View SCAP - Oracle Linux 9 STIG SCAP Benchmark V1R0

c

OL 9 must be a vendor supported release.

RMF Control: SI-2
Severity: High
CCI: CCI-002605
Version: OL09-00-000010
Vuln IDs: V-271438
Rule IDs: SV-271438r1091026_rule

An operating system release is considered "supported" if the vendor continues to provide security patches for the product. With an unsupported release, it will not be possible to resolve security issues discovered in the system software. Oracle offers Oracle Linux Premier Support, for a fee, for those customers who wish to standardize on a specific minor release for an extended period.

Fix: F-75395r1091025_fix

Upgrade OL 9 to a supported version.

c

OL 9 must use a Linux Security Module configured to enforce limits on system services.

RMF Control: SI-6
Severity: High
CCI: CCI-002696
Version: OL09-00-000060
Vuln IDs: V-271452
Rule IDs: SV-271452r1091068_rule

Without verification of the security functions, security functions may not operate correctly and the failure may go unnoticed. Security function is defined as the hardware, software, and/or firmware of the information system responsible for enforcing the system security policy and supporting the isolation of code and data on which the protection is based. Security functionality includes, but is not limited to, establishing system accounts, configuring access authorizations (i.e., permissions, privileges), setting events to be audited, and setting intrusion detection parameters. This requirement applies to operating systems performing security function verification/testing and/or systems and environments that require this functionality. Satisfies: SRG-OS-000445-GPOS-00199, SRG-OS-000134-GPOS-00068

Fix: F-75409r1091067_fix

Configure OL 9 to verify correct operation of security functions. Edit the file "/etc/selinux/config" and add or modify the following line: SELINUX=enforcing A reboot is required for the changes to take effect.

c

OL 9 must enable FIPS mode.

RMF Control: AC-17
Severity: High
CCI: CCI-000068
Version: OL09-00-000070
Vuln IDs: V-271454
Rule IDs: SV-271454r1092458_rule

Use of weak or untested encryption algorithms undermines the purposes of using encryption to protect data. The operating system must implement cryptographic modules adhering to the higher standards approved by the federal government since this provides assurance they have been tested and validated. This includes NIST FIPS-validated cryptography for the following: Provisioning digital signatures, generating cryptographic hashes, and to protect data requiring data-at-rest protections in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards. Satisfies: SRG-OS-000033-GPOS-00014, SRG-OS-000125-GPOS-00065, SRG-OS-000396-GPOS-00176, SRG-OS-000423-GPOS-00187, SRG-OS-000478-GPOS-00223

Fix: F-75411r1092458_fix

Configure OL 9 to implement FIPS mode with the following command: $ sudo fips-mode-setup --enable Reboot the system for the changes to take effect.

c

OL 9 must not have a File Transfer Protocol (FTP) server package installed.

RMF Control: IA-5
Severity: High
CCI: CCI-000197
Version: OL09-00-000130
Vuln IDs: V-271462
Rule IDs: SV-271462r1091098_rule

The FTP service provides an unencrypted remote access that does not provide for the confidentiality and integrity of user passwords or the remote session. If a privileged user were to log on using this service, the privileged user password could be compromised. SSH or other encrypted file transfer methods must be used in place of this service. Removing the "vsftpd" package decreases the risk of accidental activation. Satisfies: SRG-OS-000074-GPOS-00042, SRG-OS-000095-GPOS-00049

Fix: F-75419r1091097_fix

Remove the ftp package can be removed with the following command (using vsftpd as an example): $ sudo dnf remove vsftpd

c

OL 9 must not have a Trivial File Transfer Protocol (TFTP) server package installed.

RMF Control: CM-6
Severity: High
CCI: CCI-000366
Version: OL09-00-000135
Vuln IDs: V-271463
Rule IDs: SV-271463r1091101_rule

Removing the "tftp-server" package decreases the risk of the accidental (or intentional) activation of tftp services. If TFTP is required for operational support (such as transmission of router configurations), its use must be documented with the information systems security manager (ISSM), restricted to only authorized personnel, and have access control rules established.

Fix: F-75420r1091100_fix

Remove the tftp package can be removed with the following command: $ sudo dnf remove tftp

c

OL 9 must check the GPG signature of locally installed software packages before installation.

RMF Control
Severity: High
CCI: CCI-003992
Version: OL09-00-000496
Vuln IDs: V-271523
Rule IDs: SV-271523r1091281_rule

Changes to any software components can have significant effects on the overall security of the operating system. This requirement ensures the software has not been tampered with and that it has been provided by a trusted vendor. All software packages must be signed with a cryptographic key recognized and approved by the organization. Verifying the authenticity of software prior to installation validates the integrity of the software package received from a vendor. This verifies the software has not been tampered with and that it has been provided by a trusted vendor.

Fix: F-75480r1091280_fix

Configure dnf to always check the GPG signature of local software packages before installation. Add or update the following line in the [main] section of the /etc/dnf/dnf.conf file: localpkg_gpgcheck=1

c

OL 9 must check the GPG signature of software packages originating from external software repositories before installation.

RMF Control
Severity: High
CCI: CCI-003992
Version: OL09-00-000497
Vuln IDs: V-271524
Rule IDs: SV-271524r1091284_rule

Changes to any software components can have significant effects on the overall security of the operating system. This requirement ensures the software has not been tampered with and that it has been provided by a trusted vendor. All software packages must be signed with a cryptographic key recognized and approved by the organization. Verifying the authenticity of software prior to installation validates the integrity of the software package received from a vendor. This verifies the software has not been tampered with and that it has been provided by a trusted vendor.

Fix: F-75481r1091283_fix

Configure dnf to always check the GPG signature of software packages originating from external software repositories before installation. Add or update the following line in the [main] section of the /etc/dnf/dnf.conf file: gpgcheck=1

c

OL 9 must have GPG signature verification enabled for all software repositories.

RMF Control
Severity: High
CCI: CCI-003992
Version: OL09-00-000498
Vuln IDs: V-271525
Rule IDs: SV-271525r1091287_rule

Changes to any software components can have significant effects on the overall security of the operating system. This requirement ensures the software has not been tampered with and that it has been provided by a trusted vendor. All software packages must be signed with a cryptographic key recognized and approved by the organization. Verifying the authenticity of software prior to installation validates the integrity of the software package received from a vendor. This verifies the software has not been tampered with and that it has been provided by a trusted vendor.

Fix: F-75482r1091286_fix

Configure all software repositories defined in "/etc/yum.repos.d/" to have "gpgcheck" enabled: $ sudo sed -i 's/gpgcheck\s*=.*/gpgcheck=1/g' /etc/yum.repos.d/*

b

OL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/sudoers.

RMF Control: AC-2
Severity: Medium
CCI: CCI-000018
Version: OL09-00-000500
Vuln IDs: V-271527
Rule IDs: SV-271527r1092474_rule

The actions taken by system administrators must be audited to keep a record of what was executed on the system, as well as for accountability purposes. Editing the sudoers file may be sign of an attacker trying to establish persistent methods to a system, auditing the editing of the sudoers files mitigates this risk. Satisfies: SRG-OS-000004-GPOS-00004, SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000304-GPOS-00121, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000470-GPOS-00214, SRG-OS-000471-GPOS-00215, SRG-OS-000239-GPOS-00089, SRG-OS-000240-GPOS-00090, SRG-OS-000241-GPOS-00091, SRG-OS-000303-GPOS-00120, SRG-OS-000466-GPOS-00210, SRG-OS-000476-GPOS-00221

Fix: F-75484r1092473_fix

Configure OL 9 to generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/sudoers". Add or update the following file system rule to "/etc/audit/rules.d/audit.rules": -w /etc/sudoers -p wa -k identity The audit daemon must be restarted for the changes to take effect. Restart auditd: $ sudo service auditd restart

b

OL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/opasswd.

RMF Control: AC-2
Severity: Medium
CCI: CCI-000018
Version: OL09-00-000520
Vuln IDs: V-271531
Rule IDs: SV-271531r1092482_rule

In addition to auditing new user and group accounts, these watches will alert the system administrator(s) to any modifications. Any unexpected users, groups, or modifications should be investigated for legitimacy. Satisfies: SRG-OS-000004-GPOS-00004, SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000304-GPOS-00121, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000470-GPOS-00214, SRG-OS-000471-GPOS-00215, SRG-OS-000239-GPOS-00089, SRG-OS-000240-GPOS-00090, SRG-OS-000241-GPOS-00091, SRG-OS-000303-GPOS-00120, SRG-OS-000466-GPOS-00210, SRG-OS-000476-GPOS-00221

Fix: F-75488r1092481_fix

Configure OL 9 to generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/security/opasswd". Add or update the following file system rule to "/etc/audit/rules.d/audit.rules": -w /etc/security/opasswd -p wa -k identity The audit daemon must be restarted for the changes to take effect. Restart auditd: $ sudo service auditd restart

b

OL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/passwd.

RMF Control: AC-2
Severity: Medium
CCI: CCI-000018
Version: OL09-00-000525
Vuln IDs: V-271532
Rule IDs: SV-271532r1092484_rule

In addition to auditing new user and group accounts, these watches will alert the system administrator(s) to any modifications. Any unexpected users, groups, or modifications should be investigated for legitimacy. Satisfies: SRG-OS-000004-GPOS-00004, SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000304-GPOS-00121, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000470-GPOS-00214, SRG-OS-000471-GPOS-00215, SRG-OS-000239-GPOS-00089, SRG-OS-000240-GPOS-00090, SRG-OS-000241-GPOS-00091, SRG-OS-000303-GPOS-00120, SRG-OS-000466-GPOS-00210, SRG-OS-000476-GPOS-00221, SRG-OS-000274-GPOS-00104, SRG-OS-000275-GPOS-00105, SRG-OS-000276-GPOS-00106, SRG-OS-000277-GPOS-00107

Fix: F-75489r1092483_fix

Configure OL 9 to generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/passwd". Add or update the following file system rule to "/etc/audit/rules.d/audit.rules": -w /etc/passwd -p wa -k identity The audit daemon must be restarted for the changes to take effect. Restart auditd: $ sudo service auditd restart

b

OL 9 audit log directory must be owned by root to prevent unauthorized read access.

RMF Control: AU-9
Severity: Medium
CCI: CCI-000162
Version: OL09-00-000790
Vuln IDs: V-271584
Rule IDs: SV-271584r1091464_rule

Unauthorized disclosure of audit records can reveal system and configuration data to attackers, thus compromising its confidentiality. Satisfies: SRG-OS-000057-GPOS-00027, SRG-OS-000058-GPOS-00028, SRG-OS-000059-GPOS-00029, SRG-OS-000206-GPOS-00084

Fix: F-75541r1091463_fix

Configure OL 9 to protect the audit log from unauthorized read access by setting the correct owner as "root" with the following command: $ sudo chown root /var/log/audit

b

OL 9 must ensure the password complexity module is enabled in the password-auth file.

RMF Control
Severity: Medium
CCI: CCI-004066
Version: OL09-00-001010
Vuln IDs: V-271614
Rule IDs: SV-271614r1091554_rule

Enabling PAM password complexity permits enforcement of strong passwords and consequently makes the system less prone to dictionary attacks. Satisfies: SRG-OS-000069-GPOS-00037, SRG-OS-000070-GPOS-00038

Fix: F-75571r1091553_fix

Configure OL 9 to use "pwquality" to enforce password complexity rules. Add the following line to the "/etc/pam.d/password-auth" file (or modify the line to have the required value): password required pam_pwquality.so

b

OL 9 must enforce password complexity by requiring that at least one lowercase character be used.

RMF Control
Severity: Medium
CCI: CCI-004066
Version: OL09-00-001015
Vuln IDs: V-271615
Rule IDs: SV-271615r1091557_rule

Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised. Requiring a minimum number of lowercase characters makes password guessing attacks more difficult by ensuring a larger search space.

Fix: F-75572r1091556_fix

Configure OL 9 to enforce password complexity by requiring at least one lowercase character is used by setting the "lcredit" option. Add the following line to "/etc/security/pwquality.conf" (or modify the line to have the required value): lcredit = -1

b

OL 9 must enforce password complexity by requiring that at least one numeric character be used.

RMF Control
Severity: Medium
CCI: CCI-004066
Version: OL09-00-001020
Vuln IDs: V-271616
Rule IDs: SV-271616r1091560_rule

Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised. Requiring digits makes password guessing attacks more difficult by ensuring a larger search space.

Fix: F-75573r1091559_fix

Configure OL 9 to enforce password complexity by requiring at least one numeric character is used by setting the "dcredit" option. Add the following line to "/etc/security/pwquality.conf" (or modify the line to have the required value): dcredit = -1

b

OL 9 must require the change of at least eight characters when passwords are changed.

RMF Control
Severity: Medium
CCI: CCI-004066
Version: OL09-00-001025
Vuln IDs: V-271617
Rule IDs: SV-271617r1091563_rule

Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised. Requiring a minimum number of different characters during password changes ensures that newly changed passwords will not resemble previously compromised ones. Note that passwords changed on compromised systems will still be compromised.

Fix: F-75574r1091562_fix

Configure OL 9 to require the change of at least eight of the total number of characters when passwords are changed by setting the "difok" option. Add the following line to "/etc/security/pwquality.conf" (or modify the line to have the required value): difok = 8

b

OL 9 must require the maximum number of repeating characters of the same character class be limited to four when passwords are changed.

RMF Control
Severity: Medium
CCI: CCI-004066
Version: OL09-00-001030
Vuln IDs: V-271618
Rule IDs: SV-271618r1091566_rule

Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password complexity is one factor of several that determines how long it takes to crack a password. The more complex a password, the greater the number of possible combinations that need to be tested before the password is compromised.

Fix: F-75575r1091565_fix

Configure OL 9 to require the change of the number of repeating characters of the same character class when passwords are changed by setting the "maxclassrepeat" option. Add the following line to "/etc/security/pwquality.conf" conf (or modify the line to have the required value): maxclassrepeat = 4

b

OL 9 must require the maximum number of repeating characters be limited to three when passwords are changed.

RMF Control
Severity: Medium
CCI: CCI-004066
Version: OL09-00-001035
Vuln IDs: V-271619
Rule IDs: SV-271619r1091569_rule

Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password complexity is one factor of several that determines how long it takes to crack a password. The more complex a password, the greater the number of possible combinations that need to be tested before the password is compromised.

Fix: F-75576r1091568_fix

Configure OL 9 to require the change of the number of repeating consecutive characters when passwords are changed by setting the "maxrepeat" option. Add the following line to "/etc/security/pwquality.conf" (or modify the line to have the required value): maxrepeat = 3

b

OL 9 must require the change of at least four character classes when passwords are changed.

RMF Control
Severity: Medium
CCI: CCI-004066
Version: OL09-00-001040
Vuln IDs: V-271620
Rule IDs: SV-271620r1091572_rule

Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password complexity is one factor of several that determines how long it takes to crack a password. The more complex a password, the greater the number of possible combinations that need to be tested before the password is compromised.

Fix: F-75577r1091571_fix

Configure OL 9 to require the change of at least four character classes when passwords are changed by setting the "minclass" option. Add the following line to "/etc/security/pwquality.conf" (or modify the line to have the required value): minclass = 4

b

OL 9 must enforce password complexity rules for the root account.

RMF Control
Severity: Medium
CCI: CCI-004066
Version: OL09-00-001045
Vuln IDs: V-271621
Rule IDs: SV-271621r1091575_rule

Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised. Satisfies: SRG-OS-000072-GPOS-00040, SRG-OS-000071-GPOS-00039, SRG-OS-000070-GPOS-00038, SRG-OS-000266-GPOS-00101, SRG-OS-000078-GPOS-00046, SRG-OS-000480-GPOS-00225, SRG-OS-000069-GPOS-00037

Fix: F-75578r1091574_fix

Configure OL 9 to enforce password complexity on the root account. Add or update the following line in /etc/security/pwquality.conf: enforce_for_root

b

OL 9 must be configured so that user and group account administration utilities are configured to store only encrypted representations of passwords.

RMF Control
Severity: Medium
CCI: CCI-004062
Version: OL09-00-001050
Vuln IDs: V-271622
Rule IDs: SV-271622r1091578_rule

Passwords need to be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. Passwords that are encrypted with a weak algorithm are no more protected than if they are kept in plain text. This setting ensures user and group account administration utilities are configured to store only encrypted representations of passwords. Additionally, the "crypt_style" configuration option ensures the use of a strong hashing algorithm that makes password cracking attacks more difficult.

Fix: F-75579r1091577_fix

Configure OL 9 to use the SHA-512 algorithm for password hashing. Add or change the following line in the "[default]" section of "/etc/libuser.conf" file: crypt_style = sha512

b

OL 9 must be configured to use the shadow file to store only encrypted representations of passwords.

RMF Control
Severity: Medium
CCI: CCI-004062
Version: OL09-00-001055
Vuln IDs: V-271623
Rule IDs: SV-271623r1091581_rule

Passwords need to be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. Passwords that are encrypted with a weak algorithm are no more protected than if they are kept in plain text. This setting ensures user and group account administration utilities are configured to store only encrypted representations of passwords. Additionally, the "crypt_style" configuration option ensures the use of a strong hashing algorithm that makes password cracking attacks more difficult.

Fix: F-75580r1091580_fix

Configure OL 9 to store only SHA-512 encrypted representations of passwords. Add or update the following line in the "/etc/login.defs" file: ENCRYPT_METHOD SHA512

b

OL 9 pam_unix.so module must be configured in the password-auth file to use a FIPS 140-3 approved cryptographic hashing algorithm for system authentication.

RMF Control
Severity: Medium
CCI: CCI-004062
Version: OL09-00-001060
Vuln IDs: V-271624
Rule IDs: SV-271624r1091584_rule

Unapproved mechanisms that are used for authentication to the cryptographic module are not verified and therefore, cannot be relied upon to provide confidentiality or integrity, and DOD data may be compromised. OL 9 systems using encryption are required to use FIPS-compliant mechanisms for authenticating to cryptographic modules. FIPS 140-3 is the current standard for validating that mechanisms used to access cryptographic modules use authentication that meets DOD requirements. This allows for Security Levels 1, 2, 3, or 4 for use on a general-purpose computing system.

Fix: F-75581r1091583_fix

Configure OL 9 to use a FIPS 140-3 approved cryptographic hashing algorithm for system authentication. Edit/modify the following line in the "/etc/pam.d/password-auth" file to include the sha512 option for pam_unix.so: password sufficient pam_unix.so sha512

b

OL 9 password-auth must be configured to use a sufficient number of hashing rounds.

RMF Control
Severity: Medium
CCI: CCI-004062
Version: OL09-00-001065
Vuln IDs: V-271625
Rule IDs: SV-271625r1091587_rule

Passwords need to be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. Passwords that are encrypted with a weak algorithm are no more protected than if they are kept in plain text. Using more hashing rounds makes password cracking attacks more difficult. Satisfies: SRG-OS-000073-GPOS-00041, SRG-OS-000120-GPOS-00061

Fix: F-75582r1091586_fix

Configure Oracle Linux 9 to use 100000 hashing rounds for hashing passwords. Add or modify the following line in "/etc/pam.d/password-auth" and set "rounds" to "100000". password sufficient pam_unix.so sha512 rounds=100000

b

OL 9 system-auth must be configured to use a sufficient number of hashing rounds.

RMF Control
Severity: Medium
CCI: CCI-004062
Version: OL09-00-001070
Vuln IDs: V-271626
Rule IDs: SV-271626r1091590_rule

Passwords need to be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. Passwords that are encrypted with a weak algorithm are no more protected than if they are kept in plain text. Using more hashing rounds makes password cracking attacks more difficult. Satisfies: SRG-OS-000073-GPOS-00041, SRG-OS-000120-GPOS-00061

Fix: F-75583r1091589_fix

Configure Oracle Linux 9 to use 100000 hashing rounds for hashing passwords. Add or modify the following line in "/etc/pam.d/system-auth" and set "rounds" to 100000. password sufficient pam_unix.so sha512 rounds=100000'

b

OL 9 shadow password suite must be configured to use a sufficient number of hashing rounds.

RMF Control
Severity: Medium
CCI: CCI-004062
Version: OL09-00-001075
Vuln IDs: V-271627
Rule IDs: SV-271627r1091593_rule

Passwords need to be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. Passwords that are encrypted with a weak algorithm are no more protected than if they are kept in plain text. Using more hashing rounds makes password cracking attacks more difficult. Satisfies: SRG-OS-000073-GPOS-00041, SRG-OS-000120-GPOS-00061

Fix: F-75584r1091592_fix

Configure OL 9 to encrypt all stored passwords with a strong cryptographic hash. Edit/modify the following line in the "/etc/login.defs" file and set "SHA_CRYPT_MIN_ROUNDS" to a value no lower than "100000": SHA_CRYPT_MIN_ROUNDS 100000 SHA_CRYPT_MAX_ROUNDS 100000

b

OL 9 must employ FIPS 140-3 approved cryptographic hashing algorithms for all stored passwords.

RMF Control
Severity: Medium
CCI: CCI-004062
Version: OL09-00-001080
Vuln IDs: V-271628
Rule IDs: SV-271628r1091596_rule

The system must use a strong hashing algorithm to store the password. Passwords need to be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. Satisfies: SRG-OS-000073-GPOS-00041, SRG-OS-000120-GPOS-00061

Fix: F-75585r1091595_fix

Lock all interactive user accounts not using SHA-512 hashing until the passwords can be regenerated with SHA-512. To lock an account: $ sudo passwd -l [username]

b

OL 9 passwords for new users or password changes must have a 24-hour minimum password lifetime restriction in /etc/login.defs.

RMF Control
Severity: Medium
CCI: CCI-004066
Version: OL09-00-001085
Vuln IDs: V-271629
Rule IDs: SV-271629r1091599_rule

Enforcing a minimum password lifetime helps to prevent repeated password changes to defeat the password reuse or history enforcement requirement. If users are allowed to immediately and continually change their password, then the password could be repeatedly changed in a short period of time to defeat the organization's policy regarding password reuse. Setting the minimum password age protects against users cycling back to a favorite password after satisfying the password reuse requirement.

Fix: F-75586r1091598_fix

Configure OL 9 to enforce 24 hours as the minimum password lifetime. Add the following line in "/etc/login.defs" (or modify the line to have the required value): PASS_MIN_DAYS 1

b

OL 9 passwords must have a 24-hour minimum password lifetime restriction in /etc/shadow.

RMF Control
Severity: Medium
CCI: CCI-004066
Version: OL09-00-001090
Vuln IDs: V-271630
Rule IDs: SV-271630r1091602_rule

Enforcing a minimum password lifetime helps to prevent repeated password changes to defeat the password reuse or history enforcement requirement. If users are allowed to immediately and continually change their password, the password could be repeatedly changed in a short period of time to defeat the organization's policy regarding password reuse.

Fix: F-75587r1091601_fix

Configure noncompliant accounts to enforce a 24-hour minimum password lifetime: $ sudo passwd -n 1 [user]

b

OL 9 user account passwords for new users or password changes must have a 60-day maximum password lifetime restriction in /etc/login.defs.

RMF Control
Severity: Medium
CCI: CCI-004066
Version: OL09-00-001095
Vuln IDs: V-271631
Rule IDs: SV-271631r1091605_rule

Any password, no matter how complex, can eventually be cracked; therefore, passwords need to be changed periodically. If the operating system does not limit the lifetime of passwords and force users to change their passwords, there is the risk that the operating system passwords could be compromised. Setting the password maximum age ensures users are required to periodically change their passwords. Requiring shorter password lifetimes increases the risk of users writing down the password in a convenient location subject to physical compromise.

Fix: F-75588r1091604_fix

Configure OL 9 to enforce a 60-day maximum password lifetime. Add or modify the following line in the "/etc/login.defs" file: PASS_MAX_DAYS 60

b

OL 9 user account passwords must have a 60-day maximum password lifetime restriction.

RMF Control
Severity: Medium
CCI: CCI-004066
Version: OL09-00-001100
Vuln IDs: V-271632
Rule IDs: SV-271632r1091608_rule

Any password, no matter how complex, can eventually be cracked; therefore, passwords need to be changed periodically. If OL 9 does not limit the lifetime of passwords and force users to change their passwords, there is the risk that OL 9 passwords could be compromised.

Fix: F-75589r1091607_fix

Configure noncompliant accounts to enforce a 60-day maximum password lifetime restriction. passwd -x 60 [user]

b

OL 9 passwords must be created with a minimum of 15 characters.

RMF Control
Severity: Medium
CCI: CCI-004066
Version: OL09-00-001105
Vuln IDs: V-271633
Rule IDs: SV-271633r1091611_rule

The shorter the password, the lower the number of possible combinations that need to be tested before the password is compromised. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password length is one factor of several that helps to determine strength and how long it takes to crack a password. Use of more characters in a password helps to increase exponentially the time and/or resources required to compromise the password. OL 9 uses "pwquality" as a mechanism to enforce password complexity. Configurations are set in the "etc/security/pwquality.conf" file. The "minlen", sometimes noted as minimum length, acts as a "score" of complexity based on the credit components of the "pwquality" module. By setting the credit components to a negative value, not only will those components be required, but they will not count toward the total "score" of "minlen". This will enable "minlen" to require a 15-character minimum. The DOD minimum password requirement is 15 characters.

Fix: F-75590r1091610_fix

Configure OL 9 to enforce a minimum 15-character password length. Add the following line to "/etc/security/pwquality.conf" (or modify the line to have the required value): minlen = 15

c

OL 9 must not allow blank or null passwords.

RMF Control: CM-6
Severity: High
CCI: CCI-000366
Version: OL09-00-001110
Vuln IDs: V-271634
Rule IDs: SV-271634r1091614_rule

If an account has an empty password, anyone could log in and run commands with the privileges of that account. Accounts with empty passwords should never be used in operational environments.

Fix: F-75591r1091613_fix

Remove any instances of the "nullok" option in the "/etc/pam.d/password-auth" and "/etc/pam.d/system-auth" files to prevent logons with empty passwords. Note: Manual changes to the listed file may be overwritten by the "authselect" program.

b

OL 9 must require a boot loader superuser password.

RMF Control: AC-3
Severity: Medium
CCI: CCI-000213
Version: OL09-00-001115
Vuln IDs: V-271635
Rule IDs: SV-271635r1091617_rule

To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DOD-approved PKIs, all DOD systems (e.g., web servers and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement. Password protection on the boot loader configuration ensures users with physical access cannot trivially alter important bootloader settings. These include which kernel to use, and whether to enter single-user mode.

Fix: F-75592r1091616_fix

Configure OL 9 to require a grub bootloader password for the grub superuser account. Generate an encrypted grub2 password for the grub superuser account with the following command: $ sudo grub2-setpassword Enter password: Confirm password:

b

OL 9 must enforce password complexity by requiring that at least one special character be used.

RMF Control
Severity: Medium
CCI: CCI-004066
Version: OL09-00-001120
Vuln IDs: V-271636
Rule IDs: SV-271636r1091620_rule

Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised. OL 9 uses "pwquality" as a mechanism to enforce password complexity. Note that to require special characters without degrading the "minlen" value, the credit value must be expressed as a negative number in "/etc/security/pwquality.conf".

Fix: F-75593r1091619_fix

Configure OL 9 to enforce password complexity by requiring at least one special character be used by setting the "ocredit" option. Add the following line to "/etc/security/pwquality.conf" (or modify the line to have the required value): ocredit = -1

b

OL 9 must prevent the use of dictionary words for passwords.

RMF Control: CM-6
Severity: Medium
CCI: CCI-000366
Version: OL09-00-001125
Vuln IDs: V-271637
Rule IDs: SV-271637r1091623_rule

Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. If OL 9 allows the user to select passwords based on dictionary words, this increases the chances of password compromise by increasing the opportunity for successful guesses, and brute-force attacks.

Fix: F-75594r1091622_fix

Configure OL 9 to prevent the use of dictionary words for passwords. Add or update the following line in the "/etc/security/pwquality.conf" file or a configuration file in the /etc/pwquality.conf.d/ directory to contain the "dictcheck" parameter: dictcheck=1

b

OL 9 must not have accounts configured with blank or null passwords.

RMF Control: CM-6
Severity: Medium
CCI: CCI-000366
Version: OL09-00-001130
Vuln IDs: V-271638
Rule IDs: SV-271638r1091626_rule

If an account has an empty password, anyone could log in and run commands with the privileges of that account. Accounts with empty passwords should never be used in operational environments.

Fix: F-75595r1091625_fix

Configure OL 9 so that all accounts have a password or lock the account with the following commands: Perform a password reset: $ sudo passwd [username] To lock an account: $ sudo passwd -l [username]

b

OL 9 file system automount function must be disabled unless required.

RMF Control: IA-3
Severity: Medium
CCI: CCI-000778
Version: OL09-00-002000
Vuln IDs: V-271639
Rule IDs: SV-271639r1091629_rule

An authentication process resists replay attacks if it is impractical to achieve a successful authentication by recording and replaying a previous authentication message. Satisfies: SRG-OS-000114-GPOS-00059, SRG-OS-000378-GPOS-00163

Fix: F-75596r1091628_fix

Configure OL 9 to disable and mask the ability to automount devices. The autofs service can be disabled and masked with the following command: $ sudo systemctl mask --now autofs.service

c

OL 9 must not allow unattended or automatic logon via the graphical user interface.

RMF Control: CM-6
Severity: High
CCI: CCI-000366
Version: OL09-00-002161
Vuln IDs: V-271691
Rule IDs: SV-271691r1091785_rule

Failure to restrict system access to authenticated users negatively impacts operating system security.

Fix: F-75648r1091784_fix

Configure the GNOME desktop display manager to disable automatic login. Set AutomaticLoginEnable to false in the [daemon] section in /etc/gdm/custom.conf. For example: [daemon] AutomaticLoginEnable=false

c

OL 9 SSHD must not allow blank passwords.

RMF Control: IA-2
Severity: High
CCI: CCI-000766
Version: OL09-00-002343
Vuln IDs: V-271706
Rule IDs: SV-271706r1091830_rule

If an account has an empty password, anyone could log on and run commands with the privileges of that account. Accounts with empty passwords should never be used in operational environments.

Fix: F-75663r1091829_fix

Configure OL 9 to prevent SSH users from logging on with blank passwords by editing the following line in "/etc/ssh/sshd_config" or in a file in "/etc/ssh/sshd_config.d": PermitEmptyPasswords no Restart the SSH daemon for the settings to take effect: $ sudo systemctl restart sshd.service

c

OL 9 must enable the Pluggable Authentication Module (PAM) interface for SSHD.

RMF Control: MA-4
Severity: High
CCI: CCI-000877
Version: OL09-00-002344
Vuln IDs: V-271707
Rule IDs: SV-271707r1091833_rule

When UsePAM is set to "yes", PAM runs through account and session types properly. This is important when restricted access to services based off of IP, time, or other factors of the account is needed. Additionally, this ensures users can inherit certain environment variables on login or disallow access to the server.

Fix: F-75664r1091832_fix

Configure the OL 9 SSHD to use the UsePAM interface by adding or modifying the following line in "/etc/ssh/sshd_config" or in a file in "/etc/ssh/sshd_config.d". UsePAM yes Restart the SSH daemon for the settings to take effect: $ sudo systemctl restart sshd.service

b

OL 9 must not permit direct logons to the root account using remote access via SSH.

RMF Control
Severity: Medium
CCI: CCI-004045
Version: OL09-00-002345
Vuln IDs: V-271708
Rule IDs: SV-271708r1092594_rule

Even though the communications channel may be encrypted, an additional layer of security is gained by extending the policy of not logging directly on as root. In addition, logging in with a user-specific account provides individual accountability of actions performed on the system and also helps to minimize direct attack attempts on root's password.

Fix: F-75665r1091835_fix

Configure OL 9 to prevent SSH users from logging on directly as root by adding or modifying the following line in "/etc/ssh/sshd_config" or in a file in "/etc/ssh/sshd_config.d". PermitRootLogin no Restart the SSH daemon for the settings to take effect: $ sudo systemctl restart sshd.service

b

OL 9 must be configured so that all network connections associated with SSH traffic terminate after becoming unresponsive.

RMF Control: SC-10
Severity: Medium
CCI: CCI-001133
Version: OL09-00-002346
Vuln IDs: V-271709
Rule IDs: SV-271709r1091839_rule

Terminating an unresponsive SSH session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled on the console or console port that has been left unattended. In addition, quickly terminating an idle SSH session will also free up resources committed by the managed network element. Terminating network connections associated with communications sessions includes, for example, deallocating associated TCP/IP address/port pairs at the operating system level and deallocating networking assignments at the application level if multiple application sessions are using a single operating system-level network connection. This does not mean the operating system terminates all sessions or network access; it only ends the unresponsive session and releases the resources associated with that session. OL 9 uses /etc/ssh/sshd_config for configurations of OpenSSH. Within the sshd_config, the product of the values of "ClientAliveInterval" and "ClientAliveCountMax" are used to establish the inactivity threshold. The "ClientAliveInterval" is a timeout interval in seconds, after which if no data has been received from the client, SSHD will send a message through the encrypted channel to request a response from the client. The "ClientAliveCountMax" is the number of client alive messages that may be sent without SSHD receiving any messages back from the client. If this threshold is met, sshd will disconnect the client. For more information on these settings and others, refer to the sshd_config man pages. Satisfies: SRG-OS-000163-GPOS-00072, SRG-OS-000279-GPOS-00109

Fix: F-75666r1091838_fix

Note: This setting must be applied in conjunction with ClientAliveInterval to function correctly. Configure the SSH server to terminate a user session automatically after the SSH client has become unresponsive. Modify or append the following lines in the "/etc/ssh/sshd_config" or in a file in "/etc/ssh/sshd_config.d": ClientAliveCountMax 1 In order for the changes to take effect, the SSH daemon must be restarted. $ sudo systemctl restart sshd.service

c

OL 9 must be configured so that the systemd Ctrl-Alt-Delete burst key sequence is disabled.

RMF Control: AC-6
Severity: High
CCI: CCI-002235
Version: OL09-00-002412
Vuln IDs: V-271751
Rule IDs: SV-271751r1091965_rule

A locally logged-on user who presses Ctrl-Alt-Delete when at the console can reboot the system. If accidentally pressed, as could happen in the case of a mixed OS environment, this can create the risk of short-term loss of availability of systems due to unintentional reboot. In a graphical user environment, risk of unintentional reboot from the Ctrl-Alt-Delete sequence is reduced because the user will be prompted before any action is taken.

Fix: F-75708r1091964_fix

Configure the system to disable the CtrlAltDelBurstAction by added or modifying the following line in the "/etc/systemd/system.conf" configuration file: CtrlAltDelBurstAction=none Reload the daemon for this change to take effect. $ sudo systemctl daemon-reload

c

OL 9 must be configured so that the x86 Ctrl-Alt-Delete key sequence is disabled.

RMF Control: AC-6
Severity: High
CCI: CCI-002235
Version: OL09-00-002413
Vuln IDs: V-271752
Rule IDs: SV-271752r1091968_rule

A locally logged-on user who presses Ctrl-Alt-Delete when at the console can reboot the system. If accidentally pressed, as could happen in the case of a mixed OS environment, this can create the risk of short-term loss of availability of systems due to unintentional reboot. In a graphical user environment, risk of unintentional reboot from the Ctrl-Alt-Delete sequence is reduced because the user will be prompted before any action is taken.

Fix: F-75709r1091967_fix

Configure OL 9 to disable the ctrl-alt-del.target with the following command: $ sudo systemctl disable --now ctrl-alt-del.target $ sudo systemctl mask --now ctrl-alt-del.target

c

OL 9 file systems must not contain shosts.equiv files.

RMF Control: CM-6
Severity: High
CCI: CCI-000366
Version: OL09-00-002419
Vuln IDs: V-271757
Rule IDs: SV-271757r1092604_rule

The shosts.equiv files are used to configure host-based authentication for the system via SSH. Host-based authentication is not sufficient for preventing unauthorized access to the system, as it does not require interactive identification and authentication of a connection request, or for the use of two-factor authentication.

Fix: F-75714r1091982_fix

Remove any found "shosts.equiv" files from the system. $ sudo rm /[path]/[to]/[file]/shosts.equiv

c

OL 9 file systems must not contain .shosts files.

RMF Control: CM-6
Severity: High
CCI: CCI-000366
Version: OL09-00-002420
Vuln IDs: V-271758
Rule IDs: SV-271758r1091986_rule

The .shosts files are used to configure host-based authentication for individual users or the system via SSH. Host-based authentication is not sufficient for preventing unauthorized access to the system, as it does not require interactive identification and authentication of a connection request, or for the use of two-factor authentication.

Fix: F-75715r1091985_fix

Remove any found ".shosts" files from the system. $ sudo rm /[path]/[to]/[file]/.shosts

b

OL 9 system commands must be group-owned by root or a system account.

RMF Control: CM-5
Severity: Medium
CCI: CCI-001499
Version: OL09-00-002504
Vuln IDs: V-271773
Rule IDs: SV-271773r1092031_rule

If OL 9 allowed any user to make changes to software libraries, then those changes might be implemented without undergoing the appropriate testing and approvals that are part of a robust change management process. This requirement applies to OL 9 with software libraries that are accessible and configurable, as in the case of interpreted languages. Software libraries also include privileged programs that execute with escalated privileges.

Fix: F-75730r1092030_fix

Configure the system commands to be protected from unauthorized access. Run the following command, replacing "[FILE]" with any system command file not group-owned by "root" or a required system account. $ sudo chgrp root [FILE]

b

OL 9 system commands must be owned by root.

RMF Control: CM-5
Severity: Medium
CCI: CCI-001499
Version: OL09-00-002505
Vuln IDs: V-271774
Rule IDs: SV-271774r1092034_rule

If OL 9 allowed any user to make changes to software libraries, then those changes might be implemented without undergoing the appropriate testing and approvals that are part of a robust change management process. This requirement applies to OL 9 with software libraries that are accessible and configurable, as in the case of interpreted languages. Software libraries also include privileged programs that execute with escalated privileges.

Fix: F-75731r1092033_fix

Configure the system commands to be protected from unauthorized access. Run the following command, replacing "[FILE]" with any system command file not owned by "root". $ sudo chown root [FILE]

b

OL 9 system commands must have mode 755 or less permissive.

RMF Control: CM-5
Severity: Medium
CCI: CCI-001499
Version: OL09-00-002506
Vuln IDs: V-271775
Rule IDs: SV-271775r1092037_rule

If OL 9 allowed any user to make changes to software libraries, then those changes might be implemented without undergoing the appropriate testing and approvals that are part of a robust change management process. This requirement applies to OL 9 with software libraries that are accessible and configurable, as in the case of interpreted languages. Software libraries also include privileged programs that execute with escalated privileges.

Fix: F-75732r1092036_fix

Configure the system commands to be protected from unauthorized access. Run the following command, replacing "[FILE]" with any system command with a mode more permissive than "755". $ sudo chmod 755 [FILE]

b

OL 9 library directories must be group-owned by root or a system account.

RMF Control: CM-5
Severity: Medium
CCI: CCI-001499
Version: OL09-00-002520
Vuln IDs: V-271786
Rule IDs: SV-271786r1092070_rule

If OL 9 allowed any user to make changes to software libraries, then those changes might be implemented without undergoing the appropriate testing and approvals that are part of a robust change management process. This requirement applies to OL 9 with software libraries that are accessible and configurable, as in the case of interpreted languages. Software libraries also include privileged programs that execute with escalated privileges.

Fix: F-75743r1092069_fix

Configure the system-wide shared library directories (/lib, /lib64, /usr/lib and /usr/lib64) to be protected from unauthorized access. Run the following command, replacing "[DIRECTORY]" with any library directory not group-owned by "root". $ sudo chgrp root [DIRECTORY]

b

OL 9 library directories must be owned by root.

RMF Control: CM-5
Severity: Medium
CCI: CCI-001499
Version: OL09-00-002521
Vuln IDs: V-271787
Rule IDs: SV-271787r1092073_rule

If OL 9 allowed any user to make changes to software libraries, then those changes might be implemented without undergoing the appropriate testing and approvals that are part of a robust change management process. This requirement applies to OL 9 with software libraries that are accessible and configurable, as in the case of interpreted languages. Software libraries also include privileged programs that execute with escalated privileges.

Fix: F-75744r1092072_fix

Configure the system-wide shared library directories within (/lib, /lib64, /usr/lib and /usr/lib64) to be protected from unauthorized access. Run the following command, replacing "[DIRECTORY]" with any library directory not owned by "root". $ sudo chown root [DIRECTORY]

b

OL 9 library directories must have mode 755 or less permissive.

RMF Control: CM-5
Severity: Medium
CCI: CCI-001499
Version: OL09-00-002522
Vuln IDs: V-271788
Rule IDs: SV-271788r1092076_rule

If OL 9 allowed any user to make changes to software libraries, then those changes might be implemented without undergoing the appropriate testing and approvals that are part of a robust change management process. This requirement applies to OL 9 with software libraries that are accessible and configurable, as in the case of interpreted languages. Software libraries also include privileged programs that execute with escalated privileges.

Fix: F-75745r1092075_fix

Configure the system-wide shared library directories (/lib, /lib64, /usr/lib and /usr/lib64) to be protected from unauthorized access. Run the following command, replacing "[DIRECTORY]" with any library directory with a mode more permissive than 755. $ sudo chmod 755 [DIRECTORY]

b

OL 9 library files must be group-owned by root or a system account.

RMF Control: CM-5
Severity: Medium
CCI: CCI-001499
Version: OL09-00-002523
Vuln IDs: V-271789
Rule IDs: SV-271789r1092079_rule

If OL 9 allowed any user to make changes to software libraries, then those changes might be implemented without undergoing the appropriate testing and approvals that are part of a robust change management process. This requirement applies to OL 9 with software libraries that are accessible and configurable, as in the case of interpreted languages. Software libraries also include privileged programs that execute with escalated privileges.

Fix: F-75746r1092078_fix

Configure the system-wide shared library files (/lib, /lib64, /usr/lib and /usr/lib64) to be protected from unauthorized access. Run the following command, replacing "[FILE]" with any library file not group-owned by "root". $ sudo chgrp root [FILE]

b

OL 9 library files must be owned by root.

RMF Control: CM-5
Severity: Medium
CCI: CCI-001499
Version: OL09-00-002524
Vuln IDs: V-271790
Rule IDs: SV-271790r1092082_rule

If OL 9 allowed any user to make changes to software libraries, then those changes might be implemented without undergoing the appropriate testing and approvals that are part of a robust change management process. This requirement applies to OL 9 with software libraries that are accessible and configurable, as in the case of interpreted languages. Software libraries also include privileged programs that execute with escalated privileges.

Fix: F-75747r1092081_fix

Configure the system-wide shared library files (/lib, /lib64, /usr/lib and /usr/lib64) to be protected from unauthorized access. Run the following command, replacing "[FILE]" with any library file not owned by "root". $ sudo chown root [FILE]

b

OL 9 library files must have mode 755 or less permissive.

RMF Control: CM-5
Severity: Medium
CCI: CCI-001499
Version: OL09-00-002525
Vuln IDs: V-271791
Rule IDs: SV-271791r1092085_rule

If OL 9 allowed any user to make changes to software libraries, then those changes might be implemented without undergoing the appropriate testing and approvals that are part of a robust change management process. This requirement applies to OL 9 with software libraries that are accessible and configurable, as in the case of interpreted languages. Software libraries also include privileged programs that execute with escalated privileges.

Fix: F-75748r1092084_fix

Configure the library files to be protected from unauthorized access. Run the following command, replacing "[FILE]" with any library file with a mode more permissive than 755. $ sudo chmod 755 [FILE]

b

OL 9 /etc/group- file must be owned by root.

RMF Control: CM-6
Severity: Medium
CCI: CCI-000366
Version: OL09-00-002535
Vuln IDs: V-271797
Rule IDs: SV-271797r1092103_rule

The "/etc/group-" file is a backup file of "/etc/group", and as such, contains information regarding groups that are configured on the system. Protection of this file is important for system security.

Fix: F-75754r1092102_fix

Change the owner of the file /etc/group- to root by running the following command: $ sudo chown root /etc/group-

b

OL 9 /etc/group file must have mode 0644 or less permissive to prevent unauthorized access.

RMF Control: CM-6
Severity: Medium
CCI: CCI-000366
Version: OL09-00-002536
Vuln IDs: V-271798
Rule IDs: SV-271798r1092106_rule

The "/etc/group" file contains information regarding groups that are configured on the system. Protection of this file is important for system security.

Fix: F-75755r1092105_fix

Change the mode of the file "/etc/group" to "0644" by running the following command: $ sudo chmod 0644 /etc/group

b

OL 9 /etc/group- file must have mode 0644 or less permissive to prevent unauthorized access.

RMF Control: CM-6
Severity: Medium
CCI: CCI-000366
Version: OL09-00-002537
Vuln IDs: V-271799
Rule IDs: SV-271799r1092109_rule

The "/etc/group-" file is a backup file of "/etc/group", and as such, contains information regarding groups that are configured on the system. Protection of this file is important for system security.

Fix: F-75756r1092108_fix

Change the mode of the file "/etc/group-" to "0644" by running the following command: $ sudo chmod 0644 /etc/group-

c

OL 9 must be configured so that the root account is the only account having unrestricted access to the system.

RMF Control: CM-6
Severity: High
CCI: CCI-000366
Version: OL09-00-003000
Vuln IDs: V-271831
Rule IDs: SV-271831r1092205_rule

An account has root authority if it has a user identifier (UID) of "0". Multiple accounts with a UID of "0" afford more opportunity for potential intruders to guess a password for a privileged account. Proper configuration of sudo is recommended to afford multiple system administrators access to root privileges in an accountable manner.

Fix: F-75788r1092204_fix

Change the UID of any account on the system, other than root, that has a UID of "0". If the account is associated with system commands or applications, the UID should be changed to one greater than "0" but less than "1000". Otherwise, assign a UID of greater than "1000" that has not already been assigned.