option kernel.unprivileged_bpf_disabled 1

V-230546

RHEL 8 must restrict usage of ptrace to descendant processes.

utils.set_sysctl_option kernel.yama.ptrace_scope 1

V-230547

RHEL 8 must restrict exposed kernel pointer addresses access.

utils.set_sysctl_option kernel.kptr_restrict 1

V-230548

RHEL 8 must disable the use of user namespaces.

utils.set_sysctl_option user.max_user_namespaces 0

V-230549

RHEL 8 must use reverse path filtering on all IPv4 interfaces.

utils.set_sysctl_option net.ipv4.conf.all.rp_filter 1

V-230550

RHEL 8 must be configured to prevent unrestricted mail relaying.

# Postfix is not installed

V-230553

The graphical display manager must not be installed on RHEL 8 unless approved.

dnf list --installed "xorg*common"

V-230554

RHEL 8 network interfaces must not be in promiscuous mode.

# correctly configured by default
ip link | grep -i promisc

V-230555

RHEL 8 remote X connections for interactive users must be disabled unless to fulfill documented and validated mission requirements.

utils.set_ssh_option 'X11Forwarding no'

V-230556

The RHEL 8 SSH daemon must prevent remote hosts from connecting to the proxy display.

utils.set_ssh_option 'X11UseLocalhost yes'

V-230557

If the Trivial File Transfer Protocol (TFTP) server is required, the RHEL 8 TFTP daemon must be configured to operate in secure mode.

# no tftp server installed
utils.ensure_package_removed tftp-server

V-230559

The gssproxy package must not be installed unless mission essential on RHEL 8.

utils.ensure_package_removed gssproxy

V-230560

The iprutils package must not be installed unless mission essential on RHEL 8.

utils.ensure_package_removed iprutils

V-230561

The tuned package must not be installed unless mission essential on RHEL 8.

utils.ensure_package_removed tuned

V-237640

The krb5-server package must not be installed on RHEL 8.

utils.ensure_package_removed krb5-server

V-237641

RHEL 8 must restrict privilege elevation to authorized personnel.

# Configured correctly by default
grep -wE '^ALL' /etc/sudoers /etc/sudoers.d/*

V-237642

RHEL 8 must use the invoking user's password for privilege escalation when using "sudo".

utils.add_if_missing /etc/sudoers.d/01_stig $'Defaults !targetpw\nDefaults !rootpw\nDefaults !runaspw'

V-237643

RHEL 8 must require re-authentication when using the "sudo" command.

utils.add_if_missing /etc/sudoers.d/01_stig 'Defaults timestamp_timeout=0'

V-244519

RHEL 8 must display a banner before granting local or remote access to the system via a graphical user logon.

# no graphical interface installed

V-244521

RHEL 8 operating systems booted with United Extensible Firmware Interface (UEFI) must require a unique superusers name upon booting into single-user mode and maintenance.

# superuser name is root
cat /boot/grub2/user.cfg

V-244522

RHEL 8 operating systems booted with a BIOS must require a unique superusers name upon booting into single-user and maintenance modes.

# not applicable to UEFI systems

V-244523

RHEL 8 operating systems must require authentication upon booting into emergency mode.

grep sulogin /usr/lib/systemd/system/emergency.service

V-244524

The RHEL 8 pam_unix.so module must be configured in the system-auth file to use a FIPS 140-2 approved cryptographic hashing algorithm for system authentication.

# Rule not reviewed

V-244525

RHEL 8 must be configured so that all network connections associated with SSH traffic are terminated after 10 minutes of becoming unresponsive.

utils.set_ssh_option 'ClientAliveInterval 600'

V-244526

The RHEL 8 SSH daemon must be configured to use system-wide crypto policies.

# configured correctly by default
grep CRYPTO_POLICY /etc/sysconfig/sshd

V-244528

The RHEL 8 SSH daemon must not allow GSSAPI authentication, except to fulfill documented and validated mission requirements.

utils.set_ssh_option 'GSSAPIAuthentication no'

V-244529

RHEL 8 must use a separate file system for /var/tmp.

# Already implemented during install
mountpoint /var/tmp

V-244530

RHEL 8 must prevent files with the setuid and setgid bit set from being executed on the /boot/efi directory.

# Implemented during install
mount | grep /boot/efi

V-244531

All RHEL 8 local interactive user home directory files must have mode 0750 or less permissive.

# permissions correct in baseline

V-244532

RHEL 8 must be configured so that all files and directories contained in local interactive user home directories are group-owned by a group of which the home directory owner is a member.

# permissions correct in baseline

V-244533

RHEL 8 must configure the use of the pam_faillock.so module in the /etc/pam.d/system-auth file.

# Rule not reviewed

V-244534

RHEL 8 must configure the use of the pam_faillock.so module in the /etc/pam.d/password-auth file.

# Rule not reviewed

V-244535

RHEL 8 must initiate a session lock for graphical user interfaces when the screensaver is activated.

# no graphical interface installed

V-244536

RHEL 8 must disable the user list at logon for graphical user interfaces.

# no graphical interface installed

V-244537

RHEL 8 must have the tmux package installed.

utils.ensure_package_installed tmux

V-244538

RHEL 8 must prevent a user from overriding the session idle-delay setting for the graphical user interface.

# no graphical interface installed

V-244539

RHEL 8 must prevent a user from overriding the screensaver lock-enabled setting for the graphical user interface.

# no graphical interface installed

V-244542

RHEL 8 audit records must contain information to establish what type of events occurred, the source of events, where events occurred, and the outcome of events.

# enabled by default
systemctl -q is-active auditd || systemctl enable --now auditd

V-244543

RHEL 8 must notify the System Administrator (SA) and Information System Security Officer (ISSO) (at a minimum) when allocated audit record storage volume 75 percent utilization.

utils.set_config_option -d = /etc/audit/auditd.conf space_left_action email

V-244544

A firewall must be active on RHEL 8.

# enabled by default
systemctl -q is-active firewalld || systemctl enable --now firewalld

V-244545

The RHEL 8 fapolicy module must be enabled.

systemctl -q is-active fapolicyd || systemctl enable --now fapolicyd

V-244546

The RHEL 8 fapolicy module must be configured to employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs.

# configured correctly by default
grep permissive /etc/fapolicyd/fapolicyd.conf

V-244547

RHEL 8 must have the USBGuard installed.

# USB controller not present in VM

V-244548

RHEL 8 must enable the USBGuard.

# USB controller not present in VM

V-244549

All RHEL 8 networked systems must have SSH installed.

utils.ensure_package_installed openssh-server

V-244550

RHEL 8 must prevent IPv4 Internet Control Message Protocol (ICMP) redirect messages from being accepted.

utils.set_sysctl_option net.ipv4.conf.default.accept_redirects 0

V-244551

RHEL 8 must not forward IPv4 source-routed packets.

utils.set_sysctl_option net.ipv4.conf.all.accept_source_route 0

V-244552

RHEL 8 must not forward IPv4 source-routed packets by default.

utils.set_sysctl_option net.ipv4.conf.default.accept_source_route 0

V-244553

RHEL 8 must ignore IPv4 Internet Control Message Protocol (ICMP) redirect messages.

utils.set_sysctl_option net.ipv4.conf.all.accept_redirects 0

V-244554

RHEL 8 must enable hardening for the Berkeley Packet Filter Just-in-time compiler.

utils.set_sysctl_option net.core.bpf_jit_harden 2

V-245540

The RHEL 8 operating system must implement the Endpoint Security for Linux Threat Prevention tool.

# not implemented in baseline

V-250315

RHEL 8 systems, versions 8.2 and above, must configure SELinux context type to allow the use of a non-default faillock tally directory.

dir='/var/log/faillock'
utils.set_config_option -i -d = /etc/security/faillock.conf dir "$dir"
semanage fcontext -a -t faillog_t "$dir(/.*)?"
mkdir -p "$dir" && restorecon -R "$dir"

V-250316

RHEL 8 systems below version 8.2 must configure SELinux context type to allow the use of a non-default faillock tally directory.

# not applicable to RHEL > 8.2

V-250317

RHEL 8 must not enable IPv4 packet forwarding unless the system is a router.

utils.set_sysctl_option net.ipv4.conf.all.forwarding 0

V-251707

RHEL 8 library directories must have mode 755 or less permissive.

# permissions correct by default
find -L /usr/lib{64,} -perm /022 -type d -exec ls -l {} \;

V-251708

RHEL 8 library directories must be owned by root.

# permissions correct by default
find -L /usr/lib{64,} ! -user root -type d -exec ls -l {} \;

V-251709

RHEL 8 library directories must be group-owned by root or a system account.

# permissions correct by default
find -L /usr/lib{64,} ! -group root -type d -exec ls -l {} \;

V-251710

The RHEL 8 operating system must use a file integrity tool to verify correct operation of all security functions.

utils.ensure_package_installed aide

V-251711

RHEL 8 must specify the default "include" directory for the /etc/sudoers file.

# configured correctly by default
grep -r include /etc/sudoers.d

V-251712

The RHEL 8 operating system must not be configured to bypass password requirements for privilege escalation.

# Rule not reviewed

V-251713

RHEL 8 must ensure the password complexity module is enabled in the system-auth file.

# Rule not reviewed

V-251714

RHEL 8 systems below version 8.4 must ensure the password complexity module in the system-auth file is configured for three retries or less.

# Rule not reviewed

V-251715

RHEL 8 systems below version 8.4 must ensure the password complexity module in the password-auth file is configured for three retries or less.

# Rule not reviewed

V-251716

RHEL 8 systems, version 8.4 and above, must ensure the password complexity module is configured for three retries or less.

utils.set_config_option -i -d = /etc/security/pwquality.conf retry 3

V-251717

RHEL 8 must be configured in the system-auth file to prohibit password reuse for a minimum of five generations.

# Rule not reviewed

V-251718

The graphical display manager must not be the default target on RHEL 8 unless approved.

systemctl set-default multi-user.target

V-254520

RHEL 8 must prevent nonprivileged users from executing privileged functions, including disabling, circumventing, or altering implemented security safeguards/countermeasures.

# configured correctly in baseline

V-255924

RHEL 8 SSH server must be configured to use only FIPS-validated key exchange algorithms.

# configured by default
grep KexAlgorithms /etc/crypto-policies/back-ends/openssh.config

V-256973

RHEL 8 must ensure cryptographic verification of vendor software packages.

# Correct keys installed for Rocky Linux system
rpm -q --queryformat "%{SUMMARY}\n" gpg-pubkey

V-256974

RHEL 8 must be configured to allow sending email notifications of unauthorized configuration changes to designated personnel.

utils.ensure_package_installed mailx

V-257258

RHEL 8 must terminate idle user sessions.

utils.add_if_missing /etc/systemd/logind.conf.d/stig.conf 'StopIdleSessionSec=900'

Cat III Checks

V-230241

RHEL 8 must have policycoreutils package installed.

utils.ensure_package_installed policycoreutils

V-230253

RHEL 8 must ensure the SSH server uses strong entropy.

utils.add_if_missing /etc/sysconfig/sshd SSH_USE_STRONG_RNG=32

V-230269

RHEL 8 must restrict access to the kernel message buffer.

utils.set_sysctl_option kernel.dmesg_restrict 1

V-230270

RHEL 8 must prevent kernel profiling by unprivileged users.

utils.set_sysctl_option kernel.perf_event_paranoid 2

V-230281

YUM must remove all software components after updated versions have been installed on RHEL 8.

utils.set_config_option -d = /etc/dnf/dnf.conf clean_requirements_on_remove 1

V-230285

RHEL 8 must enable the hardware random number generator entropy gatherer service.

# not applicable for FIPS mode system

V-230292

RHEL 8 must use a separate file system for /var.

# Already implemented during install
mountpoint /var

V-230293

RHEL 8 must use a separate file system for /var/log.

# Already implemented during install
mountpoint /var/log

V-230294

RHEL 8 must use a separate file system for the system audit data path.

# Already implemented during install
mountpoint /var/log/audit

V-230346

RHEL 8 must limit the number of concurrent sessions to ten for all accounts and/or account types.

utils.add_if_missing /etc/security/limits.d/stig.conf '* hard maxlogins 10'

V-230350

RHEL 8 must prevent users from disabling session control mechanisms.

sed -i '/tmux/d' /etc/shells

V-230381

RHEL 8 must display the date and time of the last successful account logon upon logon.

# Rule not reviewed

V-230395

RHEL 8 must resolve audit information before writing to disk.

utils.set_config_option -d = /etc/audit/auditd.conf log_format ENRICHED

V-230468

RHEL 8 must enable auditing of processes that start prior to the audit daemon.

utils.add_kernel_cmdline 'audit=1 audit_backlog_limit=8192'

V-230469

RHEL 8 must allocate an audit_backlog_limit of sufficient size to capture processes that start prior to the audit daemon.

utils.add_kernel_cmdline 'audit=1 audit_backlog_limit=8192'

V-230470

RHEL 8 must enable Linux audit logging for the USBGuard daemon.

# no USB controller present in VM

V-230485

RHEL 8 must disable the chrony daemon from acting as a server.

utils.set_config_option /etc/chrony.conf port 0

V-230486

RHEL 8 must disable network management of the chrony daemon.

utils.set_config_option /etc/chrony.conf cmdport 0

V-230491

RHEL 8 must enable mitigations against processor-based vulnerabilities.

# enabled by default
dmesg | grep 'page tables'
# to enable anyway
utils.add_kernel_cmdline 'pti=on'

V-230494

RHEL 8 must disable the asynchronous transfer mode (ATM) protocol.

utils.blacklist_kernel_module atm

V-230495

RHEL 8 must disable the controller area network (CAN) protocol.

utils.blacklist_kernel_module can

V-230496

RHEL 8 must disable the stream control transmission protocol (SCTP).

utils.blacklist_kernel_module sctp

V-230497

RHEL 8 must disable the transparent inter-process communication (TIPC) protocol.

utils.blacklist_kernel_module tipc

V-230498

RHEL 8 must disable mounting of cramfs.

utils.blacklist_kernel_module cramfs

V-230499

RHEL 8 must disable IEEE 1394 (FireWire) Support.

utils.blacklist_kernel_module firewire-core

V-230551

The RHEL 8 file integrity tool must be configured to verify extended attributes.

# configured by default
grep xattrs /etc/aide.conf

V-230552

The RHEL 8 file integrity tool must be configured to verify Access Control Lists (ACLs).

# configured by default
grep acl /etc/aide.conf

V-244527

RHEL 8 must have the packages required to use the hardware random number generator entropy gatherer service.

utils.ensure_package_installed rng-tools

Rocky_9_STIG_notes.md

Rocky 9 STIG notes

RHEL-09-211045: Red Hat Enterprise Linux 9 Security Technical Implementation Guide :: Version 1, Release: 2 Benchmark Date: 24 Jan 2024

Updated on 2024-05-29

Utilities

All fix and check commands must be run as root.

The fix snippets listed later make use of the following helper functions:

# paste this block in before running the later fix commands

utils.add_if_missing() {
    [[ $# -eq 2 ]] || return
    [[ $1 != "${1%/*}" && ! -d ${1%/*} ]] && mkdir -p "${1%/*}"
    grep -qsF -- "$2" "$1" || printf '%s\n' "$2" >>"$1"
}

utils.set_sysctl_option() {
    [[ $# -eq 2 ]] || return
    [[ $(sysctl -n "$1") == "$2" ]] ||
        utils.add_if_missing /etc/sysctl.d/99-sysctl.conf "$1 = $2"
}

utils.set_ssh_option() {
    [[ $# -eq 1 ]] || return
    grep -qrsE -- "^$1" /etc/ssh/sshd_config /etc/ssh/sshd_config.d/* ||
        utils.add_if_missing /etc/ssh/sshd_config.d/99-stig.conf "$1"
}

utils.blacklist_kernel_module() {
    [[ $# -eq 1 ]] || return
    utils.add_if_missing "/etc/modprobe.d/$1.conf" \
        "$(printf 'install %s /bin/false\nblacklist %s' "$1" "$1")"
}

utils.add_audit_rule() {
    [[ $# -eq 1 ]] || return
    grep -qrs -- "$1" /etc/audit/audit.rules /etc/audit/rules.d/* ||
        utils.add_if_missing /etc/audit/rules.d/stig.rules "$1"
}

utils.add_kernel_cmdline() {
    [[ $# -eq 1 ]] || return
    awk -i inplace -v p="$1" '
        /CMDLINE/ && $0 !~ p {gsub(/(["'\''])$/, " "p"&")} 1
    ' /etc/default/grub
    grubby --update-kernel=ALL --args="$1"
}

utils.ensure_package_installed() {
    [[ $# -eq 1 ]] || return
    rpm --quiet -q $1 || dnf -qy install $1
}

utils.ensure_package_removed() {
    [[ $# -eq 1 ]] || return
    rpm --quiet -q $1 && dnf -qy remove $1
}

utils.get_config_option() {
    [[ $# -ge 2 ]] || return
    local c='#' a d i=0 r1 r2
    while [[ $# -gt 2 ]]; do
        [[ $1 == -d ]] && d=$2 && shift 2
        [[ $1 == -i ]] && i=1 && shift
    done
    [[ $# -eq 2 ]] || return
    [[ $i -eq 1 ]] && a=$c c=''
    r1="^[ \t]*(|${c:-}+.*)$"
    r2="^[ \t${a:-}]*${2}[ \t]*${d:-[ \t]+}[ \t]*([^${c:-$a}]*).*$"
    awk -v r1="$r1" -v r2="$r2" '$0 !~ r1 && $0 ~ r2 {match($0, r2, m);
        gsub(/^[ \t]*|[ \t]*$/, "", m[1]); print m[1]; exit}' "$1"
}

utils.set_config_option() {
    [[ $# -ge 3 ]] || return
    local a c='#' a d i o r1 r2
    while [[ $# -gt 3 ]]; do
        [[ $1 == -a ]] && a=1 && shift
        [[ $1 == -d ]] && d=$2 && shift 2
        [[ $1 == -i ]] && i='-i' && shift
    done
    [[ $# -eq 3 ]] || return
    [[ -f $1 ]] && o=$(utils.get_config_option -d "$d" ${i:-} "$1" "$2")
    [[ ${a:-} || ! ${o:-} ]] &&
        utils.add_if_missing "$1" "${2}${d:- }${3}" && return
    [[ ${i:-} ]] && a=$c c=''
    r1="^[ \t]*(|${c:-}+.*)$"
    r2="^([ \t${a:-}]*)(${2}[ \t]*${d:-[ \t]+}[ \t]*)([^${c:-$a}]*)(.*)$"
    awk -i inplace -v r1="$r1" -v r2="$r2" -v new="$3" '
        $0 !~ r1 && $0 ~ r2 && c == 0 {
            match($0, r2, m); gsub($0, m[2] new m[4]); c = 1
        } 1' "$1"
}

CAT I Checks

V-257777

RHEL 9 must be a vendor-supported release.

. /etc/os-release && echo $NAME $VERSION  # RHEL 9.x

V-257784

The systemd Ctrl-Alt-Delete burst key sequence in RHEL 9 must be disabled.

utils.add_if_missing /etc/systemd/system.conf.d/stig.conf 'CtrlAltDelBurstAction=none'

V-257785

The x86 Ctrl-Alt-Delete key sequence must be disabled on RHEL 9.

systemctl mask --now ctrl-alt-del.target

V-257789

RHEL 9 must require a unique superusers name upon booting into single-user and maintenance modes.

# superuser name is root
cat /boot/grub2/user.cfg

V-257820

RHEL 9 must check the GPG signature of software packages originating from external software repositories before installation.

utils.set_config_option -d = /etc/dnf/dnf.conf gpgcheck 1

V-257821

RHEL 9 must check the GPG signature of locally installed software packages before installation.

utils.set_config_option -d = /etc/dnf/dnf.conf localpkg_gpgcheck 1

V-257822

RHEL 9 must have GPG signature verification enabled for all software repositories.

sed -i 's/gpgcheck\s*=.*/gpgcheck=1/g' /etc/yum.repos.d/*

V-257826

RHEL 9 must not have a File Transfer Protocol (FTP) server package installed.

# not installed in baseline
utils.ensure_package_removed vsftpd

V-257835

RHEL 9 must not have a Trivial File Transfer Protocol (TFTP) server package installed.

# not installed in baseline
utils.ensure_package_removed tftp

V-257879

RHEL 9 local disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at rest protection.

# Not applicable to VMs

V-257955

There must be no shosts.equiv files on RHEL 9.

find / -name shosts.equiv -delete

V-257956

There must be no .shosts files on RHEL 9.

find / -name .shosts -delete

V-257984

RHEL 9 SSHD must not allow blank passwords.

utils.set_ssh_option 'PermitEmptyPasswords no'

V-257986

RHEL 9 must enable the Pluggable Authentication Module (PAM) interface for SSHD.

utils.set_ssh_option 'UsePAM yes'

V-258018

RHEL 9 must not allow unattended or automatic logon via the graphical user interface.

# no graphical interface installed

V-258059

The root account must be the only account having unrestricted access to RHEL 9 system.

awk -F: '$3 == 0 {print $1}' /etc/passwd  # only root

V-258078

RHEL 9 must use a Linux Security Module configured to enforce limits on system services.

sed -i 's/SELINUX\s*=.*/SELINUX=enforcing/g' /etc/selinux/config

V-258094

RHEL 9 must not allow blank or null passwords.

# managed by authselect
# TODO: add authselect command to validate

V-258230

RHEL 9 must enable FIPS mode.

fips-mode-setup --enable

V-258235

RHEL 9 crypto policy files must match files shipped with the operating system.

rpm -V crypto-policies  # no output

V-258238

RHEL 9 must implement DOD-approved TLS encryption in the GnuTLS package.

update-crypto-policies --show  # FIPS

CAT II Checks

V-257778

RHEL 9 vendor packaged system security patches and updates must be installed and up to date.

# install updates
dnf -y update

V-257779

RHEL 9 must display the Standard Mandatory DOD Notice and Consent Banner before granting local or remote access to the system via a command line user logon.

cat <<'EOF' >/etc/issue
US Department of Defense Warning Statement

You are accessing a U.S. Government (USG) Information System (IS) that is
provided for USG-authorized use only. By using this IS (which includes any
device attached to this IS), you consent to the following conditions:

-The USG routinely intercepts and monitors communications on this IS for
purposes including, but not limited to, penetration testing, COMSEC monitoring,
network operations and defense, personnel misconduct (PM), law enforcement
(LE), and counterintelligence (CI) investigations.

-At any time, the USG may inspect and seize data stored on this IS.

-Communications using, or data stored on, this IS are not private, are subject
to routine monitoring, interception, and search, and may be disclosed or used
for any USG-authorized purpose.

-This IS includes security measures (e.g., authentication and access controls)
to protect USG interests -- not for your personal benefit or privacy.

-Notwithstanding the above, using this IS does not constitute consent to PM, LE
or CI investigative searching or monitoring of the content of privileged
communications, or work product, related to personal representation or services
by attorneys, psychotherapists, or clergy, and their assistants. Such
communications and work product are private and confidential. See User
Agreement for details.
EOF

V-257780

RHEL 9 must implement the Endpoint Security for Linux Threat Prevention tool.

# not implemented in baseline

V-257781

The graphical display manager must not be the default target on RHEL 9 unless approved.

systemctl set-default multi-user.target

V-257783

RHEL 9 systemd-journald service must be enabled.

# enabled by default
systemctl -q is-active systemd-journald || systemctl enable --now systemd-journald

V-257786

RHEL 9 debug-shell systemd service must be disabled.

# disabled by default
systemctl -q is-active debug-shell && systemctl disable --now debug-shell

V-257787

RHEL 9 must require a boot loader superuser password.

grub2-set-password
# Follow the prompts to set password

V-257788

RHEL 9 must disable the ability of systemd to spawn an interactive boot process.

# not enabled by default
grubby --info=ALL | awk '/args/ && /systemd.confirm_spawn/'

V-257790

RHEL 9 /boot/grub2/grub.cfg file must be group-owned by root.

# owned by root by default
chown root:root /boot/grub2/grub.cfg

V-257791

RHEL 9 /boot/grub2/grub.cfg file must be owned by root.

# owned by root by default
chown root:root /boot/grub2/grub.cfg

V-257792

RHEL 9 must disable virtual system calls.

utils.add_kernel_cmdline 'vsyscall=none'

V-257793

RHEL 9 must clear the page allocator to prevent use-after-free attacks.

utils.add_kernel_cmdline 'page_poison=1'

V-257794

RHEL 9 must clear SLUB/SLAB objects to prevent use-after-free attacks.

utils.add_kernel_cmdline 'slub_debug=P'

V-257797

RHEL 9 must restrict access to the kernel message buffer.

utils.set_sysctl_option kernel.dmesg_restrict 1

V-257798

RHEL 9 must prevent kernel profiling by nonprivileged users.

utils.set_sysctl_option kernel.perf_event_paranoid 2

V-257799

RHEL 9 must prevent the loading of a new kernel for later execution.

utils.set_sysctl_option kernel.kexec_load_disabled 1

V-257800

RHEL 9 must restrict exposed kernel pointer addresses access.

utils.set_sysctl_option kernel.kptr_restrict 1

V-257801

RHEL 9 must enable kernel parameters to enforce discretionary access control on hardlinks.

utils.set_sysctl_option fs.protected_hardlinks 1

V-257802

RHEL 9 must enable kernel parameters to enforce discretionary access control on symlinks.

utils.set_sysctl_option fs.protected_symlinks 1

V-257803

RHEL 9 must disable the kernel.core_pattern.

utils.set_sysctl_option kernel.core_pattern '|/bin/false'

V-257804

RHEL 9 must be configured to disable the Asynchronous Transfer Mode kernel module.

utils.blacklist_kernel_module atm

V-257805

RHEL 9 must be configured to disable the Controller Area Network kernel module.

utils.blacklist_kernel_module can

V-257806

RHEL 9 must be configured to disable the FireWire kernel module.

utils.blacklist_kernel_module firewire-core

V-257807

RHEL 9 must disable the Stream Control Transmission Protocol (SCTP) kernel module.

utils.blacklist_kernel_module sctp

V-257808

RHEL 9 must disable the Transparent Inter Process Communication (TIPC) kernel module.

utils.blacklist_kernel_module tipc

V-257809

RHEL 9 must implement address space layout randomization (ASLR) to protect its memory from unauthorized code execution.

utils.set_sysctl_option kernel.randomize_va_space 2

V-257810

RHEL 9 must disable access to network bpf system call from nonprivileged processes.

utils.set_sysctl_option kernel.unprivileged_bpf_disabled 1

V-257811

RHEL 9 must restrict usage of ptrace to descendant processes.

utils.set_sysctl_option kernel.yama.ptrace_scope 1

V-257812

RHEL 9 must disable core dump backtraces.

utils.add_if_missing /etc/systemd/coredump.conf.d/stig.conf 'ProcessSizeMax=0'

V-257813

RHEL 9 must disable storing core dumps.

utils.add_if_missing /etc/systemd/coredump.conf.d/stig.conf 'Storage=none'

V-257814

RHEL 9 must disable core dumps for all users.

utils.add_if_missing '/etc/security/limits.d/stig.conf' '* hard core 0'

V-257815

RHEL 9 must disable acquiring, saving, and processing core dumps.

systemctl mask --now systemd-coredump.socket

V-257816

RHEL 9 must disable the use of user namespaces.

# Ignore this if containers are used
utils.set_sysctl_option user.max_user_namespaces 0

V-257817

RHEL 9 must implement nonexecutable data to protect its memory from unauthorized code execution.

# enabled by default
dmesg | grep '[NX|DX]*protection'

V-257818

The kdump service on RHEL 9 must be disabled.

systemctl mask --now kdump

V-257819

RHEL 9 must ensure cryptographic verification of vendor software packages.

# Correct keys installed for Rocky Linux system
rpm -q --queryformat "%{SUMMARY}\n" gpg-pubkey

V-257823

RHEL 9 must be configured so that the cryptographic hashes of system files match vendor values.

rpm -Va --noconfig | awk '$1 ~ /..5/ && $2 != "c"'

V-257825

RHEL 9 subscription-manager package must be installed.

# not applicable to RHEL derivatives

V-257827

RHEL 9 must not have the sendmail package installed.

# not installed in baseline
utils.ensure_package_removed sendmail

V-257828

RHEL 9 must not have the nfs-utils package installed.

# not installed in baseline
utils.ensure_package_removed nfs-utils

V-257829

RHEL 9 must not have the ypserv package installed.

# not installed in baseline
utils.ensure_package_removed ypserv

V-257830

RHEL 9 must not have the rsh-server package installed.

# not installed in baseline
utils.ensure_package_removed rsh-server

V-257831

RHEL 9 must not have the telnet-server package installed.

# not installed in baseline
utils.ensure_package_removed telnet-server

V-257832

RHEL 9 must not have the gssproxy package installed.

# not installed in baseline
utils.ensure_package_removed gssproxy

V-257833

RHEL 9 must not have the iprutils package installed.

# not installed in baseline
utils.ensure_package_removed iprutils

V-257834

RHEL 9 must not have the tuned package installed.

# not installed in baseline
utils.ensure_package_removed tuned

V-257836

RHEL 9 must not have the quagga package installed.

# not installed in baseline
utils.ensure_package_removed quagga

V-257837

A graphical display manager must not be installed on RHEL 9 unless approved.

# not installed in baseline
dnf list --installed "xorg*common"

V-257838

RHEL 9 must have the openssl-pkcs11 package installed.

utils.ensure_package_installed  openssl-pkcs11

V-257839

RHEL 9 must have the gnutls-utils package installed.

utils.ensure_package_installed  gnutls-utils

V-257840

RHEL 9 must have the nss-tools package installed.

utils.ensure_package_installed  nss-tools

V-257841

RHEL 9 must have the rng-tools package installed.

utils.ensure_package_installed  rng-tools

V-257842

RHEL 9 must have the s-nail package installed.

utils.ensure_package_installed  s-nail

V-257843

A separate RHEL 9 file system must be used for user home directories (such as /home or an equivalent).

# Already implemented during install
mountpoint /home

V-257844

RHEL 9 must use a separate file system for /tmp.

# Already implemented during install
mountpoint /tmp

V-257848

RHEL 9 must use a separate file system for /var/tmp.

# Already implemented during install
mountpoint /var/tmp

V-257849

RHEL 9 file system automount function must be disabled unless required.

# not installed in baseline

V-257850

RHEL 9 must prevent device files from being interpreted on file systems that contain user home directories.

# Already implemented during install
mount | grep /home

V-257851

RHEL 9 must prevent files with the setuid and setgid bit set from being executed on file systems that contain user home directories.

# Already implemented during install
mount | grep /home

V-257852

RHEL 9 must prevent code from being executed on file systems that contain user home directories.

# Already implemented during install
mount | grep /home

V-257853

RHEL 9 must be configured so that the Network File System (NFS) is configured to use RPCSEC_GSS.

# no NFS mounts present

V-257854

RHEL 9 must prevent special devices on file systems that are imported via Network File System (NFS).

# no NFS mounts present

V-257855

RHEL 9 must prevent code from being executed on file systems that are imported via Network File System (NFS).

# no NFS mounts present

V-257856

RHEL 9 must prevent files with the setuid and setgid bit set from being executed on file systems that are imported via Network File System (NFS).

# no NFS mounts present

V-257857

RHEL 9 must prevent code from being executed on file systems that are used with removable media.

# no removable media mounts present

V-257858

RHEL 9 must prevent special devices on file systems that are used with removable media.

# no removable media mounts present

V-257859

RHEL 9 must prevent files with the setuid and setgid bit set from being executed on file systems that are used with removable media.

# no removable media mounts present

V-257860

RHEL 9 must mount /boot with the nodev option.

mount | grep /boot

V-257861

RHEL 9 must prevent files with the setuid and setgid bit set from being executed on the /boot directory.

# Already implemented during install
mount | grep /home

V-257862

RHEL 9 must prevent files with the setuid and setgid bit set from being executed on the /boot/efi directory.

# Already implemented during install
mount | grep /home

V-257863

RHEL 9 must mount /dev/shm with the nodev option.

# Implemented by default
mount | grep /dev/shm

V-257864

RHEL 9 must mount /dev/shm with the noexec option.

# Implemented by default
mount | grep /dev/shm

V-257865

RHEL 9 must mount /dev/shm with the nosuid option.

# Implemented by default
mount | grep /dev/shm

V-257866

RHEL 9 must mount /tmp with the nodev option.

# Already implemented during install
mount | grep /tmp

V-257867

RHEL 9 must mount /tmp with the noexec option.

# Already implemented during install
mount | grep /tmp

V-257868

RHEL 9 must mount /tmp with the nosuid option.

# Already implemented during install
mount | grep /tmp

V-257869

RHEL 9 must mount /var with the nodev option.

# Already implemented during install
mount | grep /var

V-257870

RHEL 9 must mount /var/log with the nodev option.

# Already implemented during install
mount | grep /var/log

V-257871

RHEL 9 must mount /var/log with the noexec option.

# Already implemented during install
mount | grep /var/log

V-257872

RHEL 9 must mount /var/log with the nosuid option.

# Already implemented during install
mount | grep /var/log

V-257873

RHEL 9 must mount /var/log/audit with the nodev option.

# Already implemented during install
mount | grep /var/log/audit

V-257874

RHEL 9 must mount /var/log/audit with the noexec option.

# Already implemented during install
mount | grep /var/log/audit

V-257875

RHEL 9 must mount /var/log/audit with the nosuid option.

# Already implemented during install
mount | grep /var/log/audit

V-257876

RHEL 9 must mount /var/tmp with the nodev option.

# Already implemented during install
mount | grep /var/tmp

V-257877

RHEL 9 must mount /var/tmp with the noexec option.

# Already implemented during install
mount | grep /var/tmp

V-257878

RHEL 9 must mount /var/tmp with the nosuid option.

# Already implemented during install
mount | grep /var/tmp

V-257881

RHEL 9 must prevent special devices on non-root local partitions.

# Already implemented during install
mount | awk '$1 ~ /\/dev/ && $6 !~ /nodev/'

V-257882

RHEL 9 system commands must have mode 755 or less permissive.

# permissions correct by default
find -L /usr{/local,}/{s,}bin /usr/libexec -perm /022 -exec ls -l {} \;

V-257883

RHEL 9 library directories must have mode 755 or less permissive.

# permissions correct by default
find -L /usr/lib{64,} -perm /022 -type d -exec ls -l {} \;

V-257884

RHEL 9 library files must have mode 755 or less permissive.

# permissions correct by default
find -L /usr/lib{64,} -perm /022 -type f -exec ls -l {} \;

V-257885

RHEL 9 /var/log directory must have mode 0755 or less permissive.

# permissions correct by default
ls -ld /var/log

V-257886

RHEL 9 /var/log/messages file must have mode 0640 or less permissive.

# permissions correct by default
ls -la /var/log/messages

V-257887

RHEL 9 audit tools must have a mode of 0755 or less permissive.

# permissions correct by default
ls -la /sbin/{auditctl,aureport,ausearch,autrace,auditd,rsyslogd,augenrules}

V-257888

RHEL 9 cron configuration directories must have a mode of 0700 or less permissive.

find /etc/cron* -type d -exec chmod 0700 {} \;

V-257889

All RHEL 9 local initialization files must have mode 0740 or less permissive.

awk -F: '$3 >= 1000 && $7 !~ /nologin/ {print $6}' /etc/passwd |
    xargs -I_ find _ -maxdepth 1 -exec chmod g-w,o-rwx "{}" \;

V-257890

All RHEL 9 local interactive user home directories must have mode 0750 or less permissive.

awk -F: '$3 >= 1000 && $7 !~ /nologin/ {print $6}' /etc/passwd |
    xargs -l chmod 0750

V-257891

RHEL 9 /etc/group file must have mode 0644 or less permissive to prevent unauthorized access.

# permissions correct by default
ls -alh /etc/{passwd,{g,}shadow,group}*

V-257892

RHEL 9 /etc/group- file must have mode 0644 or less permissive to prevent unauthorized access.

# permissions correct by default
ls -alh /etc/{passwd,{g,}shadow,group}*

V-257893

RHEL 9 /etc/gshadow file must have mode 0000 or less permissive to prevent unauthorized access.

# permissions correct by default
ls -alh /etc/{passwd,{g,}shadow,group}*

V-257894

RHEL 9 /etc/gshadow- file must have mode 0000 or less permissive to prevent unauthorized access.

# permissions correct by default
ls -alh /etc/{passwd,{g,}shadow,group}*

V-257895

RHEL 9 /etc/passwd file must have mode 0644 or less permissive to prevent unauthorized access.

# permissions correct by default
ls -alh /etc/{passwd,{g,}shadow,group}*

V-257896

RHEL 9 /etc/passwd- file must have mode 0644 or less permissive to prevent unauthorized access.

# permissions correct by default
ls -alh /etc/{passwd,{g,}shadow,group}*

V-257897

RHEL 9 /etc/shadow- file must have mode 0000 or less permissive to prevent unauthorized access.

# permissions correct by default
ls -alh /etc/{passwd,{g,}shadow,group}*

V-257898

RHEL 9 /etc/group file must be owned by root.

# permissions correct by default
ls -alh /etc/{passwd,{g,}shadow,group}*

V-257899

RHEL 9 /etc/group file must be group-owned by root.

# permissions correct by default
ls -alh /etc/{passwd,{g,}shadow,group}*

V-257900

RHEL 9 /etc/group- file must be owned by root.

# permissions correct by default
ls -alh /etc/{passwd,{g,}shadow,group}*

V-257901

RHEL 9 /etc/group- file must be group-owned by root.

# permissions correct by default
ls -alh /etc/{passwd,{g,}shadow,group}*

V-257902

RHEL 9 /etc/gshadow file must be owned by root.

# permissions correct by default
ls -alh /etc/{passwd,{g,}shadow,group}*

V-257903

RHEL 9 /etc/gshadow file must be group-owned by root.

# permissions correct by default
ls -alh /etc/{passwd,{g,}shadow,group}*

V-257904

RHEL 9 /etc/gshadow- file must be owned by root.

# permissions correct by default
ls -alh /etc/{passwd,{g,}shadow,group}*

V-257905

RHEL 9 /etc/gshadow- file must be group-owned by root.

# permissions correct by default
ls -alh /etc/{passwd,{g,}shadow,group}*

V-257906

RHEL 9 /etc/passwd file must be owned by root.

# permissions correct by default
ls -alh /etc/{passwd,{g,}shadow,group}*

V-257907

RHEL 9 /etc/passwd file must be group-owned by root.

# permissions correct by default
ls -alh /etc/{passwd,{g,}shadow,group}*

V-257908

RHEL 9 /etc/passwd- file must be owned by root.

# permissions correct by default
ls -alh /etc/{passwd,{g,}shadow,group}*

V-257909

RHEL 9 /etc/passwd- file must be group-owned by root.

# permissions correct by default
ls -alh /etc/{passwd,{g,}shadow,group}*

V-257910

RHEL 9 /etc/shadow file must be owned by root.

# permissions correct by default
ls -alh /etc/{passwd,{g,}shadow,group}*

V-257911

RHEL 9 /etc/shadow file must be group-owned by root.

# permissions correct by default
ls -alh /etc/{passwd,{g,}shadow,group}*

V-257912

RHEL 9 /etc/shadow- file must be owned by root.

# permissions correct by default
ls -alh /etc/{passwd,{g,}shadow,group}*

V-257913

RHEL 9 /etc/shadow- file must be group-owned by root.

# permissions correct by default
ls -alh /etc/{passwd,{g,}shadow,group}*

V-257914

RHEL 9 /var/log directory must be owned by root.

# permissions correct by default
ls -ld /var/log

V-257915

RHEL 9 /var/log directory must be group-owned by root.

# permissions correct by default
ls -ld /var/log

V-257916

RHEL 9 /var/log/messages file must be owned by root.

# permissions correct by default
ls -l /var/log/messages

V-257917

RHEL 9 /var/log/messages file must be group-owned by root.

# permissions correct by default
ls -l /var/messages

V-257918

RHEL 9 system commands must be owned by root.

# permissions correct by default
find -L /usr{/local,}/{s,}bin /usr/libexec ! -user root -exec ls -l {} \;

V-257919

RHEL 9 system commands must be group-owned by root or a system account.

# permissions correct by default
find -L /usr{/local,}/{s,}bin /usr/libexec ! -group root -exec ls -l {} \;

V-257920

RHEL 9 library files must be owned by root.

# permissions correct by default
find -L /usr/lib{64,} ! -user root -type f -exec ls -l {} \;

V-257921

RHEL 9 library files must be group-owned by root or a system account.

# permissions correct by default
find -L /usr/lib{64,} ! -group root -type f -exec ls -l {} \;

V-257922

RHEL 9 library directories must be owned by root.

# permissions correct by default
find -L /usr/lib{64,} ! -user root -type d -exec ls -l {} \;

V-257923

RHEL 9 library directories must be group-owned by root or a system account.

# permissions correct by default
find -L /usr/lib{64,} ! -group root -type d -exec ls -l {} \;

V-257924

RHEL 9 audit tools must be owned by root.

# permissions correct by default
ls -la /sbin/{auditctl,aureport,ausearch,autrace,auditd,rsyslogd,augenrules}

V-257925

RHEL 9 audit tools must be group-owned by root.

# permissions correct by default
ls -la /sbin/{auditctl,aureport,ausearch,autrace,auditd,rsyslogd,augenrules}

V-257926

RHEL 9 cron configuration files directory must be owned by root.

# permissions correct by default
ls -ld /etc/cron*

V-257927

RHEL 9 cron configuration files directory must be group-owned by root.

# permissions correct by default
ls -ld /etc/cron*

V-257928

All RHEL 9 world-writable directories must be owned by root, sys, bin, or an application user.

# permissions correct by default
df --local -P | awk '{if (NR!=1) print $6}' |
    xargs -I_ find _ -xdev -type d -perm -0002 -uid +0 -print

V-257929

A sticky bit must be set on all RHEL 9 public directories.

# permissions correct by default
find / -type d -perm -0002 ! -perm -1000

V-257930

All RHEL 9 local files and directories must have a valid group owner.

# All ownership valid in the baseline
df --local -P | awk '{if (NR!=1) print $6}' | xargs -I_ find _ -xdev -nogroup

V-257931

All RHEL 9 local files and directories must have a valid owner.

# All ownership valid in the baseline
df --local -P | awk '{if (NR!=1) print $6}' | xargs -I_ find _ -xdev -nouser

V-257932

RHEL 9 must be configured so that all system device files are correctly labeled to prevent unauthorized modification.

# labels correct by default
find /dev -context *:device_t:* \( -type c -o -type b \) -printf "%p %Z\n"
find /dev -context *:unlabeled_t:* \( -type c -o -type b \) -printf "%p %Z\n"

V-257933

RHEL 9 /etc/crontab file must have mode 0600.

chmod 0600 /etc/crontab

V-257934

RHEL 9 /etc/shadow file must have mode 0000 to prevent unauthorized access.

# permissions correct by default
ls -alh /etc/{passwd,{g,}shadow,group}*

V-257935

RHEL 9 must have the firewalld package installed.

# installed by default
utils.ensure_package_installed firewalld

V-257936

The firewalld service on RHEL 9 must be active.

# enabled by default
systemctl -q is-active firewalld || systemctl enable --now firewalld

V-257937

A RHEL 9 firewall must employ a deny-all, allow-by-exception policy for allowing connections to other systems.

# Correct zone for servers is work zone
firewall-cmd --list-all

V-257938

RHEL 9 must control remote access methods.

# Baseline configuration is secure
firewall-cmd --list-all

V-257939

RHEL 9 must protect against or limit the effects of denial-of-service (DoS) attacks by ensuring rate-limiting measures on impacted network interfaces are implemented.

utils.set_config_option -i -d = /etc/firewalld/firewalld.conf FirewallBackend nftables

V-257940

RHEL 9 must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services, as defined in the Ports, Protocols, and Services Management (PPSM) Category Assignments List (CAL) and vulnerability assessments.

# only necessary services enabled by default
firewall-cmd --list-all

V-257941

RHEL 9 network interfaces must not be in promiscuous mode.

# correctly configured by default
ip link | grep -i promisc

V-257942

RHEL 9 must enable hardening for the Berkeley Packet Filter just-in-time compiler.

utils.set_sysctl_option net.core.bpf_jit_harden 2

V-257943

RHEL 9 must have the chrony package installed.

# installed by default
utils.ensure_package_installed  chrony

V-257944

RHEL 9 chronyd service must be enabled.

# enabled by default
systemctl -q is-active chronyd || systemctl enable --now chronyd

V-257945

RHEL 9 must securely compare internal information system clocks at least every 24 hours.

# Point to domain controllers
sed -i '/^server/d' /etc/chrony.conf
utils.add_if_missing /etc/chrony.conf 'server time.home.cpt.local iburst maxpoll 16'
utils.add_if_missing /etc/chrony.conf 'server time.kitX.cpt.local iburst maxpoll 16'

V-257948

RHEL 9 systems using Domain Name Servers (DNS) resolution must have at least two name servers configured.

# nameservers set via DHCP
grep nameserver /etc/resolv.conf

V-257949

RHEL 9 must configure a DNS processing mode set be Network Manager.

utils.add_if_missing /etc/NetworkManager/conf.d/dns.conf $'[main]\ndns=none'

V-257950

RHEL 9 must not have unauthorized IP tunnels configured.

# IPsec tunnels not configured

V-257951

RHEL 9 must be configured to prevent unrestricted mail relaying.

# Postfix is not installed

V-257952

If the Trivial File Transfer Protocol (TFTP) server is required, RHEL 9 TFTP daemon must be configured to operate in secure mode.

# no tftp server installed
utils.ensure_package_removed tftp-server

V-257953

RHEL 9 must forward mail from postmaster to the root account using a postfix alias.

# correctly configured by default
grep "postmaster:\s*root$" /etc/aliases

V-257954

RHEL 9 libreswan package must be installed.

utils.ensure_package_installed libreswan

V-257957

RHEL 9 must be configured to use TCP syncookies.

utils.set_sysctl_option net.ipv4.tcp_syncookies 1

V-257958

RHEL 9 must ignore Internet Protocol version 4 (IPv4) Internet Control Message Protocol (ICMP) redirect messages.

utils.set_sysctl_option net.ipv4.conf.all.accept_redirects 0

V-257959

RHEL 9 must not forward Internet Protocol version 4 (IPv4) source-routed packets.

utils.set_sysctl_option net.ipv4.conf.all.accept_source_route 0

V-257960

RHEL 9 must log IPv4 packets with impossible addresses.

utils.set_sysctl_option net.ipv4.conf.all.log_martians 1

V-257961

RHEL 9 must log IPv4 packets with impossible addresses by default.

utils.set_sysctl_option net.ipv4.conf.default.log_martians 1

V-257962

RHEL 9 must use reverse path filtering on all IPv4 interfaces.

utils.set_sysctl_option net.ipv4.conf.all.rp_filter 1

V-257963

RHEL 9 must prevent IPv4 Internet Control Message Protocol (ICMP) redirect messages from being accepted.

utils.set_sysctl_option net.ipv4.conf.default.accept_redirects 0

V-257964

RHEL 9 must not forward IPv4 source-routed packets by default.

utils.set_sysctl_option net.ipv4.conf.default.accept_source_route 0

V-257965

RHEL 9 must use a reverse-path filter for IPv4 network traffic when possible by default.

utils.set_sysctl_option net.ipv4.conf.default.rp_filter 1

V-257966

RHEL 9 must not respond to Internet Control Message Protocol (ICMP) echoes sent to a broadcast address.

utils.set_sysctl_option net.ipv4.icmp_echo_ignore_broadcasts 1

V-257967

RHEL 9 must limit the number of bogus Internet Control Message Protocol (ICMP) response errors logs.

utils.set_sysctl_option net.ipv4.icmp_ignore_bogus_error_response 1

V-257968

RHEL 9 must not send Internet Control Message Protocol (ICMP) redirects.

utils.set_sysctl_option net.ipv4.conf.all.send_redirects 0

V-257969

RHEL 9 must not allow interfaces to perform Internet Control Message Protocol (ICMP) redirects by default.

utils.set_sysctl_option net.ipv4.conf.default.send_redirects 0

V-257970

RHEL 9 must not enable IPv4 packet forwarding unless the system is a router.

utils.set_sysctl_option net.ipv4.conf.all.forwarding 0

V-257971

RHEL 9 must not accept router advertisements on all IPv6 interfaces.

utils.set_sysctl_option net.ipv6.conf.all.accept_ra 0

V-257972

RHEL 9 must ignore IPv6 Internet Control Message Protocol (ICMP) redirect messages.

utils.set_sysctl_option net.ipv6.conf.all.accept_redirects 0

V-257973

RHEL 9 must not forward IPv6 source-routed packets.

utils.set_sysctl_option net.ipv6.conf.all.accept_source_route 0

V-257974

RHEL 9 must not enable IPv6 packet forwarding unless the system is a router.

utils.set_sysctl_option net.ipv6.conf.all.forwarding 0

V-257975

RHEL 9 must not accept router advertisements on all IPv6 interfaces by default.

utils.set_sysctl_option net.ipv6.conf.default.accept_ra 0

V-257976

RHEL 9 must prevent IPv6 Internet Control Message Protocol (ICMP) redirect messages from being accepted.

utils.set_sysctl_option net.ipv6.conf.default.accept_redirects 0

V-257977

RHEL 9 must not forward IPv6 source-routed packets by default.

utils.set_sysctl_option net.ipv6.conf.default.accept_source_route 0

V-257978

All RHEL 9 networked systems must have SSH installed.

# installed by default
utils.ensure_package_installed openssh-server

V-257979

All RHEL 9 networked systems must have and implement SSH to protect the confidentiality and integrity of transmitted and received information, as well as information during preparation for transmission.

# enabled by default
systemctl -q is-active sshd || systemctl enable --now sshd

V-257980

RHEL 9 must have the openssh-clients package installed.

# installed by default
utils.ensure_package_installed openssh-clients

V-257981

RHEL 9 must display the Standard Mandatory DOD Notice and Consent Banner before granting local or remote access to the system via a SSH logon.

utils.set_ssh_option 'Banner /etc/issue'

V-257982

RHEL 9 must log SSH connection attempts and failures to the server.

utils.set_ssh_option 'LogLevel VERBOSE'

V-257983

RHEL 9 SSHD must accept public key authentication.

utils.set_ssh_option 'PubkeyAuthentication yes'

V-257985

RHEL 9 must not permit direct logons to the root account using remote access via SSH.

utils.set_ssh_option 'PermitRootLogin no'

V-257987

RHEL 9 SSH daemon must be configured to use system-wide crypto policies.

# configured by default
grep Include /etc/ssh/sshd_config  /etc/ssh/sshd_config.d/*

V-257988

RHEL 9 must implement DOD-approved encryption ciphers to protect the confidentiality of SSH client connections.

# configured by default
grep Include /etc/ssh/sshd_config  /etc/ssh/sshd_config.d/*

V-257989

RHEL 9 must implement DOD-approved encryption ciphers to protect the confidentiality of SSH server connections.

# configured by default
grep Ciphers /etc/crypto-policies/back-ends/openssh.config

V-257990

RHEL 9 SSH client must be configured to use only Message Authentication Codes (MACs) employing FIPS 140-3 validated cryptographic hash algorithms.

# configured by default
grep MACs /etc/crypto-policies/back-ends/openssh.config

V-257991

RHEL 9 SSH server must be configured to use only Message Authentication Codes (MACs) employing FIPS 140-3 validated cryptographic hash algorithms.

# configured by default
grep MACs /etc/crypto-policies/back-ends/openssh.config

V-257992

RHEL 9 must not allow a noncertificate trusted host SSH logon to the system.

utils.set_ssh_option 'HostbasedAuthentication no'

V-257993

RHEL 9 must not allow users to override SSH environment variables.

utils.set_ssh_option 'PermitUserEnvironment no'

V-257994

RHEL 9 must force a frequent session key renegotiation for SSH connections to the server.

utils.set_ssh_option 'RekeyLimit 1G 1h'

V-257995

RHEL 9 must be configured so that all network connections associated with SSH traffic terminate after becoming unresponsive.

utils.set_ssh_option 'ClientAliveCountMax 1'

V-257996

RHEL 9 must be configured so that all network connections associated with SSH traffic are terminated after 10 minutes of becoming unresponsive.

utils.set_ssh_option 'ClientAliveInterval 600'

V-257997

RHEL 9 SSH server configuration file must be group-owned by root.

# permissions correct by default
ls -l /etc/ssh/sshd_config

V-257998

RHEL 9 SSH server configuration file must be owned by root.

# permissions correct by default
ls -l /etc/ssh/sshd_config

V-257999

RHEL 9 SSH server configuration file must have mode 0600 or less permissive.

# permissions correct by default
ls -l /etc/ssh/sshd_config

V-258000

RHEL 9 SSH private host key files must have mode 0640 or less permissive.

# permissions correct by default
ls -l /etc/ssh/*_key

V-258001

RHEL 9 SSH public host key files must have mode 0644 or less permissive.

# permissions correct by default
ls -l /etc/ssh/*.pub

V-258002

RHEL 9 SSH daemon must not allow compression or must only allow compression after successful authentication.

utils.set_ssh_option 'Compression delayed'

V-258003

RHEL 9 SSH daemon must not allow GSSAPI authentication.

utils.set_ssh_option 'GSSAPIAuthentication no'

V-258004

RHEL 9 SSH daemon must not allow Kerberos authentication.

utils.set_ssh_option 'KerberosAuthentication no'

V-258005

RHEL 9 SSH daemon must not allow rhosts authentication.

utils.set_ssh_option 'IgnoreRhosts yes'

V-258006

RHEL 9 SSH daemon must not allow known hosts authentication.

utils.set_ssh_option 'IgnoreUserKnownHosts yes'

V-258007

RHEL 9 SSH daemon must disable remote X connections for interactive users.

utils.set_ssh_option 'X11forwarding no'

V-258008

RHEL 9 SSH daemon must perform strict mode checking of home directory configuration files.

utils.set_ssh_option 'StrictModes yes'

V-258009

RHEL 9 SSH daemon must display the date and time of the last successful account logon upon an SSH logon.

utils.set_ssh_option 'PrintLastLog yes'

V-258010

RHEL 9 SSH daemon must be configured to use privilege separation.

utils.set_ssh_option 'UsePrivilegeSeparation sandbox'

V-258011

RHEL 9 SSH daemon must prevent remote hosts from connecting to the proxy display.

utils.set_ssh_option 'X11UseLocalhost yes'

V-258012

RHEL 9 must display the Standard Mandatory DOD Notice and Consent Banner before granting local or remote access to the system via a graphical user logon.

# no graphical interface installed

V-258013

RHEL 9 must prevent a user from overriding the banner-message-enable setting for the graphical user interface.

# no graphical interface installed

V-258014

RHEL 9 must disable the graphical user interface automount function unless required.

# no graphical interface installed

V-258015

RHEL 9 must prevent a user from overriding the disabling of the graphical user interface automount function.

# no graphical interface installed

V-258016

RHEL 9 must disable the graphical user interface autorun function unless required.

# no graphical interface installed

V-258017

RHEL 9 must prevent a user from overriding the disabling of the graphical user interface autorun function.

# no graphical interface installed

V-258019

RHEL 9 must be able to initiate directly a session lock for all connection types using smart card when the smart card is removed.

# no graphical interface installed

V-258020

RHEL 9 must prevent a user from overriding the disabling of the graphical user smart card removal action.

# no graphical interface installed

V-258021

RHEL 9 must enable a user session lock until that user re-establishes access using established identification and authentication procedures for graphical user sessions.

# no graphical interface installed

V-258022

RHEL 9 must prevent a user from overriding the screensaver lock-enabled setting for the graphical user interface.

# no graphical interface installed

V-258023

RHEL 9 must automatically lock graphical user sessions after 15 minutes of inactivity.

# no graphical interface installed

V-258024

RHEL 9 must prevent a user from overriding the session idle-delay setting for the graphical user interface.

# no graphical interface installed

V-258025

RHEL 9 must initiate a session lock for graphical user interfaces when the screensaver is activated.

# no graphical interface installed

V-258026

RHEL 9 must prevent a user from overriding the session lock-delay setting for the graphical user interface.

# no graphical interface installed

V-258027

RHEL 9 must conceal, via the session lock, information previously visible on the display with a publicly viewable image.

# no graphical interface installed

V-258028

RHEL 9 effective dconf policy must match the policy keyfiles.

# no graphical interface installed

V-258029

RHEL 9 must disable the ability of a user to restart the system from the login screen.

# no graphical interface installed

V-258030

RHEL 9 must prevent a user from overriding the disable-restart-buttons setting for the graphical user interface.

# no graphical interface installed

V-258031

RHEL 9 must disable the ability of a user to accidentally press Ctrl-Alt-Del and cause a system to shut down or reboot.

# no graphical interface installed

V-258032

RHEL 9 must prevent a user from overriding the Ctrl-Alt-Del sequence settings for the graphical user interface.

# no graphical interface installed

V-258033

RHEL 9 must disable the user list at logon for graphical user interfaces.

# no graphical interface installed

V-258034

RHEL 9 must be configured to disable USB mass storage.

# storage controller disabled on baseline vm anyway
utils.blacklist_kernel_module usb-storage

V-258035

RHEL 9 must have the USBGuard package installed.

# USB controller not present in VM

V-258036

RHEL 9 must have the USBGuard package enabled.

# USB controller not present in VM

V-258038

RHEL 9 must block unauthorized peripherals before establishing a connection.

# USB controller not present in VM

V-258039

RHEL 9 Bluetooth must be disabled.

utils.blacklist_kernel_module bluetooth

V-258040

RHEL 9 wireless network adapters must be disabled.

# no wireless radios in a VM

V-258041

RHEL 9 user account passwords for new users or password changes must have a 60-day maximum password lifetime restriction in /etc/login.defs.

utils.set_config_option /etc/login.defs PASS_MAX_DAYS 60

V-258042

RHEL 9 user account passwords must have a 60-day maximum password lifetime restriction.

# correctly configured by default
awk -F: '$5 <= 0 {print $1 "" "" $5}' /etc/shadow

V-258043

All RHEL 9 local interactive user accounts must be assigned a home directory upon creation.

utils.set_config_option /etc/login.defs CREATE_HOME yes

V-258044

RHEL 9 must set the umask value to 077 for all local interactive user accounts.

# no umask in user profiles by default

V-258045

RHEL 9 duplicate User IDs (UIDs) must not exist for interactive users.

# correctly configured by default
awk -F ":" 'list[$3]++ {print $1, $3}' /etc/passwd

V-258046

RHEL 9 system accounts must not have an interactive login shell.

# correctly configured by default
awk -F: '$3 < 1000 && $7 !~ /nologin/ {print $1 ":" $3 ":" $7}' /etc/passwd

V-258047

RHEL 9 must automatically expire temporary accounts within 72 hours.

# no temp accounts exist by default

V-258048

All RHEL 9 interactive users must have a primary group that exists.

# correctly configured by default
pwck -qr

V-258049

RHEL 9 must disable account identifiers (individuals, groups, roles, and devices) after 35 days of inactivity.

useradd -D -f 35

V-258050

Executable search paths within the initialization files of all local interactive RHEL 9 users must only contain paths that resolve to the system default or the users home directory.

# correctly configured by default
grep -si path= /home/*/.*

V-258051

All RHEL 9 local interactive users must have a home directory assigned in the /etc/passwd file.

# correctly configured by default
awk -F: '$3 >= 1000 && $7 !~ /nologin/ {print $1, $3, $6}' /etc/passwd

V-258052

All RHEL 9 local interactive user home directories defined in the /etc/passwd file must exist.

# correctly configured by default
pwck -r

V-258053

All RHEL 9 local interactive user home directories must be group-owned by the home directory owner's primary group.

# correctly configured by default
awk -F: '$3 >= 1000 && $7 !~ /nologin/ {print $6}' /etc/passwd

V-258054

RHEL 9 must automatically lock an account when three unsuccessful logon attempts occur.

utils.set_config_option -i -d = /etc/security/faillock.conf deny 3

V-258055

RHEL 9 must automatically lock the root account until the root account is released by an administrator when three unsuccessful logon attempts occur during a 15-minute time period.

utils.set_config_option -i /etc/security/faillock.conf even_deny_root ''

V-258056

RHEL 9 must automatically lock an account when three unsuccessful logon attempts occur during a 15-minute time period.

utils.set_config_option -i -d = /etc/security/faillock.conf fail_interval 900

V-258057

RHEL 9 must maintain an account lock until the locked account is released by an administrator.

utils.set_config_option -i -d = /etc/security/faillock.conf unlock_time 0

V-258058

RHEL 9 must not have unauthorized accounts.

# correctly configured by default
awk -F: '$3 >= 1000 && $7 !~ /nologin/ {print $6}' /etc/passwd

V-258060

RHEL 9 must ensure account lockouts persist.

utils.set_config_option -i -d = /etc/security/faillock.conf dir /var/log/faillock

V-258061

RHEL 9 groups must have unique Group ID (GID).

# correctly configured by default
cut -d : -f 3 /etc/group | uniq -d

V-258062

Local RHEL 9 initialization files must not execute world-writable programs.

# correctly configured by default
find /home -perm -002 -type f -name ".[^.]*" -exec ls -ld {} \;

V-258063

RHEL 9 must have the tmux package installed.

utils.ensure_package_installed tmux

V-258064

RHEL 9 must ensure session control is automatically started at shell initialization.

cat <<'EOF' >/etc/profile.d/tmux.sh
#!/bin/bash                                                                                                           │
[[ -n $PS1 && -z $TMUX && -z $DISPLAY && ! $(pstree -s $$) =~ tmux|sudo ]] && exec tmux new -As0
EOF

V-258065

RHEL 9 must enable a user session lock until that user re-establishes access using established identification and authentication procedures for command line sessions.

utils.add_if_missing /etc/tmux.conf 'set -g lock-command vlock'
utils.add_if_missing /etc/tmux.conf 'bind X lock-session'

V-258066

RHEL 9 must automatically lock command line user sessions after 15 minutes of inactivity.

utils.add_if_missing /etc/tmux.conf 'set -g lock-after-time 900'

V-258068

RHEL 9 must automatically exit interactive command shell user sessions after 15 minutes of inactivity.

utils.add_if_missing /etc/profile.d/tmout.sh  $'#!/bin/bash\ndeclare -xr TMOUT=900'

V-258070

RHEL 9 must log username information when unsuccessful logon attempts occur.

utils.set_config_option -i /etc/security/faillock.conf audit ''

V-258071

RHEL 9 must enforce a delay of at least four seconds between logon prompts following a failed logon attempt.

utils.set_config_option /etc/login.defs FAIL_DELAY 4

V-258072

RHEL 9 must define default permissions for the bash shell.

# Don't edit /etc/bashrc directly, use drop-ins in /etc/profile.d/
utils.add_if_missing /etc/profile.d/umask.sh 'umask 077'

V-258073

RHEL 9 must define default permissions for the c shell.

# Don't edit /etc/csh.cshrc directly, use drop-ins in /etc/profile.d/
utils.add_if_missing /etc/profile.d/umask.csh 'umask 077'

V-258074

RHEL 9 must define default permissions for all authenticated users in such a way that the user can only read and modify their own files.

utils.set_config_option /etc/login.defs UMASK 077

V-258075

RHEL 9 must define default permissions for the system default profile.

# Don't edit /etc/profile directly, use drop-ins in /etc/profile.d/
utils.add_if_missing /etc/profile.d/umask.sh 'umask 077'

V-258077

RHEL 9 must terminate idle user sessions.

utils.add_if_missing /etc/systemd/logind.conf.d/stig.conf 'StopIdleSessionSec=900'

V-258079

RHEL 9 must enable the SELinux targeted policy.

# Targeted policy is default
grep SELINUXTYPE /etc/selinux/config

V-258080

RHEL 9 must configure SELinux context type to allow the use of a nondefault faillock tally directory.

dir='/var/log/faillock'
utils.set_config_option -i -d = /etc/security/faillock.conf dir "$dir"
semanage fcontext -a -t faillog_t "$dir(/.*)?"
mkdir -p "$dir" && restorecon -R "$dir"

V-258081

RHEL 9 must have policycoreutils package installed.

# installed by default
utils.ensure_package_installed policycoreutils

V-258082

RHEL 9 policycoreutils-python-utils package must be installed.

utils.ensure_package_installed policycoreutils-python-utils

V-258083

RHEL 9 must have the sudo package installed.

# installed by default
utils.ensure_package_installed sudo

V-258084

RHEL 9 must require reauthentication when using the "sudo" command.

utils.add_if_missing /etc/sudoers.d/01_stig 'Defaults timestamp_timeout=0'

V-258085

RHEL 9 must use the invoking user's password for privilege escalation when using "sudo".

utils.add_if_missing /etc/sudoers.d/01_stig $'Defaults !targetpw\nDefaults !rootpw\nDefaults !runaspw'

V-258086

RHEL 9 must require users to reauthenticate for privilege escalation.

# Configured correctly by default
grep -ir '!authenticate' /etc/sudoers /etc/sudoers.d/*

V-258087

RHEL 9 must restrict privilege elevation to authorized personnel.

# Configured correctly by default
grep -wE '^ALL' /etc/sudoers /etc/sudoers.d/*

V-258088

RHEL 9 must restrict the use of the "su" command.

sed -i -E 's/#auth(.+pam_wheel.so use_uid)/auth\1/' /etc/pam.d/su

V-258089

RHEL 9 fapolicy module must be installed.

utils.ensure_package_installed fapolicyd

V-258090

RHEL 9 fapolicy module must be enabled.

systemctl -q is-active fapolicyd || systemctl enable --now fapolicyd

V-258091

RHEL 9 must ensure the password complexity module in the system-auth file is configured for three retries or less.

# Rule not reviewed

V-258092

RHEL 9 must be configured in the password-auth file to prohibit password reuse for a minimum of five generations.

# Rule not reviewed

V-258093

RHEL 9 must be configured in the system-auth file to prohibit password reuse for a minimum of five generations.

# Rule not reviewed

V-258095

RHEL 9 must configure the use of the pam_faillock.so module in the /etc/pam.d/system-auth file.

# Rule not reviewed

V-258096

RHEL 9 must configure the use of the pam_faillock.so module in the /etc/pam.d/password-auth file.

# Rule not reviewed

V-258097

RHEL 9 must ensure the password complexity module is enabled in the password-auth file.

# Rule not reviewed

V-258098

RHEL 9 must ensure the password complexity module is enabled in the system-auth file.

# Rule not reviewed

V-258099

RHEL 9 password-auth must be configured to use a sufficient number of hashing rounds.

# Rule not reviewed

V-258100

RHEL 9 system-auth must be configured to use a sufficient number of hashing rounds.

# Rule not reviewed

V-258101

RHEL 9 must enforce password complexity rules for the root account.

utils.set_config_option -i /etc/security/pwquality.conf enforce_for_root ''

V-258102

RHEL 9 must enforce password complexity by requiring that at least one lowercase character be used.

utils.set_config_option -i -d = /etc/security/pwquality.conf lcredit '-1'

V-258103

RHEL 9 must enforce password complexity by requiring that at least one numeric character be used.

utils.set_config_option -i -d = /etc/security/pwquality.conf dcredit '-1'

V-258104

RHEL 9 passwords for new users or password changes must have a 24 hours minimum password lifetime restriction in /etc/login.defs.

utils.set_config_option /etc/login.defs PASS_MIN_DAYS 1

V-258105

RHEL 9 passwords must have a 24 hours minimum password lifetime restriction in /etc/shadow.

# Set correctly on the default account
awk -F: '$3 >= 1000 && $3 < 65534 {print $1}' /etc/passwd |
    xargs -I{} awk -F: -v u="{}" '$1 == u {print $1 " " $4}' /etc/shadow

V-258106

RHEL 9 must require users to provide a password for privilege escalation.

# configured correctly by default
grep -ri nopasswd /etc/sudoers /etc/sudoers.d/*

V-258107

RHEL 9 passwords must be created with a minimum of 15 characters.

utils.set_config_option -i -d = /etc/security/pwquality.conf minlen '15'

V-258108

RHEL 9 passwords for new users must have a minimum of 15 characters.

utils.set_config_option /etc/login.defs PASS_MIN_LEN 15

V-258109

RHEL 9 must enforce password complexity by requiring that at least one special character be used.

 utils.set_config_option -i -d = /etc/security/pwquality.conf ocredit '-1'

V-258110

RHEL 9 must prevent the use of dictionary words for passwords.

utils.set_config_option -i -d = /etc/security/pwquality.conf dictcheck 1

V-258111

RHEL 9 must enforce password complexity by requiring that at least one uppercase character be used.

utils.set_config_option -i -d = /etc/security/pwquality.conf ucredit '-1'

V-258112

RHEL 9 must require the change of at least eight characters when passwords are changed.

utils.set_config_option -i -d = /etc/security/pwquality.conf difok 8

V-258113

RHEL 9 must require the maximum number of repeating characters of the same character class be limited to four when passwords are changed.

utils.set_config_option -i -d = /etc/security/pwquality.conf maxclassrepeat 4

V-258114

RHEL 9 must require the maximum number of repeating characters be limited to three when passwords are changed.

utils.set_config_option -i -d = /etc/security/pwquality.conf maxrepeat 3

V-258115

RHEL 9 must require the change of at least four character classes when passwords are changed.

utils.set_config_option -i -d = /etc/security/pwquality.conf minclass 4

V-258116

RHEL 9 must be configured so that user and group account administration utilities are configured to store only encrypted representations of passwords.

utils.set_config_option -d = /etc/libuser.conf crypt_style sha512

V-258117

RHEL 9 must be configured to use the shadow file to store only encrypted representations of passwords.

utils.set_config_option /etc/login.defs ENCRYPT_METHOD SHA512

V-258118

RHEL 9 must not be configured to bypass password requirements for privilege escalation.

# Rule not reviewed

V-258119

RHEL 9 shadow password suite must be configured to use a sufficient number of hashing rounds.

utils.set_config_option /etc/login.defs SHA_CRYPT_MIN_ROUNDS 5000

V-258120

RHEL 9 must not have accounts configured with blank or null passwords.

# Configured correctly by default
awk -F: '!$2 {print $1}' /etc/shadow

V-258121

RHEL 9 must use the CAC smart card driver.

# Rule not reviewed

V-258122

RHEL 9 must enable certificate based smart card authentication.

# Rule not reviewed

V-258123

RHEL 9 must implement certificate status checking for multifactor authentication.

# Rule not reviewed

V-258124

RHEL 9 must have the pcsc-lite package installed.

utils.ensure_package_installed pcsc-lite

V-258125

The pcscd service on RHEL 9 must be active.

# enabled by default (indirectly)
systemctl -q is-active pcscd.socket || systemctl enable --now pcscd.socket

V-258126

RHEL 9 must have the opensc package installed.

utils.ensure_package_installed opensc

V-258127

RHEL 9, for PKI-based authentication, must enforce authorized access to the corresponding private key.

# no key files in baseline

V-258128

RHEL 9 must require authentication to access emergency mode.

# set by default
grep sulogin /usr/lib/systemd/system/emergency.service

V-258129

RHEL 9 must require authentication to access single-user mode.

# set by default
grep sulogin /usr/lib/systemd/system/rescue.service

V-258130

RHEL 9 must prevent system daemons from using Kerberos for authentication.

# No keytabs installed by default
ls -al /etc/*.keytab

V-258131

RHEL 9, for PKI-based authentication, must validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor.

# Rule not reviewed

V-258132

RHEL 9 must map the authenticated identity to the user or group account for PKI-based authentication.

# Rule not reviewed

V-258133

RHEL 9 must prohibit the use of cached authenticators after one day.

# Rule not reviewed

V-258134

RHEL 9 must have the AIDE package installed.

utils.ensure_package_installed aide

V-258135

RHEL 9 must routinely check the baseline configuration for unauthorized changes and notify the system administrator when anomalies in the operation of any security functions are discovered.

cat <<'EOF' >/etc/cron.daily/aide
#!/bin/bash
/usr/sbin/aide --check | /bin/mail -s "$HOSTNAME - Daily aide integrity check run" [email protected]
EOF

V-258136

RHEL 9 must use a file integrity tool that is configured to use FIPS 140-3-approved cryptographic hashes for validating file contents and directories.

# configured by default
grep sha512 /etc/aide.conf

V-258137

RHEL 9 must use cryptographic mechanisms to protect the integrity of audit tools.

cat <<'EOF' >>/etc/aide.conf
# STIG V-258137
/usr/sbin/auditctl p+i+n+u+g+s+b+acl+xattrs+sha512
/usr/sbin/auditd p+i+n+u+g+s+b+acl+xattrs+sha512
/usr/sbin/ausearch p+i+n+u+g+s+b+acl+xattrs+sha512
/usr/sbin/aureport p+i+n+u+g+s+b+acl+xattrs+sha512
/usr/sbin/autrace p+i+n+u+g+s+b+acl+xattrs+sha512
/usr/sbin/augenrules p+i+n+u+g+s+b+acl+xattrs+sha512
EOF

V-258140

RHEL 9 must have the rsyslog package installed.

# installed by default
utils.ensure_package_installed rsyslog

V-258141

RHEL 9 must have the packages required for encrypting offloaded audit logs installed.

# installed by default
utils.ensure_package_installed rsyslog-gnutls

V-258142

The rsyslog service on RHEL 9 must be active.

# enabled by default
systemctl -q is-active rsyslog || systemctl enable --now rsyslog

V-258143

RHEL 9 must be configured so that the rsyslog daemon does not accept log messages from other servers unless the server is being used for log aggregation.

# not enabled by default
grep -sE 'ModLoad|ServerRun' /etc/rsyslog.conf /etc/rsyslog.d/*

V-258144

All RHEL 9 remote access methods must be monitored.

utils.add_if_missing /etc/rsyslog.d/stig.conf 'auth.*;authpriv.*;daemon.* /var/log/secure'

V-258145

RHEL 9 must be configured to offload audit records onto a different system from the system being audited via syslog.

utils.set_config_option -d = /etc/audit/plugins.d/syslog.conf active yes

V-258146

RHEL 9 must authenticate the remote logging server for offloading audit logs via rsyslog.

# Rule not reviewed

V-258147

RHEL 9 must encrypt the transfer of audit records offloaded onto a different system or media from the system being audited via rsyslog.

# Rule not reviewed

V-258148

RHEL 9 must encrypt via the gtls driver the transfer of audit records offloaded onto a different system or media from the system being audited via rsyslog.

# Rule not reviewed

V-258149

RHEL 9 must be configured to forward audit records via TCP to a different system or media from the system being audited via rsyslog.

# Rule not reviewed

V-258150

RHEL 9 must use cron logging.

# configured correctly by default
grep -s cron /etc/rsyslog.conf /etc/rsyslog.d/*.conf

V-258151

RHEL 9 audit package must be installed.

# installed by default
utils.ensure_package_installed audit

V-258152

RHEL 9 audit service must be enabled.

# enabled by default
systemctl -q is-active auditd || systemctl enable --now auditd

V-258153

RHEL 9 audit system must take appropriate action when an error writing to the audit storage volume occurs.

utils.set_config_option -d = /etc/audit/auditd.conf disk_error_action SYSLOG

V-258154

RHEL 9 audit system must take appropriate action when the audit storage volume is full.

utils.set_config_option -d = /etc/audit/auditd.conf disk_full_action SYSLOG

V-258155

RHEL 9 must allocate audit record storage capacity to store at least one week's worth of audit records.

df -h /var/log/audit

V-258156

RHEL 9 must take action when allocated audit record storage volume reaches 75 percent of the repository maximum audit record storage capacity.

utils.set_config_option -d = /etc/audit/auditd.conf space_left '25%'

V-258157

RHEL 9 must notify the system administrator (SA) and information system security officer (ISSO) (at a minimum) when allocated audit record storage volume 75 percent utilization.

utils.set_config_option -d = /etc/audit/auditd.conf space_left_action email

V-258158

RHEL 9 must take action when allocated audit record storage volume reaches 95 percent of the audit record storage capacity.

utils.set_config_option -d = /etc/audit/auditd.conf admin_space_left '5%'

V-258159

RHEL 9 must take action when allocated audit record storage volume reaches 95 percent of the repository maximum audit record storage capacity.

utils.set_config_option -d = /etc/audit/auditd.conf admin_space_left_action single

V-258160

RHEL 9 audit system must take appropriate action when the audit files have reached maximum size.

utils.set_config_option -d = /etc/audit/auditd.conf max_log_file_action ROTATE

V-258161

RHEL 9 must label all offloaded audit logs before sending them to the central log server.

utils.set_config_option -d = /etc/audit/auditd.conf name_format hostname

V-258162

RHEL 9 must take appropriate action when the internal event queue is full.

utils.set_config_option -d = /etc/audit/auditd.conf overflow_action syslog

V-258163

RHEL 9 System Administrator (SA) and/or information system security officer (ISSO) (at a minimum) must be alerted of an audit processing failure event.

utils.set_config_option -d = /etc/audit/auditd.conf action_mail_acct root

V-258164

RHEL 9 audit system must audit local events.

utils.set_config_option -d = /etc/audit/auditd.conf local_events yes

V-258165

RHEL 9 audit logs must be group-owned by root or by a restricted logging group to prevent unauthorized read access.

# permissions correct by default
ls -l /var/log/audit/audit.log

V-258166

RHEL 9 audit log directory must be owned by root to prevent unauthorized read access.

# permissions correct by default
ls -ld /var/log/audit

V-258167

RHEL 9 audit logs file must have mode 0600 or less permissive to prevent unauthorized access to the audit log.

# permissions correct by default
ls -l /var/log/audit/audit.log

V-258168

RHEL 9 must periodically flush audit records to disk to prevent the loss of audit records.

utils.set_config_option -d = /etc/audit/auditd.conf freq 100

V-258169

RHEL 9 must produce audit records containing information to establish the identity of any individual or process associated with the event.

utils.set_config_option -d = /etc/audit/auditd.conf log_format ENRICHED

V-258170

RHEL 9 must write audit records to disk.

utils.set_config_option -d = /etc/audit/auditd.conf write_logs yes

V-258171

RHEL 9 must allow only the information system security manager (ISSM) (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited.

# permissions correct by default
ls -l /etc/audit/auditd.conf /etc/audit/rules.d/*.rules

V-258172

RHEL 9 /etc/audit/auditd.conf file must have 0640 or less permissive to prevent unauthorized access.

# permissions correct by default
ls -l /etc/audit/auditd.conf /etc/audit/rules.d/*.rules

V-258174

RHEL 9 must have mail aliases to notify the information system security officer (ISSO) and system administrator (SA) (at a minimum) in the event of an audit processing failure.

# Postfix package is not installed

V-258175

RHEL 9 audispd-plugins package must be installed.

utils.ensure_package_installed audispd-plugins

V-258176

RHEL 9 must audit uses of the "execve" system call.

utils.add_audit_rule '-a always,exit -F arch=b32 -S execve -C uid!=euid -F euid=0 -k execpriv '
utils.add_audit_rule '-a always,exit -F arch=b64 -S execve -C uid!=euid -F euid=0 -k execpriv'
utils.add_audit_rule '-a always,exit -F arch=b32 -S execve -C gid!=egid -F egid=0 -k execpriv'
utils.add_audit_rule '-a always,exit -F arch=b64 -S execve -C gid!=egid -F egid=0 -k execpriv'

V-258177

RHEL 9 must audit all uses of the chmod, fchmod, and fchmodat system calls.

utils.add_audit_rule '-a always,exit -F arch=b32 -S chmod,fchmod,fchmodat -F auid>=1000 -F auid!=unset -k perm_mod'
utils.add_audit_rule '-a always,exit -F arch=b64 -S chmod,fchmod,fchmodat -F auid>=1000 -F auid!=unset -k perm_mod'

V-258178

RHEL 9 must audit all uses of the chown, fchown, fchownat, and lchown system calls.

utils.add_audit_rule '-a always,exit -F arch=b32 -S chown,fchown,fchownat,lchown -F auid>=1000 -F auid!=unset -k perm_mod'
utils.add_audit_rule '-a always,exit -F arch=b64 -S chown,fchown,fchownat,lchown -F auid>=1000 -F auid!=unset -k perm_mod'

V-258179

RHEL 9 must audit all uses of the setxattr, fsetxattr, lsetxattr, removexattr, fremovexattr, and lremovexattr system calls.

utils.add_audit_rule '-a always,exit -F arch=b32 -S setxattr,fsetxattr,lsetxattr,removexattr,fremovexattr,lremovexattr -F auid>=1000 -F auid!=unset -k perm_mod'
utils.add_audit_rule '-a always,exit -F arch=b64 -S setxattr,fsetxattr,lsetxattr,removexattr,fremovexattr,lremovexattr -F auid>=1000 -F auid!=unset -k perm_mod'
utils.add_audit_rule '-a always,exit -F arch=b32 -S setxattr,fsetxattr,lsetxattr,removexattr,fremovexattr,lremovexattr -F auid=0 -k perm_mod'
utils.add_audit_rule '-a always,exit -F arch=b64 -S setxattr,fsetxattr,lsetxattr,removexattr,fremovexattr,lremovexattr -F auid=0 -k perm_mod'

V-258180

RHEL 9 must audit all uses of umount system calls.

utils.add_audit_rule '-a always,exit -F path=/usr/bin/umount -F perm=x -F auid>=1000 -F auid!=unset -k privileged-mount'

V-258181

RHEL 9 must audit all uses of the chacl command.

utils.add_audit_rule '-a always,exit -F path=/usr/bin/chacl -F perm=x -F auid>=1000 -F auid!=unset -k perm_mod'

V-258182

RHEL 9 must audit all uses of the setfacl command.

utils.add_audit_rule '-a always,exit -F path=/usr/bin/setfacl -F perm=x -F auid>=1000 -F auid!=unset -k perm_mod'

V-258183

RHEL 9 must audit all uses of the chcon command.

utils.add_audit_rule '-a always,exit -F path=/usr/bin/chcon -F perm=x -F auid>=1000 -F auid!=unset -k perm_mod'

V-258184

RHEL 9 must audit all uses of the semanage command.

utils.add_audit_rule '-a always,exit -F path=/usr/sbin/semanage -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update'

V-258185

RHEL 9 must audit all uses of the setfiles command.

utils.add_audit_rule '-a always,exit -F path=/usr/sbin/setfiles -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update'

V-258186

RHEL 9 must audit all uses of the setsebool command.

utils.add_audit_rule '-a always,exit -F path=/usr/sbin/setsebool -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged'

V-258187

RHEL 9 must audit all uses of the rename, unlink, rmdir, renameat, and unlinkat system calls.

utils.add_audit_rule '-a always,exit -F arch=b32 -S rename,unlink,rmdir,renameat,unlinkat -F auid>=1000 -F auid!=unset -k delete'
utils.add_audit_rule '-a always,exit -F arch=b64 -S rename,unlink,rmdir,renameat,unlinkat -F auid>=1000 -F auid!=unset -k delete'

V-258188

RHEL 9 must audit all uses of the truncate, ftruncate, creat, open, openat, and open_by_handle_at system calls.

utils.add_audit_rule '-a always,exit -F arch=b32 -S truncate,ftruncate,creat,open,openat,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -k perm_access'
utils.add_audit_rule '-a always,exit -F arch=b64 -S truncate,ftruncate,creat,open,openat,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -k perm_access'
utils.add_audit_rule '-a always,exit -F arch=b32 -S truncate,ftruncate,creat,open,openat,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -k perm_access'
utils.add_audit_rule '-a always,exit -F arch=b64 -S truncate,ftruncate,creat,open,openat,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -k perm_access'

V-258189

RHEL 9 must audit all uses of the delete_module system call.

utils.add_audit_rule '-a always,exit -F arch=b32 -S delete_module -F auid>=1000 -F auid!=unset -k module_chng'
utils.add_audit_rule '-a always,exit -F arch=b64 -S delete_module -F auid>=1000 -F auid!=unset -k module_chng'

V-258190

RHEL 9 must audit all uses of the init_module and finit_module system calls.

utils.add_audit_rule '-a always,exit -F arch=b32 -S init_module,finit_module -F auid>=1000 -F auid!=unset -k module_chng'
utils.add_audit_rule '-a always,exit -F arch=b64 -S init_module,finit_module -F auid>=1000 -F auid!=unset -k module_chng'

V-258191

RHEL 9 must audit all uses of the chage command.

utils.add_audit_rule '-a always,exit -F path=/usr/bin/chage -F perm=x -F auid>=1000 -F auid!=unset -k privileged-chage'

V-258192

RHEL 9 must audit all uses of the chsh command.

utils.add_audit_rule '-a always,exit -F path=/usr/bin/chsh -F perm=x -F auid>=1000 -F auid!=unset -k priv_cmd'

V-258193

RHEL 9 must audit all uses of the crontab command.

utils.add_audit_rule '-a always,exit -F path=/usr/bin/crontab -F perm=x -F auid>=1000 -F auid!=unset -k privileged-crontab'

V-258194

RHEL 9 must audit all uses of the gpasswd command.

utils.add_audit_rule '-a always,exit -F path=/usr/bin/gpasswd -F perm=x -F auid>=1000 -F auid!=unset -k privileged-gpasswd'

V-258195

RHEL 9 must audit all uses of the kmod command.

utils.add_audit_rule '-a always,exit -F path=/usr/bin/kmod -F perm=x -F auid>=1000 -F auid!=unset -k modules'

V-258196

RHEL 9 must audit all uses of the newgrp command.

utils.add_audit_rule '-a always,exit -F path=/usr/bin/newgrp -F perm=x -F auid>=1000 -F auid!=unset -k priv_cmd'

V-258197

RHEL 9 must audit all uses of the pam_timestamp_check command.

utils.add_audit_rule '-a always,exit -F path=/usr/sbin/pam_timestamp_check -F perm=x -F auid>=1000 -F auid!=unset -k privileged-pam_timestamp_check'

V-258198

RHEL 9 must audit all uses of the passwd command.

utils.add_audit_rule '-a always,exit -F path=/usr/bin/passwd -F perm=x -F auid>=1000 -F auid!=unset -k privileged-passwd'

V-258199

RHEL 9 must audit all uses of the postdrop command.

utils.add_audit_rule '-a always,exit -F path=/usr/sbin/postdrop -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update'

V-258200

RHEL 9 must audit all uses of the postqueue command.

utils.add_audit_rule '-a always,exit -F path=/usr/sbin/postqueue -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update'

V-258201

RHEL 9 must audit all uses of the ssh-agent command.

utils.add_audit_rule '-a always,exit -F path=/usr/bin/ssh-agent -F perm=x -F auid>=1000 -F auid!=unset -k privileged-ssh'

V-258202

RHEL 9 must audit all uses of the ssh-keysign command.

utils.add_audit_rule '-a always,exit -F path=/usr/libexec/openssh/ssh-keysign -F perm=x -F auid>=1000 -F auid!=unset -k privileged-ssh'

V-258203

RHEL 9 must audit all uses of the su command.

utils.add_audit_rule '-a always,exit -F path=/usr/bin/su -F perm=x -F auid>=1000 -F auid!=unset -k privileged-priv_change'

V-258204

RHEL 9 must audit all uses of the sudo command.

utils.add_audit_rule '-a always,exit -F path=/usr/bin/sudo -F perm=x -F auid>=1000 -F auid!=unset -k priv_cmd'

V-258205

RHEL 9 must audit all uses of the sudoedit command.

utils.add_audit_rule '-a always,exit -F path=/usr/bin/sudoedit -F perm=x -F auid>=1000 -F auid!=unset -k priv_cmd'

V-258206

RHEL 9 must audit all uses of the unix_chkpwd command.

utils.add_audit_rule '-a always,exit -F path=/usr/sbin/unix_chkpwd -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update'

V-258207

RHEL 9 must audit all uses of the unix_update command.

utils.add_audit_rule '-a always,exit -F path=/usr/sbin/unix_update -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update'

V-258208

RHEL 9 must audit all uses of the userhelper command.

utils.add_audit_rule '-a always,exit -F path=/usr/sbin/userhelper -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update'

V-258209

RHEL 9 must audit all uses of the usermod command.

utils.add_audit_rule '-a always,exit -F path=/usr/sbin/usermod -F perm=x -F auid>=1000 -F auid!=unset -k privileged-usermod'

V-258210

RHEL 9 must audit all uses of the mount command.

utils.add_audit_rule '-a always,exit -F path=/usr/bin/mount -F perm=x -F auid>=1000 -F auid!=unset -k privileged-mount'

V-258211

Successful/unsuccessful uses of the init command in RHEL 9 must generate an audit record.

utils.add_audit_rule '-a always,exit -F path=/usr/sbin/init -F perm=x -F auid>=1000 -F auid!=unset -k privileged-init'

V-258212

Successful/unsuccessful uses of the poweroff command in RHEL 9 must generate an audit record.

utils.add_audit_rule '-a always,exit -F path=/usr/sbin/poweroff -F perm=x -F auid>=1000 -F auid!=unset -k privileged-poweroff'

V-258213

Successful/unsuccessful uses of the reboot command in RHEL 9 must generate an audit record.

utils.add_audit_rule '-a always,exit -F path=/usr/sbin/reboot -F perm=x -F auid>=1000 -F auid!=unset -k privileged-reboot'

V-258214

Successful/unsuccessful uses of the shutdown command in RHEL 9 must generate an audit record.

utils.add_audit_rule '-a always,exit -F path=/usr/sbin/shutdown -F perm=x -F auid>=1000 -F auid!=unset -k privileged-shutdown'

V-258215

Successful/unsuccessful uses of the umount system call in RHEL 9 must generate an audit record.

utils.add_audit_rule '-a always,exit -F arch=b32 -S umount -F auid>=1000 -F auid!=unset -k privileged-umount'

V-258216

Successful/unsuccessful uses of the umount2 system call in RHEL 9 must generate an audit record.

utils.add_audit_rule '-a always,exit -F arch=b32 -S umount2 -F auid>=1000 -F auid!=unset -k perm_mod'
utils.add_audit_rule '-a always,exit -F arch=b64 -S umount2 -F auid>=1000 -F auid!=unset -k perm_mod'

V-258217

RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/sudoers.

utils.add_audit_rule '-w /etc/sudoers -p wa -k identity'

V-258218

RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/sudoers.d/ directory.

utils.add_audit_rule '-w /etc/sudoers.d/ -p wa -k identity'

V-258219

RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/group.

utils.add_audit_rule '-w /etc/group -p wa -k identity'

V-258220

RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/gshadow.

utils.add_audit_rule '-w /etc/gshadow -p wa -k identity'

V-258221

RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/opasswd.

utils.add_audit_rule '-w /etc/security/opasswd -p wa -k identity'

V-258222

RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/passwd.

utils.add_audit_rule '-w /etc/passwd -p wa -k identity'

V-258223

RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/shadow.

utils.add_audit_rule '-w /etc/shadow -p wa -k identity'

V-258224

RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /var/log/faillock.

utils.add_audit_rule '-w /var/log/faillock -p wa -k logins'

V-258225

RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /var/log/lastlog.

utils.add_audit_rule '-w /var/log/lastlog -p wa -k logins'

V-258226

RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /var/log/tallylog.

utils.add_audit_rule '-w /var/log/tallylog -p wa -k logins'

V-258227

RHEL 9 must take appropriate action when a critical audit processing failure occurs.

utils.add_audit_rule '-f 2'

V-258228

RHEL 9 audit system must protect logon UIDs from unauthorized change.

utils.add_audit_rule '--loginuid-immutable'

V-258229

RHEL 9 audit system must protect auditing rules from unauthorized change.

utils.add_audit_rule '-e 2'

V-258231

RHEL 9 must employ FIPS 140-3 approved cryptographic hashing algorithms for all stored passwords.

# configured correctly by default
awk -F: '$2 !~ /[!\*]+/ {print $2}' /etc/shadow

V-258232

RHEL 9 IP tunnels must use FIPS 140-2/140-3 approved cryptographic algorithms.

# IPsec service not installed

V-258233

RHEL 9 pam_unix.so module must be configured in the password-auth file to use a FIPS 140-3 approved cryptographic hashing algorithm for system authentication.

# Rule not reviewed

V-258234

RHEL 9 must have the crypto-policies package installed.

# installed by default
utils.ensure_package_installed crypto-policies

V-258236

RHEL 9 crypto policy must not be overridden.

# default configuration
ls -l /etc/crypto-policies/back-ends/

V-258237

RHEL 9 must use mechanisms meeting the requirements of applicable federal laws, executive orders, directives, policies, regulations, standards, and guidance for authentication to a cryptographic module.

# configured correctly by default
ls -l /etc/crypto-policies/back-ends/krb5.config

V-258239

RHEL 9 must implement DOD-approved encryption in the OpenSSL package.

# configured correctly by default
grep -i opensslcnf.config /etc/pki/tls/openssl.cnf

V-258240

RHEL 9 must implement DOD-approved TLS encryption in the OpenSSL package.

# configured correctly by default
grep -i  minprotocol /etc/crypto-policies/back-ends/opensslcnf.config

V-258241

RHEL 9 must implement a system-wide encryption policy.

update-crypto-policies --show

V-258242

RHEL 9 must implement DOD-approved encryption in the bind package.

# bind package is not installed

CAT III Checks

V-257782

RHEL 9 must enable the hardware random number generator entropy gatherer service.

# not applicable for FIPS mode system

V-257795

RHEL 9 must enable mitigations against processor-based vulnerabilities.

# enabled by default
dmesg | grep 'page tables'
# to enable anyway
utils.add_kernel_cmdline 'pti=on'

V-257796

RHEL 9 must enable auditing of processes that start prior to the audit daemon.

# both should be set together, see: V-258173
utils.add_kernel_cmdline 'audit=1 audit_backlog_limit=8192'

V-257824

RHEL 9 must remove all software components after updated versions have been installed.

utils.set_config_option -d = /etc/dnf/dnf.conf clean_requirements_on_remove 1

V-257845

RHEL 9 must use a separate file system for /var.

# Already implemented during install
mountpoint /var

V-257846

RHEL 9 must use a separate file system for /var/log.

# Already implemented during install
mountpoint /var/log

V-257847

RHEL 9 must use a separate file system for the system audit data path.

# Already implemented during install
mountpoint /var/log/audit

V-257880

RHEL 9 must disable mounting of cramfs.

# cramfs was removed in RHEL 9
utils.blacklist_kernel_module cramfs

V-257946

RHEL 9 must disable the chrony daemon from acting as a server.

utils.set_config_option /etc/chrony.conf port 0

V-257947

RHEL 9 must disable network management of the chrony daemon.

utils.set_config_option /etc/chrony.conf cmdport 0

V-258037

RHEL 9 must enable Linux audit logging for the USBGuard daemon.

# no USB controller present in VM

V-258067

RHEL 9 must prevent users from disabling session control mechanisms.

sed -i '/tmux/d' /etc/shells

V-258069

RHEL 9 must limit the number of concurrent sessions to ten for all accounts and/or account types.

utils.add_if_missing /etc/security/limits.d/stig.conf '* hard maxlogins 10'

V-258076

RHEL 9 must display the date and time of the last successful account logon upon logon.

# default behavior
grep pam_lastlog /etc/pam.d/postlogin

V-258138

RHEL 9 must be configured so that the file integrity tool verifies Access Control Lists (ACLs).

# configured by default
grep acl /etc/aide.conf

V-258139

RHEL 9 must be configured so that the file integrity tool verifies extended attributes.

# configured by default
grep xattrs /etc/aide.conf

V-258173

RHEL 9 must allocate an audit_backlog_limit of sufficient size to capture processes that start prior to the audit daemon.

# both should be set together, see: V-257796
utils.add_kernel_cmdline 'audit=1 audit_backlog_limit=8192'

Ubuntu_24_STIG_notes.md

Ubuntu 24 STIG notes

Canonical Ubuntu 22.04 LTS Security Technical Implementation Guide :: Version 1, Release: 1 Benchmark Date: 10 Apr 2024

Updated on 2024-05-29

Utilities

All fix and check commands must be run as root.

The fix snippets listed later make use of the following helper functions:

# paste this block in before running the later fix commands

utils.add_if_missing() {
    [[ $# -eq 2 ]] || return
    [[ $1 != "${1%/*}" && ! -d ${1%/*} ]] && mkdir -p "${1%/*}"
    grep -qsF -- "$2" "$1" || printf '%s\n' "$2" >>"$1"
}

utils.set_sysctl_option() {
    [[ $# -eq 2 ]] || return
    [[ $(sysctl -n "$1") == "$2" ]] ||
        utils.add_if_missing /etc/sysctl.d/99-sysctl.conf "$1 = $2"
}

utils.set_ssh_option() {
    [[ $# -eq 1 ]] || return
    grep -qrsE -- "^$1" /etc/ssh/sshd_config /etc/ssh/sshd_config.d/* ||
        utils.add_if_missing /etc/ssh/sshd_config.d/99-stig.conf "$1"
}

utils.blacklist_kernel_module() {
    [[ $# -eq 1 ]] || return
    utils.add_if_missing "/etc/modprobe.d/$1.conf" \
        "$(printf 'install %s /bin/false\nblacklist %s' "$1" "$1")"
}

utils.add_audit_rule() {
    [[ $# -eq 1 ]] || return
    grep -qrs -- "$1" /etc/audit/audit.rules /etc/audit/rules.d/* ||
        utils.add_if_missing /etc/audit/rules.d/stig.rules "$1"
}

utils.add_kernel_cmdline() {
    [[ $# -eq 1 ]] || return
    awk -i inplace -v p="$1" '
        /CMDLINE/ && $0 !~ p {gsub(/(["'\''])$/, " "p"&")} 1
    ' /etc/default/grub
    grubby --update-kernel=ALL --args="$1"
}

utils.ensure_package_installed() {
    [[ $# -eq 1 ]] || return
    dpkg -s $1 &>/dev/null || apt -qqq install $1
}

utils.ensure_package_removed() {
    [[ $# -eq 1 ]] || return
    dpkg -s $1 &>/dev/null && apt -qqq purge $1
}

utils.get_config_option() {
    [[ $# -ge 2 ]] || return
    local c='#' a d i=0 r1 r2
    while [[ $# -gt 2 ]]; do
        [[ $1 == -d ]] && d=$2 && shift 2
        [[ $1 == -i ]] && i=1 && shift
    done
    [[ $# -eq 2 ]] || return
    [[ $i -eq 1 ]] && a=$c c=''
    r1="^[ \t]*(|${c:-}+.*)$"
    r2="^[ \t${a:-}]*${2}[ \t]*${d:-[ \t]+}[ \t]*([^${c:-$a}]*).*$"
    awk -v r1="$r1" -v r2="$r2" '$0 !~ r1 && $0 ~ r2 {match($0, r2, m);
        gsub(/^[ \t]*|[ \t]*$/, "", m[1]); print m[1]; exit}' "$1"
}

utils.set_config_option() {
    [[ $# -ge 3 ]] || return
    local a c='#' a d i o r1 r2
    while [[ $# -gt 3 ]]; do
        [[ $1 == -a ]] && a=1 && shift
        [[ $1 == -d ]] && d=$2 && shift 2
        [[ $1 == -i ]] && i='-i' && shift
    done
    [[ $# -eq 3 ]] || return
    [[ -f $1 ]] && o=$(utils.get_config_option -d "$d" ${i:-} "$1" "$2")
    [[ ${a:-} || ! ${o:-} ]] &&
        utils.add_if_missing "$1" "${2}${d:- }${3}" && return
    [[ ${i:-} ]] && a=$c c=''
    r1="^[ \t]*(|${c:-}+.*)$"
    r2="^([ \t${a:-}]*)(${2}[ \t]*${d:-[ \t]+}[ \t]*)([^${c:-$a}]*)(.*)$"
    awk -i inplace -v r1="$r1" -v r2="$r2" -v new="$3" '
        $0 !~ r1 && $0 ~ r2 && c == 0 {
            match($0, r2, m); gsub($0, m[2] new m[4]); c = 1
        } 1' "$1"
}

CAT I Checks

V-260469

Ubuntu 22.04 LTS must disable the x86 Ctrl-Alt-Delete key sequence.

systemctl mask --now ctrl-alt-del.target

V-260470

Ubuntu 22.04 LTS, when booted, must require authentication upon booting into single-user and maintenance modes.

# superuser name is root
cat /boot/grub/user.cfg

V-260482

Ubuntu 22.04 LTS must not have the ""rsh-server"" package installed.

utils.ensure_package_removed rsh-server

V-260483

Ubuntu 22.04 LTS must not have the ""telnet"" package installed.

utils.ensure_package_removed telnetd

V-260523

Ubuntu 22.04 LTS must have SSH installed.

utils.ensure_package_installed ssh

V-260524

Ubuntu 22.04 LTS must use SSH to protect the confidentiality and integrity of transmitted information.

systemctl -q is-active ssh || systemctl enable --now ssh

V-260526

Ubuntu 22.04 LTS must not allow unattended or automatic login via SSH.

utils.set_ssh_option 'PermitEmptyPasswords no'
utils.set_ssh_option 'PermitUserEnvironment no'

V-260529

Ubuntu 22.04 LTS must be configured so that remote X connections are disabled, unless to fulfill documented and validated mission requirements.

utils.set_ssh_option 'X11Forwarding no'

V-260539

Ubuntu 22.04 LTS must disable the x86 Ctrl-Alt-Delete key sequence if a graphical user interface is installed.

# no graphical interface installed

V-260559

Ubuntu 22.04 LTS must ensure only users who need access to security functions are part of sudo group.

# Only default admin is in sudo group
grep sudo /etc/group

V-260570

Ubuntu 22.04 LTS must not allow accounts configured with blank or null passwords.

# Rule not reviewed

V-260571

Ubuntu 22.04 LTS must not have accounts configured with blank or null passwords.

# configured correctly by default
awk -F: '!$2 {print $1}' /etc/shadow

V-260579

Ubuntu 22.04 LTS must map the authenticated identity to the user or group account for PKI-based authentication.

# Rule not reviewed

V-260650

Ubuntu 22.04 LTS must implement NIST FIPS-validated cryptography to protect classified information and for the following: To provision digital signatures, to generate cryptographic hashes, and to protect unclassified information requiring confidentiality and cryptographic protection in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.

# requires Ubuntu One subscription
cat /proc/sys/crypto/fips_enabled

CAT II Checks

V-260468

Ubuntu 22.04 LTS must deploy an Endpoint Security Solution.

# McAfee products not used in Linux baseline

V-260471

Ubuntu 22.04 LTS must initiate session audits at system startup.

utils.add_kernel_cmdline 'audit=1'

V-260473

Ubuntu 22.04 LTS must disable kernel core dumps so that it can fail to a secure state if system initialization fails, shutdown fails or aborts fail.

systemctl mask --now kdump

V-260474

Ubuntu 22.04 LTS must implement address space layout randomization to protect its memory from unauthorized code execution.

utils.set_sysctl_option kernel.randomize_va_space 2

V-260475

Ubuntu 22.04 LTS must implement nonexecutable data to protect its memory from unauthorized code execution.

# enabled by default
dmesg | grep '[NX|DX]*protection'

V-260477

Ubuntu 22.04 LTS must be configured so that the Advance Package Tool (APT) removes all software components after updated versions have been installed.

# Rule not reviewed

V-260478

Ubuntu 22.04 LTS must have the ""libpam-pwquality"" package installed.

utils.ensure_package_installed libpam-pwquality

V-260484

Ubuntu 22.04 LTS must implement cryptographic mechanisms to prevent unauthorized disclosure and modification of all information that requires protection at rest.

# Not applicable to VMs

V-260485

Ubuntu 22.04 LTS must have directories that contain system commands set to a mode of ""755"" or less permissive.

# permissions correct by default
find -L /usr{/local,}/{s,}bin /usr/libexec -perm /022 -exec ls -l {} \;

V-260486

Ubuntu 22.04 LTS must have system commands set to a mode of ""755"" or less permissive.

# permissions correct by default
find -L /usr{/local,}/{s,}bin /usr/libexec -perm /022 -exec ls -l {} \;

V-260487

Ubuntu 22.04 LTS library files must have mode ""755"" or less permissive.

# permissions correct by default
find -L /usr/lib{64,} -perm /022 -type f -exec ls -l {} \;

V-260488

Ubuntu 22.04 LTS must configure the ""/var/log"" directory to have mode ""755"" or less permissive.

# permissions correct in baseline
ls -ld /var/log

V-260489

Ubuntu 22.04 LTS must generate error messages that provide information necessary for corrective actions without revealing information that could be exploited by adversaries.

# permissions correct in baseline
find /var/log -perm /137 ! -name '*[bw]tmp' ! -name '*lastlog' -type f

V-260490

Ubuntu 22.04 LTS must generate system journal entries without revealing information that could be exploited by adversaries.

# Invalid check, would break systemd-journald functionality

V-260491

Ubuntu 22.04 LTS must configure ""/var/log/syslog"" file with mode ""640"" or less permissive.

# permissions correct by default
ls -l /var/log/syslog

V-260492

Ubuntu 22.04 LTS must configure audit tools with a mode of ""755"" or less permissive.

# permissions correct by default
ls -la /sbin/{auditctl,aureport,ausearch,autrace,auditd,rsyslogd,augenrules}

V-260493

Ubuntu 22.04 LTS must have directories that contain system commands owned by ""root"".

# permissions correct by default
find -L /usr{/local,}/{s,}bin /usr/libexec ! -user root -exec ls -l {} \;

V-260494

Ubuntu 22.04 LTS must have directories that contain system commands group-owned by ""root"".

# permissions correct by default
find -L /usr{/local,}/{s,}bin /usr/libexec ! -group root -exec ls -l {} \;

V-260495

Ubuntu 22.04 LTS must have system commands owned by ""root"" or a system account.

# permissions correct by default
find -L /usr{/local,}/{s,}bin /usr/libexec ! -user root -exec ls -l {} \;

V-260496

Ubuntu 22.04 LTS must have system commands group-owned by ""root"" or a system account.

# permissions correct by default
find -L /usr{/local,}/{s,}bin /usr/libexec ! -group root -exec ls -l {} \;

V-260497

Ubuntu 22.04 LTS library directories must be owned by ""root"".

# permissions correct by default
find -L /usr/lib{64,} ! -user root -type d -exec ls -l {} \;

V-260498

Ubuntu 22.04 LTS library directories must be group-owned by ""root"".

# permissions correct by default
find -L /usr/lib{64,} ! -group root -type d -exec ls -l {} \;

V-260499

Ubuntu 22.04 LTS library files must be owned by ""root"".

# permissions correct by default
find -L /usr/lib{64,} ! -user root -type f -exec ls -l {} \;

V-260500

Ubuntu 22.04 LTS library files must be group-owned by ""root"".

# permissions correct by default
find -L /usr/lib{64,} ! -group root -type f -exec ls -l {} \;

V-260501

Ubuntu 22.04 LTS must configure the directories used by the system journal to be owned by ""root"".

# permissions correct by default
find -L /{var,run}/log/journal ! -user root -exec ls -l {} \;

V-260502

Ubuntu 22.04 LTS must configure the directories used by the system journal to be group-owned by ""systemd-journal"".

# permissions correct by default
find -L /{var,run}/log/journal ! -group systemd-journal -exec ls -l {} \;

V-260503

Ubuntu 22.04 LTS must configure the files used by the system journal to be owned by ""root"".

# permissions correct by default
find -L /{var,run}/log/journal ! -user root -exec ls -l {} \;

V-260504

Ubuntu 22.04 LTS must configure the files used by the system journal to be group-owned by ""systemd-journal"".

# permissions correct by default
find -L /{var,run}/log/journal ! -group systemd-journal -exec ls -l {} \;

V-260505

Ubuntu 22.04 LTS must be configured so that the ""journalctl"" command is owned by ""root"".

# permissions correct by default
ls -l /usr/bin/journalctl

V-260506

Ubuntu 22.04 LTS must be configured so that the ""journalctl"" command is group-owned by ""root"".

# permissions correct by default
ls -l /usr/bin/journalctl

V-260507

Ubuntu 22.04 LTS must configure audit tools to be owned by ""root"".

# permissions correct by default
ls -la /sbin/{auditctl,aureport,ausearch,autrace,auditd,rsyslogd,augenrules}

V-260508

Ubuntu 22.04 LTS must configure the ""/var/log"" directory to be owned by ""root"".

# permissions correct by default
ls -ld /var/log

V-260509

Ubuntu 22.04 LTS must configure the ""/var/log"" directory to be group-owned by ""syslog"".

# permissions correct by default
ls -ld /var/log

V-260510

Ubuntu 22.04 LTS must configure ""/var/log/syslog"" file to be owned by ""syslog"".

# permissions correct by default
ls -l /var/log/syslog

V-260511

Ubuntu 22.04 LTS must configure the ""/var/log/syslog"" file to be group-owned by ""adm"".

# permissions correct by default
ls -l /var/log/syslog

V-260512

Ubuntu 22.04 LTS must be configured so that the ""journalctl"" command is not accessible by unauthorized users.

# Invalid check, would break systemd-journald functionality

V-260513

Ubuntu 22.04 LTS must set a sticky bit on all public directories to prevent unauthorized and unintended information transferred via shared system resources.

# permissions correct by default
find / -type d -perm -002 ! -perm -1000

V-260514

Ubuntu 22.04 LTS must have an application firewall installed in order to control remote access methods.

# firewalld is used instead of ufw
utils.ensure_package_installed firewalld

V-260515

Ubuntu 22.04 LTS must enable and run the Uncomplicated Firewall (ufw).

# firewalld is used instead of ufw
systemctl -q is-active firewalld || systemctl enable --now firewalld

V-260516

Ubuntu 22.04 LTS must have an application firewall enabled.

# firewalld is used instead of ufw
systemctl -q is-active firewalld || systemctl enable --now firewalld

V-260517

Ubuntu 22.04 LTS must configure the Uncomplicated Firewall (ufw) to rate-limit impacted network interfaces.

# firewalld is used instead of ufw

V-260518

Ubuntu 22.04 LTS must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments.

# firewalld is used instead of ufw
firewall-cmd --permanent --list-all

V-260522

Ubuntu 22.04 LTS must be configured to use TCP syncookies.

utils.set_sysctl_option net.ipv4.tcp_syncookies 1

V-260525

Ubuntu 22.04 LTS must display the Standard Mandatory DOD Notice and Consent Banner before granting any local or remote connection to the system.

utils.set_ssh_option 'Banner /etc/issue'
cat <<'EOF' >/etc/issue
US Department of Defense Warning Statement

You are accessing a U.S. Government (USG) Information System (IS) that is
provided for USG-authorized use only. By using this IS (which includes any
device attached to this IS), you consent to the following conditions:

-The USG routinely intercepts and monitors communications on this IS for
purposes including, but not limited to, penetration testing, COMSEC monitoring,
network operations and defense, personnel misconduct (PM), law enforcement
(LE), and counterintelligence (CI) investigations.

-At any time, the USG may inspect and seize data stored on this IS.

-Communications using, or data stored on, this IS are not private, are subject
to routine monitoring, interception, and search, and may be disclosed or used
for any USG-authorized purpose.

-This IS includes security measures (e.g., authentication and access controls)
to protect USG interests -- not for your personal benefit or privacy.

-Notwithstanding the above, using this IS does not constitute consent to PM, LE
or CI investigative searching or monitoring of the content of privileged
communications, or work product, related to personal representation or services
by attorneys, psychotherapists, or clergy, and their assistants. Such
communications and work product are private and confidential. See User
Agreement for details.
EOF

V-260527

Ubuntu 22.04 LTS must be configured so that all network connections associated with SSH traffic terminate after becoming unresponsive.

utils.set_ssh_option 'ClientAliveCountMax 1'

V-260528

Ubuntu 22.04 LTS must be configured so that all network connections associated with SSH traffic are terminated after 10 minutes of becoming unresponsive.

utils.set_ssh_option 'ClientAliveInterval 600'

V-260530

Ubuntu 22.04 LTS SSH daemon must prevent remote hosts from connecting to the proxy display.

utils.set_ssh_option 'X11UseLocalhost yes'

V-260531

Ubuntu 22.04 LTS must configure the SSH daemon to use FIPS�140-3-approved ciphers to prevent the unauthorized disclosure of information and/or detect changes to information during transmission.

utils.set_ssh_option 'Ciphers aes256-ctr,[email protected],aes192-ctr,aes128-ctr,[email protected]'

V-260532

Ubuntu 22.04 LTS must configure the SSH daemon to use Message Authentication Codes (MACs) employing FIPS 140-3-approved cryptographic hashes to prevent the unauthorized disclosure of information and/or detect changes to information during transmission.

utils.set_ssh_option 'MACs hmac-sha2-512,[email protected],hmac-sha2-256,[email protected]'

V-260533

Ubuntu 22.04 LTS SSH server must be configured to use only FIPS-validated key exchange algorithms.

utils.set_ssh_option 'KexAlgorithms ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256'

V-260534

Ubuntu 22.04 LTS must use strong authenticators in establishing nonlocal maintenance and diagnostic sessions.

utils.set_ssh_option 'UsePAM yes'

V-260535

Ubuntu 22.04 LTS must enable the graphical user logon banner to display the Standard Mandatory DOD Notice and Consent Banner before granting local access to the system via a graphical user logon.

# no graphical interface installed

V-260536

Ubuntu 22.04 LTS must display the Standard Mandatory DOD Notice and Consent Banner before granting local access to the system via a graphical user logon.

# no graphical interface installed

V-260537

Ubuntu 22.04 LTS must retain a user's session lock until that user reestablishes access using established identification and authentication procedures.

# no graphical interface installed

V-260538

Ubuntu 22.04 LTS must initiate a graphical session lock after 15 minutes of inactivity.

# no graphical interface installed

V-260540

Ubuntu 22.04 LTS must disable automatic mounting of Universal Serial Bus (USB) mass storage driver.

# storage controller disabled on baseline vm anyway
utils.blacklist_kernel_module usb-storage

V-260541

Ubuntu 22.04 LTS must disable all wireless network adapters.

# no wireless radios in a VM

V-260542

Ubuntu 22.04 LTS must prevent direct login into the root account.

# correctly configured by default
passwd -S root

V-260543

Ubuntu 22.04 LTS must uniquely identify interactive users.

# correctly configured by default
awk -F ":" 'list[$3]++{print $1, $3}' /etc/passwd

V-260544

Ubuntu 22.04 LTS must allow the use of a temporary password for system logons with an immediate change to a permanent password.

# no temp accounts exist by default

V-260545

Ubuntu 22.04 LTS must enforce 24 hours/1 day as the minimum password lifetime. Passwords for new users must have a 24 hours/1 day minimum password lifetime restriction.

utils.set_config_option /etc/login.defs PASS_MIN_DAYS 1

V-260546

Ubuntu 22.04 LTS must enforce a 60-day maximum password lifetime restriction. Passwords for new users must have a 60-day maximum password lifetime restriction.

utils.set_config_option /etc/login.defs PASS_MAX_DAYS 60

V-260547

Ubuntu 22.04 LTS must disable account identifiers (individuals, groups, roles, and devices) after 35 days of inactivity.

useradd -D -f 35

V-260548

Ubuntu 22.04 LTS must automatically expire temporary accounts within 72 hours.

# no temp accounts exist by default

V-260553

Ubuntu 22.04 LTS must allow users to directly initiate a session lock for all connection types.

utils.ensure_package_installed vlock

V-260554

Ubuntu 22.04 LTS must automatically exit interactive command shell user sessions after 15 minutes of inactivity.

utils.add_if_missing /etc/profile.d/tmout.sh  $'#!/bin/bash\ndeclare -xr TMOUT=900'

V-260555

Ubuntu 22.04 LTS default filesystem permissions must be defined in such a way that all authenticated users can read and modify only their own files.

utils.set_config_option /etc/login.defs UMASK 077

V-260556

Ubuntu 22.04 LTS must have the ""apparmor"" package installed.

utils.ensure_package_installed apparmor

V-260557

Ubuntu 22.04 LTS must be configured to use AppArmor.

systemctl -q is-active apparmor || systemctl enable --now apparmor

V-260558

Ubuntu 22.04 LTS must require users to reauthenticate for privilege escalation or when changing roles.

# correctly configured by default
grep -Ei '(nopasswd|!authenticate)' /etc/sudoers /etc/sudoers.d/*

V-260560

Ubuntu 22.04 LTS must enforce password complexity by requiring at least one uppercase character be used.

utils.set_config_option -i -d = /etc/security/pwquality.conf ucredit '-1'

V-260561

Ubuntu 22.04 LTS must enforce password complexity by requiring at least one lowercase character be used.

utils.set_config_option -i -d = /etc/security/pwquality.conf lcredit '-1'

V-260562

Ubuntu 22.04 LTS must enforce password complexity by requiring that at least one numeric character be used.

utils.set_config_option -i -d = /etc/security/pwquality.conf dcredit '-1'

V-260563

Ubuntu 22.04 LTS must enforce password complexity by requiring that at least one special character be used.

utils.set_config_option -i -d = /etc/security/pwquality.conf ocredit '-1'

V-260564

Ubuntu 22.04 LTS must prevent the use of dictionary words for passwords.

utils.set_config_option -i -d = /etc/security/pwquality.conf dictcheck 1

V-260565

Ubuntu 22.04 LTS must enforce a minimum 15-character password length.

utils.set_config_option -i -d = /etc/security/pwquality.conf minlen '15'

V-260566

Ubuntu 22.04 LTS must require the change of at least eight characters when passwords are changed.

utils.set_config_option -i -d = /etc/security/pwquality.conf difok 8

V-260567

Ubuntu 22.04 LTS must be configured so that when passwords are changed or new passwords are established, pwquality must be used.

utils.set_config_option -i -d = /etc/security/pwquality.conf enforcing 1

V-260568

Ubuntu 22.04 LTS must prohibit password reuse for a minimum of five generations.

# Rule not reviewed

V-260569

Ubuntu 22.04 LTS must store only encrypted representations of passwords.

# Rule not reviewed

V-260572

Ubuntu 22.04 LTS must encrypt all stored passwords with a FIPS 140-3-approved cryptographic hashing algorithm.

utils.set_config_option /etc/login.defs ENCRYPT_METHOD SHA512

V-260573

Ubuntu 22.04 LTS must implement multifactor authentication for remote access to privileged accounts in such a way that one of the factors is provided by a device separate from the system gaining access.

utils.ensure_package_installed libpam-pkcs11

V-260574

Ubuntu 22.04 LTS must accept personal identity verification (PIV) credentials.

utils.ensure_package_installed opensc-pkcs11

V-260575

Ubuntu 22.04 LTS must implement smart card logins for multifactor authentication for local and network access to privileged and nonprivileged accounts.

# Rule not reviewed

V-260576

Ubuntu 22.04 LTS must electronically verify personal identity verification (PIV) credentials.

# Rule not reviewed

V-260577

Ubuntu 22.04 LTS, for PKI-based authentication, must validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor.

# Rule not reviewed

V-260578

Ubuntu 22.04 LTS for PKI-based authentication, must implement a local cache of revocation data in case of the inability to access revocation information via the network.

# Rule not reviewed

V-260580

Ubuntu 22.04 LTS must use DOD PKI-established certificate authorities for verification of the establishment of protected sessions.

# configured in baseline
ls -l /etc/ssl/certs/DoD*

V-260582

Ubuntu 22.04 LTS must use a file integrity tool to verify correct operation of all security functions.

utils.ensure_package_installed aide

V-260583

Ubuntu 22.04 LTS must configure AIDE to perform file integrity checking on the file system.

aide -c /etc/aide/aide.conf --check

V-260584

Ubuntu 22.04 LTS must notify designated personnel if baseline configurations are changed in an unauthorized manner. The file integrity tool must notify the system administrator when changes to the baseline configuration or anomalies in the operation of any security functions are discovered.

utils.set_config_option -d = /etc/default/aide SILENTREPORTS no

V-260585

Ubuntu 22.04 LTS must be configured so that the script that runs each 30 days or less to check file integrity is the default.

cat <<'EOF' >/etc/cron.daily/aide
#!/bin/bash
/usr/sbin/aide --check | /bin/mail -s "$HOSTNAME - Daily aide integrity check run" [email protected]
EOF

V-260586

Ubuntu 22.04 LTS must use cryptographic mechanisms to protect the integrity of audit tools.

cat <<'EOF' >>/etc/aide.conf
# STIG V-260586
/usr/sbin/auditctl p+i+n+u+g+s+b+acl+xattrs+sha512
/usr/sbin/auditd p+i+n+u+g+s+b+acl+xattrs+sha512
/usr/sbin/ausearch p+i+n+u+g+s+b+acl+xattrs+sha512
/usr/sbin/aureport p+i+n+u+g+s+b+acl+xattrs+sha512
/usr/sbin/autrace p+i+n+u+g+s+b+acl+xattrs+sha512
/usr/sbin/augenrules p+i+n+u+g+s+b+acl+xattrs+sha512
EOF

V-260588

Ubuntu 22.04 LTS must be configured to preserve log records from failure events.

utils.ensure_package_installed rsyslog

V-260589

Ubuntu 22.04 LTS must monitor remote access methods.

# Rule not reviewed

V-260590

Ubuntu 22.04 LTS must have the ""auditd"" package installed.

utils.ensure_package_installed auditd

V-260591

Ubuntu 22.04 LTS must produce audit records and reports containing information to establish when, where, what type, the source, and the outcome for all DOD-defined auditable events and actions in near real time.

systemctl -q is-active auditd || systemctl enable --now auditd

V-260594

Ubuntu 22.04 LTS must shut down by default upon audit failure.

utils.set_config_option -d = /etc/audit/auditd.conf disk_full_action SYSLOG

V-260597

Ubuntu 22.04 LTS must be configured so that audit log files are not read- or write-accessible by unauthorized users.

# permissions correct in baseline
ls -l /var/log/audit/audit.log

V-260598

Ubuntu 22.04 LTS must be configured to permit only authorized users ownership of the audit log files.

# permissions correct in baseline
ls -l /var/log/audit/audit.log

V-260599

Ubuntu 22.04 LTS must permit only authorized groups ownership of the audit log files.

utils.set_config_option -d = /etc/audit/auditd.conf log_group root

V-260600

Ubuntu 22.04 LTS must be configured so that the audit log directory is not write-accessible by unauthorized users.

# permissions correct by default
ls -ld /var/log/audit

V-260601

Ubuntu 22.04 LTS must be configured so that audit configuration files are not write-accessible by unauthorized users.

# permissions correct by default
ls -l /etc/audit/auditd.conf /etc/audit/rules.d/*.rules

V-260602

Ubuntu 22.04 LTS must permit only authorized accounts to own the audit configuration files.

# permissions correct by default
ls -l /etc/audit/auditd.conf /etc/audit/rules.d/*.rules

V-260603

Ubuntu 22.04 LTS must permit only authorized groups to own the audit configuration files.

# permissions correct by default
ls -l /etc/audit/auditd.conf /etc/audit/rules.d/*.rules

V-260604

Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the apparmor_parser command.

utils.add_audit_rule '-a always,exit -F path=/sbin/apparmor_parser -F perm=x -F auid>=1000 -F auid!=unset -k perm_chng'

V-260605

Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the chacl command.

utils.add_audit_rule '-a always,exit -F path=/usr/bin/chacl -F perm=x -F auid>=1000 -F auid!=unset -k perm_chng'

V-260606

Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the chage command.

utils.add_audit_rule '-a always,exit -F path=/usr/bin/chage -F perm=x -F auid>=1000 -F auid!=unset -k privileged-chage'

V-260607

Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the chcon command.

utils.add_audit_rule '-a always,exit -F path=/usr/bin/chcon -F perm=x -F auid>=1000 -F auid!=unset -k perm_chng'

V-260608

Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the chfn command.

utils.add_audit_rule '-a always,exit -F path=/usr/bin/chfn -F perm=x -F auid>=1000 -F auid!=unset -k privileged-chfn'

V-260609

Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the chsh command.

utils.add_audit_rule '-a always,exit -F path=/usr/bin/chsh -F perm=x -F auid>=1000 -F auid!=unset -k priv_cmd'

V-260610

Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the crontab command.

utils.add_audit_rule '-a always,exit -F path=/usr/bin/crontab -F perm=x -F auid>=1000 -F auid!=unset -k privileged-crontab'

V-260611

Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful attempts to use the fdisk command.

utils.add_audit_rule '-w /usr/sbin/fdisk -p x -k fdisk'

V-260612

Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the gpasswd command.

utils.add_audit_rule '-a always,exit -F path=/usr/bin/gpasswd -F perm=x -F auid>=1000 -F auid!=unset -k privileged-gpasswd'

V-260613

Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful attempts to use the kmod command.

utils.add_audit_rule '-w /bin/kmod -p x -k modules'

V-260614

Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful attempts to use modprobe command.

utils.add_audit_rule '-w /sbin/modprobe -p x -k modules'

V-260615

Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the mount command.

utils.add_audit_rule '-a always,exit -F path=/usr/bin/mount -F perm=x -F auid>=1000 -F auid!=unset -k privileged-mount'

V-260616

Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the newgrp command.

utils.add_audit_rule '-a always,exit -F path=/usr/bin/newgrp -F perm=x -F auid>=1000 -F auid!=unset -k priv_cmd'

V-260617

Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the pam_timestamp_check command.

utils.add_audit_rule '-a always,exit -F path=/usr/sbin/pam_timestamp_check -F perm=x -F auid>=1000 -F auid!=unset -k privileged-pam_timestamp_check'

V-260618

Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the passwd command.

utils.add_audit_rule '-a always,exit -F path=/usr/bin/passwd -F perm=x -F auid>=1000 -F auid!=unset -k privileged-passwd'

V-260619

Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the setfacl command.

utils.add_audit_rule '-a always,exit -F path=/usr/bin/setfacl -F perm=x -F auid>=1000 -F auid!=unset -k perm_chng'

V-260620

Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the ssh-agent command.

utils.add_audit_rule '-a always,exit -F path=/usr/bin/ssh-agent -F perm=x -F auid>=1000 -F auid!=unset -k privileged-ssh'

V-260621

Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the ssh-keysign command.

utils.add_audit_rule '-a always,exit -F path=/usr/lib/openssh/ssh-keysign -F perm=x -F auid>=1000 -F auid!=unset -k privileged-ssh'

V-260622

Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the su command.

utils.add_audit_rule '-a always,exit -F path=/bin/su -F perm=x -F auid>=1000 -F auid!=unset -k privileged-priv_change'

V-260623

Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the sudo command.

utils.add_audit_rule '-a always,exit -F path=/usr/bin/sudo -F perm=x -F auid>=1000 -F auid!=unset -k priv_cmd'

V-260624

Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the sudoedit command.

utils.add_audit_rule '-a always,exit -F path=/usr/bin/sudoedit -F perm=x -F auid>=1000 -F auid!=unset -k priv_cmd'

V-260625

Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the umount command.

utils.add_audit_rule '-a always,exit -F path=/usr/bin/umount -F perm=x -F auid>=1000 -F auid!=unset -k privileged-umount'

V-260626

Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the unix_update command.

utils.add_audit_rule '-a always,exit -F path=/sbin/unix_update -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update'

V-260627

Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the usermod command.

utils.add_audit_rule '-a always,exit -F path=/usr/sbin/usermod -F perm=x -F auid>=1000 -F auid!=unset -k privileged-usermod'

V-260628

Ubuntu 22.04 LTS must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/group.

utils.add_audit_rule '-w /etc/group -p wa -k usergroup_modification'

V-260629

Ubuntu 22.04 LTS must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/gshadow.

utils.add_audit_rule '-w /etc/gshadow -p wa -k usergroup_modification'

V-260630

Ubuntu 22.04 LTS must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/opasswd.

utils.add_audit_rule '-w /etc/security/opasswd -p wa -k usergroup_modification'

V-260631

Ubuntu 22.04 LTS must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/passwd.

utils.add_audit_rule '-w /etc/passwd -p wa -k usergroup_modification'

V-260632

Ubuntu 22.04 LTS must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/shadow.

utils.add_audit_rule '-w /etc/shadow -p wa -k usergroup_modification'

V-260633

Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the chmod, fchmod, and fchmodat system calls.

utils.add_audit_rule '-a always,exit -F arch=b32 -S chmod,fchmod,fchmodat -F auid>=1000 -F auid!=unset -k perm_chng'
utils.add_audit_rule '-a always,exit -F arch=b64 -S chmod,fchmod,fchmodat -F auid>=1000 -F auid!=unset -k perm_chng'

V-260634

Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the chown, fchown, fchownat, and lchown system calls.

utils.add_audit_rule '-a always,exit -F arch=b32 -S chown,fchown,fchownat,lchown -F auid>=1000 -F auid!=unset -k perm_chng'
utils.add_audit_rule '-a always,exit -F arch=b64 -S chown,fchown,fchownat,lchown -F auid>=1000 -F auid!=unset -k perm_chng'

V-260635

Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the creat, open, openat, open_by_handle_at, truncate, and ftruncate system calls.

utils.add_audit_rule '-a always,exit -F arch=b32 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -k perm_access'
utils.add_audit_rule '-a always,exit -F arch=b32 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -k perm_access'
utils.add_audit_rule '-a always,exit -F arch=b64 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -k perm_access'
utils.add_audit_rule '-a always,exit -F arch=b64 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -k perm_access'

V-260636

Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the delete_module system call.

utils.add_audit_rule '-a always,exit -F arch=b32 -S delete_module -F auid>=1000 -F auid!=unset -k module_chng'
utils.add_audit_rule '-a always,exit -F arch=b64 -S delete_module -F auid>=1000 -F auid!=unset -k module_chng'

V-260637

Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the init_module and finit_module system calls.

utils.add_audit_rule '-a always,exit -F arch=b32 -S init_module,finit_module -F auid>=1000 -F auid!=unset -k module_chng'
utils.add_audit_rule '-a always,exit -F arch=b64 -S init_module,finit_module -F auid>=1000 -F auid!=unset -k module_chng'

V-260638

Ubuntu 22.04 LTS must generate audit records for any use of the setxattr, fsetxattr, lsetxattr, removexattr, fremovexattr, and lremovexattr system calls.

utils.add_audit_rule '-a always,exit -F arch=b32 -S setxattr,fsetxattr,lsetxattr,removexattr,fremovexattr,lremovexattr -F auid>=1000 -F auid!=unset -k perm_mod'
utils.add_audit_rule '-a always,exit -F arch=b32 -S setxattr,fsetxattr,lsetxattr,removexattr,fremovexattr,lremovexattr -F auid=0 -k perm_mod'
utils.add_audit_rule '-a always,exit -F arch=b64 -S setxattr,fsetxattr,lsetxattr,removexattr,fremovexattr,lremovexattr -F auid>=1000 -F auid!=unset -k perm_mod'
utils.add_audit_rule '-a always,exit -F arch=b64 -S setxattr,fsetxattr,lsetxattr,removexattr,fremovexattr,lremovexattr -F auid=0 -k perm_mod'

V-260639

Ubuntu 22.04 LTS must generate audit records for any successful/unsuccessful use of unlink, unlinkat, rename, renameat, and rmdir system calls.

utils.add_audit_rule '-a always,exit -F arch=b64 -S unlink,unlinkat,rename,renameat,rmdir -F auid>=1000 -F auid!=unset -k delete'
utils.add_audit_rule '-a always,exit -F arch=b32 -S unlink,unlinkat,rename,renameat,rmdir -F auid>=1000 -F auid!=unset -k delete'

V-260640

Ubuntu 22.04 LTS must generate audit records for all events that affect the systemd journal files.

utils.add_audit_rule '-w /var/log/journal -p wa -k systemd_journal'

V-260641

Ubuntu 22.04 LTS must generate audit records for the /var/log/btmp file.

utils.add_audit_rule '-w /var/log/btmp -p wa -k logins'

V-260642

Ubuntu 22.04 LTS must generate audit records for the /var/log/wtmp file.

utils.add_audit_rule '-w /var/log/wtmp -p wa -k logins'

V-260643

Ubuntu 22.04 LTS must generate audit records for the /var/run/utmp file.

utils.add_audit_rule '-w /var/run/utmp -p wa -k logins'

V-260644

Ubuntu 22.04 LTS must generate audit records for the use and modification of faillog file.

utils.add_audit_rule '-w /var/log/faillog -p wa -k logins'

V-260645

Ubuntu 22.04 LTS must generate audit records for the use and modification of the lastlog file.

utils.add_audit_rule '-w /var/log/lastlog -p wa -k logins'

V-260646

Ubuntu 22.04 LTS must generate audit records when successful/unsuccessful attempts to modify the /etc/sudoers file occur.

utils.add_audit_rule '-w /etc/sudoers -p wa -k privilege_modification'

V-260647

Ubuntu 22.04 LTS must generate audit records when successful/unsuccessful attempts to modify the /etc/sudoers.d directory occur.

utils.add_audit_rule '-w /etc/sudoers.d -p wa -k privilege_modification'

V-260648

Ubuntu 22.04 LTS must prevent all software from executing at higher privilege levels than users executing the software and the audit system must be configured to audit the execution of privileged functions.

utils.add_audit_rule '-a always,exit -F arch=b64 -S execve -C uid!=euid -F euid=0 -k execpriv'
utils.add_audit_rule '-a always,exit -F arch=b64 -S execve -C gid!=egid -F egid=0 -k execpriv'
utils.add_audit_rule '-a always,exit -F arch=b32 -S execve -C uid!=euid -F euid=0 -k execpriv'
utils.add_audit_rule '-a always,exit -F arch=b32 -S execve -C gid!=egid -F egid=0 -k execpriv'

V-260649

Ubuntu 22.04 LTS must generate audit records for privileged activities, nonlocal maintenance, diagnostic sessions and other system-level access.

utils.add_audit_rule '-w /var/log/sudo.log -p wa -k maintenance'

CAT III Checks

V-260472

Ubuntu 22.04 LTS must restrict access to the kernel message buffer.

utils.set_sysctl_option kernel.dmesg_restrict 1

V-260476

Ubuntu 22.04 LTS must be configured so that the Advance Package Tool (APT) prevents the installation of patches, service packs, device drivers, or operating system components without verification they have been digitally signed using a certificate that is recognized and approved by the organization.

utils.add_if_missing /etc/apt/apt.conf.d/99stig 'APT::Get::AllowUnauthenticated "false";'

V-260479

Ubuntu 22.04 LTS must have the ""chrony"" package installed.

utils.ensure_package_installed chrony

V-260480

Ubuntu 22.04 LTS must not have the ""systemd-timesyncd"" package installed.

utils.ensure_package_removed systemd-timesyncd

V-260481

Ubuntu 22.04 LTS must not have the ""ntp"" package installed.

utils.ensure_package_removed ntp

V-260519

Ubuntu 22.04 LTS must, for networked systems, compare internal information system clocks at least every 24 hours with a server synchronized to one of the redundant United States Naval Observatory (USNO) time servers, or a time server designated for the appropriate DOD network (NIPRNet/SIPRNet), and/or the Global Positioning System (GPS).

# Point to domain controllers
sed -i '/^server/d' /etc/chrony/chrony.conf
utils.add_if_missing /etc/chrony/chrony.conf 'server time.home.cpt.local iburst maxpoll 16'
utils.add_if_missing /etc/chrony/chrony.conf 'server time.kitX.cpt.local iburst maxpoll 16'

V-260520

Ubuntu 22.04 LTS must synchronize internal information system clocks to the authoritative time source when the time difference is greater than one second.

# configured by default
grep makestep /etc/chrony/chrony.conf

V-260521

Ubuntu 22.04 LTS must record time stamps for audit records that can be mapped to Coordinated Universal Time (UTC).

# configured by default
timedatectl status

V-260549

Ubuntu 22.04 LTS must automatically lock an account until the locked account is released by an administrator when three unsuccessful logon attempts have been made.

utils.set_config_option -i -d = /etc/security/faillock.conf dir /var/log/faillock
utils.set_config_option -i /etc/security/faillock.conf audit ''
utils.set_config_option -i -d = /etc/security/faillock.conf deny 3
utils.set_config_option -i -d = /etc/security/faillock.conf fail_interval 900
utils.set_config_option -i -d = /etc/security/faillock.conf unlock_time 0
utils.set_config_option -i /etc/security/faillock.conf even_deny_root ''

V-260550

Ubuntu 22.04 LTS must enforce a delay of at least four seconds between logon prompts following a failed logon attempt.

# Rule not reviewed

V-260551

Ubuntu 22.04 LTS must display the date and time of the last successful account logon upon logon.

# Rule not reviewed

V-260552

Ubuntu 22.04 LTS must limit the number of concurrent sessions to ten for all accounts and/or account types.

utils.add_if_missing /etc/security/limits.d/stig.conf '* hard maxlogins 10'

V-260581

Ubuntu 22.04 LTS must be configured such that Pluggable Authentication Module (PAM) prohibits the use of cached authentications after one day.

# Rule not reviewed

V-260587

Ubuntu 22.04 LTS must have a crontab script running weekly to offload audit events of standalone systems.

# Rule not reviewed

V-260592

Ubuntu 22.04 LTS audit event multiplexor must be configured to offload audit logs onto a different system from the system being audited.

utils.ensure_package_installed audispd-plugins

V-260593

Ubuntu 22.04 LTS must alert the information system security officer (ISSO) and system administrator (SA) in the event of an audit processing failure.

utils.set_config_option -d = /etc/audit/auditd.conf action_mail_acct root

V-260595

Ubuntu 22.04 LTS must allocate audit record storage capacity to store at least one weeks' worth of audit records, when audit records are not immediately sent to a central audit record storage facility.

df -h /var/log/audit

V-260596

Ubuntu 22.04 LTS must immediately notify the system administrator (SA) and information system security officer (ISSO) when the audit record storage volume reaches 25 percent remaining of the allocated capacity.

utils.set_config_option -d = /etc/audit/auditd.conf space_left '25%'
utils.set_config_option -d = /etc/audit/auditd.conf space_left_action email