Cyber · Trackr The Free Compliance Library
⌘K
DoD Compliance · SCAP

Oracle Linux 9 STIG SCAP Benchmark

V1R2 · · · Published 22 Dec 2025 · 398 rules
View

Open a previous version of this SCAP benchmark.

This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DOD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.
Sort by
a
OL 9 must use a separate file system for the system audit data path.
RMF Control
AU-4
Severity
L
CCI
CCI-001849
Version
OL09-00-000002
Vuln IDs
V-271432
Rule IDs
SV-271432r1091008_rule
Placing "/var/log/audit" in its own partition enables better separation between audit files and other system files and helps ensure that auditing cannot be halted due to the partition running out of space.
Fix: F-75389r1091007_fix

Migrate the system audit data path onto a separate file system.

b
OL 9 must be configured so that a separate file system must be used for user home directories (such as /home or an equivalent).
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-000003
Vuln IDs
V-271433
Rule IDs
SV-271433r1091011_rule
Ensuring that "/home" is mounted on its own partition enables the setting of more restrictive mount options, and also helps ensure that users cannot trivially fill partitions used for log or audit data storage.
Fix: F-75390r1091010_fix

Migrate the "/home" directory onto a separate file system/partition.

b
OL 9 must use a separate file system for /tmp.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-000004
Vuln IDs
V-271434
Rule IDs
SV-271434r1091014_rule
The "/tmp" partition is used as temporary storage by many programs. Placing "/tmp" in its own partition enables the setting of more restrictive mount options, which can help protect programs that use it.
Fix: F-75391r1091013_fix

Migrate the "/tmp" path onto a separate file system.

a
OL 9 must use a separate file system for /var.
RMF Control
CM-6
Severity
L
CCI
CCI-000366
Version
OL09-00-000005
Vuln IDs
V-271435
Rule IDs
SV-271435r1091017_rule
Ensuring that "/var" is mounted on its own partition enables the setting of more restrictive mount options. This helps protect system services such as daemons or other programs which use it. It is not uncommon for the "/var" directory to contain world-writable directories installed by other software packages.
Fix: F-75392r1091016_fix

Migrate the "/var" path onto a separate file system.

a
OL 9 must use a separate file system for /var/log.
RMF Control
CM-6
Severity
L
CCI
CCI-000366
Version
OL09-00-000006
Vuln IDs
V-271436
Rule IDs
SV-271436r1091020_rule
Placing "/var/log" in its own partition enables better separation between log files and other files in "/var/".
Fix: F-75393r1091019_fix

Migrate the "/var/log" path onto a separate file system.

b
OL 9 must use a separate file system for /var/tmp.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-000007
Vuln IDs
V-271437
Rule IDs
SV-271437r1091023_rule
The "/var/tmp" partition is used as temporary storage by many programs. Placing "/var/tmp" in its own partition enables the setting of more restrictive mount options, which can help protect programs that use it.
Fix: F-75394r1091022_fix

Migrate the "/var/tmp" path onto a separate file system.

c
OL 9 must be a vendor supported release.
RMF Control
SI-2
Severity
H
CCI
CCI-002605
Version
OL09-00-000010
Vuln IDs
V-271438
Rule IDs
SV-271438r1155341_rule
An operating system release is considered "supported" if the vendor continues to provide security patches for the product. With an unsupported release, it will not be possible to resolve security issues discovered in the system software. End Of Life dates for Oracle Linux 9 releases are as follows: Current end of Premier Support for Oracle Linux 9 is June 2032. Current end of Extended Support for Oracle Linux 9 is June 2035. Each minor version reaches end of life when the new version is released.
Fix: F-75395r1091025_fix

Upgrade OL 9 to a supported version.

b
OL 9 must be configured so that the graphical display manager is not the default target unless approved.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-000020
Vuln IDs
V-271440
Rule IDs
SV-271440r1092462_rule
Unnecessary service packages must not be installed to decrease the attack surface of the system. Graphical display managers have a long history of security vulnerabilities and must not be used unless approved and documented.
Fix: F-75397r1091031_fix

Configure OL 9 to boot to the command line. Set the default target to multi-user with the following command: $ sudo systemctl set-default multi-user.target If there is an operational requirement for a graphical user interface, document it with the ISSO.

b
OL 9 must require authentication to access emergency mode.
RMF Control
AC-3
Severity
M
CCI
CCI-000213
Version
OL09-00-000025
Vuln IDs
V-271441
Rule IDs
SV-271441r1137691_rule
To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DOD-approved PKIs, all DOD systems (e.g., web servers and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement. This requirement prevents attackers with physical access from trivially bypassing security on the machine and gaining root access. Such accesses are further prevented by configuring the bootloader password.
Fix: F-75398r1091034_fix

Configure OL 9 to require authentication for emergency mode. Add or modify the following line in the "/usr/lib/systemd/system/emergency.service" file: ExecStart=-/usr/lib/systemd/systemd-sulogin-shell emergency

b
OL 9 must require authentication to access single-user mode.
RMF Control
AC-3
Severity
M
CCI
CCI-000213
Version
OL09-00-000030
Vuln IDs
V-271442
Rule IDs
SV-271442r1137691_rule
To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DOD-approved PKIs, all DOD systems (e.g., web servers and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement. This requirement prevents attackers with physical access from trivially bypassing security on the machine and gaining root access. Such accesses are further prevented by configuring the bootloader password.
Fix: F-75399r1091037_fix

Configure OL 9 to require authentication for single-user mode. Add or modify the following line in the "/usr/lib/systemd/system/rescue.service" file: ExecStart=-/usr/lib/systemd/systemd-sulogin-shell rescue

b
OL 9 must be configured to disable the Asynchronous Transfer Mode (ATM) kernel module.
RMF Control
CM-7
Severity
M
CCI
CCI-000381
Version
OL09-00-000040
Vuln IDs
V-271443
Rule IDs
SV-271443r1092463_rule
Disabling ATM protects the system against exploitation of any flaws in its implementation.
Fix: F-75400r1091040_fix

Configure OL 9 to prevent the atm kernel module from being loaded. Add the following line to the file /etc/modprobe.d/atm.conf (or create atm.conf if it does not exist): install atm /bin/false blacklist atm

b
OL 9 must be configured to disable the Controller Area Network (CAN) kernel module.
RMF Control
CM-7
Severity
M
CCI
CCI-000381
Version
OL09-00-000041
Vuln IDs
V-271444
Rule IDs
SV-271444r1091044_rule
Disabling CAN protects the system against exploitation of any flaws in its implementation.
Fix: F-75401r1091043_fix

Configure OL 9 to prevent the can kernel module from being loaded. Add the following line to the file /etc/modprobe.d/can.conf (or create atm.conf if it does not exist): install can /bin/false blacklist can

b
OL 9 must be configured to disable the FireWire kernel module.
RMF Control
CM-7
Severity
M
CCI
CCI-000381
Version
OL09-00-000042
Vuln IDs
V-271445
Rule IDs
SV-271445r1091047_rule
Disabling firewire protects the system against exploitation of any flaws in its implementation.
Fix: F-75402r1091046_fix

Configure OL 9 to prevent the firewire-core kernel module from being loaded. Add the following line to the file /etc/modprobe.d/firewire-core.conf (or create firewire-core.conf if it does not exist): install firewire-core /bin/true blacklist firewire-core

b
OL 9 must disable the Stream Control Transmission Protocol (SCTP) kernel module.
RMF Control
CM-7
Severity
M
CCI
CCI-000381
Version
OL09-00-000043
Vuln IDs
V-271446
Rule IDs
SV-271446r1155293_rule
It is detrimental for operating systems to provide, or install by default, functionality exceeding requirements or mission objectives. These unnecessary capabilities or services are often overlooked and therefore may remain unsecured. They increase the risk to the platform by providing additional attack vectors. Failing to disconnect unused protocols can result in a system compromise. The SCTP is a transport layer protocol, designed to support the idea of message-oriented communication, with several streams of messages within one connection. Disabling SCTP protects the system against exploitation of any flaws in its implementation.
Fix: F-75403r1155292_fix

Configure OL 9 to prevent the sctp kernel module from being loaded. Add the following line to the file /etc/modprobe.d/sctp.conf (or create sctp.conf if it does not exist): install sctp /bin/false blacklist sctp

b
OL 9 must disable the Transparent Inter Process Communication (TIPC) kernel module.
RMF Control
CM-7
Severity
M
CCI
CCI-000381
Version
OL09-00-000044
Vuln IDs
V-271447
Rule IDs
SV-271447r1155295_rule
It is detrimental for operating systems to provide, or install by default, functionality exceeding requirements or mission objectives. These unnecessary capabilities or services are often overlooked and therefore may remain unsecured. They increase the risk to the platform by providing additional attack vectors. Failing to disconnect unused protocols can result in a system compromise. The TIPC is a protocol that is specially designed for intra-cluster communication. It can be configured to transmit messages either on UDP or directly across Ethernet. Message delivery is sequence guaranteed, loss free, and flow controlled. Disabling TIPC protects the system against exploitation of any flaws in its implementation.
Fix: F-75404r1091052_fix

Configure OL 9 to prevent the tipc kernel module from being loaded. Add the following line to the file /etc/modprobe.d/tipc.conf (or create tipc.conf if it does not exist): install tipc /bin/false blacklist tipc

a
OL 9 must disable mounting of cramfs.
RMF Control
CM-7
Severity
L
CCI
CCI-000381
Version
OL09-00-000045
Vuln IDs
V-271448
Rule IDs
SV-271448r1155297_rule
It is detrimental for operating systems to provide, or install by default, functionality exceeding requirements or mission objectives. These unnecessary capabilities or services are often overlooked and therefore may remain unsecured. They increase the risk to the platform by providing additional attack vectors. Removing support for unneeded filesystem types reduces the local attack surface of the server. Compressed ROM/RAM file system (or cramfs) is a read-only file system designed for simplicity and space-efficiency. It is mainly used in embedded and small-footprint systems.
Fix: F-75405r1091055_fix

Configure OL 9 to prevent the cramfs kernel module from being loaded. Add the following line to the file /etc/modprobe.d/cramfs.conf (or create blacklist.conf if it does not exist): install cramfs /bin/false blacklist cramfs Reboot the system for the settings to take effect.

b
OL 9 Bluetooth must be disabled.
RMF Control
CM-7
Severity
M
CCI
CCI-000381
Version
OL09-00-000046
Vuln IDs
V-271449
Rule IDs
SV-271449r1091059_rule
This requirement applies to wireless peripheral technologies (e.g., wireless mice, keyboards, displays, etc.) used with OL 9 systems. Wireless peripherals (e.g., Wi-Fi/Bluetooth/IR keyboards, mice and pointing devices, and near field communications [NFC]) present a unique challenge by creating an open, unsecured port on a computer. Wireless peripherals must meet DOD requirements for wireless data transmission and be approved for use by the authorizing official (AO). Even though some wireless peripherals, such as mice and pointing devices, do not ordinarily carry information that need to be protected, modification of communications with these wireless peripherals may be used to compromise the OL 9 operating system. Satisfies: SRG-OS-000095-GPOS-00049, SRG-OS-000300-GPOS-00118
Fix: F-75406r1091058_fix

Configure OL 9 to disable the Bluetooth adapter when not in use. Create or modify the "/etc/modprobe.d/bluetooth.conf" file with the following line: install bluetooth /bin/false blacklist bluetooth Reboot the system for the settings to take effect.

b
OL 9 must be configured to disable USB mass storage.
RMF Control
IA-3
Severity
M
CCI
CCI-000778
Version
OL09-00-000047
Vuln IDs
V-271450
Rule IDs
SV-271450r1092466_rule
USB mass storage permits easy introduction of unknown devices, thereby facilitating malicious activity. Satisfies: SRG-OS-000114-GPOS-00059, SRG-OS-000378-GPOS-00163
Fix: F-75407r1092465_fix

Configure OL 9 to prevent the usb-storage kernel module from being loaded. Add the following line to the file /etc/modprobe.d/usb-storage.conf (or create usb-storage.conf if it does not exist): install usb-storage /bin/false blacklist usb-storage

c
OL 9 must use a Linux Security Module configured to enforce limits on system services.
RMF Control
SI-6
Severity
H
CCI
CCI-002696
Version
OL09-00-000060
Vuln IDs
V-271452
Rule IDs
SV-271452r1091068_rule
Without verification of the security functions, security functions may not operate correctly and the failure may go unnoticed. Security function is defined as the hardware, software, and/or firmware of the information system responsible for enforcing the system security policy and supporting the isolation of code and data on which the protection is based. Security functionality includes, but is not limited to, establishing system accounts, configuring access authorizations (i.e., permissions, privileges), setting events to be audited, and setting intrusion detection parameters. This requirement applies to operating systems performing security function verification/testing and/or systems and environments that require this functionality. Satisfies: SRG-OS-000445-GPOS-00199, SRG-OS-000134-GPOS-00068
Fix: F-75409r1091067_fix

Configure OL 9 to verify correct operation of security functions. Edit the file "/etc/selinux/config" and add or modify the following line: SELINUX=enforcing A reboot is required for the changes to take effect.

b
OL 9 must enable the SELinux targeted policy.
RMF Control
SI-6
Severity
M
CCI
CCI-002696
Version
OL09-00-000065
Vuln IDs
V-271453
Rule IDs
SV-271453r1091071_rule
Setting the SELinux policy to "targeted" or a more specialized policy ensures the system will confine processes that are likely to be targeted for exploitation, such as network or system services. Note: During the development or debugging of SELinux modules, it is common to temporarily place nonproduction systems in "permissive" mode. In such temporary cases, SELinux policies should be developed, and once work is completed, the system should be reconfigured to "targeted".
Fix: F-75410r1091070_fix

Configure OL 9 to use the targetd SELINUX policy. Edit the file "/etc/selinux/config" and add or modify the following line: SELINUXTYPE=targeted A reboot is required for the changes to take effect.

c
OL 9 must enable FIPS mode.
RMF Control
AC-17
Severity
H
CCI
CCI-000068
Version
OL09-00-000070
Vuln IDs
V-271454
Rule IDs
SV-271454r1092458_rule
Use of weak or untested encryption algorithms undermines the purposes of using encryption to protect data. The operating system must implement cryptographic modules adhering to the higher standards approved by the federal government since this provides assurance they have been tested and validated. This includes NIST FIPS-validated cryptography for the following: Provisioning digital signatures, generating cryptographic hashes, and to protect data requiring data-at-rest protections in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards. Satisfies: SRG-OS-000033-GPOS-00014, SRG-OS-000125-GPOS-00065, SRG-OS-000396-GPOS-00176, SRG-OS-000423-GPOS-00187, SRG-OS-000478-GPOS-00223
Fix: F-75411r1092458_fix

Configure OL 9 to implement FIPS mode with the following command: $ sudo fips-mode-setup --enable Reboot the system for the changes to take effect.

b
OL 9 must not have the nfs-utils package installed.
RMF Control
CM-7
Severity
M
CCI
CCI-000381
Version
OL09-00-000100
Vuln IDs
V-271456
Rule IDs
SV-271456r1091080_rule
"nfs-utils" provides a daemon for the kernel NFS server and related tools. This package also contains the "showmount" program. "showmount" queries the mount daemon on a remote host for information about the Network File System (NFS) server on the remote host. For example, "showmount" can display the clients that are mounted on that host.
Fix: F-75413r1091079_fix

Remove the nfs-utils package with the following command: $ sudo dnf remove nfs-utils

b
OL 9 must not have the telnet-server package installed.
RMF Control
CM-7
Severity
M
CCI
CCI-000381
Version
OL09-00-000110
Vuln IDs
V-271458
Rule IDs
SV-271458r1091086_rule
It is detrimental for operating systems to provide, or install by default, functionality exceeding requirements or mission objectives. These unnecessary capabilities are often overlooked and therefore, may remain unsecure. They increase the risk to the platform by providing additional attack vectors. The telnet service provides an unencrypted remote access service, which does not provide for the confidentiality and integrity of user passwords or the remote session. If a privileged user were to login using this service, the privileged user password could be compromised. Removing the "telnet-server" package decreases the risk of accidental (or intentional) activation of the telnet service.
Fix: F-75415r1091085_fix

Remove the telnet-server package with the following command: $ sudo dnf remove telnet-server

b
OL 9 must not have the gssproxy package installed.
RMF Control
CM-7
Severity
M
CCI
CCI-000381
Version
OL09-00-000115
Vuln IDs
V-271459
Rule IDs
SV-271459r1091089_rule
It is detrimental for operating systems to provide, or install by default, functionality exceeding requirements or mission objectives. These unnecessary capabilities or services are often overlooked and therefore, may remain unsecured. They increase the risk to the platform by providing additional attack vectors. Operating systems are capable of providing a wide variety of functions and services. Some of the functions and services provided by default may not be necessary to support essential organizational operations (e.g., key missions, functions). The gssproxy package is a proxy for GSS API credential handling and could expose secrets on some networks. It is not needed for normal function of the OS.
Fix: F-75416r1091088_fix

Remove the gssproxy package with the following command: $ sudo dnf remove gssproxy

b
OL 9 must not have the iprutils package installed.
RMF Control
CM-7
Severity
M
CCI
CCI-000381
Version
OL09-00-000120
Vuln IDs
V-271460
Rule IDs
SV-271460r1091092_rule
It is detrimental for operating systems to provide, or install by default, functionality exceeding requirements or mission objectives. These unnecessary capabilities or services are often overlooked and therefore may remain unsecured. They increase the risk to the platform by providing additional attack vectors. Operating systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). The iprutils package provides a suite of utilities to manage and configure SCSI devices supported by the ipr SCSI storage device driver.
Fix: F-75417r1091091_fix

Remove the iprutils package with the following command: $ sudo dnf remove iprutils

b
OL 9 must not have the tuned package installed.
RMF Control
CM-7
Severity
M
CCI
CCI-000381
Version
OL09-00-000125
Vuln IDs
V-271461
Rule IDs
SV-271461r1091095_rule
It is detrimental for operating systems to provide, or install by default, functionality exceeding requirements or mission objectives. These unnecessary capabilities or services are often overlooked and therefore may remain unsecured. They increase the risk to the platform by providing additional attack vectors. Operating systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). The tuned package contains a daemon that tunes the system settings dynamically. It does so by monitoring the usage of several system components periodically. Based on that information, components will then be put into lower or higher power savings modes to adapt to the current usage. The tuned package is not needed for normal OS operations.
Fix: F-75418r1091094_fix

Remove the tuned package with the following command: $ sudo dnf remove tuned

c
OL 9 must not have a File Transfer Protocol (FTP) server package installed.
RMF Control
IA-5
Severity
H
CCI
CCI-000197
Version
OL09-00-000130
Vuln IDs
V-271462
Rule IDs
SV-271462r1091098_rule
The FTP service provides an unencrypted remote access that does not provide for the confidentiality and integrity of user passwords or the remote session. If a privileged user were to log on using this service, the privileged user password could be compromised. SSH or other encrypted file transfer methods must be used in place of this service. Removing the "vsftpd" package decreases the risk of accidental activation. Satisfies: SRG-OS-000074-GPOS-00042, SRG-OS-000095-GPOS-00049
Fix: F-75419r1091097_fix

Remove the ftp package can be removed with the following command (using vsftpd as an example): $ sudo dnf remove vsftpd

c
OL 9 must not have a Trivial File Transfer Protocol (TFTP) server package installed.
RMF Control
CM-6
Severity
H
CCI
CCI-000366
Version
OL09-00-000135
Vuln IDs
V-271463
Rule IDs
SV-271463r1091101_rule
Removing the "tftp-server" package decreases the risk of the accidental (or intentional) activation of tftp services. If TFTP is required for operational support (such as transmission of router configurations), its use must be documented with the information systems security manager (ISSM), restricted to only authorized personnel, and have access control rules established.
Fix: F-75420r1091100_fix

Remove the tftp package can be removed with the following command: $ sudo dnf remove tftp

b
OL 9 must not have the quagga package installed.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-000140
Vuln IDs
V-271464
Rule IDs
SV-271464r1092459_rule
Quagga is a network routing software suite providing implementations of Open Shortest Path First (OSPF), Routing Information Protocol (RIP), Border Gateway Protocol (BGP) for Unix and Linux platforms. If there is no need to make the router software available, removing it provides a safeguard against its activation.
Fix: F-75421r1091103_fix

Remove the quagga package with the following command: $ sudo dnf remove quagga

b
OL 9 must not have a graphical display manager installed unless approved.
RMF Control
CM-7
Severity
M
CCI
CCI-000382
Version
OL09-00-000145
Vuln IDs
V-271465
Rule IDs
SV-271465r1091107_rule
Unnecessary service packages must not be installed to decrease the attack surface of the system. Graphical display managers have a long history of security vulnerabilities and must not be used, unless approved and documented.
Fix: F-75422r1091106_fix

Remove all xorg packages with the following command: Warning: If accessing the system through the graphical user interface, change to the multi-user.target with the following command: $ sudo systemctl isolate multi-user.target Warning: Removal of the graphical user interface will immediately render it useless. The following commands must not be run from a virtual terminal emulator in the graphical interface. $ sudo dnf remove "xorg*" $ sudo systemctl set-default multi-user.target If there is an operational requirement for a graphical user interface it must be documented with the ISSO.

b
OL 9 must not have the sendmail package installed.
RMF Control
CM-7
Severity
M
CCI
CCI-000381
Version
OL09-00-000150
Vuln IDs
V-271466
Rule IDs
SV-271466r1091110_rule
The sendmail software was not developed with security in mind, and its design prevents it from being effectively contained by SELinux. Postfix must be used instead.
Fix: F-75423r1091109_fix

Remove the sendmail package with the following command: $ sudo dnf remove sendmail

b
OL 9 must have policycoreutils package installed.
RMF Control
SC-3
Severity
M
CCI
CCI-001084
Version
OL09-00-000200
Vuln IDs
V-271467
Rule IDs
SV-271467r1091113_rule
Without verification of the security functions, security functions may not operate correctly and the failure may go unnoticed. Security function is defined as the hardware, software, and/or firmware of the information system responsible for enforcing the system security policy and supporting the isolation of code and data on which the protection is based. Security functionality includes, but is not limited to, establishing system accounts, configuring access authorizations (i.e., permissions, privileges), setting events to be audited, and setting intrusion detection parameters. Policycoreutils contains the policy core utilities that are required for basic operation of an SELinux-enabled system. These utilities include load_policy to load SELinux policies, setfile to label filesystems, newrole to switch roles, and run_init to run /etc/init.d scripts in the proper context.
Fix: F-75424r1091112_fix

Install the policycoreutils package with the following command: $ sudo dnf install -y policycoreutils

b
OL 9 policycoreutils-python-utils package must be installed.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-000210
Vuln IDs
V-271468
Rule IDs
SV-271468r1091116_rule
The policycoreutils-python-utils package is required to operate and manage an SELinux environment and its policies. It provides utilities such as semanage, audit2allow, audit2why, chcat, and sandbox.
Fix: F-75425r1091115_fix

Install the policycoreutils-python-utils service package (if the policycoreutils-python-utils service is not already installed) with the following command: $ sudo dnf install -y policycoreutils-python-utils

b
OL 9 must have the firewalld package installed.
RMF Control
CM-7
Severity
M
CCI
CCI-000382
Version
OL09-00-000220
Vuln IDs
V-271469
Rule IDs
SV-271469r1091119_rule
Firewalld provides an easy and effective way to block/limit remote access to the system via ports, services, and protocols. Remote access services, such as those providing remote access to network devices and information systems, which lack automated control capabilities, increase risk and make remote user access management difficult at best. Remote access is access to DOD nonpublic information systems by an authorized user (or an information system) communicating through an external, nonorganization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless. OL 9 functionality (e.g., SSH) must be capable of taking enforcement action if the audit reveals unauthorized activity. Automated control of remote access sessions allows organizations to ensure ongoing compliance with remote access policies by enforcing connection rules of remote access applications on a variety of information system components (e.g., servers, workstations, notebook computers, smartphones, and tablets). Satisfies: SRG-OS-000096-GPOS-00050, SRG-OS-000297-GPOS-00115, SRG-OS-000298-GPOS-00116, SRG-OS-000480-GPOS-00232
Fix: F-75426r1091118_fix

Install the firewalld package with the following command: $ sudo dnf install -y firewalld

b
OL 9 must be configured so that the firewalld service is active.
RMF Control
CM-7
Severity
M
CCI
CCI-000382
Version
OL09-00-000221
Vuln IDs
V-271470
Rule IDs
SV-271470r1092618_rule
Firewalld provides an easy and effective way to block/limit remote access to the system via ports, services, and protocols. Remote access services, such as those providing remote access to network devices and information systems, which lack automated control capabilities, increase risk and make remote user access management difficult at best. Remote access is access to DOD nonpublic information systems by an authorized user (or an information system) communicating through an external, nonorganization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless. OL 9 functionality (e.g., RDP) must be capable of taking enforcement action if the audit reveals unauthorized activity. Automated control of remote access sessions allows organizations to ensure ongoing compliance with remote access policies by enforcing connection rules of remote access applications on a variety of information system components (e.g., servers, workstations, notebook computers, smartphones, and tablets). Satisfies: SRG-OS-000096-GPOS-00050, SRG-OS-000297-GPOS-00115
Fix: F-75427r1092617_fix

Enable the firewalld service with the following command: $ sudo systemctl enable --now firewalld Note: If firewalld is masked, run following command: sudo systemctl unmask firewalld

b
OL 9 must have the sudo package installed.
RMF Control
AC-6
Severity
M
CCI
CCI-002235
Version
OL09-00-000230
Vuln IDs
V-271474
Rule IDs
SV-271474r1091134_rule
sudo is a program designed to allow a system administrator to give limited root privileges to users and log root activity. The basic philosophy is to give as few privileges as possible but still allow system users to complete their work.
Fix: F-75431r1091133_fix

The sudo package can be installed with the following command: # dnf install -y sudo

b
OL 9 must use the invoking user's password for privilege escalation when using sudo.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-000231
Vuln IDs
V-271475
Rule IDs
SV-271475r1091137_rule
If the rootpw, targetpw, or runaspw flags are defined and not disabled, by default the operating system will prompt the invoking user for the "root" user password.
Fix: F-75432r1091136_fix

Configure OL 9 to use the invoking user's password for privilege escalation when using sudo. Define the following in the Defaults section of the /etc/sudoers file or a single configuration file in the /etc/sudoers.d/ directory: Defaults !targetpw Defaults !rootpw Defaults !runaspw

b
OL 9 must restrict privilege elevation to authorized personnel.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-000232
Vuln IDs
V-271476
Rule IDs
SV-271476r1091140_rule
If the sudoers file is not configured correctly, any user defined on the system can initiate privileged actions on the target system.
Fix: F-75433r1091139_fix

Remove the following entries from the /etc/sudoers file or configuration file under /etc/sudoers.d/: ALL ALL=(ALL) ALL ALL ALL=(ALL:ALL) ALL

b
OL 9 must have the crypto-policies package installed.
RMF Control
SC-13
Severity
M
CCI
CCI-002450
Version
OL09-00-000240
Vuln IDs
V-271477
Rule IDs
SV-271477r1091143_rule
Centralized cryptographic policies simplify applying secure ciphers across an operating system and the applications that run on that operating system. Use of weak or untested encryption algorithms undermines the purposes of using encryption to protect data. Satisfies: SRG-OS-000396-GPOS-00176, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174
Fix: F-75434r1091142_fix

Install the crypto-policies package (if not already installed) with the following command: $ sudo dnf install -y crypto-policies

b
OL 9 networked systems must have SSH installed.
RMF Control
SC-8
Severity
M
CCI
CCI-002418
Version
OL09-00-000250
Vuln IDs
V-271482
Rule IDs
SV-271482r1091158_rule
Without protection of the transmitted information, confidentiality and integrity may be compromised because unprotected communications can be intercepted and either read or altered. This requirement applies to both internal and external networks and all types of information system components from which information can be transmitted (e.g., servers, mobile devices, notebook computers, printers, copiers, scanners, and facsimile machines). Communication paths outside the physical protection of a controlled boundary are exposed to the possibility of interception and modification. Protecting the confidentiality and integrity of organizational information can be accomplished by physical means (e.g., employing physical distribution systems) or by logical means (e.g., employing cryptographic techniques). If physical means of protection are employed, then logical means (cryptography) do not have to be employed, and vice versa. Satisfies: SRG-OS-000423-GPOS-00187, SRG-OS-000424-GPOS-00188, SRG-OS-000425-GPOS-00189, SRG-OS-000426-GPOS-00190
Fix: F-75439r1091157_fix

The openssh-server package can be installed with the following command: $ sudo dnf install -y openssh-server

b
OL 9 networked systems must have and implement SSH to protect the confidentiality and integrity of transmitted and received information, as well as information during preparation for transmission.
RMF Control
SC-8
Severity
M
CCI
CCI-002418
Version
OL09-00-000251
Vuln IDs
V-271483
Rule IDs
SV-271483r1091161_rule
Without protection of the transmitted information, confidentiality and integrity may be compromised because unprotected communications can be intercepted and either read or altered. This requirement applies to both internal and external networks and all types of information system components from which information can be transmitted (e.g., servers, mobile devices, notebook computers, printers, copiers, scanners, and facsimile machines). Communication paths outside the physical protection of a controlled boundary are exposed to the possibility of interception and modification. Protecting the confidentiality and integrity of organizational information can be accomplished by physical means (e.g., employing physical distribution systems) or by logical means (e.g., employing cryptographic techniques). If physical means of protection are employed, then logical means (cryptography) do not have to be employed, and vice versa. Satisfies: SRG-OS-000423-GPOS-00187, SRG-OS-000424-GPOS-00188, SRG-OS-000425-GPOS-00189, SRG-OS-000426-GPOS-00190
Fix: F-75440r1091160_fix

Enable the sshd service with the following command: $ systemctl enable --now sshd

b
The OL 9 SSH daemon must be configured to use systemwide cryptographic policies.
RMF Control
AC-17
Severity
M
CCI
CCI-001453
Version
OL09-00-000252
Vuln IDs
V-271484
Rule IDs
SV-271484r1092624_rule
Without cryptographic integrity protections, information can be altered by unauthorized users without detection. Remote access (e.g., RDP) is access to DOD nonpublic information systems by an authorized user (or an information system) communicating through an external, nonorganization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless. Cryptographic mechanisms used for protecting the integrity of information include, for example, signed hash functions using asymmetric cryptography enabling distribution of the public key to verify the hash information while maintaining the confidentiality of the secret key used to generate the hash. OL 9 incorporates systemwide crypto policies by default. The SSH configuration file has no effect on the ciphers, MACs, or algorithms unless specifically defined in the /etc/sysconfig/sshd file. The employed algorithms can be viewed in the /etc/crypto-policies/back-ends/ directory.
Fix: F-75441r1092623_fix

Configure the OL 9 SSH daemon to use systemwide cryptographic policies by running the following commands: $ sudo dnf reinstall -y openssh-server

b
OL 9 SSH server must be configured to use only ciphers employing FIPS 140-3 validated cryptographic hash algorithms to protect the confidentiality of SSH server connections.
RMF Control
AC-17
Severity
M
CCI
CCI-001453
Version
OL09-00-000254
Vuln IDs
V-271485
Rule IDs
SV-271485r1092625_rule
Without cryptographic integrity protections, information can be altered by unauthorized users without detection. Remote access (e.g., RDP) is access to DOD nonpublic information systems by an authorized user (or an information system) communicating through an external, nonorganization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless. Cryptographic mechanisms used for protecting the integrity of information include, for example, signed hash functions using asymmetric cryptography enabling distribution of the public key to verify the hash information while maintaining the confidentiality of the secret key used to generate the hash. OL 9 incorporates systemwide crypto policies by default. The SSH configuration file has no effect on the ciphers, MACs, or algorithms unless specifically defined in the /etc/sysconfig/sshd file. The employed algorithms can be viewed in the /etc/crypto-policies/back-ends/opensshserver.config file.
Fix: F-75442r1091166_fix

Configure the OL 9 SSH server to use only ciphers employing FIPS 140-3 approved algorithms. Reinstall crypto-policies with the following command: $ sudo dnf -y reinstall crypto-policies Set the crypto-policy to FIPS with the following command: $ sudo update-crypto-policies --set FIPS Setting system policy to FIPS Note: Systemwide crypto policies are applied on application startup. It is recommended to restart the system for the change of policies to fully take place.

b
OL 9 SSH server must be configured to use only Message Authentication Codes (MACs) employing FIPS 140-3 validated cryptographic hash algorithms to protect the confidentiality of SSH server connections.
RMF Control
AC-17
Severity
M
CCI
CCI-001453
Version
OL09-00-000255
Vuln IDs
V-271486
Rule IDs
SV-271486r1092626_rule
Without cryptographic integrity protections, information can be altered by unauthorized users without detection. Remote access (e.g., RDP) is access to DOD nonpublic information systems by an authorized user (or an information system) communicating through an external, nonorganization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless. Cryptographic mechanisms used for protecting the integrity of information include, for example, signed hash functions using asymmetric cryptography enabling distribution of the public key to verify the hash information while maintaining the confidentiality of the secret key used to generate the hash. OL 9 incorporates systemwide crypto policies by default. The SSH configuration file has no effect on the ciphers, MACs, or algorithms unless specifically defined in the /etc/sysconfig/sshd file. The employed algorithms can be viewed in the /etc/crypto-policies/back-ends/opensshserver.config file.
Fix: F-75443r1091169_fix

Configure the OL 9 SSH server to use only MACs employing FIPS 140-3 approved algorithms. Reinstall crypto-policies with the following command: $ sudo dnf -y reinstall crypto-policies Set the crypto-policy to FIPS with the following command: $ sudo update-crypto-policies --set FIPS Setting system policy to FIPS Note: Systemwide crypto policies are applied on application startup. It is recommended to restart the system for the change of policies to fully take place.

b
OL 9 must display the Standard Mandatory DOD Notice and Consent Banner before granting local or remote access to the system via a SSH logon.
RMF Control
AC-8
Severity
M
CCI
CCI-000048
Version
OL09-00-000256
Vuln IDs
V-271487
Rule IDs
SV-271487r1091173_rule
The warning message reinforces policy awareness during the logon process and facilitates possible legal action against attackers. Alternatively, systems whose ownership should not be obvious should ensure usage of a banner that does not provide easy attribution. Satisfies: SRG-OS-000023-GPOS-00006, SRG-OS-000228-GPOS-00088
Fix: F-75444r1091172_fix

Configure OL 9 to display the Standard Mandatory DOD Notice and Consent Banner before granting access to the system via ssh. Edit the "etc/ssh/sshd_config" file or a file in "/etc/ssh/sshd_config.d" to uncomment the banner keyword and configure it to point to a file that will contain the logon banner (this file may be named differently or be in a different location if using a version of SSH that is provided by a third-party vendor). An example configuration line is: Banner /etc/issue

b
OL 9 must have the openssh-clients package installed.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-000260
Vuln IDs
V-271488
Rule IDs
SV-271488r1091176_rule
This package includes utilities to make encrypted connections and transfer files securely to SSH servers.
Fix: F-75445r1091175_fix

Install the openssh-clients package with the following command: $ sudo dnf install -y openssh-clients

b
OL 9 SSH client must be configured to use only DOD-approved encryption ciphers employing FIPS 140-3 validated cryptographic hash algorithms to protect the confidentiality of SSH client connections.
RMF Control
AC-17
Severity
M
CCI
CCI-001453
Version
OL09-00-000261
Vuln IDs
V-271489
Rule IDs
SV-271489r1092627_rule
Without cryptographic integrity protections, information can be altered by unauthorized users without detection. Remote access (e.g., RDP) is access to DOD nonpublic information systems by an authorized user (or an information system) communicating through an external, nonorganization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless. Cryptographic mechanisms used for protecting the integrity of information include, for example, signed hash functions using asymmetric cryptography enabling distribution of the public key to verify the hash information while maintaining the confidentiality of the secret key used to generate the hash. OL 9 incorporates systemwide crypto policies by default. The SSH configuration file has no effect on the ciphers, MACs, or algorithms unless specifically defined in the /etc/sysconfig/sshd file. The employed algorithms can be viewed in the /etc/crypto-policies/back-ends/opensshserver.config file.
Fix: F-75446r1091178_fix

Configure the SSH client to use only ciphers employing FIPS 140-3 approved algorithms. Reinstall crypto-policies with the following command: $ sudo dnf -y reinstall crypto-policies Set the crypto-policy to FIPS with the following command: $ sudo update-crypto-policies --set FIPS Setting system policy to FIPS Note: Systemwide crypto policies are applied on application startup. It is recommended to restart the system for the change of policies to fully take place.

b
OL 9 SSH client must be configured to use only DOD-approved Message Authentication Codes (MACs) employing FIPS 140-3 validated cryptographic hash algorithms to protect the confidentiality of SSH client connections.
RMF Control
AC-17
Severity
M
CCI
CCI-001453
Version
OL09-00-000262
Vuln IDs
V-271490
Rule IDs
SV-271490r1092628_rule
Without cryptographic integrity protections, information can be altered by unauthorized users without detection. Remote access (e.g., RDP) is access to DOD nonpublic information systems by an authorized user (or an information system) communicating through an external, nonorganization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless. Cryptographic mechanisms used for protecting the integrity of information include, for example, signed hash functions using asymmetric cryptography enabling distribution of the public key to verify the hash information while maintaining the confidentiality of the secret key used to generate the hash. OL 9 incorporates systemwide crypto policies by default. The SSH configuration file has no effect on the ciphers, MACs, or algorithms unless specifically defined in the /etc/sysconfig/sshd file. The employed algorithms can be viewed in the /etc/crypto-policies/back-ends/opensshserver.config file.
Fix: F-75447r1091181_fix

Configure the SSH client to use only MACs employing FIPS 140-3 approved algorithms. Reinstall crypto-policies with the following command: $ sudo dnf -y reinstall crypto-policies Set the crypto-policy to FIPS with the following command: $ sudo update-crypto-policies --set FIPS Setting system policy to FIPS Note: Systemwide crypto policies are applied on application startup. It is recommended to restart the system for the change of policies to fully take place.

b
OL 9 must have the openssl-pkcs11 package installed.
RMF Control
IA-2
Severity
M
CCI
CCI-000765
Version
OL09-00-000270
Vuln IDs
V-271491
Rule IDs
SV-271491r1091185_rule
Without the use of multifactor authentication, the ease of access to privileged functions is greatly increased. Multifactor authentication requires using two or more factors to achieve authentication. A privileged account is defined as an information system account with authorizations of a privileged user. The DOD CAC with DOD-approved PKI is an example of multifactor authentication. Satisfies: SRG-OS-000105-GPOS-00052, SRG-OS-000375-GPOS-00160, SRG-OS-000376-GPOS-00161, SRG-OS-000377-GPOS-00162
Fix: F-75448r1091184_fix

Install the openssl-pkcs11 package with the following command: $ sudo dnf install -y openssl-pkcs11

b
OL 9 must have the SSSD package installed.
RMF Control
Severity
M
CCI
CCI-004046
Version
OL09-00-000285
Vuln IDs
V-271493
Rule IDs
SV-271493r1091191_rule
Using an authentication device, such as a CAC or token that is separate from the information system, ensures that even if the information system is compromised, that compromise will not affect credentials stored on the authentication device. Multifactor solutions that require devices separate from information systems gaining access include, for example, hardware tokens providing time-based or challenge-response authenticators and smart cards such as the U.S. Government Personal Identity Verification card and the DOD Common Access Card. A privileged account is defined as an information system account with authorizations of a privileged user. Remote access is access to DOD nonpublic information systems by an authorized user (or an information system) communicating through an external, nonorganization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless. This requirement only applies to components where this is specific to the function of the device or has the concept of an organizational user (e.g., VPN, proxy capability). This does not apply to authentication for the purpose of configuring the device itself (management). Satisfies: SRG-OS-000705-GPOS-00150, SRG-OS-000105-GPOS-00052, SRG-OS-000106-GPOS-00053, SRG-OS-000107-GPOS-00054, SRG-OS-000108-GPOS-00055, SRG-OS-000375-GPOS-00160
Fix: F-75450r1091190_fix

Install the SSSD package with the following command: $ sudo dnf install -y sssd

b
OL 9 must use the SSSD package for multifactor authentication services.
RMF Control
Severity
M
CCI
CCI-004046
Version
OL09-00-000286
Vuln IDs
V-271494
Rule IDs
SV-271494r1091194_rule
Using an authentication device, such as a CAC or token that is separate from the information system, ensures that even if the information system is compromised, that compromise will not affect credentials stored on the authentication device. Multifactor solutions that require devices separate from information systems gaining access include, for example, hardware tokens providing time-based or challenge-response authenticators and smart cards such as the U.S. Government Personal Identity Verification card and the DOD Common Access Card. A privileged account is defined as an information system account with authorizations of a privileged user. Without the use of multifactor authentication, the ease of access to privileged functions is greatly increased. Multifactor authentication requires using two or more factors to achieve authentication. Factors include: 1) Something a user knows (e.g., password/PIN); 2) Something a user has (e.g., cryptographic identification device, token); and 3) Something a user is (e.g., biometric). A privileged account is defined as an information system account with authorizations of a privileged user. Network access is defined as access to an information system by a user (or a process acting on behalf of a user) communicating through a network (e.g., local area network, wide area network, or the internet). The DOD common access card (CAC) with DOD-approved PKI is an example of multifactor authentication. Satisfies: SRG-OS-000705-GPOS-00150, SRG-OS-000105-GPOS-00052, SRG-OS-000106-GPOS-00053, SRG-OS-000107-GPOS-00054, SRG-OS-000108-GPOS-00055, SRG-OS-000375-GPOS-00161
Fix: F-75451r1091193_fix

Configure the sssd.service to start automatically on reboot with the following command: $ sudo systemctl enable sssd.service Ensure the sssd service is running: $ sudo systemctl start sssd.service

b
OL 9 must have the s-nail package installed.
RMF Control
CM-3
Severity
M
CCI
CCI-001744
Version
OL09-00-000290
Vuln IDs
V-271495
Rule IDs
SV-271495r1091197_rule
The s-nail package provides the mail command required to allow sending email notifications of unauthorized configuration changes to designated personnel.
Fix: F-75452r1091196_fix

Install the s-nail package with the following command: $ sudo dnf install -y s-nail

b
OL 9 must have the Advanced Intrusion Detection Environment (AIDE) package installed.
RMF Control
CM-3
Severity
M
CCI
CCI-001744
Version
OL09-00-000300
Vuln IDs
V-271496
Rule IDs
SV-271496r1091200_rule
Without verification of the security functions, security functions may not operate correctly, and the failure may go unnoticed. Security function is defined as the hardware, software, and/or firmware of the information system responsible for enforcing the system security policy and supporting the isolation of code and data on which the protection is based. Security functionality includes, but is not limited to, establishing system accounts, configuring access authorizations (i.e., permissions, privileges), setting events to be audited, and setting intrusion detection parameters. Satisfies: SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199
Fix: F-75453r1091199_fix

Install AIDE, initialize it, and perform a manual check. Install AIDE: $ sudo dnf install -y aide Initialize AIDE: $ sudo /usr/sbin/aide --init Example output: Start timestamp: 2023-06-05 10:09:04 -0600 (AIDE 0.16) AIDE initialized database at /var/lib/aide/aide.db.new.gz Number of entries: 86833 --------------------------------------------------- The attributes of the (uncompressed) database(s): --------------------------------------------------- /var/lib/aide/aide.db.new.gz MD5 : coZUtPHhoFoeD7+k54fUvQ== SHA1 : DVpOEMWJwo0uPgrKZAygIUgSxeM= SHA256 : EQiZH0XNEk001tcDmJa+5STFEjDb4MPE TGdBJ/uvZKc= SHA512 : 86KUqw++PZhoPK0SZvT3zuFq9yu9nnPP toei0nENVELJ1LPurjoMlRig6q69VR8l +44EwO9eYyy9nnbzQsfG1g== End timestamp: 2023-06-05 10:09:57 -0600 (run time: 0m 53s) The new database will need to be renamed to be read by AIDE: $ sudo mv /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz Perform a manual check: $ sudo /usr/sbin/aide --check Example output: 2023-06-05 10:16:08 -0600 (AIDE 0.16) AIDE found NO differences between database and filesystem. Looks okay!!

b
OL 9 must have the chrony package installed.
RMF Control
Severity
M
CCI
CCI-004923
Version
OL09-00-000310
Vuln IDs
V-271501
Rule IDs
SV-271501r1091215_rule
Inaccurate time stamps make it more difficult to correlate events and can lead to an inaccurate analysis. Determining the correct time a particular event occurred on a system is critical when conducting forensic analysis and investigating system events. Sources outside the configured acceptable allowance (drift) may be inaccurate.
Fix: F-75458r1091214_fix

Install the chrony package with the following command: $ sudo dnf install -y chrony

b
OL 9 must enable the chronyd service.
RMF Control
Severity
M
CCI
CCI-004923
Version
OL09-00-000311
Vuln IDs
V-271502
Rule IDs
SV-271502r1091218_rule
Inaccurate time stamps make it more difficult to correlate events and can lead to an inaccurate analysis. Determining the correct time a particular event occurred on a system is critical when conducting forensic analysis and investigating system events. Sources outside the configured acceptable allowance (drift) may be inaccurate. Synchronizing internal information system clocks provides uniformity of time stamps for information systems with multiple system clocks and systems connected over a network.
Fix: F-75459r1091217_fix

Enable the chronyd service with the following command: $ sudo systemctl enable --now chronyd

b
OL 9 must have the USBGuard package installed.
RMF Control
IA-3
Severity
M
CCI
CCI-001958
Version
OL09-00-000320
Vuln IDs
V-271503
Rule IDs
SV-271503r1091221_rule
The USBguard-daemon is the main component of the USBGuard software framework. It runs as a service in the background and enforces the USB device authorization policy for all USB devices. The policy is defined by a set of rules using a rule language described in the usbguard-rules.conf file. The policy and the authorization state of USB devices can be modified during runtime using the usbguard tool. The system administrator (SA) must work with the site information system security officer (ISSO) to determine a list of authorized peripherals and establish rules within the USBGuard software framework to allow only authorized devices.
Fix: F-75460r1091220_fix

Install the usbguard package with the following command: $ sudo dnf install -y usbguard

b
OL 9 must enable the USBGuard package.
RMF Control
IA-3
Severity
M
CCI
CCI-001958
Version
OL09-00-000321
Vuln IDs
V-271504
Rule IDs
SV-271504r1091224_rule
The USBguard-daemon is the main component of the USBGuard software framework. It runs as a service in the background and enforces the USB device authorization policy for all USB devices. The policy is defined by a set of rules using a rule language described in the usbguard-rules.conf file. The policy and the authorization state of USB devices can be modified during runtime using the usbguard tool. The system administrator (SA) must work with the site information system security officer (ISSO) to determine a list of authorized peripherals and establish rules within the USBGuard software framework to allow only authorized devices.
Fix: F-75461r1091223_fix

Enable the USBGuard service with the following command: $ sudo systemctl enable --now usbguard

b
OL 9 must have the subscription-manager package installed.
RMF Control
Severity
M
CCI
CCI-003992
Version
OL09-00-000330
Vuln IDs
V-271505
Rule IDs
SV-271505r1092629_rule
Oracle Linux Manager, based on the Spacewalk open source software, helps automate Oracle Linux systems management. This enables users to control the system software life cycle from initial installation through maintenance, software configuration, upgrades, and eventual decommissioning. Oracle Linux Manager also helps automate a kickstart installation, system configuration, and maintenance tasks, which enables rapid deployment of proven and consistent software configurations for Oracle Linux systems.
Fix: F-75462r1091226_fix

Install the oracle-linux-manager package with the following command: $ sudo dnf install -y oracle-linux-manager-client-release-el9

b
OL 9 must have the fapolicy module installed.
RMF Control
CM-7
Severity
M
CCI
CCI-001774
Version
OL09-00-000340
Vuln IDs
V-271506
Rule IDs
SV-271506r1091230_rule
The organization must identify authorized software programs and permit execution of authorized software. The process used to identify software programs that are authorized to execute on organizational information systems is commonly referred to as allowlisting. Using an allowlist provides a configuration management method for allowing the execution of only authorized software. Using only authorized software decreases risk by limiting the number of potential vulnerabilities. Verification of allowlisted software occurs prior to execution or at system startup. User home directories/folders may contain information of a sensitive nature. Nonprivileged users should coordinate any sharing of information with a system administrator (SA) through shared resources. OL 9 ships with many optional packages. One such package is a file access policy daemon called "fapolicyd". "fapolicyd" is a userspace daemon that determines access rights to files based on attributes of the process and file. It can be used to either blocklist or allowlist processes or file access. Proceed with caution with enforcing the use of this daemon. Improper configuration may render the system nonfunctional. The "fapolicyd" API is not namespace aware and can cause issues when launching or running containers. Satisfies: SRG-OS-000370-GPOS-00155, SRG-OS-000368-GPOS-00154
Fix: F-75463r1091229_fix

Install the fapolicyd package with the following command: $ sudo dnf install -y fapolicyd

b
OL 9 must enable the fapolicy module.
RMF Control
CM-7
Severity
M
CCI
CCI-001774
Version
OL09-00-000341
Vuln IDs
V-271507
Rule IDs
SV-271507r1091233_rule
The organization must identify authorized software programs and permit execution of authorized software. The process used to identify software programs that are authorized to execute on organizational information systems is commonly referred to as allowlisting. Using an allowlist provides a configuration management method for allowing the execution of only authorized software. Using only authorized software decreases risk by limiting the number of potential vulnerabilities. Verification of allowlisted software occurs prior to execution or at system startup. User home directories/folders may contain information of a sensitive nature. Nonprivileged users should coordinate any sharing of information with a system administrator (SA) through shared resources. OL 9 ships with many optional packages. One such package is a file access policy daemon called "fapolicyd". "fapolicyd" is a userspace daemon that determines access rights to files based on attributes of the process and file. It can be used to either blocklist or allowlist processes or file access. Proceed with caution with enforcing the use of this daemon. Improper configuration may render the system nonfunctional. The "fapolicyd" API is not namespace aware and can cause issues when launching or running containers. Satisfies: SRG-OS-000370-GPOS-00155, SRG-OS-000368-GPOS-00154
Fix: F-75464r1091232_fix

Enable the fapolicyd service with the following command: $ sudo systemctl enable --now fapolicyd

b
OL 9 must have the rsyslog package installed.
RMF Control
AU-4
Severity
M
CCI
CCI-001851
Version
OL09-00-000350
Vuln IDs
V-271508
Rule IDs
SV-271508r1091236_rule
rsyslogd is a system utility providing support for message logging. Support for both internet and Unix domain sockets enables this utility to support both local and remote logging. Couple this utility with "gnutls" (which is a secure communications library implementing the SSL, TLS, and DTLS protocols), to create a method to securely encrypt and offload auditing. Satisfies: SRG-OS-000479-GPOS-00224, SRG-OS-000051-GPOS-00024
Fix: F-75465r1091235_fix

The rsyslogd package can be installed with the following command: $ sudo dnf install -y rsyslogd

b
OL 9 must be configured so that the rsyslog service is active.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-000351
Vuln IDs
V-271509
Rule IDs
SV-271509r1091239_rule
The rsyslog service must be running to provide logging services, which are essential to system administration.
Fix: F-75466r1091238_fix

Enable the rsyslog service with the following command: $ sudo systemctl enable --now rsyslog

b
OL 9 must have the packages required for encrypting offloaded audit logs installed.
RMF Control
IA-7
Severity
M
CCI
CCI-000803
Version
OL09-00-000355
Vuln IDs
V-271510
Rule IDs
SV-271510r1091242_rule
The rsyslog-gnutls package provides Transport Layer Security (TLS) support for the rsyslog daemon, which enables secure remote logging.
Fix: F-75467r1091241_fix

Install the rsyslog-gnutls package with the following command: $ sudo dnf install -y rsyslog-gnutls

a
OL 9 must enable the hardware random number generator entropy gatherer service.
RMF Control
CM-6
Severity
L
CCI
CCI-000366
Version
OL09-00-000360
Vuln IDs
V-271511
Rule IDs
SV-271511r1091245_rule
The most important characteristic of a random number generator is its randomness, namely its ability to deliver random numbers that are impossible to predict. Entropy in computer security is associated with the unpredictability of a source of randomness. The random source with high entropy tends to achieve a uniform distribution of random values. Random number generators are one of the most important building blocks of cryptosystems. The rngd service feeds random data from hardware device to kernel random device. Quality (nonpredictable) random number generation is important for several security functions (i.e., ciphers).
Fix: F-75468r1091244_fix

Install the rng-tools package with the following command: $ sudo dnf install -y rng-tools Enable the rngd service run the following command: $ sudo systemctl enable --now rngd

b
OL 9 must have the rng-tools package installed.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-000370
Vuln IDs
V-271512
Rule IDs
SV-271512r1091248_rule
rng-tools provides hardware random number generator tools, such as those used in the formation of x509/PKI certificates.
Fix: F-75469r1091247_fix

Install the rng-tools package with the following command: $ sudo dnf install -y rng-tools

b
OL 9 must have the nss-tools package installed.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-000380
Vuln IDs
V-271513
Rule IDs
SV-271513r1091251_rule
Network Security Services (NSS) is a set of libraries designed to support cross-platform development of security-enabled client and server applications. Install the "nss-tools" package to install command-line tools to manipulate the NSS certificate and key database.
Fix: F-75470r1091250_fix

Install the nss-tools package with the following command: $ sudo dnf install -y nss-tools

b
OL 9 must have the pcsc-lite package installed.
RMF Control
Severity
M
CCI
CCI-004046
Version
OL09-00-000390
Vuln IDs
V-271514
Rule IDs
SV-271514r1091254_rule
The pcsc-lite package must be installed if it is to be available for multifactor authentication using smart cards.
Fix: F-75471r1091253_fix

Install the pcsc-lite package with the following command: $ sudo dnf install -y pcsc-lite

b
OL 9 must have the opensc package installed.
RMF Control
Severity
M
CCI
CCI-004046
Version
OL09-00-000400
Vuln IDs
V-271515
Rule IDs
SV-271515r1091257_rule
The use of PIV credentials facilitates standardization and reduces the risk of unauthorized access. The DOD has mandated the use of the Common Access Card (CAC) to support identity management and personal authentication for systems covered under Homeland Security Presidential Directive (HSPD) 12, as well as making the CAC a primary component of layered protection for national security systems. Satisfies: SRG-OS-000375-GPOS-00160, SRG-OS-000376-GPOS-00161
Fix: F-75472r1091256_fix

Install the opensc package with the following command: $ sudo dnf install -y opensc

b
OL 9 must be configured so that the pcscd service is active.
RMF Control
Severity
M
CCI
CCI-004046
Version
OL09-00-000401
Vuln IDs
V-271516
Rule IDs
SV-271516r1091260_rule
The information system ensures that even if the information system is compromised, that compromise will not affect credentials stored on the authentication device. The daemon program for pcsc-lite and the MuscleCard framework is pcscd. It is a resource manager that coordinates communications with smart card readers and smart cards and cryptographic tokens that are connected to the system.
Fix: F-75473r1091259_fix

Enable the pcscd service with the following command: $ sudo systemctl enable --now pcscd

b
OL 9 must have the libreswan package installed.
RMF Control
IA-7
Severity
M
CCI
CCI-000803
Version
OL09-00-000410
Vuln IDs
V-271517
Rule IDs
SV-271517r1101885_rule
Providing the ability for remote users or systems to initiate a secure VPN connection protects information when it is transmitted over a wide area network.
Fix: F-75474r1091262_fix

Install the libreswan service (if it is not already installed) with the following command: $ sudo dnf install -y libreswan

b
OL 9 must have the gnutls-utils package installed.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-000430
Vuln IDs
V-271518
Rule IDs
SV-271518r1091266_rule
GnuTLS is a secure communications library implementing the SSL, TLS, and DTLS protocols and technologies around them. It provides a simple C language application programming interface (API) to access the secure communications protocols as well as APIs to parse and write X.509, PKCS #12, OpenPGP and other required structures. This package contains command line TLS client and server and certificate manipulation tools.
Fix: F-75475r1091265_fix

Install the gnutls-utils package with the following command: $ sudo dnf install -y gnutls-utils

b
OL 9 must have the audit package installed.
RMF Control
AU-12
Severity
M
CCI
CCI-000169
Version
OL09-00-000440
Vuln IDs
V-271519
Rule IDs
SV-271519r1091269_rule
Without establishing what type of events occurred, the source of events, where events occurred, and the outcome of events, it would be difficult to establish, correlate, and investigate the events leading up to an outage or attack. Audit record content that may be necessary to satisfy this requirement includes, for example, time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, filenames involved, and access control or flow control rules invoked. Associating event types with detected events in audit logs provides a means of investigating an attack, recognizing resource utilization or capacity thresholds, or identifying an improperly configured OL 9 system. Satisfies: SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SRG-OS-000055-GPOS-00026
Fix: F-75476r1091268_fix

Install the audit service package (if the audit service is not already installed) with the following command: $ sudo dnf install -y audit

b
OL 9 audit service must be enabled.
RMF Control
AU-12
Severity
M
CCI
CCI-000169
Version
OL09-00-000441
Vuln IDs
V-271520
Rule IDs
SV-271520r1091272_rule
Without establishing what type of events occurred, it would be difficult to establish, correlate, and investigate the events leading up to an outage or attack. Ensuring the "auditd" service is active ensures audit records generated by the kernel are appropriately recorded. Additionally, a properly configured audit subsystem ensures that actions of individual system users can be uniquely traced to those users so they can be held accountable for their actions. Satisfies: SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220
Fix: F-75477r1091271_fix

Enable the auditd service with the following command: $ sudo systemctl enable --now auditd

b
OL 9 must have the audispd-plugins package installed.
RMF Control
AU-4
Severity
M
CCI
CCI-001851
Version
OL09-00-000450
Vuln IDs
V-271521
Rule IDs
SV-271521r1091275_rule
audispd-plugins provides plug-ins for the real-time interface to the audit subsystem, audispd. These plug-ins can do things like relay events to remote machines or analyze events for suspicious behavior.
Fix: F-75478r1091274_fix

The audispd-plugins package can be installed with the following command: $ sudo dnf install -y audispd-plugins

a
OL 9 must remove all software components after updated versions have been installed.
RMF Control
SI-2
Severity
L
CCI
CCI-002617
Version
OL09-00-000495
Vuln IDs
V-271522
Rule IDs
SV-271522r1091278_rule
Previous versions of software components that are not removed from the information system after updates have been installed may be exploited by some adversaries.
Fix: F-75479r1091277_fix

Configure OL 9 to remove all software components after updated versions have been installed. Edit the file /etc/dnf/dnf.conf by adding or editing the following line: clean_requirements_on_remove=1

c
OL 9 must check the GPG signature of locally installed software packages before installation.
RMF Control
Severity
H
CCI
CCI-003992
Version
OL09-00-000496
Vuln IDs
V-271523
Rule IDs
SV-271523r1091281_rule
Changes to any software components can have significant effects on the overall security of the operating system. This requirement ensures the software has not been tampered with and that it has been provided by a trusted vendor. All software packages must be signed with a cryptographic key recognized and approved by the organization. Verifying the authenticity of software prior to installation validates the integrity of the software package received from a vendor. This verifies the software has not been tampered with and that it has been provided by a trusted vendor.
Fix: F-75480r1091280_fix

Configure dnf to always check the GPG signature of local software packages before installation. Add or update the following line in the [main] section of the /etc/dnf/dnf.conf file: localpkg_gpgcheck=1

c
OL 9 must check the GPG signature of software packages originating from external software repositories before installation.
RMF Control
Severity
H
CCI
CCI-003992
Version
OL09-00-000497
Vuln IDs
V-271524
Rule IDs
SV-271524r1091284_rule
Changes to any software components can have significant effects on the overall security of the operating system. This requirement ensures the software has not been tampered with and that it has been provided by a trusted vendor. All software packages must be signed with a cryptographic key recognized and approved by the organization. Verifying the authenticity of software prior to installation validates the integrity of the software package received from a vendor. This verifies the software has not been tampered with and that it has been provided by a trusted vendor.
Fix: F-75481r1091283_fix

Configure dnf to always check the GPG signature of software packages originating from external software repositories before installation. Add or update the following line in the [main] section of the /etc/dnf/dnf.conf file: gpgcheck=1

c
OL 9 must have GPG signature verification enabled for all software repositories.
RMF Control
Severity
H
CCI
CCI-003992
Version
OL09-00-000498
Vuln IDs
V-271525
Rule IDs
SV-271525r1091287_rule
Changes to any software components can have significant effects on the overall security of the operating system. This requirement ensures the software has not been tampered with and that it has been provided by a trusted vendor. All software packages must be signed with a cryptographic key recognized and approved by the organization. Verifying the authenticity of software prior to installation validates the integrity of the software package received from a vendor. This verifies the software has not been tampered with and that it has been provided by a trusted vendor.
Fix: F-75482r1091286_fix

Configure all software repositories defined in "/etc/yum.repos.d/" to have "gpgcheck" enabled: $ sudo sed -i 's/gpgcheck\s*=.*/gpgcheck=1/g' /etc/yum.repos.d/*

b
OL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/sudoers.
RMF Control
AC-2
Severity
M
CCI
CCI-000018
Version
OL09-00-000500
Vuln IDs
V-271527
Rule IDs
SV-271527r1092474_rule
The actions taken by system administrators must be audited to keep a record of what was executed on the system, as well as for accountability purposes. Editing the sudoers file may be sign of an attacker trying to establish persistent methods to a system, auditing the editing of the sudoers files mitigates this risk. Satisfies: SRG-OS-000004-GPOS-00004, SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000304-GPOS-00121, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000470-GPOS-00214, SRG-OS-000471-GPOS-00215, SRG-OS-000239-GPOS-00089, SRG-OS-000240-GPOS-00090, SRG-OS-000241-GPOS-00091, SRG-OS-000303-GPOS-00120, SRG-OS-000466-GPOS-00210, SRG-OS-000476-GPOS-00221
Fix: F-75484r1092473_fix

Configure OL 9 to generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/sudoers". Add or update the following file system rule to "/etc/audit/rules.d/audit.rules": -w /etc/sudoers -p wa -k identity The audit daemon must be restarted for the changes to take effect. Restart auditd: $ sudo service auditd restart

b
OL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/sudoers.d/ directory.
RMF Control
AC-2
Severity
M
CCI
CCI-000018
Version
OL09-00-000505
Vuln IDs
V-271528
Rule IDs
SV-271528r1092476_rule
The actions taken by system administrators must be audited to keep a record of what was executed on the system, as well as for accountability purposes. Editing the sudoers file may be sign of an attacker trying to establish persistent methods to a system, auditing the editing of the sudoers files mitigates this risk. Satisfies: SRG-OS-000004-GPOS-00004, SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000304-GPOS-00121, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000470-GPOS-00214, SRG-OS-000471-GPOS-00215, SRG-OS-000239-GPOS-00089, SRG-OS-000240-GPOS-00090, SRG-OS-000241-GPOS-00091, SRG-OS-000303-GPOS-00120, SRG-OS-000466-GPOS-00210, SRG-OS-000476-GPOS-00221
Fix: F-75485r1092475_fix

Configure OL 9 to generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/sudoers.d/". Add or update the following file system rule to "/etc/audit/rules.d/audit.rules": -w /etc/sudoers.d/ -p wa -k identity The audit daemon must be restarted for the changes to take effect. Restart auditd: $ sudo service auditd restart

b
OL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/group.
RMF Control
AC-2
Severity
M
CCI
CCI-000018
Version
OL09-00-000510
Vuln IDs
V-271529
Rule IDs
SV-271529r1092478_rule
In addition to auditing new user and group accounts, these watches will alert the system administrator(s) to any modifications. Any unexpected users, groups, or modifications must be investigated for legitimacy. Satisfies: SRG-OS-000004-GPOS-00004, SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000304-GPOS-00121, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000470-GPOS-00214, SRG-OS-000471-GPOS-00215, SRG-OS-000239-GPOS-00089, SRG-OS-000240-GPOS-00090, SRG-OS-000241-GPOS-00091, SRG-OS-000303-GPOS-00120, SRG-OS-000466-GPOS-00210, SRG-OS-000476-GPOS-00221
Fix: F-75486r1092477_fix

Configure OL 9 to generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/group". Add or update the following file system rule to "/etc/audit/rules.d/audit.rules": -w /etc/group -p wa -k identity The audit daemon must be restarted for the changes to take effect. Restart auditd: $ sudo service auditd restart

b
OL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/gshadow.
RMF Control
AC-2
Severity
M
CCI
CCI-000018
Version
OL09-00-000515
Vuln IDs
V-271530
Rule IDs
SV-271530r1092480_rule
In addition to auditing new user and group accounts, these watches will alert the system administrator(s) to any modifications. Any unexpected users, groups, or modifications should be investigated for legitimacy. Satisfies: SRG-OS-000004-GPOS-00004, SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000304-GPOS-00121, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000470-GPOS-00214, SRG-OS-000471-GPOS-00215, SRG-OS-000239-GPOS-00089, SRG-OS-000240-GPOS-00090, SRG-OS-000241-GPOS-00091, SRG-OS-000303-GPOS-00120, SRG-OS-000466-GPOS-00210, SRG-OS-000476-GPOS-00221
Fix: F-75487r1092479_fix

Configure OL 9 to generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/gshadow". Add or update the following file system rule to "/etc/audit/rules.d/audit.rules": -w /etc/gshadow -p wa -k identity The audit daemon must be restarted for the changes to take effect. Restart auditd: $ sudo service auditd restart

b
OL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/opasswd.
RMF Control
AC-2
Severity
M
CCI
CCI-000018
Version
OL09-00-000520
Vuln IDs
V-271531
Rule IDs
SV-271531r1092482_rule
In addition to auditing new user and group accounts, these watches will alert the system administrator(s) to any modifications. Any unexpected users, groups, or modifications should be investigated for legitimacy. Satisfies: SRG-OS-000004-GPOS-00004, SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000304-GPOS-00121, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000470-GPOS-00214, SRG-OS-000471-GPOS-00215, SRG-OS-000239-GPOS-00089, SRG-OS-000240-GPOS-00090, SRG-OS-000241-GPOS-00091, SRG-OS-000303-GPOS-00120, SRG-OS-000466-GPOS-00210, SRG-OS-000476-GPOS-00221
Fix: F-75488r1092481_fix

Configure OL 9 to generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/security/opasswd". Add or update the following file system rule to "/etc/audit/rules.d/audit.rules": -w /etc/security/opasswd -p wa -k identity The audit daemon must be restarted for the changes to take effect. Restart auditd: $ sudo service auditd restart

b
OL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/passwd.
RMF Control
AC-2
Severity
M
CCI
CCI-000018
Version
OL09-00-000525
Vuln IDs
V-271532
Rule IDs
SV-271532r1092484_rule
In addition to auditing new user and group accounts, these watches will alert the system administrator(s) to any modifications. Any unexpected users, groups, or modifications should be investigated for legitimacy. Satisfies: SRG-OS-000004-GPOS-00004, SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000304-GPOS-00121, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000470-GPOS-00214, SRG-OS-000471-GPOS-00215, SRG-OS-000239-GPOS-00089, SRG-OS-000240-GPOS-00090, SRG-OS-000241-GPOS-00091, SRG-OS-000303-GPOS-00120, SRG-OS-000466-GPOS-00210, SRG-OS-000476-GPOS-00221, SRG-OS-000274-GPOS-00104, SRG-OS-000275-GPOS-00105, SRG-OS-000276-GPOS-00106, SRG-OS-000277-GPOS-00107
Fix: F-75489r1092483_fix

Configure OL 9 to generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/passwd". Add or update the following file system rule to "/etc/audit/rules.d/audit.rules": -w /etc/passwd -p wa -k identity The audit daemon must be restarted for the changes to take effect. Restart auditd: $ sudo service auditd restart

b
OL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/shadow.
RMF Control
AC-2
Severity
M
CCI
CCI-000018
Version
OL09-00-000530
Vuln IDs
V-271533
Rule IDs
SV-271533r1092486_rule
In addition to auditing new user and group accounts, these watches will alert the system administrator(s) to any modifications. Any unexpected users, groups, or modifications should be investigated for legitimacy. Satisfies: SRG-OS-000004-GPOS-00004, SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000304-GPOS-00121, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000470-GPOS-00214, SRG-OS-000471-GPOS-00215, SRG-OS-000239-GPOS-00089, SRG-OS-000240-GPOS-00090, SRG-OS-000241-GPOS-00091, SRG-OS-000303-GPOS-00120, SRG-OS-000466-GPOS-00210, SRG-OS-000476-GPOS-00221
Fix: F-75490r1092485_fix

Configure OL 9 to generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/shadow". Add or update the following file system rule to "/etc/audit/rules.d/audit.rules": -w /etc/shadow -p wa -k identity The audit daemon must be restarted for the changes to take effect. Restart auditd: $ sudo service auditd restart

b
OL 9 must audit all uses of the unix_update command.
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
OL09-00-000535
Vuln IDs
V-271534
Rule IDs
SV-271534r1092488_rule
Without generating audit record specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary since these affect performance. The more rules, the bigger the performance hit. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000064-GPOS-00033, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215
Fix: F-75491r1092487_fix

Configure OL 9 to generate audit records upon successful/unsuccessful attempts to use the "unix_update" command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/sbin/unix_update -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update The audit daemon must be restarted for the changes to take effect. Restart auditd: $ sudo service auditd restart

b
OL 9 must audit all uses of the su command.
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
OL09-00-000540
Vuln IDs
V-271535
Rule IDs
SV-271535r1092490_rule
Without generating audit record specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary since these affect performance. The more rules, the bigger the performance hit. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000064-GPOS-00033, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215, SRG-OS-000466-GPOS-00210
Fix: F-75492r1092489_fix

Configure OL 9 to generate audit records upon successful/unsuccessful attempts to use the su command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/bin/su -F perm=x -F auid>=1000 -F auid!=unset -k privileged-priv_change The audit daemon must be restarted for the changes to take effect. Restart auditd: $ sudo service auditd restart

b
OL 9 must audit all uses of the setxattr, fsetxattr, lsetxattr, removexattr, fremovexattr, and lremovexattr system calls.
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
OL09-00-000545
Vuln IDs
V-271536
Rule IDs
SV-271536r1092492_rule
Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary since these affect performance. The more rules, the bigger the performance hit. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000458-GPOS-00203, SRG-OS-000462-GPOS-00206, SRG-OS-000463-GPOS-00207, SRG-OS-000471-GPOS-00215, SRG-OS-000474-GPOS-00219, SRG-OS-000466-GPOS-00210, SRG-OS-000064-GPOS-00033
Fix: F-75493r1092491_fix

Configure OL 9 to audit the execution of the setxattr, fsetxattr, lsetxattr, removexattr, fremovexattr, and lremovexattr system calls by adding or updating the following lines to "/etc/audit/rules.d/audit.rules": -a always,exit -F arch=b32 -S setxattr,fsetxattr,lsetxattr,removexattr,fremovexattr,lremovexattr -F auid>=1000 -F auid!=unset -k perm_mod -a always,exit -F arch=b64 -S setxattr,fsetxattr,lsetxattr,removexattr,fremovexattr,lremovexattr -F auid>=1000 -F auid!=unset -k perm_mod -a always,exit -F arch=b32 -S setxattr,fsetxattr,lsetxattr,removexattr,fremovexattr,lremovexattr -F auid=0 -k perm_mod -a always,exit -F arch=b64 -S setxattr,fsetxattr,lsetxattr,removexattr,fremovexattr,lremovexattr -F auid=0 -k perm_mod The audit daemon must be restarted for the changes to take effect. Restart auditd: $ sudo service auditd restart

b
OL 9 must audit all uses of the chage command.
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
OL09-00-000550
Vuln IDs
V-271537
Rule IDs
SV-271537r1092494_rule
Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary since these affect performance. The more rules, the bigger the performance hit. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000468-GPOS-00212, SRG-OS-000471-GPOS-00215
Fix: F-75494r1092493_fix

Configure OL 9 to generate audit records upon successful/unsuccessful attempts to use the chage command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/bin/chage -F perm=x -F auid>=1000 -F auid!=unset -k privileged-chage The audit daemon must be restarted for the changes to take effect. Restart auditd: $ sudo service auditd restart

b
OL 9 must audit all uses of the chcon command.
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
OL09-00-000555
Vuln IDs
V-271538
Rule IDs
SV-271538r1092496_rule
Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary since these affect performance. The more rules, the bigger the performance hit. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000468-GPOS-00212, SRG-OS-000471-GPOS-00215, SRG-OS-000463-GPOS-00207, SRG-OS-000465-GPOS-00209
Fix: F-75495r1092495_fix

Configure OL 9 to generate audit records upon successful/unsuccessful attempts to use the chcon command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/bin/chcon -F perm=x -F auid>=1000 -F auid!=unset -k perm_mod The audit daemon must be restarted for the changes to take effect. Restart auditd: $ sudo service auditd restart

b
OL 9 must audit all uses of the setfacl command.
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
OL09-00-000560
Vuln IDs
V-271539
Rule IDs
SV-271539r1092498_rule
Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary since these affect performance. The more rules, the bigger the performance hit. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215
Fix: F-75496r1092497_fix

Configure OL 9 to generate audit records upon successful/unsuccessful attempts to use the setfacl command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/bin/setfacl -F perm=x -F auid>=1000 -F auid!=unset -k perm_mod The audit daemon must be restarted for the changes to take effect. Restart auditd: $ sudo service auditd restart

b
OL 9 must audit all uses of the chsh command.
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
OL09-00-000565
Vuln IDs
V-271540
Rule IDs
SV-271540r1092500_rule
Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary since these affect performance. The more rules, the bigger the performance hit. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215
Fix: F-75497r1092499_fix

Configure OL 9 to generate audit records upon successful/unsuccessful attempts to use the chsh command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/bin/chsh -F perm=x -F auid>=1000 -F auid!=unset -k priv_cmd The audit daemon must be restarted for the changes to take effect. Restart auditd: $ sudo service auditd restart

b
OL 9 must audit all uses of the crontab command.
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
OL09-00-000570
Vuln IDs
V-271541
Rule IDs
SV-271541r1092502_rule
Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary since these affect performance. The more rules, the bigger the performance hit. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215
Fix: F-75498r1092501_fix

Configure OL 9 to generate audit records upon successful/unsuccessful attempts to use the crontab command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/bin/crontab -F perm=x -F auid>=1000 -F auid!=unset -k privileged-crontab The audit daemon must be restarted for the changes to take effect. Restart auditd: $ sudo service auditd restart

b
OL 9 must audit all uses of the gpasswd command.
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
OL09-00-000575
Vuln IDs
V-271542
Rule IDs
SV-271542r1092504_rule
Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary since these affect performance. The more rules, the bigger the performance hit. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215
Fix: F-75499r1092503_fix

Configure OL 9 to generate audit records upon successful/unsuccessful attempts to use the gpasswd command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/bin/gpasswd -F perm=x -F auid>=1000 -F auid!=unset -k privileged-gpasswd The audit daemon must be restarted for the changes to take effect. Restart auditd: $ sudo service auditd restart

b
OL 9 must audit all uses of the newgrp command.
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
OL09-00-000580
Vuln IDs
V-271543
Rule IDs
SV-271543r1092506_rule
Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary since these affect performance. The more rules, the bigger the performance hit. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215
Fix: F-75500r1092505_fix

Configure OL 9 to generate audit records upon successful/unsuccessful attempts to use the newgrp command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/bin/newgrp -F perm=x -F auid>=1000 -F auid!=unset -k priv_cmd The audit daemon must be restarted for the changes to take effect. Restart auditd: $ sudo service auditd restart

b
OL 9 must audit all uses of the pam_timestamp_check command.
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
OL09-00-000585
Vuln IDs
V-271544
Rule IDs
SV-271544r1092508_rule
Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary since these affect performance. The more rules, the bigger the performance hit. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215
Fix: F-75501r1092507_fix

Configure OL 9 to generate audit records upon successful/unsuccessful attempts to use the pam_timestamp_check command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/sbin/pam_timestamp_check -F perm=x -F auid>=1000 -F auid!=unset -k privileged-pam_timestamp_check The audit daemon must be restarted for the changes to take effect. Restart auditd: $ sudo service auditd restart

b
OL 9 must audit all uses of the passwd command.
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
OL09-00-000590
Vuln IDs
V-271545
Rule IDs
SV-271545r1092510_rule
Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary since these affect performance. The more rules, the bigger the performance hit. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215
Fix: F-75502r1092509_fix

Configure OL 9 to generate audit records upon successful/unsuccessful attempts to use the passwd command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/bin/passwd -F perm=x -F auid>=1000 -F auid!=unset -k privileged-passwd The audit daemon must be restarted for the changes to take effect. Restart auditd: $ sudo service auditd restart

b
OL 9 must audit all uses of the postdrop command.
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
OL09-00-000595
Vuln IDs
V-271546
Rule IDs
SV-271546r1092512_rule
Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary since these affect performance. The more rules, the bigger the performance hit. The performance can be helped however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215
Fix: F-75503r1092511_fix

Configure OL 9 to generate audit records upon successful/unsuccessful attempts to use the postdrop command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/sbin/postdrop -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update The audit daemon must be restarted for the changes to take effect. Restart auditd: $ sudo service auditd restart

b
OL 9 must audit all uses of the postqueue command.
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
OL09-00-000600
Vuln IDs
V-271547
Rule IDs
SV-271547r1092514_rule
Without generating audit record specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary since these affect performance. The more rules, the bigger the performance hit. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215
Fix: F-75504r1092513_fix

Configure OL 9 to generate audit records upon successful/unsuccessful attempts to use the postqueue command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/sbin/postqueue -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update The audit daemon must be restarted for the changes to take effect. Restart auditd: $ sudo service auditd restart

b
OL 9 must audit all uses of the ssh-agent command.
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
OL09-00-000605
Vuln IDs
V-271548
Rule IDs
SV-271548r1092516_rule
Without generating audit record specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary since these affect performance. The more rules, the bigger the performance hit. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215
Fix: F-75505r1092515_fix

Configure OL 9 to generate audit records upon successful/unsuccessful attempts to use the ssh-agent command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/bin/ssh-agent -F perm=x -F auid>=1000 -F auid!=unset -k privileged-ssh The audit daemon must be restarted for the changes to take effect. Restart auditd: $ sudo service auditd restart

b
OL 9 must audit all uses of the ssh-keysign command.
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
OL09-00-000610
Vuln IDs
V-271549
Rule IDs
SV-271549r1092518_rule
Without generating audit record specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary since these affect performance. The more rules, the bigger the performance hit. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215
Fix: F-75506r1092517_fix

Configure OL 9 to generate audit records upon successful/unsuccessful attempts to use the ssh-keysign command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/libexec/openssh/ssh-keysign -F perm=x -F auid>=1000 -F auid!=unset -k privileged-ssh The audit daemon must be restarted for the changes to take effect. Restart auditd: $ sudo service auditd restart

b
OL 9 must audit all uses of the sudoedit command.
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
OL09-00-000615
Vuln IDs
V-271550
Rule IDs
SV-271550r1092520_rule
Without generating audit record specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary since these affect performance. The more rules, the bigger the performance hit. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215
Fix: F-75507r1092519_fix

Configure OL 9 to generate audit records upon successful/unsuccessful attempts to use the sudoedit command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/bin/sudoedit -F perm=x -F auid>=1000 -F auid!=unset -k priv_cmd The audit daemon must be restarted for the changes to take effect. Restart auditd: $ sudo service auditd restart

b
OL 9 must audit all uses of the unix_chkpwd command.
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
OL09-00-000620
Vuln IDs
V-271551
Rule IDs
SV-271551r1092522_rule
Without generating audit record specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary since these affect performance. The more rules, the bigger the performance hit. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215
Fix: F-75508r1092521_fix

Configure OL 9 to generate audit records upon successful/unsuccessful attempts to use the unix_chkpwd command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/sbin/unix_chkpwd -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update The audit daemon must be restarted for the changes to take effect. Restart auditd: $ sudo service auditd restart

b
OL 9 must audit all uses of the userhelper command.
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
OL09-00-000625
Vuln IDs
V-271552
Rule IDs
SV-271552r1092524_rule
Without generating audit record specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary since these affect performance. The more rules, the bigger the performance hit. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215
Fix: F-75509r1092523_fix

Configure OL 9 to generate audit records upon successful/unsuccessful attempts to use the userhelper command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/sbin/userhelper -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update The audit daemon must be restarted for the changes to take effect. Restart auditd: $ sudo service auditd restart

b
OL 9 must audit all uses of the mount command.
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
OL09-00-000630
Vuln IDs
V-271553
Rule IDs
SV-271553r1092526_rule
Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary since these affect performance. The more rules, the bigger the performance hit. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215
Fix: F-75510r1092525_fix

Configure OL 9 to generate audit records upon successful/unsuccessful attempts to use the mount command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/bin/mount -F perm=x -F auid>=1000 -F auid!=unset -k privileged-mount The audit daemon must be restarted for the changes to take effect. Restart auditd: $ sudo service auditd restart

b
OL 9 must audit all uses of the truncate, ftruncate, creat, open, openat, and open_by_handle_at system calls.
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
OL09-00-000635
Vuln IDs
V-271554
Rule IDs
SV-271554r1092528_rule
Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary since these affect performance. The more rules, the bigger the performance hit. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215, SRG-OS-000064-GPOS-00033, SRG-OS-000458-GPOS-00203, SRG-OS-000461-GPOS-00205
Fix: F-75511r1092527_fix

Configure OL 9 to generate an audit event for any successful/unsuccessful use of the truncate, ftruncate, creat, open, openat, and open_by_handle_at system calls by adding or updating the following rules in the "/etc/audit/rules.d/audit.rules" file: -a always,exit -F arch=b32 -S truncate,ftruncate,creat,open,openat,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -k perm_access -a always,exit -F arch=b64 -S truncate,ftruncate,creat,open,openat,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -k perm_access -a always,exit -F arch=b32 -S truncate,ftruncate,creat,open,openat,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -k perm_access -a always,exit -F arch=b64 -S truncate,ftruncate,creat,open,openat,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -k perm_access The audit daemon must be restarted for the changes to take effect. Restart auditd: $ sudo service auditd restart

b
OL 9 must audit all uses of the chmod, fchmod, and fchmodat system calls.
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
OL09-00-000640
Vuln IDs
V-271555
Rule IDs
SV-271555r1092530_rule
Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary since these affect performance. The more rules, the bigger the performance hit. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215, SRG-OS-000064-GPOS-00033, SRG-OS-000466-GPOS-00210, SRG-OS-000458-GPOS-00203
Fix: F-75512r1092529_fix

Configure OL 9 to generate audit records upon successful/unsuccessful attempts to use the chmod, fchmod, and fchmodat system calls. Add or update the following rules in "/etc/audit/rules.d/audit.rules": -a always,exit -F arch=b32 -S chmod,fchmod,fchmodat -F auid>=1000 -F auid!=unset -k perm_mod -a always,exit -F arch=b64 -S chmod,fchmod,fchmodat -F auid>=1000 -F auid!=unset -k perm_mod The audit daemon must be restarted for the changes to take effect. Restart auditd: $ sudo service auditd restart

b
OL 9 must audit all uses of the chown, fchown, fchownat, and lchown system calls.
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
OL09-00-000645
Vuln IDs
V-271556
Rule IDs
SV-271556r1092532_rule
Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary since these affect performance. The more rules, the bigger the performance hit. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215, SRG-OS-000064-GPOS-00033, SRG-OS-000466-GPOS-00210, SRG-OS-000458-GPOS-00203, SRG-OS-000474-GPOS-00219
Fix: F-75513r1092531_fix

Configure OL 9 to generate audit records upon successful/unsuccessful attempts to use the chown, fchown, fchownat, and lchown system calls. Add or update the following rules in "/etc/audit/rules.d/audit.rules": -a always,exit -F arch=b32 -S chown,fchown,fchownat,lchown -F auid>=1000 -F auid!=unset -k perm_mod -a always,exit -F arch=b64 -S chown,fchown,fchownat,lchown -F auid>=1000 -F auid!=unset -k perm_mod The audit daemon must be restarted for the changes to take effect. Restart auditd: $ sudo service auditd restart

b
OL 9 must audit all uses of the semanage command.
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
OL09-00-000650
Vuln IDs
V-271557
Rule IDs
SV-271557r1092534_rule
Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary since these affect performance. The more rules, the bigger the performance hit. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215, SRG-OS-000463-GPOS-00207, SRG-OS-000465-GPOS-00209
Fix: F-75514r1092533_fix

Configure OL 9 to generate audit records upon successful/unsuccessful attempts to use the semanage command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/sbin/semanage -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update The audit daemon must be restarted for the changes to take effect. Restart auditd: $ sudo service auditd restart

b
OL 9 must audit all uses of the setfiles command.
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
OL09-00-000655
Vuln IDs
V-271558
Rule IDs
SV-271558r1092536_rule
Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary since these affect performance. The more rules, the bigger the performance hit. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215, SRG-OS-000463-GPOS-00207, SRG-OS-000465-GPOS-00209
Fix: F-75515r1092535_fix

Configure OL 9 to generate audit records upon successful/unsuccessful attempts to use the setfiles command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/sbin/setfiles -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update The audit daemon must be restarted for the changes to take effect. Restart auditd: $ sudo service auditd restart

b
OL 9 must audit all uses of the setsebool command.
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
OL09-00-000660
Vuln IDs
V-271559
Rule IDs
SV-271559r1092538_rule
Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary since these affect performance. The more rules, the bigger the performance hit. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215, SRG-OS-000463-GPOS-00207, SRG-OS-000465-GPOS-00209
Fix: F-75516r1092537_fix

Configure OL 9 to generate an audit event for any successful/unsuccessful use of the setsebool command by adding or updating the following rules in the "/etc/audit/rules.d/audit.rules" file: -a always,exit -F path=/usr/sbin/setsebool -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged The audit daemon must be restarted for the changes to take effect. Restart auditd: $ sudo service auditd restart

b
OL 9 must audit all uses of the chacl command.
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
OL09-00-000665
Vuln IDs
V-271560
Rule IDs
SV-271560r1092540_rule
Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary since these affect performance. The more rules, the bigger the performance hit. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215, SRG-OS-000466-GPOS-00210
Fix: F-75517r1092539_fix

Configure OL 9 to generate audit records upon successful/unsuccessful attempts to use the chacl command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/bin/chacl -F perm=x -F auid>=1000 -F auid!=unset -k perm_mod The audit daemon must be restarted for the changes to take effect. Restart auditd: $ sudo service auditd restart

b
OL 9 must audit all uses of the sudo command.
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
OL09-00-000670
Vuln IDs
V-271561
Rule IDs
SV-271561r1092542_rule
Without generating audit record specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary since these affect performance. The more rules, the bigger the performance hit. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215, SRG-OS-000466-GPOS-00210
Fix: F-75518r1092541_fix

Configure OL 9 to generate audit records upon successful/unsuccessful attempts to use the sudo command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/bin/sudo -F perm=x -F auid>=1000 -F auid!=unset -k priv_cmd The audit daemon must be restarted for the changes to take effect. Restart auditd: $ sudo service auditd restart

b
OL 9 must audit all uses of the usermod command.
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
OL09-00-000675
Vuln IDs
V-271562
Rule IDs
SV-271562r1092544_rule
Without generating audit record specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary since these affect performance. The more rules, the bigger the performance hit. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215, SRG-OS-000466-GPOS-00210
Fix: F-75519r1092543_fix

Configure OL 9 to generate audit records upon successful/unsuccessful attempts to use the usermod command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/sbin/usermod -F perm=x -F auid>=1000 -F auid!=unset -k privileged-usermod The audit daemon must be restarted for the changes to take effect. Restart auditd: $ sudo service auditd restart

b
OL 9 must audit all uses of the rename, unlink, rmdir, renameat, and unlinkat system calls.
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
OL09-00-000680
Vuln IDs
V-271563
Rule IDs
SV-271563r1092546_rule
Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary since these affect performance. The more rules, the bigger the performance hit. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215, SRG-OS-000466-GPOS-00210, SRG-OS-000467-GPOS-00211, SRG-OS-000468-GPOS-00212
Fix: F-75520r1092545_fix

Configure OL 9 to generate an audit event for any successful/unsuccessful use of the rename, unlink, rmdir, renameat, and unlinkat system calls by adding or updating the following rules in the "/etc/audit/rules.d/audit.rules" file: -a always,exit -F arch=b32 -S rename,unlink,rmdir,renameat,unlinkat -F auid>=1000 -F auid!=unset -k delete -a always,exit -F arch=b64 -S rename,unlink,rmdir,renameat,unlinkat -F auid>=1000 -F auid!=unset -k delete The audit daemon must be restarted for the changes to take effect. Restart auditd: $ sudo service auditd restart

b
OL 9 must audit all uses of the delete_module system call.
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
OL09-00-000685
Vuln IDs
V-271564
Rule IDs
SV-271564r1092548_rule
Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary since these affect performance. The more rules, the bigger the performance hit. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215, SRG-OS-000471-GPOS-00216, SRG-OS-000477-GPOS-00222
Fix: F-75521r1092547_fix

Configure OL 9 to generate an audit event for any successful/unsuccessful use of the delete_module system call by adding or updating the following rules in the "/etc/audit/rules.d/audit.rules" file: -a always,exit -F arch=b32 -S delete_module -F auid>=1000 -F auid!=unset -k module_chng -a always,exit -F arch=b64 -S delete_module -F auid>=1000 -F auid!=unset -k module_chng The audit daemon must be restarted for the changes to take effect. Restart auditd: $ sudo service auditd restart

b
OL 9 must audit all uses of the init_module and finit_module system calls.
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
OL09-00-000690
Vuln IDs
V-271565
Rule IDs
SV-271565r1092550_rule
Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary since these affect performance. The more rules, the bigger the performance hit. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215, SRG-OS-000471-GPOS-00216, SRG-OS-000477-GPOS-00222
Fix: F-75522r1092549_fix

Configure OL 9 to generate an audit event for any successful/unsuccessful use of the init_module and finit_module system calls by adding or updating the following rules in the "/etc/audit/rules.d/audit.rules" file: -a always,exit -F arch=b32 -S init_module,finit_module -F auid>=1000 -F auid!=unset -k module_chng -a always,exit -F arch=b64 -S init_module,finit_module -F auid>=1000 -F auid!=unset -k module_chng The audit daemon must be restarted for the changes to take effect. Restart auditd: $ sudo service auditd restart

b
OL 9 must audit all uses of the kmod command.
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
OL09-00-000695
Vuln IDs
V-271566
Rule IDs
SV-271566r1092552_rule
Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary since these affect performance. The more rules, the bigger the performance hit. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215, SRG-OS-000471-GPOS-00216, SRG-OS-000477-GPOS-00222
Fix: F-75523r1092551_fix

Configure OL 9 to generate audit records upon successful/unsuccessful attempts to use the kmod command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/bin/kmod -F perm=x -F auid>=1000 -F auid!=unset -k modules The audit daemon must be restarted for the changes to take effect. Restart auditd: $ sudo service auditd restart

b
OL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /var/log/lastlog.
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
OL09-00-000700
Vuln IDs
V-271567
Rule IDs
SV-271567r1092554_rule
Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215, SRG-OS-000473-GPOS-00218, SRG-OS-000470-GPOS-00214
Fix: F-75524r1092553_fix

Configure OL 9 to generate audit records for all account creations, modifications, disabling, and termination events that affect /var/log/lastlog. Add or update the following file system rule to "/etc/audit/rules.d/audit.rules": -w /var/log/lastlog -p wa -k logins The audit daemon must be restarted for the changes to take effect. Restart auditd: $ sudo service auditd restart

b
OL 9 must audit all uses of umount system calls.
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
OL09-00-000705
Vuln IDs
V-271568
Rule IDs
SV-271568r1092556_rule
Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary since these affect performance. The more rules, the bigger the performance hit. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215
Fix: F-75525r1092555_fix

Configure OL 9 to generate audit records upon successful/unsuccessful attempts to use the umount command by adding or updating the following rules in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/bin/umount -F perm=x -F auid>=1000 -F auid!=unset -k privileged-mount The audit daemon must be restarted for the changes to take effect. Restart auditd: $ sudo service auditd restart

b
OL 9 must use cryptographic mechanisms to protect the integrity of audit tools.
RMF Control
AU-9
Severity
M
CCI
CCI-001493
Version
OL09-00-000710
Vuln IDs
V-271569
Rule IDs
SV-271569r1155308_rule
Protecting the integrity of the tools used for auditing purposes is a critical step toward ensuring the integrity of audit information. Audit information includes all information (e.g., audit records, audit settings, and audit reports) needed to successfully audit information system activity. Audit tools include, but are not limited to, vendor-provided and open-source audit tools needed to successfully view and manipulate audit information system activity and records. Audit tools include custom queries and report generators. It is not uncommon for attackers to replace the audit tools or inject code into the existing tools to provide the capability to hide or erase system activity from the audit logs. To address this risk, audit tools must be cryptographically signed to provide the capability to identify when the audit tools have been modified, manipulated, or replaced. An example is a checksum hash of the file or files. Satisfies: SRG-OS-000256-GPOS-00097, SRG-OS-000257-GPOS-00098, SRG-OS-000258-GPOS-00099, SRG-OS-000278-GPOS-00108
Fix: F-75526r1155307_fix

Configure OL 9 to protect the integrity of the audit tools. Add or update the following lines to /etc/aide.conf: /usr/sbin/auditctl p+i+n+u+g+s+b+acl+xattrs+sha512 /usr/sbin/auditd p+i+n+u+g+s+b+acl+xattrs+sha512 /usr/sbin/ausearch p+i+n+u+g+s+b+acl+xattrs+sha512 /usr/sbin/aureport p+i+n+u+g+s+b+acl+xattrs+sha512 /usr/sbin/autrace p+i+n+u+g+s+b+acl+xattrs+sha512 /usr/sbin/augenrules p+i+n+u+g+s+b+acl+xattrs+sha512

b
OL 9 must audit uses of the execve system call.
RMF Control
AC-6
Severity
M
CCI
CCI-002233
Version
OL09-00-000715
Vuln IDs
V-271570
Rule IDs
SV-271570r1092558_rule
Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised information system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider threats and the advanced persistent threat. Satisfies: SRG-OS-000326-GPOS-00126, SRG-OS-000327-GPOS-00127, SRG-OS-000755-GPOS-00220
Fix: F-75527r1092557_fix

Configure OL 9 to audit the execution of the execve system call. Add or update the following file system rules to "/etc/audit/rules.d/audit.rules": -a always,exit -F arch=b32 -S execve -C uid!=euid -F euid=0 -k execpriv -a always,exit -F arch=b64 -S execve -C uid!=euid -F euid=0 -k execpriv -a always,exit -F arch=b32 -S execve -C gid!=egid -F egid=0 -k execpriv -a always,exit -F arch=b64 -S execve -C gid!=egid -F egid=0 -k execpriv The audit daemon must be restarted for the changes to take effect. Restart auditd: $ sudo service auditd restart Note: Users must reboot to view above results with command "auditctl -l | grep execve".

b
OL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /var/log/faillock.
RMF Control
MA-4
Severity
M
CCI
CCI-002884
Version
OL09-00-000720
Vuln IDs
V-271571
Rule IDs
SV-271571r1092560_rule
Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Satisfies: SRG-OS-000392-GPOS-00172, SRG-OS-000470-GPOS-00214, SRG-OS-000473-GPOS-00218
Fix: F-75528r1092559_fix

Configure OL 9 to generate audit records for all account creations, modifications, disabling, and termination events that affect /var/log/faillock. Add or update the following file system rule to "/etc/audit/rules.d/audit.rules": -w /var/log/faillock -p wa -k logins The audit daemon must be restarted for the changes to take effect. Restart auditd: $ sudo service auditd restart

b
OL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /var/log/tallylog.
RMF Control
MA-4
Severity
M
CCI
CCI-002884
Version
OL09-00-000725
Vuln IDs
V-271572
Rule IDs
SV-271572r1092562_rule
Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Satisfies: SRG-OS-000392-GPOS-00172, SRG-OS-000470-GPOS-00214, SRG-OS-000473-GPOS-00218
Fix: F-75529r1092561_fix

Configure OL 9 to generate audit records for all account creations, modifications, disabling, and termination events that affect /var/log/tallylog. Add or update the following file system rule to "/etc/audit/rules.d/audit.rules": -w /var/log/tallylog -p wa -k logins The audit daemon must be restarted for the changes to take effect. Restart auditd: $ sudo service auditd restart

b
OL 9 must be configured so that successful/unsuccessful uses of the init command generate an audit record.
RMF Control
AU-12
Severity
M
CCI
CCI-000172
Version
OL09-00-000730
Vuln IDs
V-271573
Rule IDs
SV-271573r1092564_rule
Misuse of the init command may cause availability issues for the system.
Fix: F-75530r1092563_fix

Configure the audit system to generate an audit event for any successful/unsuccessful uses of the init command by adding or updating the following rule in the "/etc/audit/rules.d/audit.rules" file: -a always,exit -F path=/usr/sbin/init -F perm=x -F auid>=1000 -F auid!=unset -k privileged-init The audit daemon must be restarted for the changes to take effect. Restart auditd: $ sudo service auditd restart

b
OL 9 must be configured so that successful/unsuccessful uses of the poweroff command generate an audit record.
RMF Control
AU-12
Severity
M
CCI
CCI-000172
Version
OL09-00-000735
Vuln IDs
V-271574
Rule IDs
SV-271574r1092566_rule
Misuse of the poweroff command may cause availability issues for the system.
Fix: F-75531r1092565_fix

Configure the audit system to generate an audit event for any successful/unsuccessful uses of the poweroff command by adding or updating the following rule in the "/etc/audit/rules.d/audit.rules" file: -a always,exit -F path=/usr/sbin/poweroff -F perm=x -F auid>=1000 -F auid!=unset -k privileged-poweroff The audit daemon must be restarted for the changes to take effect. Restart auditd: $ sudo service auditd restart

b
OL 9 must be configured so that successful/unsuccessful uses of the reboot command generate an audit record.
RMF Control
AU-12
Severity
M
CCI
CCI-000172
Version
OL09-00-000740
Vuln IDs
V-271575
Rule IDs
SV-271575r1092568_rule
Misuse of the reboot command may cause availability issues for the system.
Fix: F-75532r1092567_fix

Configure the audit system to generate an audit event for any successful/unsuccessful uses of the reboot command by adding or updating the following rule in the "/etc/audit/rules.d/audit.rules" file: -a always,exit -F path=/usr/sbin/reboot -F perm=x -F auid>=1000 -F auid!=unset -k privileged-reboot The audit daemon must be restarted for the changes to take effect. Restart auditd: $ sudo service auditd restart

b
OL 9 must be configured so that successful/unsuccessful uses of the shutdown command generate an audit record.
RMF Control
AU-12
Severity
M
CCI
CCI-000172
Version
OL09-00-000745
Vuln IDs
V-271576
Rule IDs
SV-271576r1092570_rule
Misuse of the shutdown command may cause availability issues for the system.
Fix: F-75533r1092569_fix

Configure the audit system to generate an audit event for any successful/unsuccessful uses of the shutdown command by adding or updating the following rule in the "/etc/audit/rules.d/audit.rules" file: -a always,exit -F path=/usr/sbin/shutdown -F perm=x -F auid>=1000 -F auid!=unset -k privileged-shutdown The audit daemon must be restarted for the changes to take effect. Restart auditd: $ sudo service auditd restart

a
OL 9 must enable auditing of processes that start prior to the audit daemon.
RMF Control
AU-3
Severity
L
CCI
CCI-000130
Version
OL09-00-000750
Vuln IDs
V-271577
Rule IDs
SV-271577r1091443_rule
Without the capability to generate audit records, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. If auditing is enabled late in the startup process, the actions of some startup processes may not be audited. Some audit systems also maintain state information only available if auditing is enabled before a given process is created. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215, SRG-OS-000473-GPOS-00218, SRG-OS-000254-GPOS-00095
Fix: F-75534r1091442_fix

Enable auditing of processes that start prior to the audit daemon with the following command: $ sudo grubby --update-kernel=ALL --args="audit=1" Add or modify the following line in "/etc/default/grub" to ensure the configuration survives kernel updates: GRUB_CMDLINE_LINUX="audit=1"

b
OL 9 must label all offloaded audit logs before sending them to the central log server.
RMF Control
AU-3
Severity
M
CCI
CCI-000132
Version
OL09-00-000755
Vuln IDs
V-271578
Rule IDs
SV-271578r1092572_rule
Enriched logging is needed to determine who, what, and when events occur on a system. Without this, determining root cause of an event will be much more difficult. When audit logs are not labeled before they are sent to a central log server, the audit data will not be able to be analyzed and tied back to the correct system. Satisfies: SRG-OS-000039-GPOS-00017, SRG-OS-000342-GPOS-00133, SRG-OS-000479-GPOS-00224
Fix: F-75535r1092571_fix

Configure OL 9 to label all offloaded audit logs before sending them to the central log server. Edit the /etc/audit/auditd.conf file and add or update the "name_format" option: name_format = hostname The audit daemon must be restarted for changes to take effect. Restart auditd: $ sudo service auditd restart

b
OL 9 audit system must take appropriate action when an error writing to the audit storage volume occurs.
RMF Control
AU-12
Severity
M
CCI
CCI-000169
Version
OL09-00-000760
Vuln IDs
V-271579
Rule IDs
SV-271579r1091449_rule
It is critical that when the operating system is at risk of failing to process audit logs as required, it takes action to mitigate the failure. Audit processing failures include software/hardware errors; failures in the audit capturing mechanisms; and audit storage capacity being reached or exceeded. Responses to audit failure depend upon the nature of the failure mode.
Fix: F-75536r1091448_fix

Configure OL 9 to shut down by default upon audit failure (unless availability is an overriding concern). Add or update the following line (depending on configuration "disk_error_action" can be set to "SYSLOG" or "SINGLE" depending on configuration) in "/etc/audit/auditd.conf" file: disk_error_action = HALT If availability has been determined to be more important, and this decision is documented with the information system security officer (ISSO), configure the operating system to notify SA staff and ISSO staff in the event of an audit processing failure by setting the "disk_error_action" to "SYSLOG".

b
OL 9 audit system must take appropriate action when the audit storage volume is full.
RMF Control
AU-12
Severity
M
CCI
CCI-000169
Version
OL09-00-000765
Vuln IDs
V-271580
Rule IDs
SV-271580r1091452_rule
It is critical that when the operating system is at risk of failing to process audit logs as required, it takes action to mitigate the failure. Audit processing failures include software/hardware errors; failures in the audit capturing mechanisms; and audit storage capacity being reached or exceeded. Responses to audit failure depend upon the nature of the failure mode.
Fix: F-75537r1091451_fix

Configure OL 9 to shut down by default upon audit failure (unless availability is an overriding concern). Add or update the following line (depending on configuration "disk_full_action" can be set to "SYSLOG" or "SINGLE" depending on configuration) in "/etc/audit/auditd.conf" file: disk_full_action = HALT If availability has been determined to be more important, and this decision is documented with the information system security officer (ISSO), configure the operating system to notify SA staff and ISSO staff in the event of an audit processing failure by setting the "disk_full_action" to "SYSLOG".

b
OL 9 audit system must take appropriate action when the audit files have reached maximum size.
RMF Control
AU-12
Severity
M
CCI
CCI-000169
Version
OL09-00-000770
Vuln IDs
V-271581
Rule IDs
SV-271581r1091455_rule
It is critical that when the operating system is at risk of failing to process audit logs as required, it takes action to mitigate the failure. Audit processing failures include software/hardware errors; failures in the audit capturing mechanisms; and audit storage capacity being reached or exceeded. Responses to audit failure depend upon the nature of the failure mode.
Fix: F-75538r1091454_fix

Configure OL 9 to rotate the audit log when it reaches maximum size. Add or update the following line in "/etc/audit/auditd.conf" file: max_log_file_action = ROTATE

b
OL 9 must periodically flush audit records to disk to prevent the loss of audit records.
RMF Control
AU-6
Severity
M
CCI
CCI-000154
Version
OL09-00-000775
Vuln IDs
V-271582
Rule IDs
SV-271582r1092574_rule
If option "freq" is not set to a value that requires audit records being written to disk after a threshold number is reached, then audit records may be lost.
Fix: F-75539r1092573_fix

Configure OL 9 to flush audit to disk by adding or updating the following configuration in "/etc/audit/auditd.conf": freq = 100 The audit daemon must be restarted for the changes to take effect. Restart auditd: $ sudo service auditd restart

b
OL 9 audit logs must be group-owned by root or by a restricted logging group to prevent unauthorized read access.
RMF Control
AU-9
Severity
M
CCI
CCI-000162
Version
OL09-00-000785
Vuln IDs
V-271583
Rule IDs
SV-271583r1091461_rule
Unauthorized disclosure of audit records can reveal system and configuration data to attackers, thus compromising its confidentiality. Satisfies: SRG-OS-000057-GPOS-00027, SRG-OS-000058-GPOS-00028, SRG-OS-000059-GPOS-00029, SRG-OS-000206-GPOS-00084
Fix: F-75540r1091460_fix

Configure OL 9 audit logs to be group-owned by "root" or a restricted logging group. Change the group of the directory of "/var/log/audit" to be owned by a correct group. Identify the group that is configured to own audit log: $ sudo grep -P '^[ ]*log_group[ ]+=.*$' /etc/audit/auditd.conf Change the ownership to that group: $ sudo chgrp ${GROUP} /var/log/audit

b
OL 9 audit log directory must be owned by root to prevent unauthorized read access.
RMF Control
AU-9
Severity
M
CCI
CCI-000162
Version
OL09-00-000790
Vuln IDs
V-271584
Rule IDs
SV-271584r1091464_rule
Unauthorized disclosure of audit records can reveal system and configuration data to attackers, thus compromising its confidentiality. Satisfies: SRG-OS-000057-GPOS-00027, SRG-OS-000058-GPOS-00028, SRG-OS-000059-GPOS-00029, SRG-OS-000206-GPOS-00084
Fix: F-75541r1091463_fix

Configure OL 9 to protect the audit log from unauthorized read access by setting the correct owner as "root" with the following command: $ sudo chown root /var/log/audit

b
OL 9 audit logs file must have mode 0600 or less permissive to prevent unauthorized access to the audit log.
RMF Control
AU-9
Severity
M
CCI
CCI-000162
Version
OL09-00-000795
Vuln IDs
V-271585
Rule IDs
SV-271585r1091467_rule
Only authorized personnel should be aware of errors and the details of the errors. Error messages are an indicator of an organization's operational state or can identify the OL 9 system or platform. Additionally, Personally Identifiable Information (PII) and operational information must not be revealed through error messages to unauthorized personnel or their designated representatives. The structure and content of error messages must be carefully considered by the organization and development team. The extent to which the information system is able to identify and handle error conditions is guided by organizational policy and operational requirements. Satisfies: SRG-OS-000057-GPOS-00027, SRG-OS-000058-GPOS-00028, SRG-OS-000059-GPOS-00029, SRG-OS-000206-GPOS-00084
Fix: F-75542r1091466_fix

Configure the audit logs to have a mode of "0600" with the following command: Replace "[audit_log_file]" to the correct audit log path, by default this location is "/var/log/audit/audit.log". $ sudo chmod 0600 /var/log/audit/[audit_log_file] Check the group that owns the system audit logs: $ sudo grep -m 1 -q ^log_group /etc/audit/auditd.conf If the log_group is not defined or it is set to root, configure the permissions the following way: $ sudo chmod 0640 $log_file $ sudo chmod 0440 $log_file.* Otherwise, configure the permissions the following way: $ sudo chmod 0600 $log_file $ sudo chmod 0400 $log_file.*

b
OL 9 audit system must audit local events.
RMF Control
AU-12
Severity
M
CCI
CCI-000169
Version
OL09-00-000800
Vuln IDs
V-271586
Rule IDs
SV-271586r1092576_rule
Without establishing what type of events occurred, the source of events, where events occurred, and the outcome of events, it would be difficult to establish, correlate, and investigate the events leading up to an outage or attack. If option "local_events" isn't set to "yes" only events from network will be aggregated.
Fix: F-75543r1092575_fix

Configure OL 9 to generate audit records for local events by adding or updating the following line in "/etc/audit/auditd.conf": local_events = yes The audit daemon must be restarted for the changes to take effect. Restart auditd: $ sudo service auditd restart

b
OL 9 must allow only the information system security manager (ISSM) (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited.
RMF Control
AU-12
Severity
M
CCI
CCI-000171
Version
OL09-00-000805
Vuln IDs
V-271587
Rule IDs
SV-271587r1091473_rule
Without the capability to restrict the roles and individuals that can select which events are audited, unauthorized personnel may be able to prevent the auditing of critical events. Misconfigured audits may degrade the system's performance by overwhelming the audit log. Misconfigured audits may also make it more difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.
Fix: F-75544r1091472_fix

Configure the files in directory "/etc/audit/rules.d/" and the "/etc/audit/auditd.conf" file to have a mode of "0640" with the following commands: $ sudo chmod 0640 /etc/audit/rules.d/audit.rules $ sudo chmod 0640 /etc/audit/rules.d/[customrulesfile].rules $ sudo chmod 0640 /etc/audit/auditd.conf

b
OL 9 /etc/audit/auditd.conf file must have 0640 or less permissive to prevent unauthorized access.
RMF Control
AU-12
Severity
M
CCI
CCI-000171
Version
OL09-00-000810
Vuln IDs
V-271588
Rule IDs
SV-271588r1091476_rule
Without the capability to restrict the roles and individuals that can select which events are audited, unauthorized personnel may be able to prevent the auditing of critical events. Misconfigured audits may degrade the system's performance by overwhelming the audit log. Misconfigured audits may also make it more difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.
Fix: F-75545r1091475_fix

Configure the /etc/audit/auditd.conf file to have a mode of 0640 with the command: $ sudo chmod 0640 /etc/audit/auditd.conf

b
OL 9 must forward mail from postmaster to the root account using a postfix alias.
RMF Control
AU-5
Severity
M
CCI
CCI-000139
Version
OL09-00-000815
Vuln IDs
V-271589
Rule IDs
SV-271589r1091479_rule
It is critical for the appropriate personnel to be aware if a system is at risk of failing to process audit logs as required. Without this notification, the security personnel may be unaware of an impending failure of the audit capability, and system operation may be adversely affected. Audit processing failures include software/hardware errors, failures in the audit capturing mechanisms, and audit storage capacity being reached or exceeded.
Fix: F-75546r1091478_fix

Configure a valid email address as an alias for the root account. Append the following line to "/etc/aliases": postmaster: root Then, run the following command: $ sudo newaliases

b
OL 9 must take appropriate action when a critical audit processing failure occurs.
RMF Control
AU-5
Severity
M
CCI
CCI-000139
Version
OL09-00-000820
Vuln IDs
V-271590
Rule IDs
SV-271590r1091482_rule
It is critical for the appropriate personnel to be aware if a system is at risk of failing to process audit logs as required. Without this notification, the security personnel may be unaware of an impending failure of the audit capability, and system operation may be adversely affected. Audit processing failures include software/hardware errors, failures in the audit capturing mechanisms, and audit storage capacity being reached or exceeded. Satisfies: SRG-OS-000046-GPOS-00022, SRG-OS-000343-GPOS-00135
Fix: F-75547r1091481_fix

Configure OL 9 to shut down when auditing failures occur. Add the following line to the bottom of the /etc/audit/audit.rules file: -f 2

b
The OL 9 system administrator (SA) and/or information system security officer (ISSO) (at a minimum) must be alerted of an audit processing failure event.
RMF Control
AU-5
Severity
M
CCI
CCI-000139
Version
OL09-00-000825
Vuln IDs
V-271591
Rule IDs
SV-271591r1092578_rule
It is critical for the appropriate personnel to be aware if a system is at risk of failing to process audit logs as required. Without this notification, the security personnel may be unaware of an impending failure of the audit capability, and system operation may be adversely affected. Audit processing failures include software/hardware errors, failures in the audit capturing mechanisms, and audit storage capacity being reached or exceeded. This requirement applies to each audit data storage repository (i.e., distinct information system component where audit records are stored), the centralized audit storage capacity of organizations (i.e., all audit data storage repositories combined), or both. Satisfies: SRG-OS-000046-GPOS-00022, SRG-OS-000343-GPOS-00134
Fix: F-75548r1092577_fix

Configure the auditd service to notify the SA and ISSO in the event of an audit processing failure. Edit the following line in "/etc/audit/auditd.conf" to ensure that administrators are notified via email for those situations: action_mail_acct = root The audit daemon must be restarted for changes to take effect. Restart auditd: $ sudo service auditd restart

a
OL 9 must allocate an audit_backlog_limit of sufficient size to capture processes that start prior to the audit daemon.
RMF Control
AU-14
Severity
L
CCI
CCI-001464
Version
OL09-00-000830
Vuln IDs
V-271592
Rule IDs
SV-271592r1091488_rule
Without the capability to generate audit records, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. If auditing is enabled late in the startup process, the actions of some startup processes may not be audited. Some audit systems also maintain state information only available if auditing is enabled before a given process is created. Audit records can be generated from various components within the information system (e.g., module or policy filter). Allocating an audit_backlog_limit of sufficient size is critical in maintaining a stable boot process. With an insufficient limit allocated, the system is susceptible to boot failures and crashes. Satisfies: SRG-OS-000254-GPOS-00095, SRG-OS-000341-GPOS-00132
Fix: F-75549r1091487_fix

Configure OL 9 to allocate sufficient audit_backlog_limit to capture processes that start prior to the audit daemon with the following command: $ sudo grubby --update-kernel=ALL --args=audit_backlog_limit=8192

b
OL 9 must produce audit records containing information to establish the identity of any individual or process associated with the event.
RMF Control
AU-3
Severity
M
CCI
CCI-001487
Version
OL09-00-000835
Vuln IDs
V-271593
Rule IDs
SV-271593r1092580_rule
Without establishing what type of events occurred, the source of events, where events occurred, and the outcome of events, it would be difficult to establish, correlate, and investigate the events leading up to an outage or attack. Audit record content that may be necessary to satisfy this requirement includes, for example, time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, filenames involved, and access control or flow control rules invoked. Enriched logging aids in making sense of who, what, and when events occur on a system. Without this, determining root cause of an event will be much more difficult.
Fix: F-75550r1092579_fix

Configure OL 9 to produce audit records containing information to establish the identity of any individual or process associated with the event. Edit the /etc/audit/auditd.conf file and add or update the "log_format" option: log_format = ENRICHED The audit daemon must be restarted for changes to take effect. Restart auditd: $ sudo service auditd restart

b
OL 9 must be configured so that successful/unsuccessful uses of the umount system call generate an audit record.
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
OL09-00-000840
Vuln IDs
V-271594
Rule IDs
SV-271594r1155314_rule
The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications can facilitate the identification of patterns of abuse among both authorized and unauthorized users. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215
Fix: F-75551r1092581_fix

Configure the audit system to generate an audit event for any successful/unsuccessful use of the umount system call by adding or updating the following rules in "/etc/audit/audit.rules" and adding the following rules to "/etc/audit/rules.d/perm_mod.rules" or updating the existing rules in files in the "/etc/audit/rules.d/" directory: -a always,exit -F arch=b32 -S umount -F auid>=1000 -F auid!=unset -k perm_mod -a always,exit -F arch=b64 -S umount -F auid>=1000 -F auid!=unset -k perm_mod The audit daemon must be restarted for the changes to take effect. Restart auditd: $ sudo service auditd restart

b
OL 9 must be configured so that successful/unsuccessful uses of the umount2 system call generate an audit record.
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
OL09-00-000845
Vuln IDs
V-271595
Rule IDs
SV-271595r1155316_rule
The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing discretionary access control (DAC) modifications can facilitate the identification of patterns of abuse among both authorized and unauthorized users. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215
Fix: F-75552r1092583_fix

Configure the audit system to generate an audit event for any successful/unsuccessful use of the umount2 system call by adding the following rules to a rules file in /etc/audit/rules.d/ directory: (Example /etc/audit/rules.d/audit.rules) -a always,exit -F arch=b32 -S umount2 -F auid>=1000 -F auid!=unset -k perm_mod -a always,exit -F arch=b64 -S umount2 -F auid>=1000 -F auid!=unset -k perm_mod The audit daemon must be restarted for the changes to take effect. Restart auditd: $ sudo service auditd restart

b
OL 9 must allocate audit record storage capacity to store at least one week's worth of audit records.
RMF Control
AU-4
Severity
M
CCI
CCI-001849
Version
OL09-00-000850
Vuln IDs
V-271596
Rule IDs
SV-271596r1091500_rule
To ensure OL 9 systems have a sufficient storage capacity in which to write the audit logs, OL 9 needs to be able to allocate audit record storage capacity. The task of allocating audit record storage capacity is usually performed during initial installation of OL 9. Satisfies: SRG-OS-000341-GPOS-00132, SRG-OS-000342-GPOS-00133
Fix: F-75553r1091499_fix

Allocate enough storage capacity for at least one week of audit records when audit records are not immediately sent to a central audit record storage facility. If audit records are stored on a partition made specifically for audit records, resize the partition with sufficient space to contain one week of audit records. If audit records are not stored on a partition made specifically for audit records, a new partition with sufficient space will need be to be created.

b
OL 9 must be configured to offload audit records onto a different system from the system being audited via syslog.
RMF Control
AU-4
Severity
M
CCI
CCI-001851
Version
OL09-00-000855
Vuln IDs
V-271597
Rule IDs
SV-271597r1092586_rule
The auditd service does not include the ability to send audit records to a centralized server for management directly. However, it can use a plug-in for audit event multiplexor (audispd) to pass audit records to the local syslog server. Satisfies: SRG-OS-000342-GPOS-00133, SRG-OS-000479-GPOS-00224
Fix: F-75554r1092585_fix

Configure OL 9 to offload audit records onto a different system from the system being audited via syslog. Edit the /etc/audit/plugins.d/syslog.conf file and add or update the "active" option: active = yes The audit daemon must be restarted for changes to take effect. Restart auditd: $ sudo service auditd restart

b
OL 9 must take appropriate action when the internal event queue is full.
RMF Control
AU-4
Severity
M
CCI
CCI-001851
Version
OL09-00-000860
Vuln IDs
V-271598
Rule IDs
SV-271598r1092588_rule
The audit system should have an action setup in the event the internal event queue becomes full so that no data is lost. Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Offloading is a common process in information systems with limited audit storage capacity. Satisfies: SRG-OS-000342-GPOS-00133, SRG-OS-000479-GPOS-00224
Fix: F-75555r1092587_fix

Configure OL 9 to take appropriate action when the internal event queue is full. Edit the /etc/audit/auditd.conf file and add or update the "overflow_action" option: overflow_action = syslog The audit daemon must be restarted for changes to take effect. Restart auditd: $ sudo service auditd restart

b
OL 9 must take action when allocated audit record storage volume reaches 75 percent of the repository maximum audit record storage capacity.
RMF Control
AU-5
Severity
M
CCI
CCI-001855
Version
OL09-00-000865
Vuln IDs
V-271599
Rule IDs
SV-271599r1134856_rule
If security personnel are not notified immediately when storage volume reaches a maximum of 75 percent utilization, they are unable to plan for audit record storage capacity expansion. The notification can be set to trigger at lower utilization thresholds at the ISSO's discretion.
Fix: F-75556r1134855_fix

Configure OL 9 to initiate an action to notify the SA and ISSO (at a minimum) when allocated audit record storage volume reaches (at most) 75 percent of the repository maximum audit record storage capacity by adding/modifying the following line in the /etc/audit/auditd.conf file: space_left = 25%

b
OL 9 must notify the system administrator (SA) and information system security officer (ISSO) (at a minimum) when allocated audit record storage volume reaches 75 percent utilization.
RMF Control
AU-5
Severity
M
CCI
CCI-001855
Version
OL09-00-000870
Vuln IDs
V-271600
Rule IDs
SV-271600r1134858_rule
If security personnel are not notified immediately when storage volume reaches a maximum of 75 percent utilization, they are unable to plan for audit record storage capacity expansion. The notification can be set to trigger at lower utilization thresholds at the ISSO's discretion.
Fix: F-75557r1134857_fix

Configure OL 9 to initiate an action to notify the SA and ISSO (at a minimum) when allocated audit record storage volume reaches (at most) 75 percent of the repository maximum audit record storage capacity by adding/modifying the following line in the /etc/audit/auditd.conf file: space_left_action = email

b
OL 9 must take action when allocated audit record storage volume reaches 95 percent of the audit record storage capacity.
RMF Control
AU-5
Severity
M
CCI
CCI-001855
Version
OL09-00-000875
Vuln IDs
V-271601
Rule IDs
SV-271601r1091515_rule
If action is not taken when storage volume reaches 95 percent utilization, the auditing system may fail when the storage volume reaches capacity.
Fix: F-75558r1091514_fix

Configure OL 9 to initiate an action when allocated audit record storage volume reaches 95 percent of the repository maximum audit record storage capacity by adding/modifying the following line in the /etc/audit/auditd.conf file. admin_space_left = 5%

b
OL 9 must write audit records to disk.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-000880
Vuln IDs
V-271602
Rule IDs
SV-271602r1092590_rule
Audit data should be synchronously written to disk to ensure log integrity. This setting ensures that all audit event data is written disk.
Fix: F-75559r1092589_fix

Configure the audit system to write log files to the disk. Edit the /etc/audit/auditd.conf file and add or update the "write_logs" option to "yes": write_logs = yes The audit daemon must be restarted for changes to take effect. Restart auditd: $ sudo service auditd restart

b
OL 9 must act when allocated audit record storage volume reaches 95 percent of the repository maximum audit record storage capacity.
RMF Control
AU-5
Severity
M
CCI
CCI-001855
Version
OL09-00-000885
Vuln IDs
V-271603
Rule IDs
SV-271603r1092592_rule
If action is not taken when storage volume reaches 95 percent utilization, the auditing system may fail when the storage volume reaches capacity.
Fix: F-75560r1092591_fix

Configure the auditd service to take action in the event of allocated audit record storage volume reaches 95 percent of the repository maximum audit record storage capacity. Edit the following line in "/etc/audit/auditd.conf" to ensure that the system is forced into single user mode in the event the audit record storage volume is about to reach maximum capacity: admin_space_left_action = single The audit daemon must be restarted for changes to take effect. Restart auditd: $ sudo service auditd restart

b
OL 9 must enable certificate-based smart card authentication.
RMF Control
Severity
M
CCI
CCI-004046
Version
OL09-00-000925
Vuln IDs
V-271607
Rule IDs
SV-271607r1091533_rule
Without the use of multifactor authentication (MFA), the ease of access to privileged functions is greatly increased. Multifactor authentication requires using two or more factors to achieve authentication. A privileged account is defined as an information system account with authorizations of a privileged user. The DOD Common Access Card (CAC) with DOD-approved PKI is an example of multifactor authentication. Satisfies: SRG-OS-000375-GPOS-00160, SRG-OS-000105-GPOS-00052
Fix: F-75564r1091532_fix

Configure OL 9 to enable certificate-based smart card authentication. Edit the file "/etc/sssd/sssd.conf" and add or edit the following line: pam_cert_auth = True

b
OL 9 must implement certificate status checking for multifactor authentication (MFA).
RMF Control
Severity
M
CCI
CCI-004046
Version
OL09-00-000930
Vuln IDs
V-271608
Rule IDs
SV-271608r1091536_rule
Using an authentication device, such as a DOD Common Access Card (CAC) or token that is separate from the information system, ensures that even if the information system is compromised, credentials stored on the authentication device will not be affected. Multifactor solutions that require devices separate from information systems gaining access include, for example, hardware tokens providing time-based or challenge-response authenticators and smart cards such as the U.S. Government Personal Identity Verification (PIV) card and the DOD CAC. OL 9 includes multiple options for configuring certificate status checking, but for this requirement focuses on the System Security Services Daemon (SSSD). By default, SSSD performs Online Certificate Status Protocol (OCSP) checking and certificate verification using a sha256 digest function. Satisfies: SRG-OS-000375-GPOS-00160, SRG-OS-000377-GPOS-00162
Fix: F-75565r1091535_fix

Configure OL 9 to implement certificate status checking for MFA. Review the "/etc/sssd/conf.d/certificate_verification.conf" file to determine if the system is configured to prevent OCSP or certificate verification. Add the following line to the "/etc/sssd/conf.d/certificate_verification.conf" file: certificate_verification = ocsp_dgst=sha512 Set the correct ownership and permissions on the "/etc/sssd/conf.d/certificate_verification.conf" file by running these commands: $ sudo chown root:root "/etc/sssd/conf.d/certificate_verification.conf" $ sudo chmod 600 "/etc/sssd/conf.d/certificate_verification.conf" The "sssd" service must be restarted for the changes to take effect. To restart the "sssd" service, run the following command: $ sudo systemctl restart sssd.service

b
OL 9 must prohibit the use of cached authenticators after one day.
RMF Control
IA-5
Severity
M
CCI
CCI-002007
Version
OL09-00-000935
Vuln IDs
V-271609
Rule IDs
SV-271609r1091539_rule
If cached authentication information is out-of-date, the validity of the authentication information may be questionable.
Fix: F-75566r1091538_fix

Configure the SSSD to prohibit the use of cached authentications after one day. Add or change the following line in "/etc/sssd/sssd.conf" just below the line [pam]: offline_credentials_expiration = 1

b
OL 9 must use the CAC smart card driver.
RMF Control
IA-2
Severity
M
CCI
CCI-000764
Version
OL09-00-000940
Vuln IDs
V-271610
Rule IDs
SV-271610r1091542_rule
Smart card login provides two-factor authentication stronger than that provided by a username and password combination. Smart cards leverage public key infrastructure to provide and verify credentials. Configuring the smart card driver in use by the organization helps to prevent users from using unauthorized smart cards. Satisfies: SRG-OS-000104-GPOS-00051, SRG-OS-000106-GPOS-00053, SRG-OS-000107-GPOS-00054, SRG-OS-000109-GPOS-00056, SRG-OS-000108-GPOS-00055, SRG-OS-000112-GPOS-00057, SRG-OS-000113-GPOS-00058
Fix: F-75567r1091541_fix

Configure OL 9 to load the CAC driver. Add or modify the following line in the "/etc/opensc.conf" file: card_drivers = cac;

b
OL 9 must ensure the password complexity module is enabled in the system-auth file.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-001000
Vuln IDs
V-271611
Rule IDs
SV-271611r1091545_rule
Enabling PAM password complexity permits enforcement of strong passwords and consequently makes the system less prone to dictionary attacks.
Fix: F-75568r1091544_fix

Configure OL 9 to use "pwquality" to enforce password complexity rules. Add the following line to the "/etc/pam.d/system-auth" file(or modify the line to have the required value): password required pam_pwquality.so

b
OL 9 must ensure the password complexity module in the system-auth file is configured for three retries or less.
RMF Control
Severity
M
CCI
CCI-004066
Version
OL09-00-001001
Vuln IDs
V-271612
Rule IDs
SV-271612r1091548_rule
Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. "pwquality" enforces complex password construction configuration and has the ability to limit brute-force attacks on the system. OL 9 uses "pwquality" as a mechanism to enforce password complexity. This is set in both: /etc/pam.d/password-auth /etc/pam.d/system-auth By limiting the number of attempts to meet the pwquality module complexity requirements before returning with an error, the system will audit abnormal attempts at password changes.
Fix: F-75569r1091547_fix

Configure OL 9 to limit the "pwquality" retry option to "3". Add the following line to the "/etc/pam.d/system-auth" file (or modify the line to have the required value): password required pam_pwquality.so retry=3

b
OL 9 must enforce password complexity by requiring that at least one uppercase character be used.
RMF Control
Severity
M
CCI
CCI-004066
Version
OL09-00-001005
Vuln IDs
V-271613
Rule IDs
SV-271613r1091551_rule
Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised. Requiring a minimum number of uppercase characters makes password guessing attacks more difficult by ensuring a larger search space.
Fix: F-75570r1091550_fix

Configure OL 9 to enforce password complexity by requiring that at least one uppercase character is used by setting the "ucredit" option. Add the following line to /etc/security/pwquality.conf (or modify the line to have the required value): ucredit = -1

b
OL 9 must ensure the password complexity module is enabled in the password-auth file.
RMF Control
Severity
M
CCI
CCI-004066
Version
OL09-00-001010
Vuln IDs
V-271614
Rule IDs
SV-271614r1091554_rule
Enabling PAM password complexity permits enforcement of strong passwords and consequently makes the system less prone to dictionary attacks. Satisfies: SRG-OS-000069-GPOS-00037, SRG-OS-000070-GPOS-00038
Fix: F-75571r1091553_fix

Configure OL 9 to use "pwquality" to enforce password complexity rules. Add the following line to the "/etc/pam.d/password-auth" file (or modify the line to have the required value): password required pam_pwquality.so

b
OL 9 must enforce password complexity by requiring that at least one lowercase character be used.
RMF Control
Severity
M
CCI
CCI-004066
Version
OL09-00-001015
Vuln IDs
V-271615
Rule IDs
SV-271615r1091557_rule
Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised. Requiring a minimum number of lowercase characters makes password guessing attacks more difficult by ensuring a larger search space.
Fix: F-75572r1091556_fix

Configure OL 9 to enforce password complexity by requiring at least one lowercase character is used by setting the "lcredit" option. Add the following line to "/etc/security/pwquality.conf" (or modify the line to have the required value): lcredit = -1

b
OL 9 must enforce password complexity by requiring that at least one numeric character be used.
RMF Control
Severity
M
CCI
CCI-004066
Version
OL09-00-001020
Vuln IDs
V-271616
Rule IDs
SV-271616r1091560_rule
Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised. Requiring digits makes password guessing attacks more difficult by ensuring a larger search space.
Fix: F-75573r1091559_fix

Configure OL 9 to enforce password complexity by requiring at least one numeric character is used by setting the "dcredit" option. Add the following line to "/etc/security/pwquality.conf" (or modify the line to have the required value): dcredit = -1

b
OL 9 must require the change of at least eight characters when passwords are changed.
RMF Control
Severity
M
CCI
CCI-004066
Version
OL09-00-001025
Vuln IDs
V-271617
Rule IDs
SV-271617r1091563_rule
Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised. Requiring a minimum number of different characters during password changes ensures that newly changed passwords will not resemble previously compromised ones. Note that passwords changed on compromised systems will still be compromised.
Fix: F-75574r1091562_fix

Configure OL 9 to require the change of at least eight of the total number of characters when passwords are changed by setting the "difok" option. Add the following line to "/etc/security/pwquality.conf" (or modify the line to have the required value): difok = 8

b
OL 9 must require the maximum number of repeating characters of the same character class be limited to four when passwords are changed.
RMF Control
Severity
M
CCI
CCI-004066
Version
OL09-00-001030
Vuln IDs
V-271618
Rule IDs
SV-271618r1091566_rule
Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password complexity is one factor of several that determines how long it takes to crack a password. The more complex a password, the greater the number of possible combinations that need to be tested before the password is compromised.
Fix: F-75575r1091565_fix

Configure OL 9 to require the change of the number of repeating characters of the same character class when passwords are changed by setting the "maxclassrepeat" option. Add the following line to "/etc/security/pwquality.conf" conf (or modify the line to have the required value): maxclassrepeat = 4

b
OL 9 must require the maximum number of repeating characters be limited to three when passwords are changed.
RMF Control
Severity
M
CCI
CCI-004066
Version
OL09-00-001035
Vuln IDs
V-271619
Rule IDs
SV-271619r1091569_rule
Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password complexity is one factor of several that determines how long it takes to crack a password. The more complex a password, the greater the number of possible combinations that need to be tested before the password is compromised.
Fix: F-75576r1091568_fix

Configure OL 9 to require the change of the number of repeating consecutive characters when passwords are changed by setting the "maxrepeat" option. Add the following line to "/etc/security/pwquality.conf" (or modify the line to have the required value): maxrepeat = 3

b
OL 9 must require the change of at least four character classes when passwords are changed.
RMF Control
Severity
M
CCI
CCI-004066
Version
OL09-00-001040
Vuln IDs
V-271620
Rule IDs
SV-271620r1091572_rule
Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password complexity is one factor of several that determines how long it takes to crack a password. The more complex a password, the greater the number of possible combinations that need to be tested before the password is compromised.
Fix: F-75577r1091571_fix

Configure OL 9 to require the change of at least four character classes when passwords are changed by setting the "minclass" option. Add the following line to "/etc/security/pwquality.conf" (or modify the line to have the required value): minclass = 4

b
OL 9 must enforce password complexity rules for the root account.
RMF Control
Severity
M
CCI
CCI-004066
Version
OL09-00-001045
Vuln IDs
V-271621
Rule IDs
SV-271621r1091575_rule
Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised. Satisfies: SRG-OS-000072-GPOS-00040, SRG-OS-000071-GPOS-00039, SRG-OS-000070-GPOS-00038, SRG-OS-000266-GPOS-00101, SRG-OS-000078-GPOS-00046, SRG-OS-000480-GPOS-00225, SRG-OS-000069-GPOS-00037
Fix: F-75578r1091574_fix

Configure OL 9 to enforce password complexity on the root account. Add or update the following line in /etc/security/pwquality.conf: enforce_for_root

b
OL 9 must be configured so that user and group account administration utilities are configured to store only encrypted representations of passwords.
RMF Control
Severity
M
CCI
CCI-004062
Version
OL09-00-001050
Vuln IDs
V-271622
Rule IDs
SV-271622r1091578_rule
Passwords need to be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. Passwords that are encrypted with a weak algorithm are no more protected than if they are kept in plain text. This setting ensures user and group account administration utilities are configured to store only encrypted representations of passwords. Additionally, the "crypt_style" configuration option ensures the use of a strong hashing algorithm that makes password cracking attacks more difficult.
Fix: F-75579r1091577_fix

Configure OL 9 to use the SHA-512 algorithm for password hashing. Add or change the following line in the "[default]" section of "/etc/libuser.conf" file: crypt_style = sha512

b
OL 9 must be configured to use the shadow file to store only encrypted representations of passwords.
RMF Control
Severity
M
CCI
CCI-004062
Version
OL09-00-001055
Vuln IDs
V-271623
Rule IDs
SV-271623r1091581_rule
Passwords need to be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. Passwords that are encrypted with a weak algorithm are no more protected than if they are kept in plain text. This setting ensures user and group account administration utilities are configured to store only encrypted representations of passwords. Additionally, the "crypt_style" configuration option ensures the use of a strong hashing algorithm that makes password cracking attacks more difficult.
Fix: F-75580r1091580_fix

Configure OL 9 to store only SHA-512 encrypted representations of passwords. Add or update the following line in the "/etc/login.defs" file: ENCRYPT_METHOD SHA512

b
OL 9 pam_unix.so module must be configured in the password-auth file to use a FIPS 140-3 approved cryptographic hashing algorithm for system authentication.
RMF Control
Severity
M
CCI
CCI-004062
Version
OL09-00-001060
Vuln IDs
V-271624
Rule IDs
SV-271624r1091584_rule
Unapproved mechanisms that are used for authentication to the cryptographic module are not verified and therefore, cannot be relied upon to provide confidentiality or integrity, and DOD data may be compromised. OL 9 systems using encryption are required to use FIPS-compliant mechanisms for authenticating to cryptographic modules. FIPS 140-3 is the current standard for validating that mechanisms used to access cryptographic modules use authentication that meets DOD requirements. This allows for Security Levels 1, 2, 3, or 4 for use on a general-purpose computing system.
Fix: F-75581r1091583_fix

Configure OL 9 to use a FIPS 140-3 approved cryptographic hashing algorithm for system authentication. Edit/modify the following line in the "/etc/pam.d/password-auth" file to include the sha512 option for pam_unix.so: password sufficient pam_unix.so sha512

b
OL 9 password-auth must be configured to use a sufficient number of hashing rounds.
RMF Control
Severity
M
CCI
CCI-004062
Version
OL09-00-001065
Vuln IDs
V-271625
Rule IDs
SV-271625r1091587_rule
Passwords need to be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. Passwords that are encrypted with a weak algorithm are no more protected than if they are kept in plain text. Using more hashing rounds makes password cracking attacks more difficult. Satisfies: SRG-OS-000073-GPOS-00041, SRG-OS-000120-GPOS-00061
Fix: F-75582r1091586_fix

Configure Oracle Linux 9 to use 100000 hashing rounds for hashing passwords. Add or modify the following line in "/etc/pam.d/password-auth" and set "rounds" to "100000". password sufficient pam_unix.so sha512 rounds=100000

b
OL 9 system-auth must be configured to use a sufficient number of hashing rounds.
RMF Control
Severity
M
CCI
CCI-004062
Version
OL09-00-001070
Vuln IDs
V-271626
Rule IDs
SV-271626r1091590_rule
Passwords need to be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. Passwords that are encrypted with a weak algorithm are no more protected than if they are kept in plain text. Using more hashing rounds makes password cracking attacks more difficult. Satisfies: SRG-OS-000073-GPOS-00041, SRG-OS-000120-GPOS-00061
Fix: F-75583r1091589_fix

Configure Oracle Linux 9 to use 100000 hashing rounds for hashing passwords. Add or modify the following line in "/etc/pam.d/system-auth" and set "rounds" to 100000. password sufficient pam_unix.so sha512 rounds=100000'

b
OL 9 shadow password suite must be configured to use a sufficient number of hashing rounds.
RMF Control
Severity
M
CCI
CCI-004062
Version
OL09-00-001075
Vuln IDs
V-271627
Rule IDs
SV-271627r1091593_rule
Passwords need to be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. Passwords that are encrypted with a weak algorithm are no more protected than if they are kept in plain text. Using more hashing rounds makes password cracking attacks more difficult. Satisfies: SRG-OS-000073-GPOS-00041, SRG-OS-000120-GPOS-00061
Fix: F-75584r1091592_fix

Configure OL 9 to encrypt all stored passwords with a strong cryptographic hash. Edit/modify the following line in the "/etc/login.defs" file and set "SHA_CRYPT_MIN_ROUNDS" to a value no lower than "100000": SHA_CRYPT_MIN_ROUNDS 100000 SHA_CRYPT_MAX_ROUNDS 100000

b
OL 9 must employ FIPS 140-3 approved cryptographic hashing algorithms for all stored passwords.
RMF Control
Severity
M
CCI
CCI-004062
Version
OL09-00-001080
Vuln IDs
V-271628
Rule IDs
SV-271628r1091596_rule
The system must use a strong hashing algorithm to store the password. Passwords need to be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. Satisfies: SRG-OS-000073-GPOS-00041, SRG-OS-000120-GPOS-00061
Fix: F-75585r1091595_fix

Lock all interactive user accounts not using SHA-512 hashing until the passwords can be regenerated with SHA-512. To lock an account: $ sudo passwd -l [username]

b
OL 9 passwords for new users or password changes must have a 24-hour minimum password lifetime restriction in /etc/login.defs.
RMF Control
Severity
M
CCI
CCI-004066
Version
OL09-00-001085
Vuln IDs
V-271629
Rule IDs
SV-271629r1091599_rule
Enforcing a minimum password lifetime helps to prevent repeated password changes to defeat the password reuse or history enforcement requirement. If users are allowed to immediately and continually change their password, then the password could be repeatedly changed in a short period of time to defeat the organization's policy regarding password reuse. Setting the minimum password age protects against users cycling back to a favorite password after satisfying the password reuse requirement.
Fix: F-75586r1091598_fix

Configure OL 9 to enforce 24 hours as the minimum password lifetime. Add the following line in "/etc/login.defs" (or modify the line to have the required value): PASS_MIN_DAYS 1

b
OL 9 passwords must have a 24-hour minimum password lifetime restriction in /etc/shadow.
RMF Control
Severity
M
CCI
CCI-004066
Version
OL09-00-001090
Vuln IDs
V-271630
Rule IDs
SV-271630r1091602_rule
Enforcing a minimum password lifetime helps to prevent repeated password changes to defeat the password reuse or history enforcement requirement. If users are allowed to immediately and continually change their password, the password could be repeatedly changed in a short period of time to defeat the organization's policy regarding password reuse.
Fix: F-75587r1091601_fix

Configure noncompliant accounts to enforce a 24-hour minimum password lifetime: $ sudo passwd -n 1 [user]

b
OL 9 user account passwords for new users or password changes must have a 60-day maximum password lifetime restriction in /etc/login.defs.
RMF Control
Severity
M
CCI
CCI-004066
Version
OL09-00-001095
Vuln IDs
V-271631
Rule IDs
SV-271631r1091605_rule
Any password, no matter how complex, can eventually be cracked; therefore, passwords need to be changed periodically. If the operating system does not limit the lifetime of passwords and force users to change their passwords, there is the risk that the operating system passwords could be compromised. Setting the password maximum age ensures users are required to periodically change their passwords. Requiring shorter password lifetimes increases the risk of users writing down the password in a convenient location subject to physical compromise.
Fix: F-75588r1091604_fix

Configure OL 9 to enforce a 60-day maximum password lifetime. Add or modify the following line in the "/etc/login.defs" file: PASS_MAX_DAYS 60

b
OL 9 user account passwords must have a 60-day maximum password lifetime restriction.
RMF Control
Severity
M
CCI
CCI-004066
Version
OL09-00-001100
Vuln IDs
V-271632
Rule IDs
SV-271632r1091608_rule
Any password, no matter how complex, can eventually be cracked; therefore, passwords need to be changed periodically. If OL 9 does not limit the lifetime of passwords and force users to change their passwords, there is the risk that OL 9 passwords could be compromised.
Fix: F-75589r1091607_fix

Configure noncompliant accounts to enforce a 60-day maximum password lifetime restriction. passwd -x 60 [user]

b
OL 9 passwords must be created with a minimum of 15 characters.
RMF Control
Severity
M
CCI
CCI-004066
Version
OL09-00-001105
Vuln IDs
V-271633
Rule IDs
SV-271633r1091611_rule
The shorter the password, the lower the number of possible combinations that need to be tested before the password is compromised. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password length is one factor of several that helps to determine strength and how long it takes to crack a password. Use of more characters in a password helps to increase exponentially the time and/or resources required to compromise the password. OL 9 uses "pwquality" as a mechanism to enforce password complexity. Configurations are set in the "etc/security/pwquality.conf" file. The "minlen", sometimes noted as minimum length, acts as a "score" of complexity based on the credit components of the "pwquality" module. By setting the credit components to a negative value, not only will those components be required, but they will not count toward the total "score" of "minlen". This will enable "minlen" to require a 15-character minimum. The DOD minimum password requirement is 15 characters.
Fix: F-75590r1091610_fix

Configure OL 9 to enforce a minimum 15-character password length. Add the following line to "/etc/security/pwquality.conf" (or modify the line to have the required value): minlen = 15

c
OL 9 must not allow blank or null passwords.
RMF Control
CM-6
Severity
H
CCI
CCI-000366
Version
OL09-00-001110
Vuln IDs
V-271634
Rule IDs
SV-271634r1091614_rule
If an account has an empty password, anyone could log in and run commands with the privileges of that account. Accounts with empty passwords should never be used in operational environments.
Fix: F-75591r1091613_fix

Remove any instances of the "nullok" option in the "/etc/pam.d/password-auth" and "/etc/pam.d/system-auth" files to prevent logons with empty passwords. Note: Manual changes to the listed file may be overwritten by the "authselect" program.

b
OL 9 must require a boot loader superuser password.
RMF Control
AC-3
Severity
M
CCI
CCI-000213
Version
OL09-00-001115
Vuln IDs
V-271635
Rule IDs
SV-271635r1137691_rule
To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DOD-approved PKIs, all DOD systems (e.g., web servers and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement. Password protection on the boot loader configuration ensures users with physical access cannot trivially alter important bootloader settings. These include which kernel to use, and whether to enter single-user mode.
Fix: F-75592r1091616_fix

Configure OL 9 to require a grub bootloader password for the grub superuser account. Generate an encrypted grub2 password for the grub superuser account with the following command: $ sudo grub2-setpassword Enter password: Confirm password:

b
OL 9 must enforce password complexity by requiring that at least one special character be used.
RMF Control
Severity
M
CCI
CCI-004066
Version
OL09-00-001120
Vuln IDs
V-271636
Rule IDs
SV-271636r1091620_rule
Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised. OL 9 uses "pwquality" as a mechanism to enforce password complexity. Note that to require special characters without degrading the "minlen" value, the credit value must be expressed as a negative number in "/etc/security/pwquality.conf".
Fix: F-75593r1091619_fix

Configure OL 9 to enforce password complexity by requiring at least one special character be used by setting the "ocredit" option. Add the following line to "/etc/security/pwquality.conf" (or modify the line to have the required value): ocredit = -1

b
OL 9 must prevent the use of dictionary words for passwords.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-001125
Vuln IDs
V-271637
Rule IDs
SV-271637r1091623_rule
Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. If OL 9 allows the user to select passwords based on dictionary words, this increases the chances of password compromise by increasing the opportunity for successful guesses, and brute-force attacks.
Fix: F-75594r1091622_fix

Configure OL 9 to prevent the use of dictionary words for passwords. Add or update the following line in the "/etc/security/pwquality.conf" file or a configuration file in the /etc/pwquality.conf.d/ directory to contain the "dictcheck" parameter: dictcheck=1

b
OL 9 must not have accounts configured with blank or null passwords.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-001130
Vuln IDs
V-271638
Rule IDs
SV-271638r1091626_rule
If an account has an empty password, anyone could log in and run commands with the privileges of that account. Accounts with empty passwords should never be used in operational environments.
Fix: F-75595r1091625_fix

Configure OL 9 so that all accounts have a password or lock the account with the following commands: Perform a password reset: $ sudo passwd [username] To lock an account: $ sudo passwd -l [username]

b
OL 9 file system automount function must be disabled unless required.
RMF Control
IA-3
Severity
M
CCI
CCI-000778
Version
OL09-00-002000
Vuln IDs
V-271639
Rule IDs
SV-271639r1091629_rule
An authentication process resists replay attacks if it is impractical to achieve a successful authentication by recording and replaying a previous authentication message. Satisfies: SRG-OS-000114-GPOS-00059, SRG-OS-000378-GPOS-00163
Fix: F-75596r1091628_fix

Configure OL 9 to disable and mask the ability to automount devices. The autofs service can be disabled and masked with the following command: $ sudo systemctl mask --now autofs.service

b
OL 9 must prevent special devices on file systems that are imported via Network File System (NFS).
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-002011
Vuln IDs
V-271641
Rule IDs
SV-271641r1091635_rule
The "nodev" mount option causes the system to not interpret character or block special devices. Executing character or block special devices from untrusted file systems increases the opportunity for nonprivileged users to attain unauthorized administrative access.
Fix: F-75598r1091634_fix

Update each NFS mounted file system to use the "nodev" option on file systems that are being imported via NFS.

b
OL 9 must prevent code from being executed on file systems that are imported via Network File System (NFS).
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-002012
Vuln IDs
V-271642
Rule IDs
SV-271642r1092593_rule
The "noexec" mount option causes the system not to execute binary files. This option must be used for mounting any file system not containing approved binary as they may be incompatible. Executing files from untrusted file systems increases the opportunity for nonprivileged users to attain unauthorized administrative access.
Fix: F-75599r1091637_fix

Update each NFS mounted file system to use the "noexec" option on file systems that are being imported via NFS.

b
OL 9 must prevent files with the setuid and setgid bit set from being executed on file systems that are imported via Network File System (NFS).
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-002013
Vuln IDs
V-271643
Rule IDs
SV-271643r1091641_rule
The "nosuid" mount option causes the system not to execute "setuid" and "setgid" files with owner privileges. This option must be used for mounting any file system not containing approved "setuid" and "setguid" files. Executing files from untrusted file systems increases the opportunity for nonprivileged users to attain unauthorized administrative access.
Fix: F-75600r1091640_fix

Update each NFS mounted file system to use the "nosuid" option on file systems that are being imported via NFS.

b
OL 9 must mount /boot with the nodev option.
RMF Control
CM-7
Severity
M
CCI
CCI-001764
Version
OL09-00-002030
Vuln IDs
V-271647
Rule IDs
SV-271647r1091653_rule
The only legitimate location for device files is the "/dev" directory located on the root partition. The only exception to this is chroot jails.
Fix: F-75604r1091652_fix

Configure OL 9 to mount /boot with the nodev option. Modify "/etc/fstab" to use the "nodev" option on the "/boot" directory.

b
OL 9 must prevent files with the setuid and setgid bit set from being executed on the /boot directory.
RMF Control
CM-7
Severity
M
CCI
CCI-001764
Version
OL09-00-002031
Vuln IDs
V-271648
Rule IDs
SV-271648r1091656_rule
The "nosuid" mount option causes the system not to execute "setuid" and "setgid" files with owner privileges. This option must be used for mounting any file system not containing approved "setuid" and "setguid" files. Executing files from untrusted file systems increases the opportunity for nonprivileged users to attain unauthorized administrative access.
Fix: F-75605r1091655_fix

Configure OL 9 to prevent files with the setuid and setgid bit set from being executed on the /boot directory. Modify "/etc/fstab" to use the "nosuid" option on the "/boot" directory.

b
OL 9 must prevent files with the setuid and setgid bit set from being executed on the /boot/efi directory.
RMF Control
CM-7
Severity
M
CCI
CCI-001764
Version
OL09-00-002032
Vuln IDs
V-271649
Rule IDs
SV-271649r1155334_rule
The "nosuid" mount option causes the system not to execute "setuid" and "setgid" files with owner privileges. This option must be used for mounting any file system not containing approved "setuid" and "setguid" files. Executing files from untrusted file systems increases the opportunity for nonprivileged users to attain unauthorized administrative access.
Fix: F-75606r1091658_fix

Configure OL 9 to prevent files with the setuid and setgid bit set from being executed on the /boot/efi directory. Modify "/etc/fstab" to use the "nosuid" option on the "/boot/efi" directory.

b
OL 9 must mount /dev/shm with the nodev option.
RMF Control
CM-7
Severity
M
CCI
CCI-001764
Version
OL09-00-002040
Vuln IDs
V-271650
Rule IDs
SV-271650r1091662_rule
The nodev mount option causes the system to not interpret character or block special devices. Executing character or block special devices from untrusted file systems increases the opportunity for nonprivileged users to attain unauthorized administrative access. The only legitimate location for device files is the "/dev" directory located on the root partition, with the exception of chroot jails if implemented.
Fix: F-75607r1091661_fix

Configure OL 9 to mount /dev/shm with the nodev option. Modify "/etc/fstab" to use the "nodev" option on the "/dev/shm" file system.

b
OL 9 must mount /dev/shm with the noexec option.
RMF Control
CM-7
Severity
M
CCI
CCI-001764
Version
OL09-00-002041
Vuln IDs
V-271651
Rule IDs
SV-271651r1091665_rule
The noexec mount option causes the system to not execute binary files. This option must be used for mounting any file system not containing approved binary files, as they may be incompatible. Executing files from untrusted file systems increases the opportunity for nonprivileged users to attain unauthorized administrative access.
Fix: F-75608r1091664_fix

Configure OL 9 to mount /dev/shm with the noexec option. Modify "/etc/fstab" to use the "noexec" option on the "/dev/shm" file system.

b
OL 9 must mount /dev/shm with the nosuid option.
RMF Control
CM-7
Severity
M
CCI
CCI-001764
Version
OL09-00-002042
Vuln IDs
V-271652
Rule IDs
SV-271652r1094966_rule
The "nosuid" mount option causes the system to not execute "setuid" and "setgid" files with owner privileges. This option must be used for mounting any file system not containing approved "setuid" and "setguid" files. Executing files from untrusted file systems increases the opportunity for nonprivileged users to attain unauthorized administrative access.
Fix: F-75609r1091667_fix

Configure OL 9 to mount /dev/shm with the nosuid option. Modify "/etc/fstab" to use the "nosuid" option on the "/dev/shm" file system.

b
OL 9 must mount /tmp with the nodev option.
RMF Control
CM-7
Severity
M
CCI
CCI-001764
Version
OL09-00-002050
Vuln IDs
V-271653
Rule IDs
SV-271653r1091671_rule
The "nodev" mount option causes the system to not interpret character or block special devices. Executing character or block special devices from untrusted file systems increases the opportunity for nonprivileged users to attain unauthorized administrative access. The only legitimate location for device files is the "/dev" directory located on the root partition, with the exception of chroot jails if implemented.
Fix: F-75610r1091670_fix

Configure OL 9 to mount /tmp with the nodev option. Modify "/etc/fstab" to use the "nodev" option on the "/tmp" directory.

b
OL 9 must mount /tmp with the noexec option.
RMF Control
CM-7
Severity
M
CCI
CCI-001764
Version
OL09-00-002051
Vuln IDs
V-271654
Rule IDs
SV-271654r1091674_rule
The "noexec" mount option causes the system to not execute binary files. This option must be used for mounting any file system not containing approved binary files, as they may be incompatible. Executing files from untrusted file systems increases the opportunity for nonprivileged users to attain unauthorized administrative access.
Fix: F-75611r1091673_fix

Configure OL 9 to mount /tmp with the noexec option. Modify "/etc/fstab" to use the "noexec" option on the "/tmp" directory.

b
OL 9 must mount /tmp with the nosuid option.
RMF Control
CM-7
Severity
M
CCI
CCI-001764
Version
OL09-00-002052
Vuln IDs
V-271655
Rule IDs
SV-271655r1091677_rule
The "nosuid" mount option causes the system to not execute "setuid" and "setgid" files with owner privileges. This option must be used for mounting any file system not containing approved "setuid" and "setguid" files. Executing files from untrusted file systems increases the opportunity for nonprivileged users to attain unauthorized administrative access.
Fix: F-75612r1091676_fix

Configure OL 9 to mount /tmp with the nosuid option. Modify "/etc/fstab" to use the "nosuid" option on the "/tmp" directory.

b
OL 9 must mount /var with the nodev option.
RMF Control
CM-7
Severity
M
CCI
CCI-001764
Version
OL09-00-002060
Vuln IDs
V-271656
Rule IDs
SV-271656r1091680_rule
The "nodev" mount option causes the system to not interpret character or block special devices. Executing character or block special devices from untrusted file systems increases the opportunity for nonprivileged users to attain unauthorized administrative access. The only legitimate location for device files is the "/dev" directory located on the root partition, with the exception of chroot jails if implemented.
Fix: F-75613r1091679_fix

Configure OL 9 to mount /var with the nodev option. Modify "/etc/fstab" to use the "nodev" option on the "/var" directory.

b
OL 9 must mount /var/log with the nodev option.
RMF Control
CM-7
Severity
M
CCI
CCI-001764
Version
OL09-00-002061
Vuln IDs
V-271657
Rule IDs
SV-271657r1091683_rule
The "nodev" mount option causes the system to not interpret character or block special devices. Executing character or block special devices from untrusted file systems increases the opportunity for nonprivileged users to attain unauthorized administrative access. The only legitimate location for device files is the "/dev" directory located on the root partition, with the exception of chroot jails if implemented.
Fix: F-75614r1091682_fix

Configure OL 9 to mount /var/log with the nodev option. Modify "/etc/fstab" to use the "nodev" option on the "/var/log" directory.

b
OL 9 must mount /var/log with the noexec option.
RMF Control
CM-7
Severity
M
CCI
CCI-001764
Version
OL09-00-002062
Vuln IDs
V-271658
Rule IDs
SV-271658r1091686_rule
The "noexec" mount option causes the system to not execute binary files. This option must be used for mounting any file system not containing approved binary files, as they may be incompatible. Executing files from untrusted file systems increases the opportunity for nonprivileged users to attain unauthorized administrative access.
Fix: F-75615r1091685_fix

Configure OL 9 to mount /var/log with the noexec option. Modify "/etc/fstab" to use the "noexec" option on the "/var/log" directory.

b
OL 9 must mount /var/log with the nosuid option.
RMF Control
CM-7
Severity
M
CCI
CCI-001764
Version
OL09-00-002063
Vuln IDs
V-271659
Rule IDs
SV-271659r1091689_rule
The "nosuid" mount option causes the system to not execute "setuid" and "setgid" files with owner privileges. This option must be used for mounting any file system not containing approved "setuid" and "setguid" files. Executing files from untrusted file systems increases the opportunity for nonprivileged users to attain unauthorized administrative access.
Fix: F-75616r1091688_fix

Configure OL 9 to mount /var/log with the nosuid option. Modify "/etc/fstab" to use the "nosuid" option on the "/var/log" directory.

b
OL 9 must mount /var/log/audit with the nodev option.
RMF Control
CM-7
Severity
M
CCI
CCI-001764
Version
OL09-00-002064
Vuln IDs
V-271660
Rule IDs
SV-271660r1091692_rule
The "nodev" mount option causes the system to not interpret character or block special devices. Executing character or block special devices from untrusted file systems increases the opportunity for nonprivileged users to attain unauthorized administrative access. The only legitimate location for device files is the "/dev" directory located on the root partition, with the exception of chroot jails if implemented.
Fix: F-75617r1091691_fix

Configure OL 9 to mount /var/log/audit with the nodev option. Modify "/etc/fstab" to use the "nodev" option on the "/var/log/audit" directory.

b
OL 9 must mount /var/log/audit with the noexec option.
RMF Control
CM-7
Severity
M
CCI
CCI-001764
Version
OL09-00-002065
Vuln IDs
V-271661
Rule IDs
SV-271661r1091695_rule
The "noexec" mount option causes the system to not execute binary files. This option must be used for mounting any file system not containing approved binary files, as they may be incompatible. Executing files from untrusted file systems increases the opportunity for nonprivileged users to attain unauthorized administrative access.
Fix: F-75618r1091694_fix

Configure OL 9 to mount /var/log/audit with the noexec option. Modify "/etc/fstab" to use the "noexec" option on the "/var/log/audit" directory.

b
OL 9 must mount /var/log/audit with the nosuid option.
RMF Control
CM-7
Severity
M
CCI
CCI-001764
Version
OL09-00-002066
Vuln IDs
V-271662
Rule IDs
SV-271662r1091698_rule
The "nosuid" mount option causes the system to not execute "setuid" and "setgid" files with owner privileges. This option must be used for mounting any file system not containing approved "setuid" and "setguid" files. Executing files from untrusted file systems increases the opportunity for nonprivileged users to attain unauthorized administrative access.
Fix: F-75619r1091697_fix

Configure OL 9 to mount /var/log/audit with the nosuid option. Modify "/etc/fstab" to use the "nosuid" option on the "/var/log/audit" directory.

b
OL 9 must mount /var/tmp with the nodev option.
RMF Control
CM-7
Severity
M
CCI
CCI-001764
Version
OL09-00-002067
Vuln IDs
V-271663
Rule IDs
SV-271663r1091701_rule
The "nodev" mount option causes the system to not interpret character or block special devices. Executing character or block special devices from untrusted file systems increases the opportunity for nonprivileged users to attain unauthorized administrative access. The only legitimate location for device files is the "/dev" directory located on the root partition, with the exception of chroot jails if implemented.
Fix: F-75620r1091700_fix

Configure OL 9 to mount /var/tmp with the nodev option. Modify "/etc/fstab" to use the "nodev" option on the "/var/tmp" directory.

b
OL 9 must mount /var/tmp with the noexec option.
RMF Control
CM-7
Severity
M
CCI
CCI-001764
Version
OL09-00-002068
Vuln IDs
V-271664
Rule IDs
SV-271664r1091704_rule
The "noexec" mount option causes the system to not execute binary files. This option must be used for mounting any file system not containing approved binary files, as they may be incompatible. Executing files from untrusted file systems increases the opportunity for nonprivileged users to attain unauthorized administrative access.
Fix: F-75621r1091703_fix

Configure OL 9 to mount /var/tmp with the noexec option. Modify "/etc/fstab" to use the "noexec" option on the "/var/tmp" directory.

b
OL 9 must mount /var/tmp with the nosuid option.
RMF Control
CM-7
Severity
M
CCI
CCI-001764
Version
OL09-00-002069
Vuln IDs
V-271665
Rule IDs
SV-271665r1091707_rule
The "nosuid" mount option causes the system to not execute "setuid" and "setgid" files with owner privileges. This option must be used for mounting any file system not containing approved "setuid" and "setguid" files. Executing files from untrusted file systems increases the opportunity for nonprivileged users to attain unauthorized administrative access.
Fix: F-75622r1091706_fix

Configure OL 9 to mount /var/tmp with the nosuid option. Modify "/etc/fstab" to use the "nosuid" option on the "/var/tmp" directory.

b
OL 9 must prevent device files from being interpreted on file systems that contain user home directories.
RMF Control
CM-7
Severity
M
CCI
CCI-001764
Version
OL09-00-002070
Vuln IDs
V-271666
Rule IDs
SV-271666r1091710_rule
The "nodev" mount option causes the system to not interpret character or block special devices. Executing character or block special devices from untrusted file systems increases the opportunity for nonprivileged users to attain unauthorized administrative access. The only legitimate location for device files is the "/dev" directory located on the root partition, with the exception of chroot jails if implemented.
Fix: F-75623r1091709_fix

Configure OL 9 to prevent device files from being interpreted on file systems that contain user home directories. Modify "/etc/fstab" to use the "nodev" option on the "/home" directory.

b
OL 9 must prevent files with the setuid and setgid bit set from being executed on file systems that contain user home directories.
RMF Control
CM-7
Severity
M
CCI
CCI-001764
Version
OL09-00-002071
Vuln IDs
V-271667
Rule IDs
SV-271667r1091713_rule
The "nosuid" mount option causes the system to not execute "setuid" and "setgid" files with owner privileges. This option must be used for mounting any file system not containing approved "setuid" and "setguid" files. Executing files from untrusted file systems increases the opportunity for nonprivileged users to attain unauthorized administrative access.
Fix: F-75624r1091712_fix

Configure OL 9 to prevent files with the setuid and setgid bit set from being executed on file systems that contain user home directories. Modify "/etc/fstab" to use the "nosuid" option on the "/home" directory.

b
OL 9 must prevent code from being executed on file systems that contain user home directories.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-002072
Vuln IDs
V-271668
Rule IDs
SV-271668r1091716_rule
The noexec mount option causes the system to not execute binary files. This option must be used for mounting any file system not containing approved binary files, as they may be incompatible. Executing files from untrusted file systems increases the opportunity for nonprivileged users to attain unauthorized administrative access.
Fix: F-75625r1091715_fix

Configure OL 9 to prevent code from being executed on file systems that contain user home directories. Modify "/etc/fstab" to use the "noexec" option on the "/home" directory.

b
OL 9 must prevent special devices on nonroot local partitions.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-002080
Vuln IDs
V-271669
Rule IDs
SV-271669r1155336_rule
The "nodev" mount option causes the system to not interpret character or block special devices. Executing character or block special devices from untrusted file systems increases the opportunity for nonprivileged users to attain unauthorized administrative access. The only legitimate location for device files is the "/dev" directory located on the root partition, with the exception of chroot jails if implemented.
Fix: F-75626r1091718_fix

Configure the "/etc/fstab" to use the "nodev" option on all nonroot local partitions.

b
OL 9 must disable the graphical user interface automount function unless required.
RMF Control
IA-3
Severity
M
CCI
CCI-000778
Version
OL09-00-002100
Vuln IDs
V-271670
Rule IDs
SV-271670r1091722_rule
Automatically mounting file systems permits easy introduction of unknown devices, thereby facilitating malicious activity. Satisfies: SRG-OS-000114-GPOS-00059, SRG-OS-000378-GPOS-00163
Fix: F-75627r1091721_fix

Configure the GNOME desktop to disable automated mounting of removable media. The dconf settings can be edited in the /etc/dconf/db/* location. Update the [org/gnome/desktop/media-handling] section of the "/etc/dconf/db/local.d/00-security-settings" database file and add or update the following lines: [org/gnome/desktop/media-handling] automount-open=false Update the dconf system databases: $ sudo dconf update

b
OL 9 must prevent a user from overriding the disabling of the graphical user interface automount function.
RMF Control
IA-3
Severity
M
CCI
CCI-000778
Version
OL09-00-002120
Vuln IDs
V-271678
Rule IDs
SV-271678r1091746_rule
A nonprivileged account is any operating system account with authorizations of a nonprivileged user. Satisfies: SRG-OS-000114-GPOS-00059, SRG-OS-000378-GPOS-00163
Fix: F-75635r1091745_fix

Configure the GNOME desktop to not allow a user to change the setting that disables automated mounting of removable media. Add the following line to "/etc/dconf/db/local.d/locks/00-security-settings-lock" to prevent user modification: /org/gnome/desktop/media-handling/automount-open Update the dconf system databases: $ sudo dconf update

b
OL 9 must prevent a user from overriding the disabling of the graphical user interface autorun function.
RMF Control
IA-3
Severity
M
CCI
CCI-000778
Version
OL09-00-002121
Vuln IDs
V-271679
Rule IDs
SV-271679r1091749_rule
Techniques used to address this include protocols using nonces (e.g., numbers generated for a specific one-time use) or challenges (e.g., TLS, WS_Security). Additional techniques include time-synchronous or challenge-response one-time authenticators. Satisfies: SRG-OS-000114-GPOS-00059, SRG-OS-000378-GPOS-00163
Fix: F-75636r1091748_fix

Configure the GNOME desktop to not allow a user to change the setting that disables autorun on removable media. Add the following line to "/etc/dconf/db/local.d/locks/00-security-settings-lock" to prevent user modification: /org/gnome/desktop/media-handling/autorun-never Update the dconf system databases: $ sudo dconf update

b
OL 9 must prevent a user from overriding the banner-message-enable setting for the graphical user interface.
RMF Control
AC-8
Severity
M
CCI
CCI-000048
Version
OL09-00-002122
Vuln IDs
V-271680
Rule IDs
SV-271680r1091752_rule
Display of a standardized and approved use notification before granting access to the operating system ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. For U.S. government systems, system use notifications are required only for access via login interfaces with human users and are not required when such human interfaces do not exist. Satisfies: SRG-OS-000023-GPOS-00006, SRG-OS-000228-GPOS-00088
Fix: F-75637r1091751_fix

Configure OL 9 to prevent a user from overriding the banner setting for graphical user interfaces. Create a database to contain the system-wide graphical user logon settings (if it does not already exist) with the following command: $ sudo touch /etc/dconf/db/local.d/locks/session Add the following setting to prevent nonprivileged users from modifying it: /org/gnome/login-screen/banner-message-enable Run the following command to update the database: $ sudo dconf update

b
OL 9 must prevent a user from overriding the screensaver lock-enabled setting for the graphical user interface.
RMF Control
AC-11
Severity
M
CCI
CCI-000056
Version
OL09-00-002123
Vuln IDs
V-271681
Rule IDs
SV-271681r1091755_rule
A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not log out because of the temporary nature of the absence. Rather than relying on the user to manually lock their operating system session prior to vacating the vicinity, operating systems need to be able to identify when a user's session has idled and take action to initiate the session lock. The session lock is implemented at the point where session activity can be determined and/or controlled. Implementing session settings will have little value if a user is able to manipulate these settings from the defaults prescribed in the other requirements of this implementation guide. Satisfies: SRG-OS-000028-GPOS-00009, SRG-OS-000030-GPOS-00011
Fix: F-75638r1091754_fix

Configure OL 9 to prevent a user from overriding settings for graphical user interfaces. Create a database to contain the system-wide screensaver settings (if it does not already exist) with the following command: Note: The example below is using the database "local" for the system, so if the system is using another database in "/etc/dconf/profile/user", the file should be created under the appropriate subdirectory. $ sudo touch /etc/dconf/db/local.d/locks/session Add the following setting to prevent nonprivileged users from modifying it: /org/gnome/desktop/screensaver/lock-enabled Update the system databases: $ sudo dconf update

b
OL 9 must prevent a user from overriding the session idle-delay setting for the graphical user interface.
RMF Control
AC-11
Severity
M
CCI
CCI-000057
Version
OL09-00-002124
Vuln IDs
V-271682
Rule IDs
SV-271682r1091758_rule
A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not logout because of the temporary nature of the absence. Rather than relying on the user to manually lock their operating system session prior to vacating the vicinity, the GNOME desktop can be configured to identify when a user's session has idled and take action to initiate the session lock. As such, users should not be allowed to change session settings. Satisfies: SRG-OS-000029-GPOS-00010, SRG-OS-000031-GPOS-00012
Fix: F-75639r1091757_fix

Configure OL 9 to prevent a user from overriding settings for graphical user interfaces. Create a database to contain the system-wide screensaver settings (if it does not already exist) with the following command: Note: The example below is using the database "local" for the system, so if the system is using another database in "/etc/dconf/profile/user", the file should be created under the appropriate subdirectory. $ sudo touch /etc/dconf/db/local.d/locks/session Add the following setting to prevent nonprivileged users from modifying it: /org/gnome/desktop/session/idle-delay Update the system databases: $ sudo dconf update

b
OL 9 must prevent a user from overriding the session lock-delay setting for the graphical user interface.
RMF Control
AC-11
Severity
M
CCI
CCI-000057
Version
OL09-00-002125
Vuln IDs
V-271683
Rule IDs
SV-271683r1091761_rule
A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not logout because of the temporary nature of the absence. Rather than relying on the user to manually lock their operating system session prior to vacating the vicinity, the GNOME desktop can be configured to identify when a user's session has idled and take action to initiate the session lock. As such, users should not be allowed to change session settings.
Fix: F-75640r1091760_fix

Configure OL 9 to prevent a user from overriding settings for graphical user interfaces. Create a database to contain the system-wide screensaver settings (if it does not already exist) with the following command: Note: The example below is using the database "local" for the system, so if the system is using another database in "/etc/dconf/profile/user", the file should be created under the appropriate subdirectory. $ sudo touch /etc/dconf/db/local.d/locks/session Add the following setting to prevent nonprivileged users from modifying it: /org/gnome/desktop/screensaver/lock-delay Update the system databases: $ sudo dconf update

b
OL 9 must prevent a user from overriding the disabling of the graphical user smart card removal action.
RMF Control
AC-11
Severity
M
CCI
CCI-000056
Version
OL09-00-002126
Vuln IDs
V-271684
Rule IDs
SV-271684r1091764_rule
A session lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not want to log out because of the temporary nature of the absence. The session lock is implemented at the point where session activity can be determined. Rather than be forced to wait for a period of time to expire before the user session can be locked, OL 9 must provide users with the ability to manually invoke a session lock so users can secure their session if it is necessary to temporarily vacate the immediate physical vicinity. Satisfies: SRG-OS-000028-GPOS-00009, SRG-OS-000030-GPOS-00011
Fix: F-75641r1091763_fix

Configure OL 9 must prevent a user from overriding the disabling of the graphical user smart card removal action. Add the following line to "/etc/dconf/db/local.d/locks/00-security-settings-lock": /org/gnome/settings-daemon/peripherals/smartcard/removal-action Update the dconf system databases: $ sudo dconf update

b
OL 9 must disable the ability of a user to restart the system from the login screen.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-002127
Vuln IDs
V-271685
Rule IDs
SV-271685r1091767_rule
A user who is at the console can reboot the system at the login screen. If restart or shutdown buttons are pressed at the login screen, this can create the risk of short-term loss of availability of systems due to reboot.
Fix: F-75642r1091766_fix

Configure OL 9 to disable a user's ability to restart the system. Add or update the [org/gnome/settings-daemon/] section of the /etc/dconf/db/local.d/00-security-settings" database file and add or update the following lines: [org/gnome/settings-daemon/peripherals/smartcard] disable-restart-buttons='true' Then update the dconf system databases: $ sudo dconf update

b
OL 9 must prevent a user from overriding the disable-restart-buttons setting for the graphical user interface.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-002128
Vuln IDs
V-271686
Rule IDs
SV-271686r1091770_rule
A user who is at the console can reboot the system at the login screen. If restart or shutdown buttons are pressed at the login screen, this can create the risk of short-term loss of availability of systems due to reboot.
Fix: F-75643r1091769_fix

Configure OL 9 to prevent a user from overriding the disable-restart-buttons setting for graphical user interfaces. Create a database to contain the system-wide graphical user logon settings (if it does not already exist) with the following command: $ sudo touch /etc/dconf/db/local.d/locks/session Add the following line to prevent nonprivileged users from modifying it: /org/gnome/login-screen/disable-restart-buttons Run the following command to update the database: $ sudo dconf update

b
OL 9 must prevent a user from overriding the Ctrl-Alt-Del sequence settings for the graphical user interface.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-002129
Vuln IDs
V-271687
Rule IDs
SV-271687r1091773_rule
A locally logged-in user who presses Ctrl-Alt-Del, when at the console, can reboot the system. If accidentally pressed, as could happen in the case of mixed OS environment, this can create the risk of short-term loss of availability of systems due to unintentional reboot.
Fix: F-75644r1091772_fix

Configure OL 9 to disallow the user changing the Ctrl-Alt-Del sequence in the GNOME desktop. Create a database to container system-wide graphical user logon settings (if it does not already exist) with the following command: $ sudo touch /etc/dconf/db/local.d/locks/session Add the following line to the session locks file to prevent nonprivileged users from modifying the Ctrl-Alt-Del setting: /org/gnome/settings-daemon/plugins/media-keys/logout Run the following command to update the database: $ sudo dconf update

b
OL 9 must be configured to enable the display of the Standard Mandatory DOD Notice and Consent Banner before granting local or remote access to the system via a graphical user logon.
RMF Control
AC-8
Severity
M
CCI
CCI-000048
Version
OL09-00-002150
Vuln IDs
V-271688
Rule IDs
SV-271688r1091776_rule
Display of a standardized and approved use notification before granting access to the operating system ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. For U.S. government systems, system use notifications are required only for access via login interfaces with human users and are not required when such human interfaces do not exist. Satisfies: SRG-OS-000023-GPOS-00006, SRG-OS-000228-GPOS-00088
Fix: F-75645r1091775_fix

Configure OL 9 to display the Standard Mandatory DOD Notice and Consent Banner before granting access to the system via a graphical user logon. Create a database to contain the system-wide graphical user logon settings (if it does not already exist) with the following command: $ sudo touch /etc/dconf/db/local.d/01-banner-message Add the following lines to the [org/gnome/login-screen] section of the "/etc/dconf/db/local.d/01-banner-message": [org/gnome/login-screen] banner-message-enable=true Run the following command to update the database: $ sudo dconf update

b
OL 9 must be able to directly initiate a session lock for all connection types using smart card when the smart card is removed.
RMF Control
AC-11
Severity
M
CCI
CCI-000056
Version
OL09-00-002160
Vuln IDs
V-271690
Rule IDs
SV-271690r1092634_rule
A session lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not want to log out because of the temporary nature of the absence. The session lock is implemented at the point where session activity can be determined. Rather than be forced to wait for a period of time to expire before the user session can be locked, OL 9 needs to provide users with the ability to manually invoke a session lock so users can secure their session if it is necessary to temporarily vacate the immediate physical vicinity. Satisfies: SRG-OS-000028-GPOS-00009, SRG-OS-000030-GPOS-00011
Fix: F-75647r1092633_fix

Configure OL 9 to enable a user's session lock until that user reestablishes access using established identification and authentication procedures. Select or create an authselect profile and incorporate the "with-smartcard-lock-on-removal" feature with the following example: $ sudo authselect select sssd with-smartcard with-smartcard-lock-on-removal Alternatively, the dconf settings can be edited in the /etc/dconf/db/* location. Add or update the [org/gnome/settings-daemon/peripherals/smartcard] section of the /etc/dconf/db/local.d/00-security-settings" database file and add or update the following lines: [org/gnome/settings-daemon/peripherals/smartcard] removal-action='lock-screen' Update the dconf system databases: $ sudo dconf update

c
OL 9 must not allow unattended or automatic logon via the graphical user interface.
RMF Control
CM-6
Severity
H
CCI
CCI-000366
Version
OL09-00-002161
Vuln IDs
V-271691
Rule IDs
SV-271691r1091785_rule
Failure to restrict system access to authenticated users negatively impacts operating system security.
Fix: F-75648r1091784_fix

Configure the GNOME desktop display manager to disable automatic login. Set AutomaticLoginEnable to false in the [daemon] section in /etc/gdm/custom.conf. For example: [daemon] AutomaticLoginEnable=false

b
OL 9 must define default permissions for the bash shell.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-002301
Vuln IDs
V-271693
Rule IDs
SV-271693r1091791_rule
The umask controls the default access mode assigned to newly created files. A umask of 077 limits new files to mode 600 or less permissive. Although umask can be represented as a four-digit number, the first digit representing special access modes is typically ignored or required to be "0". This requirement applies to the globally configured system defaults and the local interactive user defaults for each account on the system.
Fix: F-75650r1091790_fix

Configure OL 9 to define default permissions for all authenticated users using the bash shell. Add or edit the lines for the "umask" parameter in the "/etc/bashrc" file to "077": umask 077

b
OL 9 must define default permissions for the c shell.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-002302
Vuln IDs
V-271694
Rule IDs
SV-271694r1091794_rule
The umask controls the default access mode assigned to newly created files. A umask of 077 limits new files to mode 600 or less permissive. Although umask can be represented as a four-digit number, the first digit representing special access modes is typically ignored or required to be "0". This requirement applies to the globally configured system defaults and the local interactive user defaults for each account on the system.
Fix: F-75651r1091793_fix

Configure OL 9 to define default permissions for all authenticated users using the c shell. Add or edit the lines for the "umask" parameter in the "/etc/csh.cshrc" file to "077": umask 077

b
OL 9 must define default permissions for the system default profile.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-002303
Vuln IDs
V-271695
Rule IDs
SV-271695r1091797_rule
The umask controls the default access mode assigned to newly created files. A umask of 077 limits new files to mode 600 or less permissive. Although umask can be represented as a four-digit number, the first digit representing special access modes is typically ignored or required to be "0". This requirement applies to the globally configured system defaults and the local interactive user defaults for each account on the system.
Fix: F-75652r1091796_fix

Configure OL 9 to define default permissions for all authenticated users in such a way that the user can only read and modify their own files. Add or edit the lines for the "umask" parameter in the "/etc/profile" file to "077": umask 077

b
OL 9 must define default permissions for all authenticated users in such a way that the user can only read and modify their own files.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-002304
Vuln IDs
V-271696
Rule IDs
SV-271696r1091800_rule
Setting the most restrictive default permissions ensures that when new accounts are created, they do not have unnecessary access.
Fix: F-75653r1091799_fix

Configure OL 9 to define default permissions for all authenticated users in such a way that the user can only read and modify their own files. Add or edit the lines for the "UMASK" parameter in the "/etc/login.defs" file to "077": UMASK 077

a
OL 9 must disable the chrony daemon from acting as a server.
RMF Control
CM-7
Severity
L
CCI
CCI-000382
Version
OL09-00-002320
Vuln IDs
V-271697
Rule IDs
SV-271697r1091803_rule
Minimizing the exposure of the server functionality of the chrony daemon diminishes the attack surface. Satisfies: SRG-OS-000096-GPOS-00050, SRG-OS-000095-GPOS-00049
Fix: F-75654r1091802_fix

Configure OL 9 to disable the chrony daemon from acting as a server by adding/modifying the following line in the /etc/chrony.conf file: port 0

a
OL 9 must disable network management of the chrony daemon.
RMF Control
CM-7
Severity
L
CCI
CCI-000382
Version
OL09-00-002321
Vuln IDs
V-271698
Rule IDs
SV-271698r1091806_rule
Not exposing the management interface of the chrony daemon on the network diminishes the attack space. Satisfies: SRG-OS-000096-GPOS-00050, SRG-OS-000095-GPOS-00049
Fix: F-75655r1091805_fix

Configure OL 9 to disable network management of the chrony daemon by adding/modifying the following line in the /etc/chrony.conf file: cmdport 0

a
OL 9 must enable Linux audit logging for the USBGuard daemon.
RMF Control
AU-12
Severity
L
CCI
CCI-000169
Version
OL09-00-002330
Vuln IDs
V-271700
Rule IDs
SV-271700r1091812_rule
Without the capability to generate audit records, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. If auditing is enabled late in the startup process, the actions of some startup processes may not be audited. Some audit systems also maintain state information only available if auditing is enabled before a given process is created. Audit records can be generated from various components within the information system (e.g., module or policy filter). The list of audited events is the set of events for which audits are to be generated. This set of events is typically a subset of the list of all events for which the system is capable of generating audit records. DOD has defined the list of events for which OL 9 will provide an audit record generation capability as the following: 1. Successful and unsuccessful attempts to access, modify, or delete privileges, security objects, security levels, or categories of information (e.g., classification levels); 2. Access actions, such as successful and unsuccessful logon attempts, privileged activities or other system-level access, starting and ending time for user access to the system, concurrent logons from different workstations, successful and unsuccessful accesses to objects, all program initiations, and all direct access to the information system; 3. All account creations, modifications, disabling, and terminations; and 4. All kernel module load, unload, and restart actions.
Fix: F-75657r1091811_fix

Configure OL 9 USBGuard AuditBackend to use the audit system. Add or edit the following line in /etc/usbguard/usbguard-daemon.conf AuditBackend=LinuxAudit

b
OL 9 must log SSH connection attempts and failures to the server.
RMF Control
AC-17
Severity
M
CCI
CCI-000067
Version
OL09-00-002340
Vuln IDs
V-271703
Rule IDs
SV-271703r1091821_rule
SSH provides several logging levels with varying amounts of verbosity. "DEBUG" is specifically not recommended other than strictly for debugging SSH communications since it provides so much data that it is difficult to identify important security information. "INFO" or "VERBOSE" level is the basic level that only records login activity of SSH users. In many situations, such as Incident Response, it is important to determine when a particular user was active on a system. The logout record can eliminate those users who disconnected, which helps narrow the field.
Fix: F-75660r1091820_fix

Configure OL 9 to log connection attempts add or modify the following line in "/etc/ssh/sshd_config" or in a file in "/etc/ssh/sshd_config.d". LogLevel VERBOSE Restart the SSH daemon for the settings to take effect: $ sudo systemctl restart sshd.service

b
OL 9 SSH daemon must not allow Generic Security Service Application Program Interface (GSSAPI) authentication.
RMF Control
CM-5
Severity
M
CCI
CCI-001813
Version
OL09-00-002341
Vuln IDs
V-271704
Rule IDs
SV-271704r1091824_rule
GSSAPI authentication is used to provide additional authentication mechanisms to applications. Allowing GSSAPI authentication through SSH exposes the system's GSSAPI to remote hosts, increasing the attack surface of the system.
Fix: F-75661r1091823_fix

Configure the SSH daemon to not allow GSSAPI authentication. Add or uncomment the following line to "/etc/ssh/sshd_config" or to a file in "/etc/ssh/sshd_config.d" and set the value to "no": GSSAPIAuthentication no The SSH service must be restarted for changes to take effect: $ sudo systemctl restart sshd.service

b
OL 9 must force a frequent session key renegotiation for SSH connections to the server.
RMF Control
SC-8
Severity
M
CCI
CCI-002418
Version
OL09-00-002342
Vuln IDs
V-271705
Rule IDs
SV-271705r1091827_rule
Without protection of the transmitted information, confidentiality and integrity may be compromised because unprotected communications can be intercepted and either read or altered. This requirement applies to both internal and external networks and all types of information system components from which information can be transmitted (e.g., servers, mobile devices, notebook computers, printers, copiers, scanners, and facsimile machines). Communication paths outside the physical protection of a controlled boundary are exposed to the possibility of interception and modification. Protecting the confidentiality and integrity of organizational information can be accomplished by physical means (e.g., employing physical distribution systems) or by logical means (e.g., employing cryptographic techniques). If physical means of protection are employed, then logical means (cryptography) do not have to be employed, and vice versa. Session key regeneration limits the chances of a session key becoming compromised. Satisfies: SRG-OS-000423-GPOS-00187, SRG-OS-000033-GPOS-00014, SRG-OS-000424-GPOS-00188
Fix: F-75662r1091826_fix

Configure OL 9 to force a frequent session key renegotiation for SSH connections to the server by adding or modifying the following line in the "/etc/ssh/sshd_config" or in a file in "/etc/ssh/sshd_config.d": RekeyLimit 1G 1h Restart the SSH daemon for the settings to take effect. $ sudo systemctl restart sshd.service

c
OL 9 SSHD must not allow blank passwords.
RMF Control
IA-2
Severity
H
CCI
CCI-000766
Version
OL09-00-002343
Vuln IDs
V-271706
Rule IDs
SV-271706r1091830_rule
If an account has an empty password, anyone could log on and run commands with the privileges of that account. Accounts with empty passwords should never be used in operational environments.
Fix: F-75663r1091829_fix

Configure OL 9 to prevent SSH users from logging on with blank passwords by editing the following line in "/etc/ssh/sshd_config" or in a file in "/etc/ssh/sshd_config.d": PermitEmptyPasswords no Restart the SSH daemon for the settings to take effect: $ sudo systemctl restart sshd.service

c
OL 9 must enable the Pluggable Authentication Module (PAM) interface for SSHD.
RMF Control
MA-4
Severity
H
CCI
CCI-000877
Version
OL09-00-002344
Vuln IDs
V-271707
Rule IDs
SV-271707r1091833_rule
When UsePAM is set to "yes", PAM runs through account and session types properly. This is important when restricted access to services based off of IP, time, or other factors of the account is needed. Additionally, this ensures users can inherit certain environment variables on login or disallow access to the server.
Fix: F-75664r1091832_fix

Configure the OL 9 SSHD to use the UsePAM interface by adding or modifying the following line in "/etc/ssh/sshd_config" or in a file in "/etc/ssh/sshd_config.d". UsePAM yes Restart the SSH daemon for the settings to take effect: $ sudo systemctl restart sshd.service

b
OL 9 must not permit direct logons to the root account using remote access via SSH.
RMF Control
Severity
M
CCI
CCI-004045
Version
OL09-00-002345
Vuln IDs
V-271708
Rule IDs
SV-271708r1092594_rule
Even though the communications channel may be encrypted, an additional layer of security is gained by extending the policy of not logging directly on as root. In addition, logging in with a user-specific account provides individual accountability of actions performed on the system and also helps to minimize direct attack attempts on root's password.
Fix: F-75665r1091835_fix

Configure OL 9 to prevent SSH users from logging on directly as root by adding or modifying the following line in "/etc/ssh/sshd_config" or in a file in "/etc/ssh/sshd_config.d". PermitRootLogin no Restart the SSH daemon for the settings to take effect: $ sudo systemctl restart sshd.service

b
OL 9 must be configured so that all network connections associated with SSH traffic terminate after becoming unresponsive.
RMF Control
SC-10
Severity
M
CCI
CCI-001133
Version
OL09-00-002346
Vuln IDs
V-271709
Rule IDs
SV-271709r1091839_rule
Terminating an unresponsive SSH session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled on the console or console port that has been left unattended. In addition, quickly terminating an idle SSH session will also free up resources committed by the managed network element. Terminating network connections associated with communications sessions includes, for example, deallocating associated TCP/IP address/port pairs at the operating system level and deallocating networking assignments at the application level if multiple application sessions are using a single operating system-level network connection. This does not mean the operating system terminates all sessions or network access; it only ends the unresponsive session and releases the resources associated with that session. OL 9 uses /etc/ssh/sshd_config for configurations of OpenSSH. Within the sshd_config, the product of the values of "ClientAliveInterval" and "ClientAliveCountMax" are used to establish the inactivity threshold. The "ClientAliveInterval" is a timeout interval in seconds, after which if no data has been received from the client, SSHD will send a message through the encrypted channel to request a response from the client. The "ClientAliveCountMax" is the number of client alive messages that may be sent without SSHD receiving any messages back from the client. If this threshold is met, sshd will disconnect the client. For more information on these settings and others, refer to the sshd_config man pages. Satisfies: SRG-OS-000163-GPOS-00072, SRG-OS-000279-GPOS-00109
Fix: F-75666r1091838_fix

Note: This setting must be applied in conjunction with ClientAliveInterval to function correctly. Configure the SSH server to terminate a user session automatically after the SSH client has become unresponsive. Modify or append the following lines in the "/etc/ssh/sshd_config" or in a file in "/etc/ssh/sshd_config.d": ClientAliveCountMax 1 In order for the changes to take effect, the SSH daemon must be restarted. $ sudo systemctl restart sshd.service

b
OL 9 must be configured so that all network connections associated with SSH traffic are terminated after 10 minutes of becoming unresponsive.
RMF Control
SC-10
Severity
M
CCI
CCI-001133
Version
OL09-00-002347
Vuln IDs
V-271710
Rule IDs
SV-271710r1092596_rule
Terminating an unresponsive SSH session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled on the console or console port that has been left unattended. In addition, quickly terminating an idle SSH session will also free up resources committed by the managed network element. Terminating network connections associated with communications sessions includes, for example, deallocating associated TCP/IP address/port pairs at the operating system level and deallocating networking assignments at the application level if multiple application sessions are using a single operating system-level network connection. This does not mean the operating system terminates all sessions or network access; it only ends the unresponsive session and releases the resources associated with that session. OL 9 uses /etc/ssh/sshd_config for configurations of OpenSSH. Within the sshd_config, the product of the values of "ClientAliveInterval" and "ClientAliveCountMax" are used to establish the inactivity threshold. The "ClientAliveInterval" is a timeout interval in seconds, after which if no data has been received from the client, SSHD will send a message through the encrypted channel to request a response from the client. The "ClientAliveCountMax" is the number of client alive messages that may be sent without SSHD receiving any messages back from the client. If this threshold is met, SSHD will disconnect the client. For more information on these settings and others, refer to the sshd_config man pages. Satisfies: SRG-OS-000163-GPOS-00072, SRG-OS-000279-GPOS-00109, SRG-OS-000395-GPOS-00175
Fix: F-75667r1092595_fix

Note: This setting must be applied in conjunction with ClientAliveCountMax" setting to function correctly. Configure the SSH server to terminate a user session automatically after the SSH client has been unresponsive for 10 minutes. Modify or append the following lines in the "/etc/ssh/sshd_config" or in a file in "/etc/ssh/sshd_config.d": ClientAliveInterval 600 In order for the changes to take effect, the SSH daemon must be restarted. $ sudo systemctl restart sshd.service

b
OL 9 SSH daemon must not allow rhosts authentication.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-002348
Vuln IDs
V-271711
Rule IDs
SV-271711r1091845_rule
SSH trust relationships mean a compromise on one host can allow an attacker to move trivially to other hosts.
Fix: F-75668r1091844_fix

Configure the SSH daemon to not allow rhosts authentication. Add the following line to "/etc/ssh/sshd_config" or to a file in "/etc/ssh/sshd_config.d" or uncomment the line and set the value to "yes": IgnoreRhosts yes The SSH service must be restarted for changes to take effect: $ sudo systemctl restart sshd.service

b
OL 9 SSH daemon must not allow known hosts authentication.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-002349
Vuln IDs
V-271712
Rule IDs
SV-271712r1091848_rule
Configuring the IgnoreUserKnownHosts setting for the SSH daemon provides additional assurance that remote login via SSH will require a password, even in the event of misconfiguration elsewhere.
Fix: F-75669r1091847_fix

Configure the SSH daemon to not allow known hosts authentication. Add the following line to "/etc/ssh/sshd_config" or to a file in "/etc/ssh/sshd_config.d" or uncomment the line and set the value to "yes": IgnoreUserKnownHosts yes The SSH service must be restarted for changes to take effect: $ sudo systemctl restart sshd.service

b
OL 9 SSH daemon must disable remote X connections for interactive users.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-002350
Vuln IDs
V-271713
Rule IDs
SV-271713r1091851_rule
When X11 forwarding is enabled, there may be additional exposure to the server and client displays if the SSHD proxy display is configured to listen on the wildcard address. By default, SSHD binds the forwarding server to the loopback address and sets the hostname part of the DISPLAY environment variable to localhost. This prevents remote hosts from connecting to the proxy display.
Fix: F-75670r1091850_fix

Configure the SSH daemon to not allow X11 forwarding. Add the following line to "/etc/ssh/sshd_config" or to a file in "/etc/ssh/sshd_config.d" or uncomment the line and set the value to "no": X11Forwarding no The SSH service must be restarted for changes to take effect: $ sudo systemctl restart sshd.service

b
OL 9 SSH daemon must perform strict mode checking of home directory configuration files.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-002351
Vuln IDs
V-271714
Rule IDs
SV-271714r1091854_rule
If other users have access to modify user-specific SSH configuration files, they may be able to log into the system as another user.
Fix: F-75671r1091853_fix

Configure the SSH daemon to perform strict mode checking of home directory configuration files. Add the following line to "/etc/ssh/sshd_config" or to a file in "/etc/ssh/sshd_config.d" or uncomment the line and set the value to "yes": StrictModes yes The SSH service must be restarted for changes to take effect: $ sudo systemctl restart sshd.service

b
OL 9 SSH daemon must display the date and time of the last successful account logon upon an SSH logon.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-002352
Vuln IDs
V-271715
Rule IDs
SV-271715r1091857_rule
Providing users feedback on when account accesses last occurred facilitates user recognition and reporting of unauthorized account use.
Fix: F-75672r1091856_fix

Configure the SSH daemon to provide users with feedback on when account accesses last occurred. Add the following line to "/etc/ssh/sshd_config" or to a file in "/etc/ssh/sshd_config.d" or uncomment the line and set the value to "yes": PrintLastLog yes The SSH service must be restarted for changes to take effect: $ sudo systemctl restart sshd.service

b
OL 9 SSH daemon must prevent remote hosts from connecting to the proxy display.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-002354
Vuln IDs
V-271716
Rule IDs
SV-271716r1091860_rule
When X11 forwarding is enabled, there may be additional exposure to the server and client displays if the SSHD proxy display is configured to listen on the wildcard address. By default, SSHD binds the forwarding server to the loopback address and sets the hostname part of the "DISPLAY" environment variable to localhost. This prevents remote hosts from connecting to the proxy display.
Fix: F-75673r1091859_fix

Configure the SSH daemon to prevent remote hosts from connecting to the proxy display. Add the following line to "/etc/ssh/sshd_config" or to a file in "/etc/ssh/sshd_config.d" or uncomment the line and set the value to "yes": X11UseLocalhost yes The SSH service must be restarted for changes to take effect: $ sudo systemctl restart sshd.service

b
OL 9 SSH daemon must not allow compression or must only allow compression after successful authentication.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-002355
Vuln IDs
V-271717
Rule IDs
SV-271717r1091863_rule
If compression is allowed in an SSH connection prior to authentication, vulnerabilities in the compression software could result in compromise of the system from an unauthenticated connection, potentially with root privileges.
Fix: F-75674r1091862_fix

Configure the SSH daemon to not allow compression. Add the following line to "/etc/ssh/sshd_config" or to a file in "/etc/ssh/sshd_config.d" or uncomment the line and set the value to "delayed" or "no": Compression no The SSH service must be restarted for changes to take effect: $ sudo systemctl restart sshd.service

b
OL 9 SSH daemon must not allow Kerberos authentication.
RMF Control
CM-5
Severity
M
CCI
CCI-001813
Version
OL09-00-002356
Vuln IDs
V-271718
Rule IDs
SV-271718r1091866_rule
Kerberos authentication for SSH is often implemented using Generic Security Service Application Program Interface (GSSAPI). If Kerberos is enabled through SSH, the SSH daemon provides a means of access to the system's Kerberos implementation. Vulnerabilities in the system's Kerberos implementations may be subject to exploitation.
Fix: F-75675r1091865_fix

Configure the SSH daemon to not allow Kerberos authentication. Add the following line in "/etc/ssh/sshd_config" or to a file in "/etc/ssh/sshd_config.d" or uncomment the line and set the value to "no": KerberosAuthentication no The SSH service must be restarted for changes to take effect: $ sudo systemctl restart sshd.service

b
OL 9 must not allow a noncertificate trusted host SSH logon to the system.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-002357
Vuln IDs
V-271719
Rule IDs
SV-271719r1091869_rule
SSH trust relationships mean a compromise on one host can allow an attacker to move trivially to other hosts.
Fix: F-75676r1091868_fix

Configure OL 9 to not allow a noncertificate trusted host SSH logon to access the system. Add or modify the following line in "/etc/ssh/sshd_config" or in a file in "/etc/ssh/sshd_config.d". HostbasedAuthentication no Restart the SSH daemon for the settings to take effect: $ sudo systemctl restart sshd.service

b
OL 9 must not allow users to override SSH environment variables.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-002358
Vuln IDs
V-271720
Rule IDs
SV-271720r1091872_rule
SSH environment options potentially allow users to bypass access restriction in some configurations.
Fix: F-75677r1091871_fix

Configure the OL 9 SSH daemon to not allow unattended or automatic logon to the system. Add or edit the following line in the "/etc/ssh/sshd_config" or in a file in "/etc/ssh/sshd_config.d": PermitUserEnvironment no Restart the SSH daemon for the setting to take effect: $ sudo systemctl restart sshd.service

b
OL 9 SSHD must accept public key authentication.
RMF Control
IA-2
Severity
M
CCI
CCI-000765
Version
OL09-00-002359
Vuln IDs
V-271721
Rule IDs
SV-271721r1091875_rule
Without the use of multifactor authentication, the ease of access to privileged functions is greatly increased. Multifactor authentication requires using two or more factors to achieve authentication. A privileged account is defined as an information system account with authorizations of a privileged user. A DOD CAC with DOD-approved PKI is an example of multifactor authentication. Satisfies: SRG-OS-000105-GPOS-00052, SRG-OS-000106-GPOS-00053, SRG-OS-000107-GPOS-00054, SRG-OS-000108-GPOS-00055
Fix: F-75678r1091874_fix

Configure OL 9 to accept public key authentication by adding or modifying the following line in "/etc/ssh/sshd_config". PubkeyAuthentication yes Restart the SSH daemon for the settings to take effect: $ sudo systemctl restart sshd.service

b
OL 9 must require reauthentication when using the "sudo" command.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-002360
Vuln IDs
V-271722
Rule IDs
SV-271722r1091878_rule
Without reauthentication, users may access resources or perform tasks for which they do not have authorization. When operating systems provide the capability to escalate a functional capability, it is critical the organization requires the user to reauthenticate when using the "sudo" command. If the value is set to an integer less than "0", the user's time stamp will not expire and the user will not have to reauthenticate for privileged actions until the user's session is terminated.
Fix: F-75679r1091877_fix

Configure OL 9 to reauthenticate "sudo" commands after the specified timeout: Add the following line to "/etc/sudoers": Defaults timestamp_timeout=0

b
OL 9 must restrict the use of the su command.
RMF Control
AC-3
Severity
M
CCI
CCI-002165
Version
OL09-00-002361
Vuln IDs
V-271723
Rule IDs
SV-271723r1091881_rule
The su program allows to run commands with a substitute user and group ID. It is commonly used to run commands as the root user. Limiting access to such commands is considered a good security practice.
Fix: F-75680r1091880_fix

Configure OL 9 to require users to be in the "wheel" group to run su command. In file "/etc/pam.d/su", uncomment the following line: "#auth required pam_wheel.so use_uid" Or use the following command to update /etc/pam.d/su $ sed '/^[[:space:]]*#[[:space:]]*auth[[:space:]]\+required[[:space:]]\+pam_wheel\.so[[:space:]]\+use_uid$/s/^[[:space:]]*#//' -i /etc/pam.d/su If necessary, create a "wheel" group and add administrative users to the group. $ grep wheel /etc/group

b
OL 9 must require users to reauthenticate for privilege escalation.
RMF Control
AC-6
Severity
M
CCI
CCI-002234
Version
OL09-00-002362
Vuln IDs
V-271724
Rule IDs
SV-271724r1091884_rule
Without reauthentication, users may access resources or perform tasks for which they do not have authorization. When operating systems provide the capability to escalate a functional capability, it is critical that the user reauthenticate.
Fix: F-75681r1091883_fix

Configure OL 9 to not allow users to execute privileged actions without authenticating. Remove any occurrence of "!authenticate" found in "/etc/sudoers" file or files in the "/etc/sudoers.d" directory. $ sudo sed -i '/\!authenticate/ s/^/# /g' /etc/sudoers /etc/sudoers.d/*

b
OL 9 must require users to provide a password for privilege escalation.
RMF Control
AC-6
Severity
M
CCI
CCI-002234
Version
OL09-00-002363
Vuln IDs
V-271725
Rule IDs
SV-271725r1155318_rule
Without reauthentication, users may access resources or perform tasks for which they do not have authorization. When operating systems provide the capability to escalate a functional capability, it is critical that the user reauthenticate.
Fix: F-75682r1091886_fix

Configure OL 9 to not allow users to execute privileged actions without authenticating with a password. Remove any occurrence of "NOPASSWD" found in "/etc/sudoers" file or files in the "/etc/sudoers.d" directory. $ sudo sed -i '/NOPASSWD/ s/^/# /g' /etc/sudoers /etc/sudoers.d/*

b
OL 9 must not be configured to bypass password requirements for privilege escalation.
RMF Control
AC-6
Severity
M
CCI
CCI-002234
Version
OL09-00-002364
Vuln IDs
V-271726
Rule IDs
SV-271726r1091890_rule
Without reauthentication, users may access resources or perform tasks for which they do not have authorization. When operating systems provide the capability to escalate a functional capability, it is critical the user reauthenticate.
Fix: F-75683r1091889_fix

Configure the operating system to require users to supply a password for privilege escalation. Remove any occurrences of " pam_succeed_if " in the "/etc/pam.d/sudo" file.

b
OL 9 must disable the use of user namespaces.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-002370
Vuln IDs
V-271727
Rule IDs
SV-271727r1091893_rule
User namespaces are used primarily for Linux containers. The value "0" disallows the use of user namespaces.
Fix: F-75684r1091892_fix

Configure OL 9 to disable the use of user namespaces by adding the following line to a file, in the "/etc/sysctl.d" directory: Note: User namespaces are used primarily for Linux containers. If containers are in use, this requirement is Not Applicable. user.max_user_namespaces = 0 The system configuration files need to be reloaded for the changes to take effect. To reload the contents of the files, run the following command: $ sudo sysctl --system

b
OL 9 must disable the kernel.core_pattern.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-002380
Vuln IDs
V-271728
Rule IDs
SV-271728r1091896_rule
A core dump includes a memory image taken at the time the operating system terminates an application. The memory image could contain sensitive data and is generally useful only for developers trying to debug problems.
Fix: F-75685r1091895_fix

Configure OL 9 to disable storing core dumps. Add or edit the following line in a system configuration file, in the "/etc/sysctl.d/" directory: kernel.core_pattern = |/bin/false The system configuration files need to be reloaded for the changes to take effect. To reload the contents of the files, run the following command: $ sudo sysctl --system

b
OL 9 must disable core dump backtraces.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-002381
Vuln IDs
V-271729
Rule IDs
SV-271729r1155325_rule
A core dump includes a memory image taken at the time the operating system terminates an application. The memory image could contain sensitive data and is generally useful only for developers or system operators trying to debug problems. Enabling core dumps on production systems is not recommended; however, there may be overriding operational requirements to enable advanced debugging. Permitting temporary enablement of core dumps during such situations must be reviewed through local needs and policy.
Fix: F-75686r1091898_fix

Configure the operating system to disable core dump backtraces. Add or modify the following line in /etc/systemd/coredump.conf: ProcessSizeMax=0

b
OL 9 must disable storing core dumps.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-002382
Vuln IDs
V-271730
Rule IDs
SV-271730r1155327_rule
A core dump includes a memory image taken at the time the operating system terminates an application. The memory image could contain sensitive data and is generally useful only for developers or system operators trying to debug problems. Enabling core dumps on production systems is not recommended; however, there may be overriding operational requirements to enable advanced debugging. Permitting temporary enablement of core dumps during such situations must be reviewed through local needs and policy.
Fix: F-75687r1091901_fix

Configure the operating system to disable storing core dumps for all users. Add or modify the following line in /etc/systemd/coredump.conf: Storage=none

b
OL 9 must disable core dumps for all users.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-002383
Vuln IDs
V-271731
Rule IDs
SV-271731r1155302_rule
A core dump includes a memory image taken at the time the operating system terminates an application. The memory image could contain sensitive data and is generally useful only for developers trying to debug problems.
Fix: F-75688r1155301_fix

Configure OL 9 to disable core dumps for all users. Add the following line to the top of the /etc/security/limits.conf or in a single ".conf" file defined in /etc/security/limits.d/: * hard core 0 Remove or comment out any entries for users or groups with a value set to anything other than "0".

b
OL 9 must disable acquiring, saving, and processing core dumps.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-002384
Vuln IDs
V-271732
Rule IDs
SV-271732r1155329_rule
A core dump includes a memory image taken at the time the operating system terminates an application. The memory image could contain sensitive data and is generally useful only for developers trying to debug problems.
Fix: F-75689r1091907_fix

Configure the system to disable the systemd-coredump.socket with the following command: $ sudo systemctl mask --now systemd-coredump.socket Created symlink /etc/systemd/system/systemd-coredump.socket -> /dev/null Reload the daemon for this change to take effect. $ sudo systemctl daemon-reload

b
OL 9 must be configured so that the kdump service is disabled.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-002385
Vuln IDs
V-271733
Rule IDs
SV-271733r1092598_rule
Kernel core dumps may contain the full contents of system memory at the time of the crash. Kernel core dumps consume a considerable amount of disk space and may result in denial of service by exhausting the available space on the target file system partition. Unless the system is used for kernel development or testing, there is little need to run the kdump service.
Fix: F-75690r1092597_fix

Configure OL 9 to disable and mask the kdump service. To disable the kdump service, run the following command: $ sudo systemctl disable --now kdump To mask the kdump service, run the following command: $ sudo systemctl mask --now kdump

b
OL 9 must clear SLUB/SLAB objects to prevent use-after-free attacks.
RMF Control
SI-16
Severity
M
CCI
CCI-002824
Version
OL09-00-002390
Vuln IDs
V-271734
Rule IDs
SV-271734r1091914_rule
Some adversaries launch attacks with the intent of executing code in nonexecutable regions of memory or in memory locations that are prohibited. Security safeguards employed to protect memory include, for example, data execution prevention and address space layout randomization. Data execution prevention safeguards can be either hardware-enforced or software-enforced with hardware providing the greater strength of mechanism. Poisoning writes an arbitrary value to freed pages, so any modification or reference to that page after being freed or before being initialized will be detected and prevented. This prevents many types of use-after-free vulnerabilities at little performance cost. Also prevents leak of data and detection of corrupted memory. SLAB objects are blocks of physically contiguous memory. SLUB is the unqueued SLAB allocator. Satisfies: SRG-OS-000433-GPOS-00192, SRG-OS-000134-GPOS-00068
Fix: F-75691r1091913_fix

Configure OL 9 to enable poisoning of SLUB/SLAB objects with the following commands: $ sudo grubby --update-kernel=ALL --args="slub_debug=P" Add or modify the following line in "/etc/default/grub" to ensure the configuration survives kernel updates: GRUB_CMDLINE_LINUX="slub_debug=P"

a
OL 9 must enable mitigations against processor-based vulnerabilities.
RMF Control
SI-16
Severity
L
CCI
CCI-002824
Version
OL09-00-002391
Vuln IDs
V-271735
Rule IDs
SV-271735r1091917_rule
Kernel page-table isolation is a kernel feature that mitigates the Meltdown security vulnerability and hardens the kernel against attempts to bypass kernel address space layout randomization (KASLR). Satisfies: SRG-OS-000433-GPOS-00193, SRG-OS-000095-GPOS-00049
Fix: F-75692r1091916_fix

Configure OL 9 to enable kernel page-table isolation with the following command: $ sudo grubby --update-kernel=ALL --args="pti=on" Add or modify the following line in "/etc/default/grub" to ensure the configuration survives kernel updates: GRUB_CMDLINE_LINUX="pti=on"

b
OL 9 must disable the ability of systemd to spawn an interactive boot process.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-002392
Vuln IDs
V-271736
Rule IDs
SV-271736r1091920_rule
Using interactive or recovery boot, the console user could disable auditing, firewalls, or other services, weakening system security.
Fix: F-75693r1091919_fix

Configure OL 9 to allocate sufficient audit_backlog_limit to disable the ability of systemd to spawn an interactive boot process with the following command: $ sudo grubby --update-kernel=ALL --remove-args="systemd.confirm_spawn"

b
OL 9 must disable virtual system calls.
RMF Control
SC-3
Severity
M
CCI
CCI-001084
Version
OL09-00-002393
Vuln IDs
V-271737
Rule IDs
SV-271737r1094967_rule
System calls are special routines in the Linux kernel, which userspace applications ask to do privileged tasks. Invoking a system call is an expensive operation because the processor must interrupt the currently executing task and switch context to kernel mode and then back to userspace after the system call completes. Virtual system calls map into user space a page that contains some variables and the implementation of some system calls. This allows the system calls to be executed in userspace to alleviate the context switching expense. Virtual system calls provide an opportunity of attack for a user who has control of the return instruction pointer. Disabling virtual system calls help to prevent return-oriented programming (ROP) attacks via buffer overflows and overruns. If the system intends to run containers based on OL 6 components, virtual system calls will have to be enabled so the components function properly.
Fix: F-75694r1091922_fix

Document the use of virtual system calls with the ISSO as an operational requirement or disable them with the following command: $ sudo grubby --update-kernel=ALL --args="vsyscall=none" Add or modify the following line in "/etc/default/grub" to ensure the configuration survives kernel updates: GRUB_CMDLINE_LINUX="vsyscall=none"

b
OL 9 must clear the page allocator to prevent use-after-free attacks.
RMF Control
SC-3
Severity
M
CCI
CCI-001084
Version
OL09-00-002394
Vuln IDs
V-271738
Rule IDs
SV-271738r1092600_rule
Poisoning writes an arbitrary value to freed pages, so any modification or reference to that page after being freed or before being initialized will be detected and prevented. This prevents many types of use-after-free vulnerabilities at little performance cost. Also prevents leak of data and detection of corrupted memory.
Fix: F-75695r1091925_fix

Configure OL 9 to enable page poisoning with the following commands: $ sudo grubby --update-kernel=ALL --args="page_poison=1" Add or modify the following line in "/etc/default/grub" to ensure the configuration survives kernel updates: GRUB_CMDLINE_LINUX="page_poison=1"

b
OL 9 systemd-journald service must be enabled.
RMF Control
SC-24
Severity
M
CCI
CCI-001665
Version
OL09-00-002400
Vuln IDs
V-271739
Rule IDs
SV-271739r1091929_rule
In the event of a system failure, OL 9 must preserve any information necessary to determine cause of failure and any information necessary to return to operations with least disruption to system processes.
Fix: F-75696r1091928_fix

Configure OL 9 to enable the systemd-journald service with the following command: $ sudo systemctl enable --now systemd-journald

b
OL 9 must enable kernel parameters to enforce discretionary access control on hardlinks.
RMF Control
AC-3
Severity
M
CCI
CCI-002165
Version
OL09-00-002401
Vuln IDs
V-271740
Rule IDs
SV-271740r1091932_rule
By enabling the fs.protected_hardlinks kernel parameter, users can no longer create soft or hard links to files they do not own. Disallowing such hardlinks mitigates vulnerabilities based on insecure file system accessed by privileged programs, avoiding an exploitation vector exploiting unsafe use of open() or creat(). Satisfies: SRG-OS-000312-GPOS-00123, SRG-OS-000324-GPOS-00125
Fix: F-75697r1091931_fix

Configure OL 9 to enable DAC on hardlinks with the following: Add or edit the following line in a system configuration file in the "/etc/sysctl.d/" directory: fs.protected_hardlinks = 1 Load settings from all system configuration files with the following command: $ sudo sysctl --system

b
OL 9 must enable kernel parameters to enforce discretionary access control on symlinks.
RMF Control
AC-3
Severity
M
CCI
CCI-002165
Version
OL09-00-002402
Vuln IDs
V-271741
Rule IDs
SV-271741r1091935_rule
By enabling the fs.protected_symlinks kernel parameter, symbolic links are permitted to be followed only when outside a sticky world-writable directory, or when the user identifier (UID) of the link and follower match, or when the directory owner matches the symlink's owner. Disallowing such symlinks helps mitigate vulnerabilities based on insecure file system accessed by privileged programs, avoiding an exploitation vector exploiting unsafe use of open() or creat(). Satisfies: SRG-OS-000312-GPOS-00123, SRG-OS-000324-GPOS-00125
Fix: F-75698r1091934_fix

Configure OL 9 to enable DAC on symlinks with the following: Add or edit the following line in a system configuration file in the "/etc/sysctl.d/" directory: fs.protected_symlinks = 1 Load settings from all system configuration files with the following command: $ sudo sysctl --system

b
OL 9 debug-shell systemd service must be disabled.
RMF Control
AC-6
Severity
M
CCI
CCI-002235
Version
OL09-00-002403
Vuln IDs
V-271742
Rule IDs
SV-271742r1091938_rule
The debug-shell requires no authentication and provides root privileges to anyone who has physical access to the machine. While this feature is disabled by default, masking it adds an additional layer of assurance that it will not be enabled via a dependency in systemd. This also prevents attackers with physical access from trivially bypassing security on the machine through valid troubleshooting configurations and gaining root access when the system is rebooted.
Fix: F-75699r1091937_fix

Configure OL 9 to mask the debug-shell systemd service with the following command: $ sudo systemctl disable --now debug-shell.service $ sudo systemctl mask --now debug-shell.service

b
OL 9 IP tunnels must use 140-3 approved cryptographic algorithms.
RMF Control
AC-17
Severity
M
CCI
CCI-000068
Version
OL09-00-002404
Vuln IDs
V-271743
Rule IDs
SV-271743r1092635_rule
Overriding the system crypto policy makes the behavior of the Libreswan service violate expectations and makes system configuration more fragmented.
Fix: F-75700r1092602_fix

Configure IPsec to use the systemwide cryptographic policy. Add the following line to "/etc/ipsec.conf": include /etc/crypto-policies/back-ends/libreswan.config

b
OL 9 must restrict access to the kernel message buffer.
RMF Control
SC-2
Severity
M
CCI
CCI-001082
Version
OL09-00-002406
Vuln IDs
V-271745
Rule IDs
SV-271745r1117266_rule
Preventing unauthorized information transfers mitigates the risk of information, including encrypted representations of information, produced by the actions of prior users/roles (or the actions of processes acting on behalf of prior users/roles) from being available to any current users/roles (or current processes) that obtain access to shared system resources (e.g., registers, main memory, hard disks) after those resources have been released back to information systems. The control of information in shared resources is also commonly referred to as object reuse and residual information protection. This requirement generally applies to the design of an information technology product, but it can also apply to the configuration of particular information system components that are, or use, such products. This can be verified by acceptance/validation processes in DOD or other government agencies. There may be shared resources with configurable protections (e.g., files in storage) that may be assessed on specific information system components. Restricting access to the kernel message buffer limits access to only root. This prevents attackers from gaining additional system information as a nonprivileged user. Satisfies: SRG-OS-000132-GPOS-00067, SRG-OS-000138-GPOS-00069
Fix: F-75702r1091946_fix

Configure OL 9 to restrict access to the kernel message buffer. Add or edit the following line in /etc/sysctl.d/99-sysctl.conf system configuration file: kernel.dmesg_restrict = 1 Load settings from all system configuration files with the following command: $ sudo sysctl --system

b
OL 9 must prevent kernel profiling by nonprivileged users.
RMF Control
SC-2
Severity
M
CCI
CCI-001082
Version
OL09-00-002407
Vuln IDs
V-271746
Rule IDs
SV-271746r1117266_rule
Preventing unauthorized information transfers mitigates the risk of information, including encrypted representations of information, produced by the actions of prior users/roles (or the actions of processes acting on behalf of prior users/roles) from being available to any current users/roles (or current processes) that obtain access to shared system resources (e.g., registers, main memory, hard disks) after those resources have been released back to information systems. The control of information in shared resources is also commonly referred to as object reuse and residual information protection. This requirement generally applies to the design of an information technology product, but it can also apply to the configuration of particular information system components that are, or use, such products. This can be verified by acceptance/validation processes in DOD or other government agencies. There may be shared resources with configurable protections (e.g., files in storage) that may be assessed on specific information system components. Setting the kernel.perf_event_paranoid kernel parameter to "2" prevents attackers from gaining additional system information as a nonprivileged user. Satisfies: SRG-OS-000132-GPOS-00067, SRG-OS-000138-GPOS-00069
Fix: F-75703r1091949_fix

Configure OL 9 to prevent kernel profiling by nonprivileged users. Add or edit the following line in /etc/sysctl.d/99-sysctl.conf system configuration file: kernel.perf_event_paranoid = 2 Load settings from all system configuration files with the following command: $ sudo sysctl --system

b
OL 9 must restrict exposed kernel pointer addresses access.
RMF Control
SC-2
Severity
M
CCI
CCI-001082
Version
OL09-00-002408
Vuln IDs
V-271747
Rule IDs
SV-271747r1117266_rule
Exposing kernel pointers (through procfs or "seq_printf()") exposes kernel writeable structures, which may contain functions pointers. If a write vulnerability occurs in the kernel, allowing write access to any of this structure, the kernel can be compromised. This option disallows any program without the CAP_SYSLOG capability to get the addresses of kernel pointers by replacing them with "0". Satisfies: SRG-OS-000132-GPOS-00067, SRG-OS-000433-GPOS-00192
Fix: F-75704r1091952_fix

Configure OL 9 to prevent the leak of kernel pointers to unprivileged users. Add or edit the following line in /etc/sysctl.d/99-sysctl.conf system configuration file: kernel.kptr_restrict = 1 Reload settings from all system configuration files with the following command: $ sudo sysctl --system

b
OL 9 must disable access to network bpf system call from nonprivileged processes.
RMF Control
SC-2
Severity
M
CCI
CCI-001082
Version
OL09-00-002409
Vuln IDs
V-271748
Rule IDs
SV-271748r1117266_rule
Loading and accessing the packet filters programs and maps using the bpf() system call has the potential of revealing sensitive information about the kernel state.
Fix: F-75705r1091955_fix

Configure OL 9 to prevent privilege escalation thru the kernel by disabling access to the bpf syscall by adding the following line to a file, in the "/etc/sysctl.d" directory: kernel.unprivileged_bpf_disabled = 1 The system configuration files need to be reloaded for the changes to take effect. To reload the contents of the files, run the following command: $ sudo sysctl --system

b
OL 9 must restrict usage of ptrace to descendant processes.
RMF Control
SC-2
Severity
M
CCI
CCI-001082
Version
OL09-00-002410
Vuln IDs
V-271749
Rule IDs
SV-271749r1117266_rule
Unrestricted usage of ptrace allows compromised binaries to run ptrace on other processes of the user. Like this, the attacker can steal sensitive information from the target processes (e.g., SSH sessions, web browser, etc.) without any additional assistance from the user (i.e., without resorting to phishing).
Fix: F-75706r1091958_fix

Configure OL 9 to restrict usage of ptrace to descendant processes by adding the following line to "/etc/sysctl.d/99-sysctl.conf": kernel.yama.ptrace_scope = 1 The system configuration files need to be reloaded for the changes to take effect. To reload the contents of the files, run the following command: $ sudo sysctl --system

b
OL 9 must automatically exit interactive command shell user sessions after 15 minutes of inactivity.
RMF Control
SC-10
Severity
M
CCI
CCI-001133
Version
OL09-00-002411
Vuln IDs
V-271750
Rule IDs
SV-271750r1091962_rule
Terminating an idle interactive command shell user session within a short time period reduces the window of opportunity for unauthorized personnel to take control of it when left unattended in a virtual terminal or physical console. Satisfies: SRG-OS-000163-GPOS-00072, SRG-OS-000029-GPOS-00010
Fix: F-75707r1091961_fix

Configure OL 9 to exit interactive command shell user sessions after 15 minutes of inactivity. Add or edit the following line in "/etc/profile.d/tmout.sh": #!/bin/bash declare -xr TMOUT=900

c
OL 9 must be configured so that the systemd Ctrl-Alt-Delete burst key sequence is disabled.
RMF Control
AC-6
Severity
H
CCI
CCI-002235
Version
OL09-00-002412
Vuln IDs
V-271751
Rule IDs
SV-271751r1155321_rule
A locally logged-on user who presses Ctrl-Alt-Delete when at the console can reboot the system. If accidentally pressed, as could happen in the case of a mixed OS environment, this can create the risk of short-term loss of availability of systems due to unintentional reboot. In a graphical user environment, risk of unintentional reboot from the Ctrl-Alt-Delete sequence is reduced because the user will be prompted before any action is taken.
Fix: F-75708r1155320_fix

Configure OL 9 to disable the CtrlAltDelBurstAction by adding it to a drop file in a "/etc/systemd/system.conf.d/" configuration file: If no drop file exists, create one with the following command: $ sudo mkdir -p /etc/systemd/system.conf.d && sudo vi /etc/systemd/system.conf.d/55-CtrlAltDel-BurstAction Edit the file to contain the setting by adding the following text: CtrlAltDelBurstAction=none Reload the daemon for this change to take effect. $ sudo systemctl daemon-reload

c
OL 9 must be configured so that the x86 Ctrl-Alt-Delete key sequence is disabled.
RMF Control
AC-6
Severity
H
CCI
CCI-002235
Version
OL09-00-002413
Vuln IDs
V-271752
Rule IDs
SV-271752r1091968_rule
A locally logged-on user who presses Ctrl-Alt-Delete when at the console can reboot the system. If accidentally pressed, as could happen in the case of a mixed OS environment, this can create the risk of short-term loss of availability of systems due to unintentional reboot. In a graphical user environment, risk of unintentional reboot from the Ctrl-Alt-Delete sequence is reduced because the user will be prompted before any action is taken.
Fix: F-75709r1091967_fix

Configure OL 9 to disable the ctrl-alt-del.target with the following command: $ sudo systemctl disable --now ctrl-alt-del.target $ sudo systemctl mask --now ctrl-alt-del.target

a
OL 9 must limit the number of concurrent sessions to ten for all accounts and/or account types.
RMF Control
AC-10
Severity
L
CCI
CCI-000054
Version
OL09-00-002415
Vuln IDs
V-271753
Rule IDs
SV-271753r1091971_rule
Operating system management includes the ability to control the number of users and user sessions that use an operating system. Limiting the number of allowed users and sessions per user is helpful in reducing the risks related to denial-of-service (DoS) attacks. This requirement addresses concurrent sessions for information system accounts and does not address concurrent sessions by single users via multiple system accounts. The maximum number of concurrent sessions must be defined based on mission needs and the operational environment for each system.
Fix: F-75710r1091970_fix

Configure OL 9 to limit the number of concurrent sessions to "10" for all accounts and/or account types. Add the following line to the /etc/security/limits.conf or in a ".conf" file defined in /etc/security/limits.d/: * hard maxlogins 10

b
OL 9 must automatically lock an account when three unsuccessful logon attempts occur during a 15-minute time period.
RMF Control
AC-7
Severity
M
CCI
CCI-002238
Version
OL09-00-002416
Vuln IDs
V-271754
Rule IDs
SV-271754r1091974_rule
By limiting the number of failed logon attempts the risk of unauthorized system access via user password guessing, otherwise known as brute-forcing, is reduced. Limits are imposed by locking the account. Satisfies: SRG-OS-000329-GPOS-00128, SRG-OS-000021-GPOS-00005
Fix: F-75711r1091973_fix

Configure OL 9 to lock out the "root" account after a number of incorrect login attempts within 15 minutes using "pam_faillock.so" by enabling the feature using the following command: $ sudo authselect enable-feature with-faillock Then edit the "/etc/security/faillock.conf" file as follows: fail_interval = 900

b
OL 9 must maintain an account lock until the locked account is released by an administrator.
RMF Control
AC-7
Severity
M
CCI
CCI-002238
Version
OL09-00-002417
Vuln IDs
V-271755
Rule IDs
SV-271755r1091977_rule
By limiting the number of failed logon attempts the risk of unauthorized system access via user password guessing, otherwise known as brute-forcing, is reduced. Limits are imposed by locking the account. Satisfies: SRG-OS-000329-GPOS-00128, SRG-OS-000021-GPOS-00005
Fix: F-75712r1091976_fix

Configure OL 9 to lock an account until released by an administrator after three unsuccessful logon attempts with the command: $ sudo authselect enable-feature with-faillock Then edit the "/etc/security/faillock.conf" file as follows: unlock_time = 0

c
OL 9 file systems must not contain shosts.equiv files.
RMF Control
CM-6
Severity
H
CCI
CCI-000366
Version
OL09-00-002419
Vuln IDs
V-271757
Rule IDs
SV-271757r1092604_rule
The shosts.equiv files are used to configure host-based authentication for the system via SSH. Host-based authentication is not sufficient for preventing unauthorized access to the system, as it does not require interactive identification and authentication of a connection request, or for the use of two-factor authentication.
Fix: F-75714r1091982_fix

Remove any found "shosts.equiv" files from the system. $ sudo rm /[path]/[to]/[file]/shosts.equiv

c
OL 9 file systems must not contain .shosts files.
RMF Control
CM-6
Severity
H
CCI
CCI-000366
Version
OL09-00-002420
Vuln IDs
V-271758
Rule IDs
SV-271758r1091986_rule
The .shosts files are used to configure host-based authentication for individual users or the system via SSH. Host-based authentication is not sufficient for preventing unauthorized access to the system, as it does not require interactive identification and authentication of a connection request, or for the use of two-factor authentication.
Fix: F-75715r1091985_fix

Remove any found ".shosts" files from the system. $ sudo rm /[path]/[to]/[file]/.shosts

b
OL 9 must implement DOD-approved encryption in the bind package.
RMF Control
SC-8
Severity
M
CCI
CCI-002418
Version
OL09-00-002421
Vuln IDs
V-271759
Rule IDs
SV-271759r1091989_rule
Without cryptographic integrity protections, information can be altered by unauthorized users without detection. Cryptographic mechanisms used for protecting the integrity of information include, for example, signed hash functions using asymmetric cryptography enabling distribution of the public key to verify the hash information while maintaining the confidentiality of the secret key used to generate the hash. OL 9 incorporates system-wide crypto policies by default. The employed algorithms can be viewed in the /etc/crypto-policies/back-ends/ directory. Satisfies: SRG-OS-000423-GPOS-00187, SRG-OS-000426-GPOS-00190
Fix: F-75716r1091988_fix

Configure BIND to use the system crypto policy. Add the following line to the "options" section in "/etc/named.conf": include "/etc/crypto-policies/back-ends/bind.config";

b
OL 9 must implement address space layout randomization (ASLR) to protect its memory from unauthorized code execution.
RMF Control
SI-16
Severity
M
CCI
CCI-002824
Version
OL09-00-002423
Vuln IDs
V-271761
Rule IDs
SV-271761r1091995_rule
ASLR makes it more difficult for an attacker to predict the location of attack code they have introduced into a process' address space during an attempt at exploitation. Additionally, ASLR makes it more difficult for an attacker to know the location of existing code to repurpose it using return-oriented programming (ROP) techniques.
Fix: F-75718r1091994_fix

Configure OL 9 to implement address space layout randomization (ASLR) to protect its memory from unauthorized code execution. Add or edit the following line in a system configuration file in the "/etc/sysctl.d/" directory: kernel.randomize_va_space = 2 Reload settings from all system configuration files with the following command: $ sudo sysctl --system

b
OL 9 must be configured to prevent unrestricted mail relaying.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-002425
Vuln IDs
V-271763
Rule IDs
SV-271763r1092001_rule
If unrestricted mail relaying is permitted, unauthorized senders could use this host as a mail relay for the purpose of sending spam or other unauthorized activity.
Fix: F-75720r1092000_fix

Modify the postfix configuration file to restrict client connections to the local network with the following command: $ sudo postconf -e 'smtpd_client_restrictions = permit_mynetworks,reject'

b
OL 9 must prevent the loading of a new kernel for later execution.
RMF Control
Severity
M
CCI
CCI-003992
Version
OL09-00-002428
Vuln IDs
V-271766
Rule IDs
SV-271766r1092010_rule
Changes to any software components can have significant effects on the overall security of the operating system. This requirement ensures the software has not been tampered with and that it has been provided by a trusted vendor. Disabling kexec_load prevents an unsigned kernel image (that could be a windows kernel or modified vulnerable kernel) from being loaded. Kexec can be used subvert the entire secureboot process and should be avoided at all costs especially since it can load unsigned kernel images.
Fix: F-75723r1092009_fix

Configure OL 9 to prevent the loading of a new kernel for later execution. Add or edit the following line in a system configuration file in the "/etc/sysctl.d/" directory: kernel.kexec_load_disabled = 1 Load settings from all system configuration files with the following command: $ sudo sysctl --system

b
OL 9 must enable hardening for the Berkeley Packet Filter (BPF) just-in-time compiler.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-002430
Vuln IDs
V-271768
Rule IDs
SV-271768r1092016_rule
When hardened, the extended BPF just-in-time (JIT) compiler will randomize any kernel addresses in the BPF programs and maps and will not expose the JIT addresses in "/proc/kallsyms".
Fix: F-75725r1092015_fix

Configure OL 9 to enable hardening for the BPF JIT compiler by adding the following line to a file, in the "/etc/sysctl.d" directory: net.core.bpf_jit_harden = 2 The system configuration files need to be reloaded for the changes to take effect. To reload the contents of the files, run the following command: $ sudo sysctl --system

b
OL 9 SSH private host key files must have mode 0640 or less permissive.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-002502
Vuln IDs
V-271771
Rule IDs
SV-271771r1092025_rule
If an unauthorized user obtains the private SSH host key file, the host could be impersonated.
Fix: F-75728r1092024_fix

Configure the mode of SSH private host key files under "/etc/ssh" to "0640" with the following command: $ sudo chmod 0640 /etc/ssh/ssh_host*key Restart the SSH daemon for the changes to take effect: $ sudo systemctl restart sshd.service

b
OL 9 SSH public host key files must have mode 0644 or less permissive.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-002503
Vuln IDs
V-271772
Rule IDs
SV-271772r1092028_rule
If a public host key file is modified by an unauthorized user, the SSH service may be compromised.
Fix: F-75729r1092027_fix

Change the mode of public host key files under "/etc/ssh" to "0644" with the following command: $ sudo chmod 0644 /etc/ssh/*key.pub Restart the SSH daemon for the changes to take effect: $ sudo systemctl restart sshd.service

b
OL 9 system commands must be group-owned by root or a system account.
RMF Control
CM-5
Severity
M
CCI
CCI-001499
Version
OL09-00-002504
Vuln IDs
V-271773
Rule IDs
SV-271773r1155299_rule
If OL 9 allowed any user to make changes to software libraries, then those changes might be implemented without undergoing the appropriate testing and approvals that are part of a robust change management process. This requirement applies to OL 9 with software libraries that are accessible and configurable, as in the case of interpreted languages. Software libraries also include privileged programs that execute with escalated privileges.
Fix: F-75730r1092030_fix

Configure the system commands to be protected from unauthorized access. Run the following command, replacing "[FILE]" with any system command file not group-owned by "root" or a required system account. $ sudo chgrp root [FILE]

b
OL 9 system commands must be owned by root.
RMF Control
CM-5
Severity
M
CCI
CCI-001499
Version
OL09-00-002505
Vuln IDs
V-271774
Rule IDs
SV-271774r1092034_rule
If OL 9 allowed any user to make changes to software libraries, then those changes might be implemented without undergoing the appropriate testing and approvals that are part of a robust change management process. This requirement applies to OL 9 with software libraries that are accessible and configurable, as in the case of interpreted languages. Software libraries also include privileged programs that execute with escalated privileges.
Fix: F-75731r1092033_fix

Configure the system commands to be protected from unauthorized access. Run the following command, replacing "[FILE]" with any system command file not owned by "root". $ sudo chown root [FILE]

b
OL 9 system commands must have mode 755 or less permissive.
RMF Control
CM-5
Severity
M
CCI
CCI-001499
Version
OL09-00-002506
Vuln IDs
V-271775
Rule IDs
SV-271775r1092037_rule
If OL 9 allowed any user to make changes to software libraries, then those changes might be implemented without undergoing the appropriate testing and approvals that are part of a robust change management process. This requirement applies to OL 9 with software libraries that are accessible and configurable, as in the case of interpreted languages. Software libraries also include privileged programs that execute with escalated privileges.
Fix: F-75732r1092036_fix

Configure the system commands to be protected from unauthorized access. Run the following command, replacing "[FILE]" with any system command with a mode more permissive than "755". $ sudo chmod 755 [FILE]

b
OL 9 SSH server configuration file must be group-owned by root.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-002507
Vuln IDs
V-271776
Rule IDs
SV-271776r1092040_rule
Service configuration files enable or disable features of their respective services, which if configured incorrectly, can lead to insecure and vulnerable configurations. Therefore, service configuration files must be owned by the correct group to prevent unauthorized changes.
Fix: F-75733r1092039_fix

Configure the "/etc/ssh/sshd_config" file to be group-owned by root with the following command: $ sudo chgrp root /etc/ssh/sshd_config

b
OL 9 SSH server configuration file must be owned by root.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-002508
Vuln IDs
V-271777
Rule IDs
SV-271777r1092043_rule
Service configuration files enable or disable features of their respective services, which if configured incorrectly, can lead to insecure and vulnerable configurations. Therefore, service configuration files must be owned by the correct group to prevent unauthorized changes.
Fix: F-75734r1092042_fix

Configure the "/etc/ssh/sshd_config" file to be owned by root with the following command: $ sudo chown root /etc/ssh/sshd_config

b
OL 9 SSH server configuration file must have mode 0600 or less permissive.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-002509
Vuln IDs
V-271778
Rule IDs
SV-271778r1092046_rule
Service configuration files enable or disable features of their respective services that if configured incorrectly can lead to insecure and vulnerable configurations. Therefore, service configuration files should be owned by the correct group to prevent unauthorized changes.
Fix: F-75735r1092045_fix

Configure the "/etc/ssh/sshd_config" permissions to be "0600" with the following command: $ sudo chmod 0600 /etc/ssh/sshd_config

b
OL 9 local initialization files must have mode 0740 or less permissive.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-002513
Vuln IDs
V-271782
Rule IDs
SV-271782r1092058_rule
Local initialization files are used to configure the user's shell environment upon logon. Malicious modification of these files could compromise accounts upon logon.
Fix: F-75739r1092057_fix

Set the mode of the local initialization files to "0740" with the following command: Note: The example will be for the wadea user, who has a home directory of "/home/wadea". $ sudo chmod 0740 /home/wadea/.<INIT_FILE>

b
OL 9 local interactive user home directories must have mode 0750 or less permissive.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-002515
Vuln IDs
V-271784
Rule IDs
SV-271784r1092064_rule
Excessive permissions on local interactive user home directories may allow unauthorized access to user files by other users.
Fix: F-75741r1092063_fix

Change the mode of interactive user's home directories to "0750". To change the mode of a local interactive user's home directory, use the following command: Note: The example will be for the user "wadea". $ sudo chmod 0750 /home/wadea

b
OL 9 library directories must be group-owned by root or a system account.
RMF Control
CM-5
Severity
M
CCI
CCI-001499
Version
OL09-00-002520
Vuln IDs
V-271786
Rule IDs
SV-271786r1092070_rule
If OL 9 allowed any user to make changes to software libraries, then those changes might be implemented without undergoing the appropriate testing and approvals that are part of a robust change management process. This requirement applies to OL 9 with software libraries that are accessible and configurable, as in the case of interpreted languages. Software libraries also include privileged programs that execute with escalated privileges.
Fix: F-75743r1092069_fix

Configure the system-wide shared library directories (/lib, /lib64, /usr/lib and /usr/lib64) to be protected from unauthorized access. Run the following command, replacing "[DIRECTORY]" with any library directory not group-owned by "root". $ sudo chgrp root [DIRECTORY]

b
OL 9 library directories must be owned by root.
RMF Control
CM-5
Severity
M
CCI
CCI-001499
Version
OL09-00-002521
Vuln IDs
V-271787
Rule IDs
SV-271787r1092073_rule
If OL 9 allowed any user to make changes to software libraries, then those changes might be implemented without undergoing the appropriate testing and approvals that are part of a robust change management process. This requirement applies to OL 9 with software libraries that are accessible and configurable, as in the case of interpreted languages. Software libraries also include privileged programs that execute with escalated privileges.
Fix: F-75744r1092072_fix

Configure the system-wide shared library directories within (/lib, /lib64, /usr/lib and /usr/lib64) to be protected from unauthorized access. Run the following command, replacing "[DIRECTORY]" with any library directory not owned by "root". $ sudo chown root [DIRECTORY]

b
OL 9 library directories must have mode 755 or less permissive.
RMF Control
CM-5
Severity
M
CCI
CCI-001499
Version
OL09-00-002522
Vuln IDs
V-271788
Rule IDs
SV-271788r1155305_rule
If OL 9 allowed any user to make changes to software libraries, then those changes might be implemented without undergoing the appropriate testing and approvals that are part of a robust change management process. This requirement applies to OL 9 with software libraries that are accessible and configurable, as in the case of interpreted languages. Software libraries also include privileged programs that execute with escalated privileges.
Fix: F-75745r1155304_fix

Configure the systemwide shared library directories (/lib, /lib64, /usr/lib and /usr/lib64) to be protected from unauthorized access. Run the following command, replacing "[DIRECTORY]" with any library directory with a mode more permissive than 755. $ sudo chmod 755 [DIRECTORY]

b
OL 9 library files must be group owned by root or a system account.
RMF Control
CM-5
Severity
M
CCI
CCI-001499
Version
OL09-00-002523
Vuln IDs
V-271789
Rule IDs
SV-271789r1134863_rule
If OL 9 allowed any user to make changes to software libraries, then those changes might be implemented without undergoing the appropriate testing and approvals that are part of a robust change management process. This requirement applies to OL 9 with software libraries that are accessible and configurable, as in the case of interpreted languages. Software libraries also include privileged programs that execute with escalated privileges.
Fix: F-75746r1134862_fix

Configure the OL 9 systemwide shared library files contained in the directories "/lib", "/lib64", "/usr/lib", and "/usr/lib64" to be group owned by root with the following command: $ sudo find /lib /lib64 /usr/lib /usr/lib64 -type f -name '*.so*' ! -group root -exec chown :root {} +

b
OL 9 library files must be owned by root.
RMF Control
CM-5
Severity
M
CCI
CCI-001499
Version
OL09-00-002524
Vuln IDs
V-271790
Rule IDs
SV-271790r1134866_rule
If OL 9 allowed any user to make changes to software libraries, then those changes might be implemented without undergoing the appropriate testing and approvals that are part of a robust change management process. This requirement applies to OL 9 with software libraries that are accessible and configurable, as in the case of interpreted languages. Software libraries also include privileged programs that execute with escalated privileges.
Fix: F-75747r1134865_fix

Configure the systemwide shared library files contained in the directories "/lib", "/lib64", "/usr/lib", and "/usr/lib64" to be owned by root with the following command: $ sudo find /lib /lib64 /usr/lib /usr/lib64 -type f -name '*.so*' ! -user root -exec chown root {} +

b
OL 9 library files must have mode 0755 or less permissive.
RMF Control
CM-5
Severity
M
CCI
CCI-001499
Version
OL09-00-002525
Vuln IDs
V-271791
Rule IDs
SV-271791r1134971_rule
If OL 9 allowed any user to make changes to software libraries, then those changes might be implemented without undergoing the appropriate testing and approvals that are part of a robust change management process. This requirement applies to OL 9 with software libraries that are accessible and configurable, as in the case of interpreted languages. Software libraries also include privileged programs that execute with escalated privileges.
Fix: F-75748r1134868_fix

Configure the systemwide shared library files contained in the directories "/lib", "/lib64", "/usr/lib", and "/usr/lib64" to have mode 0755 or less permissive with the following command: $ sudo find /lib /lib64 /usr/lib /usr/lib64 -type f -name '*.so*' -perm /022 -exec chmod go-w {} +

b
OL 9 /boot/grub2/grub.cfg file must be group-owned by root.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-002530
Vuln IDs
V-271792
Rule IDs
SV-271792r1094968_rule
The "root" group is a highly privileged group. The group-owner of this file should not have any access privileges.
Fix: F-75749r1092087_fix

Change the group of the file /boot/grub2/grub.cfg to root by running the following command: $ sudo chgrp root /boot/grub2/grub.cfg

b
OL 9 /boot/grub2/grub.cfg file must be owned by root.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-002531
Vuln IDs
V-271793
Rule IDs
SV-271793r1092605_rule
The "/boot/grub2/grub.cfg" file stores sensitive system configuration. Protection of this file is critical for system security.
Fix: F-75750r1092090_fix

Change the owner of the file /boot/grub2/grub.cfg to root by running the following command: $ sudo chown root /boot/grub2/grub.cfg

b
OL 9 /etc/group file must be group-owned by root.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-002532
Vuln IDs
V-271794
Rule IDs
SV-271794r1092094_rule
The "/etc/group" file contains information regarding groups that are configured on the system. Protection of this file is important for system security.
Fix: F-75751r1092093_fix

Change the group of the file /etc/group to root by running the following command: $ sudo chgrp root /etc/group

b
OL 9 /etc/group- file must be group-owned by root.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-002533
Vuln IDs
V-271795
Rule IDs
SV-271795r1092097_rule
The "/etc/group-" file is a backup file of "/etc/group", and as such, contains information regarding groups that are configured on the system. Protection of this file is important for system security.
Fix: F-75752r1092096_fix

Change the group of the file /etc/group- to root by running the following command: $ sudo chgrp root /etc/group-

b
OL 9 /etc/group file must be owned by root.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-002534
Vuln IDs
V-271796
Rule IDs
SV-271796r1092100_rule
The "/etc/group" file contains information regarding groups that are configured on the system. Protection of this file is important for system security.
Fix: F-75753r1092099_fix

Change the owner of the file /etc/group to root by running the following command: $ sudo chown root /etc/group

b
OL 9 /etc/group- file must be owned by root.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-002535
Vuln IDs
V-271797
Rule IDs
SV-271797r1092103_rule
The "/etc/group-" file is a backup file of "/etc/group", and as such, contains information regarding groups that are configured on the system. Protection of this file is important for system security.
Fix: F-75754r1092102_fix

Change the owner of the file /etc/group- to root by running the following command: $ sudo chown root /etc/group-

b
OL 9 /etc/group file must have mode 0644 or less permissive to prevent unauthorized access.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-002536
Vuln IDs
V-271798
Rule IDs
SV-271798r1092106_rule
The "/etc/group" file contains information regarding groups that are configured on the system. Protection of this file is important for system security.
Fix: F-75755r1092105_fix

Change the mode of the file "/etc/group" to "0644" by running the following command: $ sudo chmod 0644 /etc/group

b
OL 9 /etc/group- file must have mode 0644 or less permissive to prevent unauthorized access.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-002537
Vuln IDs
V-271799
Rule IDs
SV-271799r1092109_rule
The "/etc/group-" file is a backup file of "/etc/group", and as such, contains information regarding groups that are configured on the system. Protection of this file is important for system security.
Fix: F-75756r1092108_fix

Change the mode of the file "/etc/group-" to "0644" by running the following command: $ sudo chmod 0644 /etc/group-

b
OL 9 /etc/gshadow file must be group-owned by root.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-002538
Vuln IDs
V-271800
Rule IDs
SV-271800r1092112_rule
The "/etc/gshadow" file contains group password hashes. Protection of this file is critical for system security.
Fix: F-75757r1092111_fix

Change the group of the file /etc/gshadow to root by running the following command: $ sudo chgrp root /etc/gshadow

b
OL 9 /etc/gshadow- file must be group-owned by root.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-002539
Vuln IDs
V-271801
Rule IDs
SV-271801r1092115_rule
The "/etc/gshadow-" file is a backup of "/etc/gshadow", and as such, contains group password hashes. Protection of this file is critical for system security.
Fix: F-75758r1092114_fix

Change the group of the file /etc/gshadow- to root by running the following command: $ sudo chgrp root /etc/gshadow-

b
OL 9 /etc/gshadow file must be owned by root.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-002540
Vuln IDs
V-271802
Rule IDs
SV-271802r1092118_rule
The "/etc/gshadow" file contains group password hashes. Protection of this file is critical for system security.
Fix: F-75759r1092117_fix

Change the owner of the file /etc/gshadow to root by running the following command: $ sudo chown root /etc/gshadow

b
OL 9 /etc/gshadow- file must be owned by root.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-002541
Vuln IDs
V-271803
Rule IDs
SV-271803r1092121_rule
The "/etc/gshadow-" file is a backup of "/etc/gshadow", and as such, contains group password hashes. Protection of this file is critical for system security.
Fix: F-75760r1092120_fix

Change the owner of the file /etc/gshadow- to root by running the following command: $ sudo chown root /etc/gshadow-

b
OL 9 /etc/gshadow file must have mode 0000 or less permissive to prevent unauthorized access.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-002542
Vuln IDs
V-271804
Rule IDs
SV-271804r1092124_rule
The "/etc/gshadow" file contains group password hashes. Protection of this file is critical for system security.
Fix: F-75761r1092123_fix

Change the mode of the file "/etc/gshadow" to "0000" by running the following command: $ sudo chmod 0000 /etc/gshadow

b
OL 9 /etc/gshadow- file must have mode 0000 or less permissive to prevent unauthorized access.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-002543
Vuln IDs
V-271805
Rule IDs
SV-271805r1092127_rule
The "/etc/gshadow-" file is a backup of "/etc/gshadow", and as such, contains group password hashes. Protection of this file is critical for system security.
Fix: F-75762r1092126_fix

Change the mode of the file "/etc/gshadow-" to "0000" by running the following command: $ sudo chmod 0000 /etc/gshadow-

b
OL 9 /etc/passwd file must be group-owned by root.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-002544
Vuln IDs
V-271806
Rule IDs
SV-271806r1092130_rule
The "/etc/passwd" file contains information about the users that are configured on the system. Protection of this file is critical for system security.
Fix: F-75763r1092129_fix

Change the group of the file /etc/passwd to root by running the following command: $ sudo chgrp root /etc/passwd

b
OL 9 /etc/passwd- file must be group-owned by root.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-002545
Vuln IDs
V-271807
Rule IDs
SV-271807r1092133_rule
The "/etc/passwd-" file is a backup file of "/etc/passwd", and as such, contains information about the users that are configured on the system. Protection of this file is critical for system security.
Fix: F-75764r1092132_fix

Change the group of the file /etc/passwd- to root by running the following command: $ sudo chgrp root /etc/passwd-

b
OL 9 /etc/passwd file must be owned by root.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-002546
Vuln IDs
V-271808
Rule IDs
SV-271808r1092136_rule
The "/etc/passwd" file contains information about the users that are configured on the system. Protection of this file is critical for system security.
Fix: F-75765r1092135_fix

Change the owner of the file /etc/passwd to root by running the following command: $ sudo chown root /etc/passwd

b
OL 9 /etc/passwd- file must be owned by root.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-002547
Vuln IDs
V-271809
Rule IDs
SV-271809r1092139_rule
The "/etc/passwd-" file is a backup file of "/etc/passwd", and as such, contains information about the users that are configured on the system. Protection of this file is critical for system security.
Fix: F-75766r1092138_fix

Change the owner of the file /etc/passwd- to root by running the following command: $ sudo chown root /etc/passwd-

b
OL 9 /etc/passwd file must have mode 0644 or less permissive to prevent unauthorized access.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-002548
Vuln IDs
V-271810
Rule IDs
SV-271810r1092142_rule
If the "/etc/passwd" file is writable by a group-owner or the world the risk of its compromise is increased. The file contains the list of accounts on the system and associated information, and protection of this file is critical for system security.
Fix: F-75767r1092141_fix

Change the mode of the file "/etc/passwd" to "0644" by running the following command: $ sudo chmod 0644 /etc/passwd

b
OL 9 /etc/passwd- file must have mode 0644 or less permissive to prevent unauthorized access.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-002549
Vuln IDs
V-271811
Rule IDs
SV-271811r1092145_rule
The "/etc/passwd-" file is a backup file of "/etc/passwd", and as such, contains information about the users that are configured on the system. Protection of this file is critical for system security.
Fix: F-75768r1092144_fix

Change the mode of the file "/etc/passwd-" to "0644" by running the following command: $ sudo chmod 0644 /etc/passwd-

b
OL 9 /etc/shadow file must be group-owned by root.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-002550
Vuln IDs
V-271812
Rule IDs
SV-271812r1092148_rule
The "/etc/shadow" file stores password hashes. Protection of this file is critical for system security.
Fix: F-75769r1092147_fix

Change the group of the file /etc/shadow to root by running the following command: $ sudo chgrp root /etc/shadow

b
OL 9 /etc/shadow- file must be group-owned by root.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-002551
Vuln IDs
V-271813
Rule IDs
SV-271813r1092151_rule
The "/etc/shadow-" file is a backup file of "/etc/shadow", and as such, contains the list of local system accounts and password hashes. Protection of this file is critical for system security.
Fix: F-75770r1092150_fix

Change the group of the file /etc/shadow- to root by running the following command: $ sudo chgrp root /etc/shadow-

b
OL 9 /etc/shadow file must be owned by root.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-002552
Vuln IDs
V-271814
Rule IDs
SV-271814r1092154_rule
The "/etc/shadow" file contains the list of local system accounts and stores password hashes. Protection of this file is critical for system security. Failure to give ownership of this file to root provides the designated owner with access to sensitive information, which could weaken the system security posture.
Fix: F-75771r1092153_fix

Change the owner of the file /etc/shadow to root by running the following command: $ sudo chown root /etc/shadow

b
OL 9 /etc/shadow- file must be owned by root.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-002553
Vuln IDs
V-271815
Rule IDs
SV-271815r1092157_rule
The "/etc/shadow-" file is a backup file of "/etc/shadow", and as such, contains the list of local system accounts and password hashes. Protection of this file is critical for system security.
Fix: F-75772r1092156_fix

Change the owner of the file /etc/shadow- to root by running the following command: $ sudo chown root /etc/shadow-

b
OL 9 /etc/shadow- file must have mode 0000 or less permissive to prevent unauthorized access.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-002554
Vuln IDs
V-271816
Rule IDs
SV-271816r1092160_rule
The "/etc/shadow-" file is a backup file of "/etc/shadow", and as such, contains the list of local system accounts and password hashes. Protection of this file is critical for system security.
Fix: F-75773r1092159_fix

Change the mode of the file "/etc/shadow-" to "0000" by running the following command: $ sudo chmod 0000 /etc/shadow-

b
OL 9 /etc/shadow file must have mode 0000 to prevent unauthorized access.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-002555
Vuln IDs
V-271817
Rule IDs
SV-271817r1092163_rule
The "/etc/shadow" file contains the list of local system accounts and stores password hashes. Protection of this file is critical for system security. Failure to give ownership of this file to root provides the designated owner with access to sensitive information, which could weaken the system security posture.
Fix: F-75774r1092162_fix

Change the mode of the file "/etc/shadow" to "0000" by running the following command: $ sudo chmod 0000 /etc/shadow

b
OL 9 /var/log directory must be group-owned by root.
RMF Control
SI-11
Severity
M
CCI
CCI-001314
Version
OL09-00-002560
Vuln IDs
V-271818
Rule IDs
SV-271818r1092166_rule
Only authorized personnel should be aware of errors and the details of the errors. Error messages are an indicator of an organization's operational state or can identify the OL 9 system or platform. Additionally, personally identifiable information (PII) and operational information must not be revealed through error messages to unauthorized personnel or their designated representatives. The structure and content of error messages must be carefully considered by the organization and development team. The extent to which the information system is able to identify and handle error conditions is guided by organizational policy and operational requirements.
Fix: F-75775r1092165_fix

Configure the group owner of the directory "/var/log" to "root" by running the following command: $ sudo chgrp root /var/log

b
OL 9 /var/log directory must be owned by root.
RMF Control
SI-11
Severity
M
CCI
CCI-001314
Version
OL09-00-002561
Vuln IDs
V-271819
Rule IDs
SV-271819r1092169_rule
Only authorized personnel should be aware of errors and the details of the errors. Error messages are an indicator of an organization's operational state or can identify the OL 9 system or platform. Additionally, personally identifiable information (PII) and operational information must not be revealed through error messages to unauthorized personnel or their designated representatives. The structure and content of error messages must be carefully considered by the organization and development team. The extent to which the information system is able to identify and handle error conditions is guided by organizational policy and operational requirements.
Fix: F-75776r1092168_fix

Configure the owner of the directory "/var/log" to "root" by running the following command: $ sudo chown root /var/log

b
OL 9 /var/log directory must have mode 0755 or less permissive.
RMF Control
SI-11
Severity
M
CCI
CCI-001314
Version
OL09-00-002562
Vuln IDs
V-271820
Rule IDs
SV-271820r1092172_rule
Only authorized personnel should be aware of errors and the details of the errors. Error messages are an indicator of an organization's operational state or can identify the OL 9 system or platform. Additionally, personally identifiable information (PII) and operational information must not be revealed through error messages to unauthorized personnel or their designated representatives. The structure and content of error messages must be carefully considered by the organization and development team. The extent to which the information system is able to identify and handle error conditions is guided by organizational policy and operational requirements.
Fix: F-75777r1092171_fix

Configure the "/var/log" directory to a mode of "0755" by running the following command: $ sudo chmod 0755 /var/log

b
OL 9 /var/log/messages file must be group-owned by root.
RMF Control
SI-11
Severity
M
CCI
CCI-001314
Version
OL09-00-002563
Vuln IDs
V-271821
Rule IDs
SV-271821r1092175_rule
Only authorized personnel should be aware of errors and the details of the errors. Error messages are an indicator of an organization's operational state or can identify the OL 9 system or platform. Additionally, personally identifiable information (PII) and operational information must not be revealed through error messages to unauthorized personnel or their designated representatives. The structure and content of error messages must be carefully considered by the organization and development team. The extent to which the information system is able to identify and handle error conditions is guided by organizational policy and operational requirements.
Fix: F-75778r1092174_fix

Change the group owner of the "/var/log/messages" file to "root" by running the following command: $ sudo chgrp root /var/log/messages

b
OL 9 /var/log/messages file must be owned by root.
RMF Control
SI-11
Severity
M
CCI
CCI-001314
Version
OL09-00-002564
Vuln IDs
V-271822
Rule IDs
SV-271822r1092178_rule
Only authorized personnel should be aware of errors and the details of the errors. Error messages are an indicator of an organization's operational state or can identify the OL 9 system or platform. Additionally, personally identifiable information (PII) and operational information must not be revealed through error messages to unauthorized personnel or their designated representatives. The structure and content of error messages must be carefully considered by the organization and development team. The extent to which the information system is able to identify and handle error conditions is guided by organizational policy and operational requirements.
Fix: F-75779r1092177_fix

Change the owner of the "/var/log/messages" file to "root" by running the following command: $ sudo chown root /var/log/messages

b
OL 9 /var/log/messages file must have mode 0640 or less permissive.
RMF Control
SI-11
Severity
M
CCI
CCI-001314
Version
OL09-00-002565
Vuln IDs
V-271823
Rule IDs
SV-271823r1092181_rule
Only authorized personnel should be aware of errors and the details of the errors. Error messages are an indicator of an organization's operational state or can identify the OL 9 system or platform. Additionally, personally identifiable information (PII) and operational information must not be revealed through error messages to unauthorized personnel or their designated representatives. The structure and content of error messages must be carefully considered by the organization and development team. The extent to which the information system is able to identify and handle error conditions is guided by organizational policy and operational requirements.
Fix: F-75780r1092180_fix

Configure the "/var/log/messages" file to have a mode of "0640" by running the following command: $ sudo chmod 0640 /var/log/messages

b
OL 9 audit tools must be group-owned by root.
RMF Control
AU-9
Severity
M
CCI
CCI-001493
Version
OL09-00-002570
Vuln IDs
V-271824
Rule IDs
SV-271824r1092184_rule
Protecting audit information also includes identifying and protecting the tools used to view and manipulate log data; therefore, protecting audit tools is necessary to prevent unauthorized operation on audit information. OL 9 systems providing tools to interface with audit information will leverage user permissions and roles identifying the user accessing the tools, and the corresponding rights the user enjoys, to make access decisions regarding the access to audit tools. Audit tools include, but are not limited to, vendor-provided and open source audit tools needed to successfully view and manipulate audit information system activity and records. Audit tools include custom queries and report generators.
Fix: F-75781r1092183_fix

Configure the audit tools to be group-owned by "root" by running the following command: $ sudo chgrp root [audit_tool] Replace "[audit_tool]" with each audit tool not group-owned by "root".

b
OL 9 audit tools must be owned by root.
RMF Control
AU-9
Severity
M
CCI
CCI-001493
Version
OL09-00-002571
Vuln IDs
V-271825
Rule IDs
SV-271825r1092187_rule
Protecting audit information also includes identifying and protecting the tools used to view and manipulate log data. Therefore, protecting audit tools is necessary to prevent unauthorized operation on audit information. OL 9 systems providing tools to interface with audit information will leverage user permissions and roles identifying the user accessing the tools, and the corresponding rights the user enjoys, to make access decisions regarding the access to audit tools. Audit tools include, but are not limited to, vendor-provided and open source audit tools needed to successfully view and manipulate audit information system activity and records. Audit tools include custom queries and report generators.
Fix: F-75782r1092186_fix

Configure the audit tools to be owned by "root" by running the following command: $ sudo chown root [audit_tool] Replace "[audit_tool]" with each audit tool not owned by "root".

b
OL 9 audit tools must have a mode of 0755 or less permissive.
RMF Control
AU-9
Severity
M
CCI
CCI-001493
Version
OL09-00-002572
Vuln IDs
V-271826
Rule IDs
SV-271826r1092190_rule
Protecting audit information also includes identifying and protecting the tools used to view and manipulate log data. Therefore, protecting audit tools is necessary to prevent unauthorized operation on audit information. OL 9 systems providing tools to interface with audit information will leverage user permissions and roles identifying the user accessing the tools, and the corresponding rights the user enjoys, to make access decisions regarding the access to audit tools. Audit tools include, but are not limited to, vendor-provided and open source audit tools needed to successfully view and manipulate audit information system activity and records. Audit tools include custom queries and report generators.
Fix: F-75783r1092189_fix

Configure the audit tools to have a mode of "0755" by running the following command: $ sudo chmod 0755 [audit_tool] Replace "[audit_tool]" with each audit tool that has a more permissive mode than 0755.

b
OL 9 cron configuration directories must have a mode of 0700 or less permissive.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-002580
Vuln IDs
V-271827
Rule IDs
SV-271827r1092193_rule
Service configuration files enable or disable features of their respective services that if configured incorrectly can lead to insecure and vulnerable configurations. Therefore, service configuration files should have the correct access rights to prevent unauthorized changes.
Fix: F-75784r1092192_fix

Configure any OL 9 cron configuration directory with a mode more permissive than "0700" as follows: $ sudo chmod 0700 [cron configuration directory]

b
OL 9 cron configuration files directory must be group-owned by root.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-002581
Vuln IDs
V-271828
Rule IDs
SV-271828r1092196_rule
Service configuration files enable or disable features of their respective services that if configured incorrectly can lead to insecure and vulnerable configurations; therefore, service configuration files should be owned by the correct group to prevent unauthorized changes.
Fix: F-75785r1092195_fix

Configure any cron configuration not group-owned by root with the following command: $ sudo chgrp root [cron config file]

b
OL 9 cron configuration files directory must be owned by root.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-002582
Vuln IDs
V-271829
Rule IDs
SV-271829r1092199_rule
Service configuration files enable or disable features of their respective services that if configured incorrectly can lead to insecure and vulnerable configurations; therefore, service configuration files must be owned by the correct group to prevent unauthorized changes.
Fix: F-75786r1092198_fix

Configure any cron configuration not owned by root with the following command: $ sudo chown root [cron config file]

b
OL 9 /etc/crontab file must have mode 0600.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-002583
Vuln IDs
V-271830
Rule IDs
SV-271830r1092202_rule
Service configuration files enable or disable features of their respective services that if configured incorrectly can lead to insecure and vulnerable configurations; therefore, service configuration files must have the correct access rights to prevent unauthorized changes.
Fix: F-75787r1092201_fix

Configure the OL 9 file /etc/crontab with mode 600. $ sudo chmod 0600 /etc/crontab

c
OL 9 must be configured so that the root account is the only account having unrestricted access to the system.
RMF Control
CM-6
Severity
H
CCI
CCI-000366
Version
OL09-00-003000
Vuln IDs
V-271831
Rule IDs
SV-271831r1092205_rule
An account has root authority if it has a user identifier (UID) of "0". Multiple accounts with a UID of "0" afford more opportunity for potential intruders to guess a password for a privileged account. Proper configuration of sudo is recommended to afford multiple system administrators access to root privileges in an accountable manner.
Fix: F-75788r1092204_fix

Change the UID of any account on the system, other than root, that has a UID of "0". If the account is associated with system commands or applications, the UID should be changed to one greater than "0" but less than "1000". Otherwise, assign a UID of greater than "1000" that has not already been assigned.

b
OL 9 duplicate User IDs (UIDs) must not exist for interactive users.
RMF Control
IA-2
Severity
M
CCI
CCI-000764
Version
OL09-00-003001
Vuln IDs
V-271832
Rule IDs
SV-271832r1092208_rule
To ensure accountability and prevent unauthenticated access, interactive users must be identified and authenticated to prevent potential misuse and compromise of the system. Satisfies: SRG-OS-000104-GPOS-00051, SRG-OS-000121-GPOS-00062, SRG-OS-000042-GPOS-00020
Fix: F-75789r1092207_fix

Edit the file "/etc/passwd" and provide each interactive user account that has a duplicate UID with a unique UID.

b
OL 9 local interactive users must have a home directory assigned in the /etc/passwd file.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-003002
Vuln IDs
V-271833
Rule IDs
SV-271833r1092607_rule
If local interactive users are not assigned a valid home directory, there is no place for the storage and control of files they should own.
Fix: F-75790r1092210_fix

Create and assign home directories to all local interactive users on OL 9 that currently do not have a home directory assigned.

b
OL 9 interactive users must have a primary group that exists.
RMF Control
IA-2
Severity
M
CCI
CCI-000764
Version
OL09-00-003005
Vuln IDs
V-271834
Rule IDs
SV-271834r1092214_rule
If a user is assigned the Group Identifier (GID) of a group that does not exist on the system, and a group with the GID is subsequently created, the user may have unintended rights to any files associated with the group.
Fix: F-75791r1092213_fix

Configure the system so that all GIDs are referenced in "/etc/passwd" are defined in "/etc/group". Edit the file "/etc/passwd" and ensure that every user's GID is a valid GID.

b
OL 9 groups must have unique Group ID (GID).
RMF Control
IA-2
Severity
M
CCI
CCI-000764
Version
OL09-00-003006
Vuln IDs
V-271835
Rule IDs
SV-271835r1092217_rule
To ensure accountability and prevent unauthenticated access, groups must be identified uniquely to prevent potential misuse and compromise of the system.
Fix: F-75792r1092216_fix

Edit the file "/etc/group" and provide each group that has a duplicate GID with a unique GID.

b
OL 9 must configure SELinux context type to allow the use of a nondefault faillock tally directory.
RMF Control
AC-7
Severity
M
CCI
CCI-000044
Version
OL09-00-003010
Vuln IDs
V-271836
Rule IDs
SV-271836r1092637_rule
Not having the correct SELinux context on the faillock directory may lead to unauthorized access to the directory.
Fix: F-75793r1092219_fix

Configure OL 9 to allow the use of a nondefault faillock tally directory while SELinux enforces a targeted policy. Create a nondefault faillock tally directory (if it does not already exist) with the following example: $ sudo mkdir /var/log/faillock Update the /etc/selinux/targeted/contexts/files/file_contexts.local with "faillog_t" context type for the nondefault faillock tally directory with the following command: $ sudo semanage fcontext -a -t faillog_t "/var/log/faillock(/.*)?" Update the context type of the nondefault faillock directory/subdirectories and files with the following command: $ sudo restorecon -R -v /var/log/faillock

b
OL 9 must automatically lock an account when three unsuccessful logon attempts occur.
RMF Control
AC-7
Severity
M
CCI
CCI-002238
Version
OL09-00-003020
Vuln IDs
V-271839
Rule IDs
SV-271839r1092229_rule
By limiting the number of failed logon attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute-force attacks, is reduced. Limits are imposed by locking the account. Satisfies: SRG-OS-000329-GPOS-00128, SRG-OS-000021-GPOS-00005
Fix: F-75796r1092228_fix

Configure OL 9 to lock an account when three unsuccessful logon attempts occur. Add/modify the "/etc/security/faillock.conf" file to match the following line: deny = 3

b
OL 9 must automatically lock the root account until the root account is released by an administrator when three unsuccessful logon attempts occur during a 15-minute time period.
RMF Control
AC-7
Severity
M
CCI
CCI-002238
Version
OL09-00-003021
Vuln IDs
V-271840
Rule IDs
SV-271840r1092232_rule
By limiting the number of failed logon attempts, the risk of unauthorized system access via user password guessing, also known as brute-forcing, is reduced. Limits are imposed by locking the account. Satisfies: SRG-OS-000329-GPOS-00128, SRG-OS-000021-GPOS-00005
Fix: F-75797r1092231_fix

Configure OL 9 to lock out the "root" account after a number of incorrect login attempts using "pam_faillock.so", first enable the feature using the following command: $ sudo authselect enable-feature with-faillock Then edit the "/etc/security/faillock.conf" file as follows: add or uncomment the following line: even_deny_root

b
OL 9 must log username information when unsuccessful logon attempts occur.
RMF Control
AC-7
Severity
M
CCI
CCI-000044
Version
OL09-00-003022
Vuln IDs
V-271841
Rule IDs
SV-271841r1092235_rule
Without auditing of these events, it may be harder or impossible to identify what an attacker did after an attack.
Fix: F-75798r1092234_fix

Configure OL 9 to log username information when unsuccessful logon attempts occur. Add/modify the "/etc/security/faillock.conf" file to match the following line: audit

b
OL 9 must ensure account lockouts persist.
RMF Control
AC-7
Severity
M
CCI
CCI-000044
Version
OL09-00-003023
Vuln IDs
V-271842
Rule IDs
SV-271842r1092238_rule
Having lockouts persist across reboots ensures that account is only unlocked by an administrator. If the lockouts did not persist across reboots, an attacker could simply reboot the system to continue brute force attacks against the accounts on the system.
Fix: F-75799r1092237_fix

Configure OL 9 maintain the contents of the faillock directory after a reboot. Add/modify the "/etc/security/faillock.conf" file to match the following line: dir = /var/log/faillock

b
OL 9 system accounts must not have an interactive login shell.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-003051
Vuln IDs
V-271845
Rule IDs
SV-271845r1092247_rule
Ensuring shells are not given to system accounts upon login makes it more difficult for attackers to make use of system accounts.
Fix: F-75802r1092246_fix

Configure OL 9 so that all noninteractive accounts on the system do not have an interactive shell assigned to them. If the system account needs a shell assigned for mission operations, document the need with the ISSO. Run the following command to disable the interactive shell for a specific noninteractive user account: Replace <user> with the user that has a login shell. $ sudo usermod --shell /sbin/nologin <user> Do not perform the steps in this section on the root account. Doing so will cause the system to become inaccessible.

b
OL 9 local interactive user accounts must be assigned a home directory upon creation.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-003052
Vuln IDs
V-271846
Rule IDs
SV-271846r1092250_rule
If local interactive users are not assigned a valid home directory, there is no place for the storage and control of files they should own.
Fix: F-75803r1092249_fix

Configure OL 9 to assign home directories to all new local interactive users by setting the "CREATE_HOME" parameter in "/etc/login.defs" to "yes" as follows. CREATE_HOME yes

b
OL 9 must disable account identifiers (individuals, groups, roles, and devices) after 35 days of inactivity.
RMF Control
Severity
M
CCI
CCI-003627
Version
OL09-00-003065
Vuln IDs
V-271849
Rule IDs
SV-271849r1092259_rule
Inactive identifiers pose a risk to systems and applications because attackers may exploit an inactive identifier and potentially obtain undetected access to the system. Disabling inactive accounts ensures that accounts which may not have been responsibly removed are not available to attackers who may have compromised their credentials. Owners of inactive accounts will not notice if unauthorized access to their user account has been obtained. Satisfies: SRG-OS-000118-GPOS-00060, SRG-OS-000590-GPOS-00110
Fix: F-75806r1092258_fix

Configure OL 9 to disable account identifiers after 35 days of inactivity after the password expiration. Run the following command to change the configuration for useradd: $ sudo useradd -D -f 35 The recommendation is 35 days, but a lower value is acceptable.

b
OL 9 must enforce a delay of at least four seconds between logon prompts following a failed logon attempt.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-003070
Vuln IDs
V-271850
Rule IDs
SV-271850r1092262_rule
Increasing the time between a failed authentication attempt and reprompting to enter credentials helps to slow a single-threaded brute force attack.
Fix: F-75807r1092261_fix

Configure the OL 9 to enforce a delay of at least four seconds between logon prompts following a failed console logon attempt. Modify the "/etc/login.defs" file to set the "FAIL_DELAY" parameter to 4 or greater: FAIL_DELAY 4

b
OL 9 remote access methods must be monitored.
RMF Control
AC-17
Severity
M
CCI
CCI-000067
Version
OL09-00-005000
Vuln IDs
V-271851
Rule IDs
SV-271851r1092265_rule
Logging remote access methods can be used to trace the decrease in the risks associated with remote user access management. It can also be used to spot cyberattacks and ensure ongoing compliance with organizational policies surrounding the use of remote access methods.
Fix: F-75808r1092264_fix

Configure OL 9 remote access methods to be monitored. Add or update the following lines to the "/etc/rsyslog.conf" file: auth.*;authpriv.*;daemon.* /var/log/secure The "rsyslog" service must be restarted for the changes to take effect with the following command: $ sudo systemctl restart rsyslog.service

b
OL 9 must be configured to forward audit records via TCP to a different system or media from the system being audited via rsyslog.
RMF Control
AU-4
Severity
M
CCI
CCI-001851
Version
OL09-00-005005
Vuln IDs
V-271852
Rule IDs
SV-271852r1092608_rule
Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Offloading is a common process in information systems with limited audit storage capacity. OL 9 installation media provides "rsyslogd", a system utility providing support for message logging. Support for both internet and Unix domain sockets enables this utility to support both local and remote logging. Coupling this utility with "gnutls" (a secure communications library implementing the SSL, TLS, and DTLS protocols) creates a method to securely encrypt and offload auditing. Rsyslog provides three ways to forward message: the traditional UDP transport, which is extremely lossy but standard; the plain TCP based transport, which loses messages only during certain situations but is widely available; and the RELP transport, which does not lose messages but is currently available only as part of the rsyslogd 3.15.0 and above. Examples of each configuration: UDP *.* @remotesystemname TCP *.* @@remotesystemname RELP *.* :omrelp:remotesystemname:2514 Note that a port number was given as there is no standard port for RELP. Satisfies: SRG-OS-000479-GPOS-00224, SRG-OS-000342-GPOS-00133
Fix: F-75809r1092267_fix

Configure OL 9 to offload audit records onto a different system or media from the system being audited via TCP using rsyslog by specifying the remote logging server in "/etc/rsyslog.conf"" or "/etc/rsyslog.d/[customfile].conf" with the name or IP address of the log aggregation server. *.* @@[remoteloggingserver]:[port]"

b
OL 9 must authenticate the remote logging server for offloading audit logs via rsyslog.
RMF Control
AU-4
Severity
M
CCI
CCI-001851
Version
OL09-00-005015
Vuln IDs
V-271854
Rule IDs
SV-271854r1092274_rule
Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Offloading is a common process in information systems with limited audit storage capacity. OL 9 installation media provides "rsyslogd", a system utility providing support for message logging. Support for both internet and Unix domain sockets enables this utility to support both local and remote logging. Coupling this utility with "gnutls" (a secure communications library implementing the SSL, TLS, and DTLS protocols) creates a method to securely encrypt and offload auditing. "Rsyslog" supported authentication modes include: anon - anonymous authentication x509/fingerprint - certificate fingerprint authentication x509/certvalid - certificate validation only x509/name - certificate validation and subject name authentication Satisfies: SRG-OS-000342-GPOS-00133, SRG-OS-000479-GPOS-00224
Fix: F-75811r1092273_fix

Configure OL 9 to authenticate the remote logging server for off-loading audit logs by setting the following option in "/etc/rsyslog.conf" or "/etc/rsyslog.d/[customfile].conf": $ActionSendStreamDriverAuthMode x509/name

b
OL 9 must encrypt the transfer of audit records offloaded onto a different system or media from the system being audited via rsyslog.
RMF Control
AU-4
Severity
M
CCI
CCI-001851
Version
OL09-00-005020
Vuln IDs
V-271855
Rule IDs
SV-271855r1092277_rule
Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Offloading is a common process in information systems with limited audit storage capacity. OL 9 installation media provides "rsyslogd", a system utility providing support for message logging. Support for both internet and Unix domain sockets enables this utility to support both local and remote logging. Coupling this utility with "gnutls" (a secure communications library implementing the SSL, TLS, and DTLS protocols) creates a method to securely encrypt and offload auditing. "Rsyslog" supported authentication modes include: anon - anonymous authentication x509/fingerprint - certificate fingerprint authentication x509/certvalid - certificate validation only x509/name - certificate validation and subject name authentication Satisfies: SRG-OS-000342-GPOS-00133, SRG-OS-000479-GPOS-00224
Fix: F-75812r1092276_fix

Configure OL 9 to encrypt offloaded audit records via rsyslog by setting the following options in "/etc/rsyslog.conf" or "/etc/rsyslog.d/[customfile].conf": $ActionSendStreamDriverMode 1

b
OL 9 must encrypt via the gtls driver the transfer of audit records offloaded onto a different system or media from the system being audited via rsyslog.
RMF Control
AU-4
Severity
M
CCI
CCI-001851
Version
OL09-00-005025
Vuln IDs
V-271856
Rule IDs
SV-271856r1092280_rule
Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Offloading is a common process in information systems with limited audit storage capacity. OL 9 installation media provides "rsyslogd", a system utility providing support for message logging. Support for both internet and Unix domain sockets enables this utility to support both local and remote logging. Coupling this utility with "gnutls" (a secure communications library implementing the SSL, TLS, and DTLS protocols) creates a method to securely encrypt and offload auditing. Satisfies: SRG-OS-000342-GPOS-00133, SRG-OS-000479-GPOS-00224
Fix: F-75813r1092279_fix

Configure OL 9 to use the gtls driver to encrypt offloaded audit records by setting the following options in "/etc/rsyslog.conf" or "/etc/rsyslog.d/[customfile].conf": $DefaultNetstreamDriver gtls

b
OL 9 must be configured so that the rsyslog daemon does not accept log messages from other servers unless the server is being used for log aggregation.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-005030
Vuln IDs
V-271857
Rule IDs
SV-271857r1155339_rule
Unintentionally running a rsyslog server accepting remote messages puts the system at increased risk. Malicious rsyslog messages sent to the server could exploit vulnerabilities in the server software itself, could introduce misleading information into the system's logs, or could fill the system's storage leading to a denial of service. If the system is intended to be a log aggregation server, its use must be documented with the information system security officer (ISSO).
Fix: F-75814r1155338_fix

Configure OL 9 to not receive remote logs using rsyslog. Remove the lines in /etc/rsyslog.conf and any files in the /etc/rsyslog.d directory that match any of the following: InputTCPServerRun UDPServerRun RELPServerRun module(load="imtcp") module(load="imudp") module(load="imrelp") input(type="imudp" port="514") input(type="imtcp" port="514") input(type="imrelp" port="514") The rsyslog daemon must be restarted for the changes to take effect: $ sudo systemctl restart rsyslog.service

b
OL 9 must protect against or limit the effects of denial-of-service (DoS) attacks by ensuring rate-limiting measures on impacted network interfaces are implemented.
RMF Control
SC-5
Severity
M
CCI
CCI-002385
Version
OL09-00-006000
Vuln IDs
V-271858
Rule IDs
SV-271858r1092286_rule
DoS is a condition when a resource is not available for legitimate users. When this occurs, the organization either cannot accomplish its mission or must operate at degraded capacity. This requirement addresses the configuration of OL 9 to mitigate the impact of DoS attacks that have occurred or are ongoing on system availability. For each system, known and potential DoS attacks must be identified and solutions for each type implemented. A variety of technologies exists to limit or, in some cases, eliminate the effects of DoS attacks (e.g., limiting processes or establishing memory partitions). Employing increased capacity and bandwidth, combined with service redundancy, may reduce the susceptibility to some DoS attacks.
Fix: F-75815r1092285_fix

Configure "nftables" to be the default "firewallbackend" for "firewalld" by adding or editing the following line in "/etc/firewalld/firewalld.conf": FirewallBackend=nftables Establish rate-limiting rules based on organization-defined types of DoS attacks on impacted network interfaces.

b
OL 9 must configure a DNS processing mode set be Network Manager.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-006002
Vuln IDs
V-271860
Rule IDs
SV-271860r1092292_rule
To ensure that DNS resolver settings are respected, a DNS mode in Network Manager must be configured.
Fix: F-75817r1092291_fix

Configure NetworkManager in OL 9 to use a DNS mode. In "/etc/NetworkManager/NetworkManager.conf" add the following line in the "[main]" section: dns = none NetworkManager must be reloaded for the change to take effect. $ sudo systemctl reload NetworkManager

b
OL 9 systems using Domain Name Servers (DNS) resolution must have at least two name servers configured.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-006003
Vuln IDs
V-271861
Rule IDs
SV-271861r1092295_rule
To provide availability for name resolution services, multiple redundant name servers are mandated. A failure in name resolution could lead to the failure of security functions requiring name resolution, which may include time synchronization, centralized authentication, and remote system logging.
Fix: F-75818r1092294_fix

Configure the operating system to use two or more name servers for DNS resolution based on the DNS mode of the system. If the NetworkManager DNS mode is set to "none", then add the following lines to "/etc/resolv.conf": nameserver [name server 1] nameserver [name server 2] Replace [name server 1] and [name server 2] with the IPs of two different DNS resolvers. If the NetworkManager DNS mode is set to "default" then add two DNS servers to a NetworkManager connection. Using the following commands: $ sudo nmcli connection modify [connection name] ipv4.dns [name server 1] $ sudo nmcli connection modify [connection name] ipv4.dns [name server 2] Replace [name server 1] and [name server 2] with the IPs of two different DNS resolvers. Replace [connection name] with a valid NetworkManager connection name on the system. Replace ipv4 with ipv6 if IPv6 DNS servers are used.

b
OL 9 network interfaces must not be in promiscuous mode.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-006004
Vuln IDs
V-271862
Rule IDs
SV-271862r1092298_rule
Network interfaces in promiscuous mode allow for the capture of all network traffic visible to the system. If unauthorized individuals can access these applications, it may allow them to collect information such as logon IDs, passwords, and key exchanges between systems. If the system is being used to perform a network troubleshooting function, the use of these tools must be documented with the information systems security officer (ISSO) and restricted to only authorized personnel.
Fix: F-75819r1092297_fix

Configure network interfaces to turn off promiscuous mode unless approved by the ISSO and documented. Set the promiscuous mode of an interface to off with the following command: $ sudo ip link set dev <devicename> multicast off promisc off

b
OL 9 must ignore Internet Protocol version 4 (IPv4) Internet Control Message Protocol (ICMP) redirect messages.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-006020
Vuln IDs
V-271864
Rule IDs
SV-271864r1092304_rule
ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular destination. These messages modify the host's route table and are unauthenticated. An illicit ICMP redirect message could result in a man-in-the-middle attack. This feature of the IPv4 protocol has few legitimate uses. It should be disabled unless absolutely required.
Fix: F-75821r1092303_fix

Configure OL 9 to ignore IPv4 ICMP redirect messages. Add or edit the following line in a single system configuration file in the "/etc/sysctl.d/" directory: net.ipv4.conf.all.accept_redirects = 0 Load settings from all system configuration files with the following command: $ sudo sysctl --system

b
OL 9 must not forward Internet Protocol version 4 (IPv4) source-routed packets.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-006021
Vuln IDs
V-271865
Rule IDs
SV-271865r1092307_rule
Source-routed packets allow the source of the packet to suggest routers forward the packet along a different path than configured on the router, which can be used to bypass network security measures. This requirement applies only to the forwarding of source-routed traffic, such as when IPv4 forwarding is enabled and the system is functioning as a router. Accepting source-routed packets in the IPv4 protocol has few legitimate uses. It must be disabled unless it is absolutely required.
Fix: F-75822r1092306_fix

Configure OL 9 to ignore IPv4 source-routed packets. Add or edit the following line in a single system configuration file in the "/etc/sysctl.d/" directory: net.ipv4.conf.all.accept_source_route = 0 Load settings from all system configuration files with the following command: $ sudo sysctl --system

b
OL 9 must log IPv4 packets with impossible addresses.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-006022
Vuln IDs
V-271866
Rule IDs
SV-271866r1092310_rule
The presence of "martian" packets (which have impossible addresses) as well as spoofed packets, source-routed packets, and redirects could be a sign of nefarious network activity. Logging these packets enables this activity to be detected.
Fix: F-75823r1092309_fix

Configure OL 9 to log martian packets on IPv4 interfaces. Add or edit the following line in a single system configuration file in the "/etc/sysctl.d/" directory: net.ipv4.conf.all.log_martians=1 Load settings from all system configuration files with the following command: $ sudo sysctl --system

b
OL 9 must log IPv4 packets with impossible addresses by default.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-006023
Vuln IDs
V-271867
Rule IDs
SV-271867r1092313_rule
The presence of "martian" packets (which have impossible addresses) as well as spoofed packets, source-routed packets, and redirects could be a sign of nefarious network activity. Logging these packets enables this activity to be detected.
Fix: F-75824r1092312_fix

Configure OL 9 to log martian packets on IPv4 interfaces by default. Add or edit the following line in a single system configuration file in the "/etc/sysctl.d/" directory: net.ipv4.conf.default.log_martians=1 Load settings from all system configuration files with the following command: $ sudo sysctl --system

b
OL 9 must use reverse path filtering on all IPv4 interfaces.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-006024
Vuln IDs
V-271868
Rule IDs
SV-271868r1172845_rule
Enabling reverse path filtering drops packets with source addresses that should not have been able to be received on the interface on which they were received. It must not be used on systems that are routers for complicated networks but is helpful for end hosts and routers serving small networks.
Fix: F-75825r1092315_fix

Configure OL 9 to use reverse path filtering on all IPv4 interfaces. Add or edit the following line in a single system configuration file in the "/etc/sysctl.d/" directory: net.ipv4.conf.all.rp_filter = 1 The system configuration files need to be reloaded for the changes to take effect. To reload the contents of the files, run the following command: $ sudo sysctl --system

b
OL 9 must prevent IPv4 Internet Control Message Protocol (ICMP) redirect messages from being accepted.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-006025
Vuln IDs
V-271869
Rule IDs
SV-271869r1092319_rule
ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular destination. These messages modify the host's route table and are unauthenticated. An illicit ICMP redirect message could result in a man-in-the-middle attack. This feature of the IPv4 protocol has few legitimate uses. It must be disabled unless absolutely required.
Fix: F-75826r1092318_fix

Configure OL 9 to prevent IPv4 ICMP redirect messages from being accepted. Add or edit the following line in a single system configuration file in the "/etc/sysctl.d/" directory: net.ipv4.conf.default.accept_redirects = 0 Load settings from all system configuration files with the following command: $ sudo sysctl --system

b
OL 9 must not forward IPv4 source-routed packets by default.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-006026
Vuln IDs
V-271870
Rule IDs
SV-271870r1092322_rule
Source-routed packets allow the source of the packet to suggest routers forward the packet along a different path than configured on the router, which can be used to bypass network security measures. Accepting source-routed packets in the IPv4 protocol has few legitimate uses. It must be disabled unless it is absolutely required, such as when IPv4 forwarding is enabled and the system is legitimately functioning as a router.
Fix: F-75827r1092321_fix

Configure OL 9 to not forward IPv4 source-routed packets by default. Add or edit the following line in a single system configuration file in the "/etc/sysctl.d/" directory: net.ipv4.conf.default.accept_source_route = 0 Load settings from all system configuration files with the following command: $ sudo sysctl --system

b
OL 9 must use a reverse-path filter for IPv4 network traffic, when possible, by default.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-006027
Vuln IDs
V-271871
Rule IDs
SV-271871r1172843_rule
Enabling reverse path filtering drops packets with source addresses that should not have been able to be received on the interface on which they were received. It must not be used on systems that are routers for complicated networks but is helpful for end hosts and routers serving small networks.
Fix: F-75828r1092324_fix

Configure OL 9 to use reverse path filtering on IPv4 interfaces by default. Add or edit the following line in a single system configuration file in the "/etc/sysctl.d/" directory: net.ipv4.conf.default.rp_filter = 1 Load settings from all system configuration files with the following command: $ sudo sysctl --system

b
OL 9 must not enable IPv4 packet forwarding unless the system is a router.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-006028
Vuln IDs
V-271872
Rule IDs
SV-271872r1092328_rule
Routing protocol daemons are typically used on routers to exchange network topology information with other routers. If this capability is used when not required, system network information may be unnecessarily transmitted across the network.
Fix: F-75829r1092327_fix

Configure OL 9 to not allow IPv4 packet forwarding unless the system is a router. Add or edit the following line in a single system configuration file in the "/etc/sysctl.d/" directory: net.ipv4.conf.all.forwarding = 0 Load settings from all system configuration files with the following command: $ sudo sysctl --system

b
OL 9 must not respond to Internet Control Message Protocol (ICMP) echoes sent to a broadcast address.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-006030
Vuln IDs
V-271873
Rule IDs
SV-271873r1092331_rule
Responding to broadcast (ICMP) echoes facilitates network mapping and provides a vector for amplification attacks. Ignoring ICMP echo requests (pings) sent to broadcast or multicast addresses makes the system slightly more difficult to enumerate on the network.
Fix: F-75830r1092330_fix

Configure OL 9 to not respond to IPv4 ICMP echoes sent to a broadcast address. Add or edit the following line in a single system configuration file in the "/etc/sysctl.d/" directory: net.ipv4.icmp_echo_ignore_broadcasts = 1 Load settings from all system configuration files with the following command: $ sudo sysctl --system

b
OL 9 must limit the number of bogus Internet Control Message Protocol (ICMP) response errors logs.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-006031
Vuln IDs
V-271874
Rule IDs
SV-271874r1092612_rule
Some routers will send responses to broadcast frames that violate RFC-1122, which fills up a log file system with many useless error messages. An attacker may take advantage of this and attempt to flood the logs with bogus error logs. Ignoring bogus ICMP error responses reduces log size, although some activity would not be logged.
Fix: F-75831r1092333_fix

Configure OL 9 to not log bogus ICMP errors: Add or edit the following line in a single system configuration file in the "/etc/sysctl.d/" directory: net.ipv4.icmp_ignore_bogus_error_responses = 1 Load settings from all system configuration files with the following command: $ sudo sysctl --system

b
OL 9 must not send Internet Control Message Protocol (ICMP) redirects.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-006032
Vuln IDs
V-271875
Rule IDs
SV-271875r1092337_rule
ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular destination. These messages contain information from the system's route table possibly revealing portions of the network topology. The ability to send ICMP redirects is only appropriate for systems acting as routers.
Fix: F-75832r1092336_fix

Configure OL 9 to not allow interfaces to perform IPv4 ICMP redirects. Add or edit the following line in a single system configuration file in the "/etc/sysctl.d/" directory: net.ipv4.conf.all.send_redirects = 0 Load settings from all system configuration files with the following command: $ sudo sysctl --system

b
OL 9 must not allow interfaces to perform Internet Control Message Protocol (ICMP) redirects by default.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-006033
Vuln IDs
V-271876
Rule IDs
SV-271876r1092641_rule
ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular destination. These messages contain information from the system's route table possibly revealing portions of the network topology. The ability to send ICMP redirects is only appropriate for systems acting as routers.
Fix: F-75833r1092640_fix

Configure OL 9 to not allow interfaces to perform IPv4 ICMP redirects by default. Add or edit the following line in a single system configuration file in the "/etc/sysctl.d/" directory: net.ipv4.conf.default.send_redirects = 0 Load settings from all system configuration files with the following command: $ sudo sysctl --system

b
OL 9 must not accept router advertisements on all IPv6 interfaces.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-006040
Vuln IDs
V-271877
Rule IDs
SV-271877r1092343_rule
An illicit router advertisement message could result in a man-in-the-middle attack.
Fix: F-75834r1092342_fix

Configure OL 9 to not accept router advertisements on all IPv6 interfaces unless the system is a router. Add or edit the following line in a single system configuration file in the "/etc/sysctl.d/" directory: net.ipv6.conf.all.accept_ra = 0 Load settings from all system configuration files with the following command: $ sudo sysctl --system

b
OL 9 must ignore IPv6 Internet Control Message Protocol (ICMP) redirect messages.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-006041
Vuln IDs
V-271878
Rule IDs
SV-271878r1092346_rule
An illicit ICMP redirect message could result in a man-in-the-middle attack.
Fix: F-75835r1092345_fix

Configure OL 9 to ignore IPv6 ICMP redirect messages. Add or edit the following line in a single system configuration file in the "/etc/sysctl.d/" directory: net.ipv6.conf.all.accept_redirects = 0 Load settings from all system configuration files with the following command: $ sudo sysctl --system

b
OL 9 must not forward IPv6 source-routed packets.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-006042
Vuln IDs
V-271879
Rule IDs
SV-271879r1092349_rule
Source-routed packets allow the source of the packet to suggest that routers forward the packet along a different path than configured on the router, which can be used to bypass network security measures. This requirement applies only to the forwarding of source-routed traffic, such as when forwarding is enabled and the system is functioning as a router.
Fix: F-75836r1092348_fix

Configure OL 9 to not forward IPv6 source-routed packets. Add or edit the following line in a single system configuration file in the "/etc/sysctl.d/" directory: net.ipv6.conf.all.accept_source_route = 0 Load settings from all system configuration files with the following command: $ sudo sysctl --system

b
OL 9 must not enable IPv6 packet forwarding unless the system is a router.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-006043
Vuln IDs
V-271880
Rule IDs
SV-271880r1092352_rule
IP forwarding permits the kernel to forward packets from one network interface to another. The ability to forward packets between two networks is only appropriate for systems acting as routers.
Fix: F-75837r1092351_fix

Configure OL 9 to not allow IPv6 packet forwarding unless the system is a router. Add or edit the following line in a single system configuration file in the "/etc/sysctl.d/" directory: net.ipv6.conf.all.forwarding = 0 Load settings from all system configuration files with the following command: $ sudo sysctl --system

b
OL 9 must not accept router advertisements on all IPv6 interfaces by default.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-006044
Vuln IDs
V-271881
Rule IDs
SV-271881r1092355_rule
An illicit router advertisement message could result in a man-in-the-middle attack.
Fix: F-75838r1092354_fix

Configure OL 9 to not accept router advertisements on all IPv6 interfaces by default unless the system is a router. Add or edit the following line in a single system configuration file in the "/etc/sysctl.d/" directory: net.ipv6.conf.default.accept_ra = 0 Load settings from all system configuration files with the following command: $ sudo sysctl --system

b
OL 9 must prevent IPv6 Internet Control Message Protocol (ICMP) redirect messages from being accepted.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-006045
Vuln IDs
V-271882
Rule IDs
SV-271882r1092358_rule
ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular destination. These messages modify the host's route table and are unauthenticated. An illicit ICMP redirect message could result in a man-in-the-middle attack.
Fix: F-75839r1092357_fix

Configure OL 9 to prevent IPv6 ICMP redirect messages from being accepted. Add or edit the following line in a single system configuration file in the "/etc/sysctl.d/" directory: net.ipv6.conf.default.accept_redirects = 0 Load settings from all system configuration files with the following command: $ sudo sysctl --system

b
OL 9 must not forward IPv6 source-routed packets by default.
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
OL09-00-006046
Vuln IDs
V-271883
Rule IDs
SV-271883r1092361_rule
Source-routed packets allow the source of the packet to suggest that routers forward the packet along a different path than configured on the router, which can be used to bypass network security measures. This requirement applies only to the forwarding of source-routed traffic, such as when forwarding is enabled and the system is functioning as a router. Accepting source-routed packets in the IPv6 protocol has few legitimate uses. It must be disabled unless it is absolutely required.
Fix: F-75840r1092360_fix

Configure OL 9 to not forward IPv6 source-routed packets by default. Add or edit the following line in a single system configuration file in the "/etc/sysctl.d/" directory: net.ipv6.conf.default.accept_source_route = 0 Load settings from all system configuration files with the following command: $ sudo sysctl --system

b
OL 9 must be configured to use TCP syncookies.
RMF Control
SC-5
Severity
M
CCI
CCI-002385
Version
OL09-00-006050
Vuln IDs
V-271884
Rule IDs
SV-271884r1092364_rule
Denial of service (DoS) is a condition when a resource is not available for legitimate users. When this occurs, the organization either cannot accomplish its mission or must operate at degraded capacity. Managing excess capacity ensures that sufficient capacity is available to counter flooding attacks. Employing increased capacity and service redundancy may reduce the susceptibility to some DoS attacks. Managing excess capacity may include, for example, establishing selected usage priorities, quotas, or partitioning. Satisfies: SRG-OS-000420-GPOS-00186, SRG-OS-000142-GPOS-00071
Fix: F-75841r1092363_fix

Configure OL 9 to use TCP syncookies. Add or edit the following line in a system configuration file in the "/etc/sysctl.d/" directory: net.ipv4.tcp_syncookies = 1 Load settings from all system configuration files with the following command: $ sudo sysctl --system

b
OL 9 audit system must protect logon UIDs from unauthorized change.
RMF Control
AU-12
Severity
M
CCI
CCI-000172
Version
OL09-00-008000
Vuln IDs
V-271885
Rule IDs
SV-271885r1092367_rule
If modification of login user identifiers (UIDs) is not prevented, they can be changed by nonprivileged users and make auditing complicated or impossible. Satisfies: SRG-OS-000462-GPOS-00206, SRG-OS-000475-GPOS-00220, SRG-OS-000057-GPOS-00027, SRG-OS-000058-GPOS-00028, SRG-OS-000059-GPOS-00029
Fix: F-75842r1092366_fix

Configure OL 9 auditing to prevent modification of login UIDs once they are set by adding the following line to /etc/audit/rules.d/audit.rules: --loginuid-immutable The audit daemon must be restarted for the changes to take effect. $ sudo service auditd restart

b
OL 9 audit system must protect auditing rules from unauthorized change.
RMF Control
AU-9
Severity
M
CCI
CCI-000162
Version
OL09-00-008005
Vuln IDs
V-271886
Rule IDs
SV-271886r1092370_rule
Unauthorized disclosure of audit records can reveal system and configuration data to attackers, thus compromising its confidentiality. Audit information includes all information (e.g., audit records, audit settings, audit reports) needed to successfully audit OL 9 system activity. In immutable mode, unauthorized users cannot execute changes to the audit system to potentially hide malicious activity and then put the audit rules back. A system reboot would be noticeable, and a system administrator could then investigate the unauthorized changes. Satisfies: SRG-OS-000057-GPOS-00027, SRG-OS-000058-GPOS-00028, SRG-OS-000059-GPOS-00029
Fix: F-75843r1092369_fix

Configure the audit system to set the audit rules to be immutable by adding the following line to end of "/etc/audit/rules.d/audit.rules" -e 2 The audit daemon must be restarted for the changes to take effect. $ sudo service auditd restart

b
OL 9 must audit any script or executable called by cron as root or by any privileged user.
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
OL09-00-002584
Vuln IDs
V-278952
Rule IDs
SV-278952r1135407_rule
Any script or executable called by cron as root or by any privileged user must be owned by that user, must have the permissions 0755 or more restrictive, and should have no extended rights that allow any nonprivileged user to modify the script or executable.
Fix: F-83391r1135405_fix

Configure OL 9 to audit the execution of any system call made by cron as root or as any privileged user. Add or update the following file system rules to "/etc/audit/rules.d/audit.rules": auditctl -w /etc/cron.d/ -p wa -k cronjobs auditctl -w /var/spool/cron/ -p wa -k cronjobs To load the rules to the kernel immediately, use the following command: $ sudo augenrules --load

b
OL 9 must terminate idle user sessions.
RMF Control
SC-10
Severity
M
CCI
CCI-001134
Version
OL09-00-002376
Vuln IDs
V-279935
Rule IDs
SV-279935r1156358_rule
Terminating an idle session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled on the console or console port that has been left unattended.
Fix: F-84400r1156357_fix

Configure OL 9 to log out idle sessions by editing the /etc/systemd/logind.conf file with the following line: StopIdleSessionSec=600 The "logind" service must be restarted for the changes to take effect. To restart the "logind" service, run the following command: $ sudo systemctl restart systemd-logind