Cyber · Trackr The Free Compliance Library
⌘K
DoD Compliance · SCAP

Red Hat Enterprise Linux 10 STIG SCAP Benchmark

V1R0 · · · Published 14 May 2026 · 233 rules
View

Open a previous version of this SCAP benchmark.

This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DOD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.
Sort by
b
RHEL 10 must disable the debug-shell systemd service.
RMF Control
AC-6
Severity
M
CCI
CCI-002235
Version
RHEL-10-700970
Vuln IDs
V-280094
Rule IDs
SV-280094r1184607_rule
The debug-shell requires no authentication and provides root privileges to anyone who has physical access to the machine. While this feature is disabled by default, masking it adds an additional layer of assurance that it will not be enabled via a dependency in systemd. This also prevents attackers with physical access from trivially bypassing security on the machine through valid troubleshooting configurations and gaining root access when the system is rebooted.
Fix: F-84560r1158920_fix

Configure RHEL 10 to mask the debug-shell systemd service with the following command: $ sudo systemctl disable --now debug-shell.service $ sudo systemctl mask --now debug-shell.service

c
RHEL 10 must check the GNU Privacy Guard (GPG) signature of software packages originating from external software repositories before installation.
RMF Control
Severity
H
CCI
CCI-003992
Version
RHEL-10-001030
Vuln IDs
V-280932
Rule IDs
SV-280932r1197215_rule
Changes to any software components can have significant effects on the overall security of the operating system. This requirement ensures the software has not been tampered with and has been provided by a trusted vendor. All software packages must be signed with a cryptographic key recognized and approved by the organization. Verifying the authenticity of software prior to installation validates the integrity of the software package received from a vendor.
Fix: F-85398r1165150_fix

Configure RHEL 10 dnf to always check the GPG signature of software packages originating from external software repositories before installation. Add or update the following line in the [main] section of the "/etc/dnf/dnf.conf" file: gpgcheck=1

c
RHEL 10 must check the GNU Privacy Guard (GPG) signature of locally installed software packages before installation.
RMF Control
Severity
H
CCI
CCI-003992
Version
RHEL-10-001040
Vuln IDs
V-280933
Rule IDs
SV-280933r1197217_rule
Changes to any software components can have significant effects on the overall security of the operating system. This requirement ensures the software has not been tampered with and that it has been provided by a trusted vendor. All software packages must be signed with a cryptographic key recognized and approved by the organization. Verifying the authenticity of software prior to installation validates the integrity of the software package received from a vendor.
Fix: F-85399r1165153_fix

Configure RHEL 10 dnf to always check the GPG signature of local software packages before installation. Add or update the following line in the [main] section of the "/etc/dnf/dnf.conf" file: localpkg_gpgcheck=1

c
RHEL 10 must have GNU Privacy Guard (GPG) signature verification enabled for all software repositories.
RMF Control
Severity
H
CCI
CCI-003992
Version
RHEL-10-001050
Vuln IDs
V-280934
Rule IDs
SV-280934r1165157_rule
Changes to any software components can have significant effects on the overall security of the operating system. This requirement ensures the software has not been tampered with and has been provided by a trusted vendor. All software packages must be signed with a cryptographic key recognized and approved by the organization. Verifying the authenticity of software prior to installation validates the integrity of the software package received from a vendor.
Fix: F-85400r1165156_fix

Configure RHEL 10 software repositories defined in "/etc/yum.repos.d/" to have "gpgcheck" enabled with the following command: $ sudo sed -i 's/gpgcheck\s*=.*/gpgcheck=1/g' /etc/yum.repos.d/*

b
RHEL 10 must use a separate file system for user home directories (such as "/home" or an equivalent).
RMF Control
SC-5
Severity
M
CCI
CCI-002385
Version
RHEL-10-000530
Vuln IDs
V-280937
Rule IDs
SV-280937r1184727_rule
Ensuring that "/home" is mounted on its own partition enables the setting of more restrictive mount options and helps ensure that users cannot trivially fill partitions used for log or audit data storage.
Fix: F-85403r1165165_fix

Configure RHEL 10 to use a separate file system for user home directories by migrating the "/home" directory onto a separate file system/partition.

c
RHEL 10 must not have the "telnet-server" package installed.
RMF Control
CM-7
Severity
H
CCI
CCI-000381
Version
RHEL-10-200020
Vuln IDs
V-280944
Rule IDs
SV-280944r1184749_rule
It is detrimental for operating systems to provide, or install by default, functionality exceeding requirements or mission objectives. These unnecessary capabilities are often overlooked and therefore, may remain unsecure. They increase the risk to the platform by providing additional attack vectors. The telnet service provides an unencrypted remote access service, which does not provide for the confidentiality and integrity of user passwords or the remote session. If a privileged user were to log in using this service, the privileged user password could be compromised. Removing the "telnet-server" package decreases the risk of accidental (or intentional) activation of the telnet service.
Fix: F-85410r1165186_fix

Configure RHEL 10 to not have the "telnet-server" package installed with the following command: $ sudo dnf -y remove telnet-server

c
RHEL 10 must not have the "tftp" package installed.
RMF Control
IA-5
Severity
H
CCI
CCI-000197
Version
RHEL-10-200070
Vuln IDs
V-280949
Rule IDs
SV-280949r1195338_rule
It is detrimental for operating systems to provide, or install by default, functionality exceeding requirements or mission objectives. These unnecessary capabilities are often overlooked and therefore, may remain unsecure. They increase the risk to the platform by providing additional attack vectors. If Trivial File Transfer Protocol (TFTP) is required for operational support (such as transmission of router configurations), its use must be documented with the information system security manager, restricted to only authorized personnel, and have access control rules established.
Fix: F-85415r1165201_fix

Configure RHEL 10 to not have the "tftp" package installed with the following command: $ sudo dnf -y remove tftp

c
RHEL 10 must not have a File Transfer Protocol (FTP) server package installed.
RMF Control
IA-5
Severity
H
CCI
CCI-000197
Version
RHEL-10-200090
Vuln IDs
V-280951
Rule IDs
SV-280951r1184744_rule
The FTP service provides an unencrypted remote access that does not provide for the confidentiality and integrity of user passwords or the remote session. If a privileged user were to log in using this service, the privileged user password could be compromised. Secure Shell (SSH) or other encrypted file transfer methods must be used in place of this service. Removing the "vsftpd" package decreases the risk of accidental activation. Satisfies: SRG-OS-000074-GPOS-00042, SRG-OS-000095-GPOS-00049
Fix: F-85417r1165207_fix

Configure RHEL 10 to not have the FTP package installed with the following command (using "vsftpd" as an example): $ sudo dnf -y remove vsftpd

b
RHEL 10 must enable the "fapolicy" module.
RMF Control
CM-7
Severity
M
CCI
CCI-001774
Version
RHEL-10-200601
Vuln IDs
V-280970
Rule IDs
SV-280970r1165265_rule
The organization must identify authorized software programs and permit execution of authorized software. The process used to identify software programs that are authorized to execute on organizational information systems is commonly referred to as allowlisting. Using an allowlist provides a configuration management method for allowing the execution of only authorized software. Using only authorized software decreases risk by limiting the number of potential vulnerabilities. Verification of allowlisted software occurs prior to execution or at system startup. User home directories/folders may contain information of a sensitive nature. Nonprivileged users should coordinate any sharing of information with a system administrator through shared resources. RHEL 10 ships with many optional packages. One such package is a file access policy daemon called "fapolicyd". The "fapolicyd" is a userspace daemon that determines access rights to files based on attributes of the process and file. It can be used to either blocklist or allowlist processes or file access. Proceed with caution with enforcing the use of this daemon. Improper configuration may render the system nonfunctional. The "fapolicyd" application programming interface (API) is not namespace aware and can cause issues when launching or running containers. Satisfies: SRG-OS-000370-GPOS-00155, SRG-OS-000368-GPOS-00154
Fix: F-85436r1165264_fix

Configure RHEL 10 to enable "fapolicyd" with the following command: $ systemctl enable --now fapolicyd

b
RHEL 10 must be configured to employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs.
RMF Control
CM-7
Severity
M
CCI
CCI-001764
Version
RHEL-10-200602
Vuln IDs
V-280971
Rule IDs
SV-280971r1184780_rule
The organization must identify authorized software programs and permit execution of authorized software. The process used to identify software programs that are authorized to execute on organizational information systems is commonly referred to as allowlisting. Using an allowlist provides a configuration management method for allowing the execution of only authorized software. Using only authorized software decreases risk by limiting the number of potential vulnerabilities. Verification of allowlisted software occurs prior to execution or at system startup. User home directories/folders may contain information of a sensitive nature. Nonprivileged users should coordinate any sharing of information with a system administrator through shared resources. RHEL 10 ships with many optional packages. One such package is a file access policy daemon called "fapolicyd". The "fapolicyd" is a userspace daemon that determines access rights to files based on attributes of the process and file. It can be used to either block list or allowlist processes or file access. Proceed with caution with enforcing the use of this daemon. Improper configuration may render the system nonfunctional. The "fapolicyd" application programming interface (API) is not namespace aware and can cause issues when launching or running containers. Satisfies: SRG-OS-000368-GPOS-00154, SRG-OS-000370-GPOS-00155
Fix: F-85437r1184779_fix

Configure RHEL 10 to employ a deny-all, permit-by-exception application allow listing policy with "fapolicyd". With the "fapolicyd" installed and enabled, configure the daemon to function in permissive mode until the allow list is built correctly to avoid system lockout. Do this by editing the "/etc/fapolicyd/fapolicyd.conf" file with the following line: permissive = 1 Build the allow list in a file within the "/etc/fapolicyd/rules.d" directory, ensuring the last rule implements a deny-all policy, such as "deny perm=any all : all". Once it is determined the allow list is built correctly, set the "fapolicyd" to enforcing mode by editing the "permissive" line in the /etc/fapolicyd/fapolicyd.conf file. permissive = 0

b
RHEL 10 must have the "pcsc-lite" package installed.
RMF Control
Severity
M
CCI
CCI-004046
Version
RHEL-10-200610
Vuln IDs
V-280972
Rule IDs
SV-280972r1195360_rule
The "pcsc-lite" package must be installed if it is to be available for multifactor authentication using smart cards.
Fix: F-85438r1165270_fix

Configure RHEL 10 to have the "pcsc-lite" package installed with the following command: $ sudo dnf -y install pcsc-lite

b
RHEL 10 must have the "pcscd" socket set to active.
RMF Control
Severity
M
CCI
CCI-004046
Version
RHEL-10-200611
Vuln IDs
V-280973
Rule IDs
SV-280973r1208793_rule
The information system ensures that even if the information system is compromised, that compromise will not affect credentials stored on the authentication device. The daemon program for pcsc-lite and the MuscleCard framework is pcscd. It is a resource manager that coordinates communications with smart card readers and smart cards and cryptographic tokens that are connected to the system.
Fix: F-85439r1165273_fix

Configure RHEL 10 to have the "pcscd" socket set to active with the following command: $ sudo systemctl enable --now pcscd.socket

b
RHEL 10 must have the "pcsc-lite-ccid" package installed.
RMF Control
Severity
M
CCI
CCI-004046
Version
RHEL-10-200612
Vuln IDs
V-280974
Rule IDs
SV-280974r1195362_rule
The "pcsc-lite-ccid" package must be installed if it is to be available for multifactor authentication using smart cards.
Fix: F-85440r1165276_fix

Configure RHEL 10 to have the "pcsc-lite-ccid" package installed with the following command: $ sudo dnf -y install pcsc-lite-ccid

b
RHEL 10 must have the "opensc" package installed.
RMF Control
Severity
M
CCI
CCI-004046
Version
RHEL-10-200620
Vuln IDs
V-280975
Rule IDs
SV-280975r1195364_rule
The use of Personal Identity Verification (PIV) credentials facilitates standardization and reduces the risk of unauthorized access. The DOD has mandated the use of the common access card (CAC) to support identity management and personal authentication for systems covered under Homeland Security Presidential Directive (HSPD) 12, as well as making the CAC a primary component of layered protection for national security systems. Satisfies: SRG-OS-000375-GPOS-00160, SRG-OS-000376-GPOS-00161
Fix: F-85441r1165279_fix

Configure RHEL 10 to have the "opensc" package installed with the following command: $ sudo dnf -y install opensc

b
RHEL 10 must use the common access card (CAC) smart card driver.
RMF Control
IA-2
Severity
M
CCI
CCI-000764
Version
RHEL-10-200621
Vuln IDs
V-280976
Rule IDs
SV-280976r1165283_rule
Smart card login provides two-factor authentication stronger than that provided by a username and password combination. Smart cards leverage public key infrastructure to provide and verify credentials. Configuring the smart card driver helps to prevent the use of unauthorized smart cards. Satisfies: SRG-OS-000104-GPOS-00051, SRG-OS-000106-GPOS-00053, SRG-OS-000107-GPOS-00054, SRG-OS-000109-GPOS-00056, SRG-OS-000108-GPOS-00055
Fix: F-85442r1165282_fix

Configure RHEL 10 to load the CAC driver: $ sudo opensc-tool --set-conf-entry app:default:card_drivers:cac Restart the pcscd service with the following command for the changes to take effect: $ sudo systemctl restart pcscd

b
RHEL 10 must have the Advanced Intrusion Detection Environment (AIDE) package installed.
RMF Control
SI-6
Severity
M
CCI
CCI-002696
Version
RHEL-10-200630
Vuln IDs
V-280977
Rule IDs
SV-280977r1195366_rule
Without verification of the security functions, security functions may not operate correctly, and the failure may go unnoticed. Security function is defined as the hardware, software, and/or firmware of the information system responsible for enforcing the system security policy and supporting the isolation of code and data on which the protection is based. Security functionality includes, but is not limited to, establishing system accounts, configuring access authorizations (e.g., permissions, privileges), setting events to be audited, and setting intrusion detection parameters.
Fix: F-85443r1184613_fix

Configure RHEL 10 so that "AIDE" is installed and initialized, and then perform a manual check. Install AIDE: $ sudo dnf -y install aide Initialize AIDE: $ sudo /usr/sbin/aide --init Example output: Start timestamp: 2025-04-03 10:09:04 -0600 (AIDE 0.16) AIDE initialized database at /var/lib/aide/aide.db.new.gz Number of entries: 86833 --------------------------------------------------- The attributes of the (uncompressed) database(s): --------------------------------------------------- /var/lib/aide/aide.db.new.gz MD5 : coZUtPHhoFoeD7+k54fUvQ== SHA1 : DVpOEMWJwo0uPgrKZAygIUgSxeM= SHA256 : EQiZH0XNEk001tcDmJa+5STFEjDb4MPE TGdBJ/uvZKc= SHA512 : 86KUqw++PZhoPK0SZvT3zuFq9yu9nnPP toei0nENVELJ1LPurjoMlRig6q69VR8l +44EwO9eYyy9nnbzQsfG1g== End timestamp: 2025-04-03 10:09:57 -0600 (run time: 0m 53s) The new database must be renamed to be read by AIDE: $ sudo mv /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz Perform a manual check: $ sudo /usr/sbin/aide --check Example output: 2025-04-03 10:16:08 -0600 (AIDE 0.16) AIDE found NO differences between database and filesystem. Looks okay!! ...

c
RHEL 10 must use cryptographic mechanisms to protect the integrity of audit tools.
RMF Control
AU-9
Severity
H
CCI
CCI-001496
Version
RHEL-10-200631
Vuln IDs
V-280978
Rule IDs
SV-280978r1165289_rule
Protecting the integrity of the tools used for auditing purposes is a critical step toward ensuring the integrity of audit information. Audit information includes all information (e.g., audit records, audit settings, and audit reports) needed to successfully audit information system activity. Audit tools include, but are not limited to, vendor-provided and open-source audit tools needed to successfully view and manipulate audit information system activity and records. Audit tools include custom queries and report generators. It is not uncommon for attackers to replace the audit tools or inject code into the existing tools to provide the capability to hide or erase system activity from the audit logs. To address this risk, audit tools must be cryptographically signed to provide the capability to identify when the audit tools have been modified, manipulated, or replaced. An example is a checksum hash of the file or files.
Fix: F-85444r1165288_fix

Configure RHEL 10 to use cryptographic mechanisms to protect the integrity of audit tools. Add or update the following lines to "/etc/aide.conf" to protect the integrity of the audit tools. /usr/sbin/auditctl p+i+n+u+g+s+b+acl+xattrs+sha512 /usr/sbin/auditd p+i+n+u+g+s+b+acl+xattrs+sha512 /usr/sbin/ausearch p+i+n+u+g+s+b+acl+xattrs+sha512 /usr/sbin/aureport p+i+n+u+g+s+b+acl+xattrs+sha512 /usr/sbin/augenrules p+i+n+u+g+s+b+acl+xattrs+sha512

b
RHEL 10 must have the "rsyslog" package installed.
RMF Control
AU-4
Severity
M
CCI
CCI-001851
Version
RHEL-10-200640
Vuln IDs
V-280983
Rule IDs
SV-280983r1195368_rule
The "rsyslogd" is a system utility providing support for message logging. Support for both internet and Unix domain sockets enables this utility to support local and remote logging. Couple this utility with "gnutls" (which is a secure communications library implementing the Secure Sockets Layer [SSL], Transport Layer Security [TLS], and Datagram TLS [DTLS] protocols), to create a method to securely encrypt and off-load auditing. Satisfies: SRG-OS-000479-GPOS-00224, SRG-OS-000051-GPOS-00024
Fix: F-85449r1165303_fix

Configure RHEL 10 to have the "rsyslogd" package installed with the following command: $ sudo dnf -y install rsyslogd

b
RHEL 10 must have the rsyslog service set to active.
RMF Control
AU-3
Severity
M
CCI
CCI-000133
Version
RHEL-10-200641
Vuln IDs
V-280984
Rule IDs
SV-280984r1165307_rule
The rsyslog service must be running to provide logging services, which are essential to system administration.
Fix: F-85450r1165306_fix

Configure RHEL 10 to enable the rsyslog service with the following command: $ sudo systemctl enable --now rsyslog

b
RHEL 10 must be configured to forward audit records via Transmission Control Protocol (TCP) to a different system or media from the system being audited via rsyslog.
RMF Control
AU-4
Severity
M
CCI
CCI-001851
Version
RHEL-10-200642
Vuln IDs
V-280985
Rule IDs
SV-280985r1197221_rule
Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Off-loading is a common process in information systems with limited audit storage capacity. RHEL 10 installation media provides "rsyslogd", a system utility providing support for message logging. Support for both internet and Unix domain sockets enables this utility to support both local and remote logging. Coupling this utility with "gnutls" (a secure communications library implementing the Secure Sockets Layer [SSL], Transport Layer Security [TLS], and Datagram TLS [DTLS] protocols) creates a method to securely encrypt and off-load auditing. The rsyslog provides three ways to forward message: the traditional User Datagram Protocol (UDP) transport, which is extremely lossy but standard; the plain TCP-based transport, which loses messages only during certain situations but is widely available; and the Reliable Event Logging Protocol (RELP) transport, which does not lose messages but is currently available only as part of the rsyslogd 3.15.0 and above. Examples of each configuration: UDP *.* @remotesystemname TCP *.* @@remotesystemname RELP *.* :omrelp:remotesystemname:2514 Note that a port number was given as there is no standard port for RELP.
Fix: F-85451r1184701_fix

Configure RHEL 10 to off-load audit records onto a different system or media from the system being audited via TCP using rsyslog by specifying the remote logging server in "/etc/rsyslog.conf" or "/etc/rsyslog.d/[customfile].conf" with the name or IP address of the log aggregation server. Using legacy "@host:port" syntax example: *.* @@[remoteloggingserver]:[port] Using Rainer script example: action( type="omfwd" target="logserver.example.com" port="514" protocol="tcp" action.resumeRetryCount="-1" queue.type="linkedList" que.size="10000" ) Note: The Rainer script above does not contain the required encryption settings.

b
RHEL 10 must be configured so that the rsyslog daemon does not accept log messages from other servers unless the server is being used for log aggregation.
RMF Control
SC-5
Severity
M
CCI
CCI-002385
Version
RHEL-10-200643
Vuln IDs
V-280986
Rule IDs
SV-280986r1184782_rule
Unintentionally running a rsyslog server accepting remote messages puts the system at increased risk. Malicious rsyslog messages sent to the server could exploit vulnerabilities in the server software, introduce misleading information into the system's logs, or fill the system's storage, leading to a denial of service. If the system is intended to be a log aggregation server, its use must be documented with the information system security officer.
Fix: F-85452r1165312_fix

Configure RHEL 10 to not receive remote logs using rsyslog. Remove the lines in "/etc/rsyslog.conf" and any files in the "/etc/rsyslog.d" directory that match any of the following: InputTCPServerRun UDPServerRun RELPServerRun module(load="imtcp") module(load="imudp") module(load="imrelp") input(type="imudp" port="514") input(type="imtcp" port="514") input(type="imrelp" port="514") Restart the rsyslog daemon with the following command for the changes to take effect: $ sudo systemctl restart rsyslog.service

b
RHEL 10 must monitor all remote access methods.
RMF Control
AC-17
Severity
M
CCI
CCI-000067
Version
RHEL-10-200647
Vuln IDs
V-280990
Rule IDs
SV-280990r1165325_rule
Logging remote access methods can be used to trace the decrease in the risks associated with remote user access management. It can also be used to spot cyberattacks and ensure ongoing compliance with organizational policies surrounding the use of remote access methods.
Fix: F-85456r1165324_fix

Configure RHEL 10 to monitor all remote access methods. Add or update the following lines to the "/etc/rsyslog.conf" file or a file in "/etc/rsyslog.d": auth.*;authpriv.*;daemon.* /var/log/secure Restart the "rsyslog" service with the following command for the changes to take effect: $ sudo systemctl restart rsyslog.service

b
RHEL 10 must have the packages required for encrypting off-loaded audit logs installed.
RMF Control
IA-7
Severity
M
CCI
CCI-000803
Version
RHEL-10-200650
Vuln IDs
V-280992
Rule IDs
SV-280992r1195379_rule
The "rsyslog-gnutls" package provides Transport Layer Security (TLS) support for the rsyslog daemon, which enables secure remote logging.
Fix: F-85458r1165330_fix

Configure RHEL 10 to have the "rsyslog-gnutls" package installed with the following command: $ sudo dnf -y install rsyslog-gnutls

b
RHEL 10 must have the "audit" package installed.
RMF Control
AU-12
Severity
M
CCI
CCI-000169
Version
RHEL-10-200660
Vuln IDs
V-280993
Rule IDs
SV-280993r1195381_rule
Without establishing what type of events occurred, along with the source, location, and outcome, it would be difficult to establish, correlate, and investigate the events leading up to an outage or attack. Audit record content that may be necessary to satisfy this requirement includes, for example, time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, filenames involved, and access control or flow control rules invoked. Associating event types with detected events in audit logs provides a means of investigating an attack, recognizing resource utilization or capacity thresholds, or identifying an improperly configured RHEL 10 system. Satisfies: SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220
Fix: F-85459r1165333_fix

Configure RHEL 10 to have the "audit" service package installed with the following command: $ sudo dnf -y install audit

b
RHEL 10 must enable the audit service.
RMF Control
AU-12
Severity
M
CCI
CCI-000169
Version
RHEL-10-200661
Vuln IDs
V-280994
Rule IDs
SV-280994r1165337_rule
Without establishing what type of events occurred, it would be difficult to establish, correlate, and investigate the events leading up to an outage or attack. Ensuring the auditd service is active ensures audit records generated by the kernel are appropriately recorded. Additionally, a properly configured audit subsystem ensures that actions of individual system users can be uniquely traced to those users so they can be held accountable for their actions. Satisfies: SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220
Fix: F-85460r1165336_fix

Configure RHEL 10 to enable the auditd service with the following command: $ sudo systemctl enable --now auditd

b
RHEL 10 must have the "libreswan" package installed.
RMF Control
IA-7
Severity
M
CCI
CCI-000803
Version
RHEL-10-200680
Vuln IDs
V-280996
Rule IDs
SV-280996r1195385_rule
Providing the ability for remote users or systems to initiate a secure virtual private network connection protects information when it is transmitted over a wide area network.
Fix: F-85462r1165342_fix

Configure RHEL 10 to have the "libreswan" service package installed with the following command: $ sudo dnf -y install libreswan

b
RHEL 10 must be configured to prevent unrestricted mail relaying.
RMF Control
CM-7
Severity
M
CCI
CCI-000381
Version
RHEL-10-200692
Vuln IDs
V-280999
Rule IDs
SV-280999r1165352_rule
If unrestricted mail relaying is permitted, unauthorized senders could use this host as a mail relay to send spam or for other unauthorized activity.
Fix: F-85465r1165351_fix

Configure RHEL 10 so that the postfix configuration file restricts client connections to the local network with the following command: $ sudo postconf -e 'smtpd_client_restrictions = permit_mynetworks,reject'

b
RHEL 10 must have the "cronie" package installed.
RMF Control
CM-7
Severity
M
CCI
CCI-000381
Version
RHEL-10-200700
Vuln IDs
V-281000
Rule IDs
SV-281000r1195389_rule
The "cronie" package must be installed if it is to be available for multifactor authentication using smart cards.
Fix: F-85466r1165354_fix

Configure RHEL 10 to have the "cronie" package installed with the following command: $ sudo dnf -y install cronie

b
RHEL 10 must, for all networked systems, have and implement Secure Shell (SSH) to protect the confidentiality and integrity of transmitted and received information.
RMF Control
SC-8
Severity
M
CCI
CCI-002418
Version
RHEL-10-200721
Vuln IDs
V-281002
Rule IDs
SV-281002r1184641_rule
Without protection of the transmitted information, confidentiality and integrity may be compromised because unprotected communications can be intercepted and either read or altered. This requirement applies to both internal and external networks and all types of information system components from which information can be transmitted (e.g., servers, mobile devices, notebook computers, printers, copiers, scanners, and facsimile machines). Communication paths outside the physical protection of a controlled boundary are exposed to the possibility of interception and modification. Protecting the confidentiality and integrity of organizational information can be accomplished by physical means (e.g., employing physical distribution systems) or logical means (e.g., employing cryptographic techniques). If physical means of protection are employed, then logical means (cryptography) do not have to be employed, and vice versa. Satisfies: SRG-OS-000423-GPOS-00187, SRG-OS-000424-GPOS-00188, SRG-OS-000425-GPOS-00189, SRG-OS-000426-GPOS-00190
Fix: F-85468r1165360_fix

Configure RHEL 10 to enable the sshd service by running the following command: $ systemctl enable --now sshd

b
RHEL 10 must have the "openssh-clients" package installed.
RMF Control
CM-7
Severity
M
CCI
CCI-000381
Version
RHEL-10-200722
Vuln IDs
V-281003
Rule IDs
SV-281003r1195393_rule
This package includes utilities to make encrypted connections and transfer files securely to Secure Shell (SSH) servers.
Fix: F-85469r1165363_fix

Configure RHEL 10 to have the "openssh-clients" package installed with the following command: $ sudo dnf -y install openssh-clients

b
RHEL 10 must have the "pkcs11-provider" package installed.
RMF Control
IA-2
Severity
M
CCI
CCI-000765
Version
RHEL-10-200730
Vuln IDs
V-281005
Rule IDs
SV-281005r1195395_rule
Without the use of multifactor authentication, the ease of access to privileged functions is greatly increased. Multifactor authentication requires using two or more factors to achieve authentication. A privileged account is defined as an information system account with authorizations of a privileged user. The DOD common access card (CAC) with DOD-approved PKI is an example of multifactor authentication. Satisfies: SRG-OS-000105-GPOS-00052, SRG-OS-000375-GPOS-00160, SRG-OS-000377-GPOS-00162
Fix: F-85471r1165369_fix

Configure RHEL 10 to have the "openssl-pkcs11" package installed with the following command: $ sudo dnf -y install pkcs11-provider

b
RHEL 10 must have the "gnutls-utils" package installed.
RMF Control
CM-7
Severity
M
CCI
CCI-000381
Version
RHEL-10-200740
Vuln IDs
V-281006
Rule IDs
SV-281006r1195397_rule
"GnuTLS" is a secure communications library implementing the Secure Sockets Layer (SSL), Transport Layer Security (TLS), and Datagram TLS (DTLS) protocols and technologies around them. It provides a simple C language application programming interface (API) to access the secure communications protocols as well as APIs to parse and write X.509, PKCS #12, OpenPGP, and other required structures. This package contains command line TLS client and server and certificate manipulation tools.
Fix: F-85472r1165372_fix

Configure RHEL 10 to have the "gnutls-utils" package installed with the following command: $ sudo dnf -y install gnutls-utils

c
RHEL 10 must have the "crypto-policies" package installed.
RMF Control
SC-13
Severity
H
CCI
CCI-002450
Version
RHEL-10-300000
Vuln IDs
V-281007
Rule IDs
SV-281007r1195399_rule
Centralized cryptographic policies simplify applying secure ciphers across an operating system and the applications that run on that operating system. Use of weak or untested encryption algorithms undermines the purposes of using encryption to protect data. Satisfies: SRG-OS-000396-GPOS-00176, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174
Fix: F-85473r1165375_fix

Configure RHEL 10 to have the "crypto-policies" package installed with the following command: $ sudo dnf -y install crypto-policies

c
RHEL 10 must enable FIPS mode.
RMF Control
AC-17
Severity
H
CCI
CCI-000068
Version
RHEL-10-000500
Vuln IDs
V-281009
Rule IDs
SV-281009r1184724_rule
Use of weak or untested encryption algorithms undermines the purposes of using encryption to protect data. The operating system must implement cryptographic modules adhering to the higher standards approved by the federal government because this provides assurance they have been tested and validated. Satisfies: SRG-OS-000033-GPOS-00014, SRG-OS-000125-GPOS-00065, SRG-OS-000250-GPOS-00093, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174, SRG-OS-000396-GPOS-00176, SRG-OS-000423-GPOS-00187, SRG-OS-000478-GPOS-00223
Fix: F-85475r1184723_fix

Configure RHEL 10 to implement FIPS mode. If this check fails on an installed system, it is a permanent finding until the system is reinstalled with "fips=1" during installation. Red Hat 10 does not support switching to strict FIPS mode after installation.

c
RHEL 10 must be configured so that Secure Shell (SSH) clients use only DOD-approved encryption ciphers employing FIPS 140-3-validated cryptographic hash algorithms to protect the confidentiality of SSH client connections.
RMF Control
AC-17
Severity
H
CCI
CCI-000068
Version
RHEL-10-300030
Vuln IDs
V-281010
Rule IDs
SV-281010r1184643_rule
Without cryptographic integrity protections, information can be altered by unauthorized users without detection. Remote access (e.g., Remote Desktop Protocol [RDP]) is access to DOD nonpublic information systems by an authorized user (or an information system) communicating through an external, nonorganizational-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless. Cryptographic mechanisms used for protecting the integrity of information include, for example, signed hash functions that use asymmetric cryptography. This enables distribution of the public key to verify the hash information while maintaining the confidentiality of the secret key used to generate the hash. RHEL 10 incorporates systemwide crypto policies by default. The SSH configuration file has no effect on the ciphers, MACs, or algorithms unless specifically defined in the "/etc/sysconfig/sshd" file. The employed algorithms can be viewed in the "/etc/crypto-policies/back-ends/openssh.config" file. Satisfies: SRG-OS-000033-GPOS-00014, SRG-OS-000125-GPOS-00065, SRG-OS-000250-GPOS-00093, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174, SRG-OS-000423-GPOS-00187
Fix: F-85476r1165384_fix

Configure RHEL 10 SSH clients to use only ciphers employing FIPS 140-3-approved algorithms. Reinstall crypto-policies with the following command: $ sudo dnf -y reinstall crypto-policies Set the crypto-policy to FIPS with the following command: $ sudo update-crypto-policies --set FIPS Setting system policy to FIPS Note: Systemwide crypto policies are applied on application startup. It is recommended to restart the system for the change of policies to fully take place.

c
RHEL 10 must be configured so that Secure Shell (SSH) servers use only DOD-approved encryption ciphers employing FIPS 140-3-validated cryptographic hash algorithms to protect the confidentiality of SSH server connections.
RMF Control
MA-4
Severity
H
CCI
CCI-000877
Version
RHEL-10-300040
Vuln IDs
V-281011
Rule IDs
SV-281011r1184644_rule
Without cryptographic integrity protections, unauthorized users can alter information without detection. Remote access (e.g., Remote Desktop Protocol [RDP]) is access to DOD nonpublic information systems by an authorized user (or an information system) communicating through an external, nonorganizational-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless. Cryptographic mechanisms used for protecting the integrity of information include, for example, signed hash functions that use asymmetric cryptography. This enables distribution of the public key to verify the hash information while maintaining the confidentiality of the secret key used to generate the hash. RHEL 10 incorporates systemwide crypto policies by default. The SSH configuration file has no effect on the ciphers, MACs, or algorithms unless specifically defined in the "/etc/sysconfig/sshd" file. The employed algorithms can be viewed in the "/etc/crypto-policies/back-ends/opensshserver.config" file. Satisfies: SRG-OS-000125-GPOS-00065, SRG-OS-000250-GPOS-00093
Fix: F-85477r1165387_fix

Configure RHEL 10 SSH servers to use only ciphers employing FIPS 140-3-approved algorithms. Reinstall crypto-policies with the following command: $ sudo dnf -y reinstall crypto-policies Set the crypto-policy to FIPS with the following command: $ sudo update-crypto-policies --set FIPS Setting system policy to FIPS Note: Systemwide crypto policies are applied on application startup. It is recommended to restart the system for the change of policies to fully take place.

c
RHEL 10 must be configured so that Secure Shell (SSH) clients use only DOD-approved Message Authentication Codes (MACs) employing FIPS 140-3-validated cryptographic hash algorithms to protect the confidentiality of SSH client connections.
RMF Control
MA-4
Severity
H
CCI
CCI-000877
Version
RHEL-10-300050
Vuln IDs
V-281012
Rule IDs
SV-281012r1184645_rule
Without cryptographic integrity protections, information can be altered by unauthorized users without detection. Remote access (e.g., Remote Desktop Protocol [RDP]) is access to DOD nonpublic information systems by an authorized user (or an information system) communicating through an external, nonorganizational-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless. Cryptographic mechanisms used for protecting the integrity of information include, for example, signed hash functions that use asymmetric cryptography. This enables distribution of the public key to verify the hash information while maintaining the confidentiality of the secret key used to generate the hash. RHEL 10 incorporates systemwide crypto policies by default. The SSH configuration file has no effect on the ciphers, MACs, or algorithms unless specifically defined in the "/etc/sysconfig/sshd" file. The employed algorithms can be viewed in the "/etc/crypto-policies/back-ends/openssh.config" file. Satisfies: SRG-OS-000125-GPOS-00065, SRG-OS-000250-GPOS-00093
Fix: F-85478r1165390_fix

Configure RHEL 10 SSH clients to use only MACs employing FIPS 140-3-approved algorithms. Reinstall crypto-policies with the following command: $ sudo dnf -y reinstall crypto-policies Set the crypto-policy to FIPS with the following command: $ sudo update-crypto-policies --set FIPS Setting system policy to FIPS Note: Systemwide crypto policies are applied on application startup. It is recommended to restart the system for the change of policies to fully take place.

c
RHEL 10 must be configured so that Secure Shell (SSH) servers use only DOD-approved Message Authentication Codes (MACs) employing FIPS 140-3-validated cryptographic hash algorithms to protect the confidentiality of SSH server connections.
RMF Control
MA-4
Severity
H
CCI
CCI-000877
Version
RHEL-10-300060
Vuln IDs
V-281013
Rule IDs
SV-281013r1184646_rule
Without cryptographic integrity protections, information can be altered by unauthorized users without detection. Remote access (e.g., Remote Desktop Protocol [RDP]) is access to DOD nonpublic information systems by an authorized user (or an information system) communicating through an external, nonorganization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless. Cryptographic mechanisms used for protecting the integrity of information include, for example, signed hash functions using asymmetric cryptography enabling distribution of the public key to verify the hash information while maintaining the confidentiality of the secret key used to generate the hash. RHEL 10 incorporates systemwide crypto policies by default. The SSH configuration file has no effect on the ciphers, MACs, or algorithms unless specifically defined in the "/etc/sysconfig/sshd" file. The employed algorithms can be viewed in the "/etc/crypto-policies/back-ends/opensshserver.config" file. Satisfies: SRG-OS-000125-GPOS-00065, SRG-OS-000250-GPOS-00093
Fix: F-85479r1165393_fix

Configure RHEL 10 SSH servers to use only MACs employing FIPS 140-3-approved algorithms. Reinstall crypto-policies with the following command: $ sudo dnf -y reinstall crypto-policies Set the crypto-policy to FIPS with the following command: $ sudo update-crypto-policies --set FIPS Setting system policy to FIPS Note: Systemwide crypto policies are applied on application startup. It is recommended to restart the system for the change of policies to fully take place.

c
RHEL 10 must use FIPS 140-3-approved cryptographic algorithms for IP tunnels.
RMF Control
AC-17
Severity
H
CCI
CCI-000068
Version
RHEL-10-300070
Vuln IDs
V-281014
Rule IDs
SV-281014r1165397_rule
Overriding the systemwide cryptographic policy makes the behavior of the Libreswan service violate expectations and makes system configuration more fragmented.
Fix: F-85480r1165396_fix

Configure RHEL 10 so that Libreswan uses the systemwide cryptographic policy. Add the following line to "/etc/ipsec.conf": include /etc/crypto-policies/back-ends/libreswan.config

c
RHEL 10 must implement DOD-approved encryption in the bind package.
RMF Control
SC-8
Severity
H
CCI
CCI-002418
Version
RHEL-10-300080
Vuln IDs
V-281015
Rule IDs
SV-281015r1184783_rule
Without cryptographic integrity protections, information can be altered by unauthorized users without detection. Cryptographic mechanisms used for protecting the integrity of information include, for example, signed hash functions using asymmetric cryptography enabling distribution of the public key to verify the hash information while maintaining the confidentiality of the secret key used to generate the hash. RHEL 10 incorporates systemwide crypto policies by default. The employed algorithms can be viewed in the "/etc/crypto-policies/back-ends/" directory. Satisfies: SRG-OS-000423-GPOS-00187, SRG-OS-000426-GPOS-00190
Fix: F-85481r1165399_fix

Configure RHEL 10 BIND to use the systemwide cryptographic policy. Add the following line to the "options" section in "/etc/named.conf": include "/etc/crypto-policies/back-ends/bind.config";

b
RHEL 10 must be configured so that the "/etc/group" file is group-owned by "root".
RMF Control
AC-3
Severity
M
CCI
CCI-000213
Version
RHEL-10-400005
Vuln IDs
V-281018
Rule IDs
SV-281018r1165409_rule
The "/etc/group" file contains information regarding groups that are configured on the system. Protection of this file is important for system security.
Fix: F-85484r1165408_fix

Configure RHEL 10 so that the group of the file "/etc/group" is set to "root" by running the following command: $ sudo chgrp root /etc/group

b
RHEL 10 must be configured so that the "/etc/group-" file is owned by "root".
RMF Control
AC-3
Severity
M
CCI
CCI-000213
Version
RHEL-10-400010
Vuln IDs
V-281019
Rule IDs
SV-281019r1165412_rule
The "/etc/group-" file is a backup file of "/etc/group", and as such contains information regarding groups that are configured on the system. Protection of this file is important for system security.
Fix: F-85485r1165411_fix

Configure RHEL 10 so that the owner of the "/etc/group-" file is set to "root" by running the following command: $ sudo chown root /etc/group-

b
RHEL 10 must be configured so that the "/etc/group-" file is group-owned by "root".
RMF Control
AC-3
Severity
M
CCI
CCI-000213
Version
RHEL-10-400015
Vuln IDs
V-281020
Rule IDs
SV-281020r1165415_rule
The "/etc/group-" file is a backup file of "/etc/group", and as such contains information regarding groups that are configured on the system. Protection of this file is important for system security.
Fix: F-85486r1165414_fix

Configure RHEL 10 so that the group of the "/etc/group-" file is set to "root" by running the following command: $ sudo chgrp root /etc/group-

b
RHEL 10 must be configured so that the "/etc/gshadow" file is owned by "root".
RMF Control
AC-3
Severity
M
CCI
CCI-000213
Version
RHEL-10-400020
Vuln IDs
V-281021
Rule IDs
SV-281021r1165418_rule
The "/etc/gshadow" file contains group password hashes. Protection of this file is critical for system security.
Fix: F-85487r1165417_fix

Configure RHEL 10 so that the owner of the file "/etc/gshadow" is set to "root" by running the following command: $ sudo chown root /etc/gshadow

b
RHEL 10 must be configured so that the "/etc/gshadow" file is group-owned by "root".
RMF Control
AC-3
Severity
M
CCI
CCI-000213
Version
RHEL-10-400025
Vuln IDs
V-281022
Rule IDs
SV-281022r1165421_rule
The "/etc/gshadow" file contains group password hashes. Protection of this file is critical for system security.
Fix: F-85488r1165420_fix

Configure RHEL 10 so that the group of the "/etc/gshadow" file is set to "root" by running the following command: $ sudo chgrp root /etc/gshadow

b
RHEL 10 must be configured so that the "/etc/gshadow-" file is owned by "root".
RMF Control
AC-3
Severity
M
CCI
CCI-000213
Version
RHEL-10-400030
Vuln IDs
V-281023
Rule IDs
SV-281023r1165424_rule
The "/etc/gshadow-" file is a backup of "/etc/gshadow", and as such contains group password hashes. Protection of this file is critical for system security.
Fix: F-85489r1165423_fix

Configure RHEL 10 so that the owner of the "/etc/gshadow-" file is set to "root" by running the following command: $ sudo chown root /etc/gshadow-

b
RHEL 10 must be configured so that the "/etc/gshadow-" file is group-owned by "root".
RMF Control
AC-3
Severity
M
CCI
CCI-000213
Version
RHEL-10-400035
Vuln IDs
V-281024
Rule IDs
SV-281024r1165427_rule
The "/etc/gshadow-" file is a backup of "/etc/gshadow", and as such contains group password hashes. Protection of this file is critical for system security.
Fix: F-85490r1165426_fix

Configure RHEL 10 so that the group of the "/etc/gshadow-" file is set to "root" by running the following command: $ sudo chgrp root /etc/gshadow-

b
RHEL 10 must be configured so that the "/etc/passwd" file is owned by "root".
RMF Control
AC-3
Severity
M
CCI
CCI-000213
Version
RHEL-10-400040
Vuln IDs
V-281025
Rule IDs
SV-281025r1165430_rule
The "/etc/passwd" file contains information about the users that are configured on the system. Protection of this file is critical for system security.
Fix: F-85491r1165429_fix

Configure RHEL 10 so that the owner of the "/etc/passwd" file is set to "root" by running the following command: $ sudo chown root /etc/passwd

b
RHEL 10 must be configured so that the "/etc/passwd" file is group-owned by "root".
RMF Control
AC-3
Severity
M
CCI
CCI-000213
Version
RHEL-10-400045
Vuln IDs
V-281026
Rule IDs
SV-281026r1165433_rule
The "/etc/passwd" file contains information about the users that are configured on the system. Protection of this file is critical for system security.
Fix: F-85492r1165432_fix

Configure RHEL 10 so that the group of the "/etc/passwd" file is set to "root" by running the following command: $ sudo chgrp root /etc/passwd

b
RHEL 10 must be configured so that the "/etc/passwd-" file is owned by "root".
RMF Control
AC-3
Severity
M
CCI
CCI-000213
Version
RHEL-10-400050
Vuln IDs
V-281027
Rule IDs
SV-281027r1165436_rule
The "/etc/passwd-" file is a backup file of "/etc/passwd", and as such contains information about the users that are configured on the system. Protection of this file is critical for system security.
Fix: F-85493r1165435_fix

Configure RHEL 10 so that the owner of the "/etc/passwd-" file is set to "root" by running the following command: $ sudo chown root /etc/passwd-

b
RHEL 10 must be configured so that the "/etc/passwd-" file is group-owned by "root".
RMF Control
AC-3
Severity
M
CCI
CCI-000213
Version
RHEL-10-400055
Vuln IDs
V-281028
Rule IDs
SV-281028r1165439_rule
The "/etc/passwd-" file is a backup file of "/etc/passwd", and as such contains information about the users that are configured on the system. Protection of this file is critical for system security.
Fix: F-85494r1165438_fix

Configure RHEL 10 so that the group of the "/etc/passwd-" file is set to "root" by running the following command: $ sudo chgrp root /etc/passwd-

b
RHEL 10 must be configured so that the "/etc/shadow" file is owned by "root".
RMF Control
AC-3
Severity
M
CCI
CCI-000213
Version
RHEL-10-400060
Vuln IDs
V-281029
Rule IDs
SV-281029r1165442_rule
The "/etc/shadow" file contains the list of local system accounts and stores password hashes. Protection of this file is critical for system security. Failure to give ownership of this file to "root" provides the designated owner with access to sensitive information, which could weaken the system security posture.
Fix: F-85495r1165441_fix

Configure RHEL 10 so that the owner of the "/etc/shadow" file is set to "root" by running the following command: $ sudo chown root /etc/shadow

b
RHEL 10 must be configured so that the "/etc/shadow" file is group-owned by "root".
RMF Control
AC-3
Severity
M
CCI
CCI-000213
Version
RHEL-10-400065
Vuln IDs
V-281030
Rule IDs
SV-281030r1165445_rule
The "/etc/shadow" file stores password hashes. Protection of this file is critical for system security.
Fix: F-85496r1165444_fix

Configure RHEL 10 so that the group of the "/etc/shadow" file is set to "root" by running the following command: $ sudo chgrp root /etc/shadow

b
RHEL 10 must be configured so that the "/etc/shadow-" file is owned by "root".
RMF Control
AC-3
Severity
M
CCI
CCI-000213
Version
RHEL-10-400070
Vuln IDs
V-281031
Rule IDs
SV-281031r1165448_rule
The "/etc/shadow-" file is a backup file of "/etc/shadow", and as such contains the list of local system accounts and password hashes. Protection of this file is critical for system security.
Fix: F-85497r1165447_fix

Configure RHEL 10 so that the owner of the "/etc/shadow-" file is set to "root" by running the following command: $ sudo chown root /etc/shadow-

b
RHEL 10 must be configured so that the "/etc/shadow-" file is group-owned by "root".
RMF Control
AC-3
Severity
M
CCI
CCI-000213
Version
RHEL-10-400075
Vuln IDs
V-281032
Rule IDs
SV-281032r1165451_rule
The "/etc/shadow-" file is a backup file of "/etc/shadow", and as such contains the list of local system accounts and password hashes. Protection of this file is critical for system security.
Fix: F-85498r1165450_fix

Configure RHEL 10 so that the group of the "/etc/shadow-" file is set to "root" by running the following command: $ sudo chgrp root /etc/shadow-

b
RHEL 10 must be configured so that the "/var/log" directory is owned by "root".
RMF Control
SI-11
Severity
M
CCI
CCI-001314
Version
RHEL-10-400080
Vuln IDs
V-281033
Rule IDs
SV-281033r1165454_rule
Only authorized personnel should be aware of errors and the details of the errors. Error messages are an indicator of an organization's operational state or can identify the RHEL 10 system or platform. Additionally, personally identifiable information (PII) and operational information must not be revealed through error messages to unauthorized personnel or their designated representatives. The structure and content of error messages must be carefully considered by the organization and development team. The extent to which the information system is able to identify and handle error conditions is guided by organizational policy and operational requirements.
Fix: F-85499r1165453_fix

Configure RHEL 10 so that the owner of the directory "/var/log" is set to "root" by running the following command: $ sudo chown root /var/log

b
RHEL 10 must be configured so that the "/var/log" directory is group-owned by "root".
RMF Control
SI-11
Severity
M
CCI
CCI-001314
Version
RHEL-10-400085
Vuln IDs
V-281034
Rule IDs
SV-281034r1165457_rule
Only authorized personnel should be aware of errors and the details of the errors. Error messages are an indicator of an organization's operational state or can identify the RHEL 10 system or platform. Additionally, personally identifiable information (PII) and operational information must not be revealed through error messages to unauthorized personnel or their designated representatives. The structure and content of error messages must be carefully considered by the organization and development team. The extent to which the information system is able to identify and handle error conditions is guided by organizational policy and operational requirements.
Fix: F-85500r1165456_fix

Configure RHEL 10 so that the group owner of the directory "/var/log" is set to "root" by running the following command: $ sudo chgrp root /var/log

b
RHEL 10 must be configured so that the "/var/log/"messages file is owned by root.
RMF Control
SI-11
Severity
M
CCI
CCI-001314
Version
RHEL-10-400090
Vuln IDs
V-281035
Rule IDs
SV-281035r1165460_rule
Only authorized personnel should be aware of errors and the details of the errors. Error messages are an indicator of an organization's operational state or can identify the RHEL 10 system or platform. Additionally, personally identifiable information (PII) and operational information must not be revealed through error messages to unauthorized personnel or their designated representatives. The structure and content of error messages must be carefully considered by the organization and development team. The extent to which the information system is able to identify and handle error conditions is guided by organizational policy and operational requirements.
Fix: F-85501r1165459_fix

Configure RHEL 10 so that the owner of the "/var/log/messages" file is set to "root" by running the following command: $ sudo chown root /var/log/messages

b
RHEL 10 must be configured so that the "/var/log/messages" file is group-owned by "root".
RMF Control
SI-11
Severity
M
CCI
CCI-001314
Version
RHEL-10-400095
Vuln IDs
V-281036
Rule IDs
SV-281036r1165463_rule
Only authorized personnel should be aware of errors and the details of the errors. Error messages are an indicator of an organization's operational state or can identify the RHEL 10 system or platform. Additionally, personally identifiable information (PII) and operational information must not be revealed through error messages to unauthorized personnel or their designated representatives. The structure and content of error messages must be carefully considered by the organization and development team. The extent to which the information system is able to identify and handle error conditions is guided by organizational policy and operational requirements.
Fix: F-85502r1165462_fix

Configure RHEL 10 so that the group owner of the "/var/log/messages" file is set to "root" by running the following command: $ sudo chgrp root /var/log/messages

b
RHEL 10 must be configured so that system commands are owned by "root".
RMF Control
CM-5
Severity
M
CCI
CCI-001499
Version
RHEL-10-400100
Vuln IDs
V-281037
Rule IDs
SV-281037r1165466_rule
If RHEL 10 allowed any user to make changes to software libraries, those changes might be implemented without undergoing the appropriate testing and approvals that are part of a robust change management process. This requirement applies to RHEL 10 with software libraries that are accessible and configurable, as in the case of interpreted languages. Software libraries also include privileged programs that execute with escalated privileges.
Fix: F-85503r1165465_fix

Configure RHEL 10 so that the system commands are protected from unauthorized access. Run the following command, replacing "[FILE]" with any system command file not owned by "root". $ sudo chown root [FILE]

b
RHEL 10 must be configured so that audit tools are group-owned by "root".
RMF Control
AU-9
Severity
M
CCI
CCI-001493
Version
RHEL-10-400305
Vuln IDs
V-281078
Rule IDs
SV-281078r1165589_rule
Protecting audit information also includes identifying and protecting the tools used to view and manipulate log data; therefore, protecting audit tools is necessary to prevent unauthorized operation on audit information. RHEL 10 systems providing tools to interface with audit information will leverage user permissions and roles identifying the user accessing the tools, and the corresponding rights the user enjoys, to make access decisions regarding the access to audit tools. Audit tools include, but are not limited to, vendor-provided and open source audit tools needed to successfully view and manipulate audit information system activity and records. Audit tools include custom queries and report generators. Satisfies: SRG-OS-000256-GPOS-00097, SRG-OS-000257-GPOS-00098, SRG-OS-000258-GPOS-00099
Fix: F-85544r1165588_fix

Configure RHEL 10 so that the audit tools are group-owned by "root" by running the following command: $ sudo chgrp root [audit_tool] Replace "[audit_tool]" with each audit tool not group-owned by "root".

b
RHEL 10 must define default permissions for the bash shell.
RMF Control
AC-3
Severity
M
CCI
CCI-000213
Version
RHEL-10-400315
Vuln IDs
V-281080
Rule IDs
SV-281080r1184687_rule
The "umask" controls the default access mode assigned to newly created files. A "umask" of "077" limits new files to mode "600" or less permissive. Although "umask" can be represented as a four-digit number, the first digit representing special access modes is typically ignored or required to be "0". This requirement applies to the globally configured system defaults and the local interactive user defaults for each account on the system.
Fix: F-85546r1165594_fix

Configure RHEL 10 to define default permissions for all authenticated users using the bash shell. Add or edit the lines for the "umask" parameter in the "/etc/bashrc" file to "077": umask 077

b
RHEL 10 must define default permissions for the c shell.
RMF Control
AC-3
Severity
M
CCI
CCI-000213
Version
RHEL-10-400320
Vuln IDs
V-281081
Rule IDs
SV-281081r1184682_rule
The "umask" controls the default access mode assigned to newly created files. A "umask" of "077" limits new files to mode "600" or less permissive. Although "umask" can be represented as a four-digit number, the first digit representing special access modes is typically ignored or required to be "0". This requirement applies to the globally configured system defaults and the local interactive user defaults for each account on the system.
Fix: F-85547r1165597_fix

Configure RHEL 10 to define default permissions for all authenticated users using the c shell. Add or edit the lines for the "umask" parameter in the "/etc/csh.cshrc" file to "077": umask 077

b
RHEL 10 must define default permissions for all authenticated users in such a way that the user can read and modify only their own files.
RMF Control
AC-3
Severity
M
CCI
CCI-000213
Version
RHEL-10-400325
Vuln IDs
V-281082
Rule IDs
SV-281082r1195406_rule
Setting the most restrictive default permissions ensures that when new accounts are created, they do not have unnecessary access.
Fix: F-85548r1195405_fix

Configure RHEL 10 to define default permissions for all authenticated users in such a way that the user can read and modify only their own files. Add or edit the lines for the "umask" parameter in the "/etc/login.defs" file to "077": umask 077

b
RHEL 10 must define default permissions for the system default profile.
RMF Control
AC-3
Severity
M
CCI
CCI-000213
Version
RHEL-10-400330
Vuln IDs
V-281083
Rule IDs
SV-281083r1184689_rule
The "umask" controls the default access mode assigned to newly created files. A "umask" of "077" limits new files to mode "600" or less permissive. "Although umask" can be represented as a four-digit number, the first digit representing special access modes is typically ignored or required to be "0". This requirement applies to the globally configured system defaults and the local interactive user defaults for each account on the system.
Fix: F-85549r1165603_fix

Configure RHEL 10 to define default permissions for all authenticated users in such a way that the user can read and modify only their own files. Add or edit the lines for the "umask" parameter in the "/etc/profile" file to "077": umask 077

b
RHEL 10 must enforce mode "0600" or less permissive for Secure Shell (SSH) private host key files.
RMF Control
AC-3
Severity
M
CCI
CCI-000213
Version
RHEL-10-400340
Vuln IDs
V-281085
Rule IDs
SV-281085r1195409_rule
If an unauthorized user obtains the private SSH host key file, the host could be impersonated.
Fix: F-85551r1195408_fix

Configure RHEL 10 to enforce mode "0600" for SSH private host key files with the following command: $ sudo chmod 0600 /etc/ssh/ssh_host*key Restart the SSH daemon for the changes to take effect: $ sudo systemctl restart sshd.service

b
RHEL 10 must enforce "root" group ownership of the "/boot/grub2/grub.cfg" file.
RMF Control
AC-3
Severity
M
CCI
CCI-000213
Version
RHEL-10-400345
Vuln IDs
V-281086
Rule IDs
SV-281086r1165613_rule
The "root" group is a highly privileged group. Furthermore, the group owner of this file should not have any access privileges anyway.
Fix: F-85552r1165612_fix

Configure RHEL 10 to enforce group ownership of the "/boot/grub2/grub.cfg" file. Change the group owner of the file "/boot/grub2/grub.cfg" to "root" by running the following command: $ sudo chgrp root /boot/grub2/grub.cfg

b
RHEL 10 must enforce "root" ownership of the "/boot/grub2/grub.cfg" file.
RMF Control
AC-3
Severity
M
CCI
CCI-000213
Version
RHEL-10-400350
Vuln IDs
V-281087
Rule IDs
SV-281087r1165616_rule
The " /boot/grub2/grub.cfg" file stores sensitive system configuration. Protection of this file is critical for system security.
Fix: F-85553r1165615_fix

Configure RHEL 10 to enforce ownership of the "/boot/grub2/grub.cfg" file. Change the owner of the "/boot/grub2/grub.cfg" file to "root" by running the following command: $ sudo chown root /boot/grub2/grub.cfg

b
RHEL 10 must prevent device files from being interpreted on file systems that contain user home directories.
RMF Control
CM-7
Severity
M
CCI
CCI-001764
Version
RHEL-10-400355
Vuln IDs
V-281088
Rule IDs
SV-281088r1165619_rule
The "nodev" mount option causes the system to not interpret character or block special devices. Executing character or block special devices from untrusted file systems increases the opportunity for nonprivileged users to attain unauthorized administrative access. The only legitimate location for device files is the "/dev" directory located on the root partition, with the exception of chroot jails if implemented.
Fix: F-85554r1165618_fix

Configure RHEL 10 to prevent device files from being interpreted on file systems that contain user home directories. Modify "/etc/fstab" to use the "nodev" option on the "/home" directory.

b
RHEL 10 must prevent files with the "setuid" and "setgid" bit set from being executed on file systems that contain user home directories.
RMF Control
CM-7
Severity
M
CCI
CCI-001764
Version
RHEL-10-400360
Vuln IDs
V-281089
Rule IDs
SV-281089r1165622_rule
The "nosuid" mount option causes the system to not execute "setuid" and "setgid" files with owner privileges. This option must be used for mounting any file system not containing approved "setuid" and "setguid" files. Executing files from untrusted file systems increases the opportunity for nonprivileged users to attain unauthorized administrative access.
Fix: F-85555r1165621_fix

Configure RHEL 10 to prevent files with the "setuid" and "setgid" bit set from being executed on file systems that contain user home directories. Modify "/etc/fstab" to use the "nosuid" option on the "/home" directory.

b
RHEL 10 must prevent code from being executed on file systems that contain user home directories.
RMF Control
AC-3
Severity
M
CCI
CCI-000213
Version
RHEL-10-400365
Vuln IDs
V-281090
Rule IDs
SV-281090r1165625_rule
The "noexec" mount option causes the system to not execute binary files. This option must be used for mounting any file system not containing approved binary files, as they may be incompatible. Executing files from untrusted file systems increases the opportunity for nonprivileged users to attain unauthorized administrative access.
Fix: F-85556r1165624_fix

Configure RHEL 10 to prevent code from being executed on file systems that contain user home directories. Modify "/etc/fstab" to use the "noexec" option on the "/home" directory.

b
RHEL 10 must mount "/var/log/audit" with the "nodev" option.
RMF Control
CM-7
Severity
M
CCI
CCI-001764
Version
RHEL-10-400400
Vuln IDs
V-281091
Rule IDs
SV-281091r1165628_rule
The "nodev" mount option causes the system to not interpret character or block special devices. Executing character or block special devices from untrusted file systems increases the opportunity for nonprivileged users to attain unauthorized administrative access. The only legitimate location for device files is the "/dev" directory located on the root partition, with the exception of chroot jails if implemented.
Fix: F-85557r1165627_fix

Configure RHEL 10 to mount "/var/log/audit" with the "nodev" option. Modify "/etc/fstab" to use the "nodev" option on the "/var/log/audit" directory.

b
RHEL 10 must mount "/var/log/audit" with the "noexec" option.
RMF Control
CM-7
Severity
M
CCI
CCI-001764
Version
RHEL-10-400405
Vuln IDs
V-281092
Rule IDs
SV-281092r1165631_rule
The "noexec" mount option causes the system to not execute binary files. This option must be used for mounting any file system not containing approved binary files, as they may be incompatible. Executing files from untrusted file systems increases the opportunity for nonprivileged users to attain unauthorized administrative access.
Fix: F-85558r1165630_fix

Configure RHEL 10 to mount "/var/log/audit" with the "noexec" option. Modify "/etc/fstab" to use the "noexec" option on the "/var/log/audit" directory.

b
RHEL 10 must mount "/var/log/audit" with the "nosuid" option.
RMF Control
CM-7
Severity
M
CCI
CCI-001764
Version
RHEL-10-400410
Vuln IDs
V-281093
Rule IDs
SV-281093r1165634_rule
The "nosuid" mount option causes the system to not execute "setuid" and "setgid" files with owner privileges. This option must be used for mounting any file system not containing approved "setuid" and "setguid" files. Executing files from untrusted file systems increases the opportunity for nonprivileged users to attain unauthorized administrative access.
Fix: F-85559r1165633_fix

Configure RHEL 10 to mount "/var/log/audit" with the "nosuid" option. Modify "/etc/fstab" to use the "nosuid" option on the "/var/log/audit" directory.

b
RHEL 10 must enforce a mode of "0755" or less permissive for audit tools.
RMF Control
AU-9
Severity
M
CCI
CCI-001493
Version
RHEL-10-400450
Vuln IDs
V-281094
Rule IDs
SV-281094r1165637_rule
Protecting audit information also includes identifying and protecting the tools used to view and manipulate log data. Therefore, protecting audit tools is necessary to prevent unauthorized operation on audit information. RHEL 10 systems providing tools to interface with audit information will leverage user permissions and roles identifying the user accessing the tools, and the corresponding rights the user enjoys, to make access decisions regarding the access to audit tools. Audit tools include, but are not limited to, vendor-provided and open source audit tools needed to successfully view and manipulate audit information system activity and records. Audit tools include custom queries and report generators. Satisfies: SRG-OS-000256-GPOS-00097, SRG-OS-000257-GPOS-00098, SRG-OS-000258-GPOS-00099
Fix: F-85560r1165636_fix

Configure RHEL 10 so that the audit tools to have a mode of "0755" by running the following command: $ sudo chmod 0755 [audit_tool] Replace "[audit_tool]" with each audit tool that has a mode more permissive than "0755".

b
RHEL 10 must enable the systemd-journald service.
RMF Control
SC-24
Severity
M
CCI
CCI-001665
Version
RHEL-10-500000
Vuln IDs
V-281096
Rule IDs
SV-281096r1165643_rule
In the event of a system failure, RHEL 10 must preserve any information necessary to determine cause of failure and return to operations with least disruption to system processes.
Fix: F-85562r1165642_fix

Configure RHEL 10 to enable the systemd-journald service. To enable the systemd-journald service, run the following command: $ sudo systemctl enable --now systemd-journald

b
RHEL 10 must enable auditing of processes that start prior to the audit daemon.
RMF Control
AC-3
Severity
M
CCI
CCI-000213
Version
RHEL-10-500005
Vuln IDs
V-281097
Rule IDs
SV-281097r1165646_rule
Without the capability to generate audit records, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. If auditing is enabled late in the startup process, the actions of some startup processes may not be audited. Some audit systems also maintain state information available only if auditing is enabled before a given process is created.
Fix: F-85563r1165645_fix

Configure RHEL 10 to enable auditing of processes that start prior to the audit daemon with the following command: $ sudo grubby --update-kernel=ALL --args="audit=1" Add or modify the following line in "/etc/default/grub" to ensure the configuration survives kernel updates: GRUB_CMDLINE_LINUX="audit=1"

b
RHEL 10 must audit local events.
RMF Control
AU-12
Severity
M
CCI
CCI-000169
Version
RHEL-10-500010
Vuln IDs
V-281098
Rule IDs
SV-281098r1165649_rule
Without establishing what type of events occurred, along with the source, location, and outcome, it would be difficult to establish, correlate, and investigate the events leading up to an outage or attack. If option "local_events" is not set to "yes", only events from the network will be aggregated.
Fix: F-85564r1165648_fix

Configure RHEL 10 to generate audit records for local events by adding or updating the following line in "/etc/audit/auditd.conf": local_events = yes Restart the audit daemon with the following command for the changes to take effect: $ sudo service auditd restart

b
RHEL 10 must write audit records to disk.
RMF Control
AU-9
Severity
M
CCI
CCI-000163
Version
RHEL-10-500015
Vuln IDs
V-281099
Rule IDs
SV-281099r1165652_rule
Audit data must be synchronously written to disk to ensure log integrity. This setting ensures that all audit event data is written to disk.
Fix: F-85565r1165651_fix

Configure the RHEL 10 audit system to write log files to the disk. Edit the "/etc/audit/auditd.conf" file and add or update the "write_logs" option to "yes": write_logs = yes Restart the audit daemon with the following command for changes to take effect: $ sudo service auditd restart

b
RHEL 10 must log username information when unsuccessful login attempts occur.
RMF Control
AC-7
Severity
M
CCI
CCI-000044
Version
RHEL-10-500020
Vuln IDs
V-281100
Rule IDs
SV-281100r1165655_rule
Without auditing of these events, it may be harder or impossible to identify what an attacker did after an attack.
Fix: F-85566r1165654_fix

Configure RHEL 10 to log username information when unsuccessful login attempts occur. Enable the feature using the following command: $ sudo authselect enable-feature with-faillock Add/modify the "/etc/security/faillock.conf" file to match the following line: audit

b
RHEL 10 must take appropriate action when a critical audit processing failure occurs.
RMF Control
AU-5
Severity
M
CCI
CCI-000139
Version
RHEL-10-500035
Vuln IDs
V-281103
Rule IDs
SV-281103r1166261_rule
It is critical for the appropriate personnel to be aware if a system is at risk of failing to process audit logs as required. Without this notification, the security personnel may be unaware of an impending failure of the audit capability, and system operation may be adversely affected. Audit processing failures include software/hardware errors, failures in the audit capturing mechanisms, and audit storage capacity being reached or exceeded.
Fix: F-85569r1166260_fix

Configure RHEL 10 to shut down when auditing failures occur. Add the following line to the bottom of the "/etc/audit/rules.d/audit.rules" file: -f 2

b
RHEL 10 must take action when allocated audit record storage volume reaches 75 percent of the audit record storage capacity.
RMF Control
AU-5
Severity
M
CCI
CCI-001855
Version
RHEL-10-500040
Vuln IDs
V-281104
Rule IDs
SV-281104r1208795_rule
If action is not taken when storage volume reaches 75 percent utilization, the auditing system may fail when the storage volume reaches capacity.
Fix: F-85570r1166263_fix

Configure RHEL 10 to initiate an action when allocated audit record storage volume reaches 75 percent of the repository maximum audit record storage capacity by adding/modifying the following line in the /etc/audit/auditd.conf file: space_left = 25% Restart the audit daemon with the following command for the changes to take effect: $ sudo service auditd restart

b
RHEL 10 must label all off-loaded audit logs before sending them to the central log server.
RMF Control
AU-3
Severity
M
CCI
CCI-000132
Version
RHEL-10-500045
Vuln IDs
V-281105
Rule IDs
SV-281105r1166267_rule
Enriched logging is needed to determine who, what, and when events occur on a system. Without this, determining root cause of an event will be much more difficult. When audit logs are not labeled before they are sent to a central log server, the audit data will not be able to be analyzed and tied back to the correct system. Satisfies: SRG-OS-000039-GPOS-00017, SRG-OS-000342-GPOS-00133, SRG-OS-000479-GPOS-00224
Fix: F-85571r1166266_fix

Configure RHEL 10 so that all off-loaded audit logs are labeled before sending them to the central log server. Edit the "/etc/audit/auditd.conf" file and add or update the "name_format" option: name_format = hostname Restart the audit daemon with the following command for the changes to take effect: $ sudo service auditd restart

a
RHEL 10 must allocate audit record storage capacity to store at least one week's worth of audit records.
RMF Control
AU-4
Severity
L
CCI
CCI-001849
Version
RHEL-10-500100
Vuln IDs
V-281106
Rule IDs
SV-281106r1166270_rule
To ensure RHEL 10 systems have a sufficient storage capacity in which to write the audit logs, RHEL 10 must be able to allocate audit record storage capacity. The task of allocating audit record storage capacity is usually performed during initial installation of RHEL 10. Satisfies: SRG-OS-000341-GPOS-00132, SRG-OS-000342-GPOS-00133
Fix: F-85572r1166269_fix

Configure RHEL 10 to allocate enough storage capacity for at least one week of audit records when audit records are not immediately sent to a central audit record storage facility. If audit records are stored on a partition made specifically for audit records, resize the partition with sufficient space to contain one week of audit records. If audit records are not stored on a partition made specifically for audit records, a new partition with sufficient space must be created.

b
RHEL 10 must take action when allocated audit record storage volume reaches 95 percent of the audit record storage capacity.
RMF Control
AU-5
Severity
M
CCI
CCI-001855
Version
RHEL-10-500105
Vuln IDs
V-281107
Rule IDs
SV-281107r1166273_rule
If action is not taken when storage volume reaches 95 percent utilization, the auditing system may fail when the storage volume reaches capacity.
Fix: F-85573r1166272_fix

Configure RHEL 10 to initiate an action when allocated audit record storage volume reaches 95 percent of the repository maximum audit record storage capacity by adding/modifying the following line in the /etc/audit/auditd.conf file: admin_space_left = 5% Restart the audit daemon with the following command for the changes to take effect: $ sudo service auditd restart

b
RHEL 10 must take action when allocated audit record storage volume reaches 95 percent of the repository maximum audit record storage capacity.
RMF Control
AU-5
Severity
M
CCI
CCI-001855
Version
RHEL-10-500110
Vuln IDs
V-281108
Rule IDs
SV-281108r1166276_rule
If action is not taken when storage volume reaches 95 percent utilization, the auditing system may fail when the storage volume reaches capacity.
Fix: F-85574r1166275_fix

Configure RHEL 10 auditd service to take action if allocated audit record storage volume reaching 95 percent of the repository maximum audit record storage capacity. Edit the following line in "/etc/audit/auditd.conf" to ensure the system is forced into single user mode if the audit record storage volume is about to reach maximum capacity: admin_space_left_action = single Restart the audit daemon with the following command for the changes to take effect: $ sudo service auditd restart

b
RHEL 10 must take appropriate action when the internal event queue is full.
RMF Control
AU-4
Severity
M
CCI
CCI-001851
Version
RHEL-10-500115
Vuln IDs
V-281109
Rule IDs
SV-281109r1184691_rule
The audit system must have an action set up in case the internal event queue becomes full so that no data is lost. Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Off-loading is a common process in information systems with limited audit storage capacity. Satisfies: SRG-OS-000342-GPOS-00133, SRG-OS-000479-GPOS-00224
Fix: F-85575r1166278_fix

Configure RHEL 10 to take appropriate action when the internal event queue is full. Edit the "/etc/audit/auditd.conf" file and add or update the "overflow_action" option: overflow_action = syslog Restart the audit daemon with the following command for the changes to take effect: $ sudo service auditd restart

b
RHEL 10 must produce audit records containing information to establish the identity of any individual or process associated with the event.
RMF Control
AU-3
Severity
M
CCI
CCI-001487
Version
RHEL-10-500120
Vuln IDs
V-281110
Rule IDs
SV-281110r1166282_rule
Without establishing what type of events occurred, along with the source, location, and outcome, it would be difficult to establish, correlate, and investigate the events leading up to an outage or attack. Audit record content that may be necessary to satisfy this requirement includes, for example, time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, filenames involved, and access control or flow control rules invoked. Enriched logging aids in making sense of who, what, and when events occur on a system. Without this, determining root cause of an event will be much more difficult.
Fix: F-85576r1166281_fix

Configure RHEL 10 audit system to resolve audit information before writing to disk. Edit the "/etc/audit/auditd.conf" file and add or update the "log_format" option: log_format = ENRICHED Restart the audit daemon with the following command for the changes to take effect: $ sudo service auditd restart

b
RHEL 10 must periodically flush audit records to disk to ensure that audit records are not lost.
RMF Control
AU-6
Severity
M
CCI
CCI-000154
Version
RHEL-10-500125
Vuln IDs
V-281111
Rule IDs
SV-281111r1166285_rule
If option "freq" is not set to a value that requires audit records to be written to disk after a threshold number is reached, audit records may be lost.
Fix: F-85577r1166284_fix

Configure RHEL 10 to flush audit records to disk by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": freq = 100 Restart the audit daemon with the following command for changes to take effect: $ sudo service auditd restart

b
RHEL 10 must notify the system administrator (SA) and information system security officer (ISSO) (at a minimum) when allocated audit record storage volume 75 percent utilization.
RMF Control
AU-5
Severity
M
CCI
CCI-001855
Version
RHEL-10-500205
Vuln IDs
V-281113
Rule IDs
SV-281113r1184746_rule
If security personnel are not notified immediately when storage volume reaches 75 percent utilization, they are unable to plan for audit record storage capacity expansion.
Fix: F-85579r1166290_fix

Configure RHEL 10 to initiate an action to notify the SA and ISSO (at a minimum) when allocated audit record storage volume reaches 75 percent of the repository maximum audit record storage capacity by adding/modifying the following line in the "/etc/audit/auditd.conf" file. space_left_action = email Restart the audit daemon with the following command for the changes to take effect: $ sudo service auditd restart

b
RHEL 10 must notify the system administrator (SA) and/or information system security officer (ISSO) (at a minimum) of an audit processing failure.
RMF Control
AU-5
Severity
M
CCI
CCI-000139
Version
RHEL-10-500210
Vuln IDs
V-281114
Rule IDs
SV-281114r1166294_rule
It is critical for the appropriate personnel to be aware if a system is at risk of failing to process audit logs as required. Without this notification, the security personnel may be unaware of an impending failure of the audit capability, and system operation may be adversely affected. Audit processing failures include software/hardware errors, failures in the audit capturing mechanisms, and audit storage capacity being reached or exceeded. This requirement applies to each audit data storage repository (i.e., distinct information system component where audit records are stored), the centralized audit storage capacity of organizations (i.e., all audit data storage repositories combined), or both. Satisfies: SRG-OS-000046-GPOS-00022, SRG-OS-000343-GPOS-00134
Fix: F-85580r1166293_fix

Configure RHEL 10 to notify the SA and/or ISSO (at a minimum) of an audit processing failure. Edit the following line in "/etc/audit/auditd.conf" to ensure administrators are notified via email for those situations: action_mail_acct = root Restart the audit daemon with the following command for the changes to take effect: $ sudo service auditd restart

b
RHEL 10 must log Secure Shell (SSH) connection attempts and failures to the server.
RMF Control
AC-17
Severity
M
CCI
CCI-000067
Version
RHEL-10-500215
Vuln IDs
V-281115
Rule IDs
SV-281115r1184650_rule
SSH provides several logging levels with varying amounts of verbosity. "DEBUG" is specifically not recommended other than strictly for debugging SSH communications because it provides so much data that it is difficult to identify important security information. "INFO" or "VERBOSE" level is the basic level that only records login activity of SSH users. In many situations, such as incident response, it is important to determine when a particular user was active on a system. The logout record can eliminate users who disconnected, which helps narrow the field.
Fix: F-85581r1166296_fix

Configure RHEL 10 to log connection attempts by adding or modifying the following line in "/etc/ssh/sshd_config" or in a file in "/etc/ssh/sshd_config.d": LogLevel VERBOSE Restart the SSH daemon with the following command for the settings to take effect: $ sudo systemctl restart sshd.service

b
RHEL 10 must generate audit records for successful and unsuccessful uses of the "execve" system call.
RMF Control
AC-6
Severity
M
CCI
CCI-002233
Version
RHEL-10-500300
Vuln IDs
V-281116
Rule IDs
SV-281116r1166300_rule
Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised information system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider threats and the advanced persistent threat. Satisfies: SRG-OS-000326-GPOS-00126, SRG-OS-000327-GPOS-00127, SRG-OS-000755-GPOS-00220
Fix: F-85582r1166299_fix

Configure RHEL 10 to generate audit records upon successful and unsuccessful attempts to use the "execve" system call. Add or update the following file system rules to "/etc/audit/rules.d/audit.rules": -a always,exit -F arch=b32 -S execve -C uid!=euid -F euid=0 -k execpriv -a always,exit -F arch=b64 -S execve -C uid!=euid -F euid=0 -k execpriv -a always,exit -F arch=b32 -S execve -C gid!=egid -F egid=0 -k execpriv -a always,exit -F arch=b64 -S execve -C gid!=egid -F egid=0 -k execpriv Restart the audit daemon with the following command for the changes to take effect: $ sudo service auditd restart

b
RHEL 10 must generate audit records for successful and unsuccessful uses of the "setxattr", "fsetxattr", "lsetxattr", "removexattr", "fremovexattr", and "lremovexattr" system calls.
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
RHEL-10-500310
Vuln IDs
V-281117
Rule IDs
SV-281117r1184680_rule
Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each syscall made by all programs on the system. Therefore, it is very important to use syscall rules only when absolutely necessary because these affect performance. More rules lead to poorer performance. The performance can be helped, however, by combining syscalls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000458-GPOS-00203, SRG-OS-000462-GPOS-00206, SRG-OS-000463-GPOS-00207, SRG-OS-000471-GPOS-00215, SRG-OS-000474-GPOS-00219, SRG-OS-000466-GPOS-00210, SRG-OS-000468-GPOS-00212, SRG-OS-000064-GPOS-00033
Fix: F-85583r1166302_fix

Configure RHEL 10 to generate audit records upon successful and unsuccessful attempts to use the "setxattr", "fsetxattr", "lsetxattr", "removexattr", "fremovexattr", and "lremovexattr" system calls by adding or updating the following lines to "/etc/audit/rules.d/audit.rules": -a always,exit -F arch=b32 -S setxattr,fsetxattr,lsetxattr,removexattr,fremovexattr,lremovexattr -F auid>=1000 -F auid!=unset -k perm_mod -a always,exit -F arch=b64 -S setxattr,fsetxattr,lsetxattr,removexattr,fremovexattr,lremovexattr -F auid>=1000 -F auid!=unset -k perm_mod -a always,exit -F arch=b32 -S setxattr,fsetxattr,lsetxattr,removexattr,fremovexattr,lremovexattr -F auid=0 -k perm_mod -a always,exit -F arch=b64 -S setxattr,fsetxattr,lsetxattr,removexattr,fremovexattr,lremovexattr -F auid=0 -k perm_mod Restart the audit daemon with the following command for the changes to take effect: $ sudo service auditd restart

b
RHEL 10 must generate audit records for successful and unsuccessful uses of "umount" system calls.
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
RHEL-10-500320
Vuln IDs
V-281118
Rule IDs
SV-281118r1166306_rule
Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary because these affect performance. More rules lead to poorer performance. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215
Fix: F-85584r1166305_fix

Configure RHEL 10 to generate audit records upon successful and unsuccessful attempts to use the "umount" command by adding or updating the following rules in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/bin/umount -F perm=x -F auid>=1000 -F auid!=unset -k privileged-mount Restart the audit daemon with the following command for the changes to take effect: $ sudo service auditd restart

b
RHEL 10 must generate audit records for successful and unsuccessful uses of the "chacl" command.
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
RHEL-10-500330
Vuln IDs
V-281119
Rule IDs
SV-281119r1166309_rule
Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary because these affect performance. More rules lead to poorer performance. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215, SRG-OS-000466-GPOS-00210
Fix: F-85585r1166308_fix

Configure RHEL 10 to generate audit records upon successful and unsuccessful attempts to use the "chacl" command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/bin/chacl -F perm=x -F auid>=1000 -F auid!=unset -k perm_mod Restart the audit daemon with the following command for the changes to take effect: $ sudo service auditd restart

b
RHEL 10 must generate audit records for successful and unsuccessful uses of the "setfacl" command.
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
RHEL-10-500340
Vuln IDs
V-281120
Rule IDs
SV-281120r1166312_rule
Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary because these affect performance. More rules lead to poorer performance. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215
Fix: F-85586r1166311_fix

Configure RHEL 10 to generate audit records upon successful and unsuccessful attempts to use the "setfacl" command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/bin/setfacl -F perm=x -F auid>=1000 -F auid!=unset -k perm_mod Restart the audit daemon with the following command for the changes to take effect: $ sudo service auditd restart

b
RHEL 10 must generate audit records for successful and unsuccessful uses of the "chcon" command.
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
RHEL-10-500350
Vuln IDs
V-281121
Rule IDs
SV-281121r1166315_rule
Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary because these affect performance. More rules lead to poorer performance. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000468-GPOS-00212, SRG-OS-000471-GPOS-00215, SRG-OS-000463-GPOS-00207, SRG-OS-000465-GPOS-00209
Fix: F-85587r1166314_fix

Configure RHEL 10 to generate audit records upon successful and unsuccessful attempts to use the "chcon" command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/bin/chcon -F perm=x -F auid>=1000 -F auid!=unset -k perm_mod Restart the audit daemon with the following command for the changes to take effect: $ sudo service auditd restart

b
RHEL 10 must generate audit records for successful and unsuccessful uses of the "semanage" command.
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
RHEL-10-500360
Vuln IDs
V-281122
Rule IDs
SV-281122r1166318_rule
Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary because these affect performance. More rules lead to poorer performance. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215, SRG-OS-000463-GPOS-00207, SRG-OS-000465-GPOS-00209
Fix: F-85588r1166317_fix

Configure RHEL 10 to generate audit records upon successful and unsuccessful attempts to use the "semanage" command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/sbin/semanage -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update Restart the audit daemon with the following command for the changes to take effect: $ sudo service auditd restart

b
RHEL 10 must generate audit records for successful and unsuccessful uses of the "setfiles" command.
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
RHEL-10-500370
Vuln IDs
V-281123
Rule IDs
SV-281123r1166321_rule
Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary because these affect performance. More rules lead to poorer performance. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215, SRG-OS-000463-GPOS-00207, SRG-OS-000465-GPOS-00209
Fix: F-85589r1166320_fix

Configure RHEL 10 to generate audit records upon successful and unsuccessful attempts to use the "setfiles" command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/sbin/setfiles -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update Restart the audit daemon with the following command for the changes to take effect: $ sudo service auditd restart

b
RHEL 10 must generate audit records for successful and unsuccessful uses of the "setsebool" command.
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
RHEL-10-500380
Vuln IDs
V-281124
Rule IDs
SV-281124r1166324_rule
Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary because these affect performance. More rules lead to poorer performance. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215, SRG-OS-000463-GPOS-00207, SRG-OS-000465-GPOS-00209
Fix: F-85590r1166323_fix

Configure RHEL 10 to generate audit records upon successful and unsuccessful use of the "setsebool " command by adding or updating the following rules in the "/etc/audit/rules.d/audit.rules" file: -a always,exit -F path=/usr/sbin/setsebool -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged Restart the audit daemon with the following command for the changes to take effect: $ sudo service auditd restart

b
RHEL 10 must generate audit records for successful and unsuccessful uses of the "truncate", "ftruncate", "creat", "open", "openat", and "open_by_handle_at" system calls.
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
RHEL-10-500390
Vuln IDs
V-281125
Rule IDs
SV-281125r1197225_rule
Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each syscall made by all programs on the system. Therefore, it is very important to use syscall rules only when absolutely necessary because these affect performance. More rules lead to poorer performance. The performance can be helped, however, by combining syscalls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215, SRG-OS-000064-GPOS-00033, SRG-OS-000458-GPOS-00203, SRG-OS-000461-GPOS-00205
Fix: F-85591r1166326_fix

Configure RHEL 10 to generate audit records upon successful and unsuccessful use of the "truncate", "ftruncate", "creat", "open", "openat", and "open_by_handle_at" system calls by adding or updating the following rules in the "/etc/audit/rules.d/audit.rules" file: -a always,exit -F arch=b32 -S truncate,ftruncate,creat,open,openat,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -k perm_access -a always,exit -F arch=b64 -S truncate,ftruncate,creat,open,openat,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -k perm_access -a always,exit -F arch=b32 -S truncate,ftruncate,creat,open,openat,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -k perm_access -a always,exit -F arch=b64 -S truncate,ftruncate,creat,open,openat,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -k perm_access Restart the audit daemon with the following command for the changes to take effect: $ sudo service auditd restart

b
RHEL 10 must generate audit records for successful and unsuccessful uses of the "delete_module" system call.
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
RHEL-10-500400
Vuln IDs
V-281126
Rule IDs
SV-281126r1166330_rule
Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary because these affect performance. More rules lead to poorer performance. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215, SRG-OS-000471-GPOS-00216, SRG-OS-000477-GPOS-00222
Fix: F-85592r1166329_fix

Configure RHEL 10 to generate audit records upon successful and unsuccessful use of the "delete_module" system call by adding or updating the following rules in the "/etc/audit/rules.d/audit.rules" file: -a always,exit -F arch=b32 -S delete_module -F auid>=1000 -F auid!=unset -k module_chng -a always,exit -F arch=b64 -S delete_module -F auid>=1000 -F auid!=unset -k module_chng Restart the audit daemon with the following command for the changes to take effect: $ sudo service auditd restart

b
RHEL 10 must generate audit records for successful and unsuccessful uses of the "init_module" and "finit_module" system calls.
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
RHEL-10-500410
Vuln IDs
V-281127
Rule IDs
SV-281127r1208796_rule
Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each syscall made by all programs on the system. Therefore, it is very important to use syscall rules only when absolutely necessary because these affect performance. More rules lead to poorer performance. The performance can be helped, however, by combining syscalls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215, SRG-OS-000471-GPOS-00216, SRG-OS-000477-GPOS-00222
Fix: F-85593r1166332_fix

Configure RHEL 10 to generate audit records upon successful and unsuccessful use of the "init_module" and "finit_module" system calls by adding or updating the following rules in the "/etc/audit/rules.d/audit.rules" file: -a always,exit -F arch=b32 -S init_module,finit_module -F auid>=1000 -F auid!=unset -k module_chng -a always,exit -F arch=b64 -S init_module,finit_module -F auid>=1000 -F auid!=unset -k module_chng Restart the audit daemon with the following command for the changes to take effect: $ sudo service auditd restart

b
RHEL 10 must generate audit records for successful and unsuccessful uses of the "chage" command.
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
RHEL-10-500420
Vuln IDs
V-281128
Rule IDs
SV-281128r1166336_rule
Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary because these affect performance. More rules lead to poorer performance. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000468-GPOS-00212, SRG-OS-000471-GPOS-00215
Fix: F-85594r1166335_fix

Configure RHEL 10 to generate audit records upon successful and unsuccessful attempts to use the "chage" command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/bin/chage -F perm=x -F auid>=1000 -F auid!=unset -k privileged-chage Restart the audit daemon with the following command for the changes to take effect: $ sudo service auditd restart

b
RHEL 10 must generate audit records for successful and unsuccessful uses of the "chsh" command.
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
RHEL-10-500430
Vuln IDs
V-281129
Rule IDs
SV-281129r1166339_rule
Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary because these affect performance. More rules lead to poorer performance. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215
Fix: F-85595r1166338_fix

Configure RHEL 10 to generate audit records upon successful and unsuccessful attempts to use the "chsh" command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/bin/chsh -F perm=x -F auid>=1000 -F auid!=unset -k priv_cmd Restart the audit daemon with the following command for the changes to take effect: $ sudo service auditd restart

b
RHEL 10 must generate audit records for successful and unsuccessful uses of the "crontab" command.
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
RHEL-10-500440
Vuln IDs
V-281130
Rule IDs
SV-281130r1166342_rule
Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary because these affect performance. More rules lead to poorer performance. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215
Fix: F-85596r1166341_fix

Configure RHEL 10 to generate audit records upon successful and unsuccessful attempts to use the "crontab" command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/bin/crontab -F perm=x -F auid>=1000 -F auid!=unset -k privileged-crontab Restart the audit daemon with the following command for the changes to take effect: $ sudo service auditd restart

b
RHEL 10 must generate audit records for successful and unsuccessful uses of the "gpasswd" command.
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
RHEL-10-500450
Vuln IDs
V-281131
Rule IDs
SV-281131r1166345_rule
Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary because these affect performance. More rules lead to poorer performance. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215
Fix: F-85597r1166344_fix

Configure RHEL 10 to generate audit records upon successful and unsuccessful attempts to use the "gpasswd" command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/bin/gpasswd -F perm=x -F auid>=1000 -F auid!=unset -k privileged-gpasswd Restart the audit daemon with the following command for the changes to take effect: $ sudo service auditd restart

b
RHEL 10 must generate audit records for successful and unsuccessful uses of the "kmod" command.
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
RHEL-10-500460
Vuln IDs
V-281132
Rule IDs
SV-281132r1166348_rule
Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary because these affect performance. More rules lead to poorer performance. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215, SRG-OS-000471-GPOS-00216, SRG-OS-000477-GPOS-00222
Fix: F-85598r1166347_fix

Configure RHEL 10 to generate audit records upon successful and unsuccessful attempts to use the "kmod" command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/bin/kmod -F perm=x -F auid>=1000 -F auid!=unset -k modules Restart the audit daemon with the following command for the changes to take effect: $ sudo service auditd restart

b
RHEL 10 must generate audit records for successful and unsuccessful uses of the "newgrp" command.
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
RHEL-10-500470
Vuln IDs
V-281133
Rule IDs
SV-281133r1166351_rule
Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary because these affect performance. More rules lead to poorer performance. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215
Fix: F-85599r1166350_fix

Configure RHEL 10 to generate audit records upon successful and unsuccessful attempts to use the "newgrp" command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/bin/newgrp -F perm=x -F auid>=1000 -F auid!=unset -k priv_cmd Restart the audit daemon with the following command for the changes to take effect: $ sudo service auditd restart

b
RHEL 10 must generate audit records for successful and unsuccessful uses of the "pam_timestamp_check" command.
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
RHEL-10-500480
Vuln IDs
V-281134
Rule IDs
SV-281134r1166354_rule
Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary because these affect performance. More rules lead to poorer performance. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215
Fix: F-85600r1166353_fix

Configure RHEL 10 to generate audit records upon successful and unsuccessful attempts to use the "pam_timestamp_check" command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/sbin/pam_timestamp_check -F perm=x -F auid>=1000 -F auid!=unset -k privileged-pam_timestamp_check Restart the audit daemon with the following command for the changes to take effect: $ sudo service auditd restart

b
RHEL 10 must generate audit records for successful and unsuccessful uses of the "passwd" command.
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
RHEL-10-500490
Vuln IDs
V-281135
Rule IDs
SV-281135r1184693_rule
Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary because these affect performance. More rules lead to poorer performance. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215
Fix: F-85601r1166356_fix

Configure RHEL 10 to generate audit records upon successful and unsuccessful attempts to use the "passwd" command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/bin/passwd -F perm=x -F auid>=1000 -F auid!=unset -k privileged-passwd Restart the audit daemon with the following command for the changes to take effect: $ sudo service auditd restart

b
RHEL 10 must generate audit records for successful and unsuccessful uses of the "postdrop" command.
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
RHEL-10-500500
Vuln IDs
V-281136
Rule IDs
SV-281136r1166360_rule
Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary because these affect performance. More rules lead to poorer performance. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215
Fix: F-85602r1166359_fix

Configure RHEL 10 to generate audit records upon successful and unsuccessful attempts to use the "postdrop" command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/sbin/postdrop -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update Restart the audit daemon with the following command for the changes to take effect: $ sudo service auditd restart

b
RHEL 10 must generate audit records for successful and unsuccessful uses of the "postqueue" command.
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
RHEL-10-500510
Vuln IDs
V-281137
Rule IDs
SV-281137r1197226_rule
Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary because these affect performance. More rules lead to poorer performance. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215
Fix: F-85603r1166362_fix

Configure RHEL 10 to generate audit records upon successful and unsuccessful attempts to use the "postqueue" command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/sbin/postqueue -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update Restart the audit daemon with the following command for the changes to take effect: $ sudo service auditd restart

b
RHEL 10 must generate audit records for successful and unsuccessful uses of the ssh-agent command.
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
RHEL-10-500520
Vuln IDs
V-281138
Rule IDs
SV-281138r1197227_rule
Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary because these affect performance. More rules lead to poorer performance. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215
Fix: F-85604r1166365_fix

Configure RHEL 10 to generate audit records upon successful and unsuccessful attempts to use the "ssh-agent" command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/bin/ssh-agent -F perm=x -F auid>=1000 -F auid!=unset -k privileged-ssh Restart the audit daemon with the following command for the changes to take effect: $ sudo service auditd restart

b
RHEL 10 must generate audit records for successful and unsuccessful uses of the "ssh-keysign" command.
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
RHEL-10-500530
Vuln IDs
V-281139
Rule IDs
SV-281139r1197228_rule
Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary because these affect performance. More rules lead to poorer performance. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215
Fix: F-85605r1166368_fix

Configure RHEL 10 to generate audit records upon successful and unsuccessful attempts to use the "ssh-keysign" command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/libexec/openssh/ssh-keysign -F perm=x -F auid>=1000 -F auid!=unset -k privileged-ssh Restart the audit daemon with the following command for the changes to take effect: $ sudo service auditd restart

b
RHEL 10 must generate audit records for successful and unsuccessful uses of the "su" command.
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
RHEL-10-500540
Vuln IDs
V-281140
Rule IDs
SV-281140r1197229_rule
Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary because these affect performance. More rules lead to poorer performance. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000064-GPOS-00033, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215, SRG-OS-000466-GPOS-00210, SRG-OS-000755-GPOS-00220
Fix: F-85606r1166371_fix

Configure RHEL 10 to generate audit records upon successful and unsuccessful attempts to use the "su" command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/bin/su -F perm=x -F auid>=1000 -F auid!=unset -k privileged-priv_change Restart the audit daemon with the following command for the changes to take effect: $ sudo service auditd restart

b
RHEL 10 must generate audit records for successful and unsuccessful uses of the "sudo" command.
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
RHEL-10-500550
Vuln IDs
V-281141
Rule IDs
SV-281141r1197230_rule
Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary because these affect performance. More rules lead to poorer performance. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215, SRG-OS-000466-GPOS-00210, SRG-OS-000755-GPOS-00220
Fix: F-85607r1166374_fix

Configure RHEL 10 to generate audit records upon successful and unsuccessful attempts to use the "sudo" command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/bin/sudo -F perm=x -F auid>=1000 -F auid!=unset -k priv_cmd Restart the audit daemon with the following command for the changes to take effect: $ sudo service auditd restart

b
RHEL 10 must generate audit records for successful and unsuccessful uses of the "sudoedit" command.
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
RHEL-10-500560
Vuln IDs
V-281142
Rule IDs
SV-281142r1197231_rule
Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary because these affect performance. More rules lead to poorer performance. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215, SRG-OS-000755-GPOS-00220
Fix: F-85608r1166377_fix

Configure RHEL 10 to generate audit records upon successful and unsuccessful attempts to use the "sudoedit" command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/bin/sudoedit -F perm=x -F auid>=1000 -F auid!=unset -k priv_cmd Restart the audit daemon with the following command for the changes to take effect: $ sudo service auditd restart

b
RHEL 10 must generate audit records for successful and unsuccessful uses of the "unix_chkpwd" command.
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
RHEL-10-500570
Vuln IDs
V-281143
Rule IDs
SV-281143r1197232_rule
Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary because these affect performance. More rules lead to poorer performance. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215
Fix: F-85609r1166380_fix

Configure RHEL 10 to generate audit records upon successful and unsuccessful attempts to use the "unix_chkpwd" command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/sbin/unix_chkpwd -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update Restart the audit daemon with the following command for the changes to take effect: $ sudo service auditd restart

b
RHEL 10 must generate audit records for successful and unsuccessful uses of the "unix_update" command.
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
RHEL-10-500580
Vuln IDs
V-281144
Rule IDs
SV-281144r1166384_rule
Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary because these affect performance. More rules lead to poorer performance. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000064-GPOS-00033, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215
Fix: F-85610r1166383_fix

Configure RHEL 10 to generate audit records upon successful and unsuccessful attempts to use the "unix_update" command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/sbin/unix_update -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update Restart the audit daemon with the following command for the changes to take effect: $ sudo service auditd restart

b
RHEL 10 must generate audit records for successful and unsuccessful uses of the "userhelper" command.
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
RHEL-10-500590
Vuln IDs
V-281145
Rule IDs
SV-281145r1197233_rule
Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary because these affect performance. More rules lead to poorer performance. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215
Fix: F-85611r1166386_fix

Configure RHEL 10 to generate audit records upon successful and unsuccessful attempts to use the "userhelper" command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/sbin/userhelper -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update Restart the audit daemon with the following command for the changes to take effect: $ sudo service auditd restart

b
RHEL 10 must generate audit records for successful and unsuccessful uses of the "usermod" command.
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
RHEL-10-500600
Vuln IDs
V-281146
Rule IDs
SV-281146r1197235_rule
Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary because these affect performance. More rules lead to poorer performance. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215, SRG-OS-000466-GPOS-00210
Fix: F-85612r1197234_fix

Configure RHEL 10 to generate audit records upon successful and unsuccessful attempts to use the "usermod" command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/sbin/usermod -F perm=x -F auid>=1000 -F auid!=unset -k privileged-usermod Restart the audit daemon with the following command for the changes to take effect: $ sudo service auditd restart

b
RHEL 10 must generate audit records for successful and unsuccessful uses of the "mount" command.
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
RHEL-10-500610
Vuln IDs
V-281147
Rule IDs
SV-281147r1166393_rule
Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each syscall made by all programs on the system. Therefore, it is very important to use syscall rules only when absolutely necessary because these affect performance. More rules lead to poorer performance. The performance can be helped, however, by combining syscalls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215
Fix: F-85613r1166392_fix

Configure RHEL 10 to generate audit records upon successful and unsuccessful attempts to use the "mount" command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F arch=b32 -S mount -F auid>=1000 -F auid!=unset -k export -a always,exit -F arch=b64 -S mount -F auid>=1000 -F auid!=unset -k export Restart the audit daemon with the following command for the changes to take effect: $ sudo service auditd restart

b
RHEL 10 must generate audit records for successful and unsuccessful uses of the "init" command.
RMF Control
AU-12
Severity
M
CCI
CCI-000172
Version
RHEL-10-500620
Vuln IDs
V-281148
Rule IDs
SV-281148r1166396_rule
Misuse of the "init" command may cause availability issues for the system.
Fix: F-85614r1166395_fix

Configure RHEL 10 to generate audit records upon successful and unsuccessful uses of the "init" command by adding or updating the following rule in the "/etc/audit/rules.d/audit.rules" file: -a always,exit -F path=/usr/sbin/init -F perm=x -F auid>=1000 -F auid!=unset -k privileged-init Restart the audit daemon with the following command for the changes to take effect: $ sudo service auditd restart

b
RHEL 10 must generate audit records for successful and unsuccessful uses of the "poweroff" command.
RMF Control
AU-12
Severity
M
CCI
CCI-000172
Version
RHEL-10-500630
Vuln IDs
V-281149
Rule IDs
SV-281149r1166399_rule
Misuse of the "poweroff" command may cause availability issues for the system.
Fix: F-85615r1166398_fix

Configure RHEL 10 to generate audit records upon successful and unsuccessful uses of the "poweroff" command by adding or updating the following rule in the "/etc/audit/rules.d/audit.rules" file: -a always,exit -F path=/usr/sbin/poweroff -F perm=x -F auid>=1000 -F auid!=unset -k privileged-poweroff Restart the audit daemon with the following command for the changes to take effect: $ sudo service auditd restart

b
RHEL 10 must generate audit records for successful and unsuccessful uses of the "reboot" command.
RMF Control
AU-12
Severity
M
CCI
CCI-000172
Version
RHEL-10-500640
Vuln IDs
V-281150
Rule IDs
SV-281150r1166402_rule
Misuse of the "reboot" command may cause system availability issues.
Fix: F-85616r1166401_fix

Configure RHEL 10 to generate audit records upon successful and unsuccessful uses of the "reboot" command by adding or updating the following rule in the "/etc/audit/rules.d/audit.rules" file: -a always,exit -F path=/usr/sbin/reboot -F perm=x -F auid>=1000 -F auid!=unset -k privileged-reboot Restart the audit daemon with the following command for the changes to take effect: $ sudo service auditd restart

b
RHEL 10 must generate audit records for successful and unsuccessful uses of the shutdown command.
RMF Control
AU-12
Severity
M
CCI
CCI-000172
Version
RHEL-10-500650
Vuln IDs
V-281151
Rule IDs
SV-281151r1166405_rule
Misuse of the shutdown command may cause availability issues for the system.
Fix: F-85617r1166404_fix

Configure RHEL 10 to generate audit records upon successful and unsuccessful uses of the "shutdown" command by adding or updating the following rule in the "/etc/audit/rules.d/audit.rules" file: -a always,exit -F path=/usr/sbin/shutdown -F perm=x -F auid>=1000 -F auid!=unset -k privileged-shutdown Restart the audit daemon with the following command for the changes to take effect: $ sudo service auditd restart

b
RHEL 10 must generate audit records for successful and unsuccessful uses of the "umount" system call.
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
RHEL-10-500660
Vuln IDs
V-281152
Rule IDs
SV-281152r1166408_rule
The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing discretionary access control (DAC) modifications can facilitate the identification of patterns of abuse among both authorized and unauthorized users. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215
Fix: F-85618r1166407_fix

Configure RHEL 10 to generate audit records upon successful and unsuccessful uses of the "umount" system call by adding or updating the following rules in "/etc/audit/audit.rules" and adding the following rules to "/etc/audit/rules.d/perm_mod.rules" or updating the existing rules in files in the "/etc/audit/rules.d/" directory: -a always,exit -F arch=b32 -S umount -F auid>=1000 -F auid!=unset -k privileged-umount Restart the audit daemon with the following command for the changes to take effect: $ sudo service auditd restart

b
RHEL 10 must generate audit records for successful and unsuccessful uses of the "umount2" system call.
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
RHEL-10-500670
Vuln IDs
V-281153
Rule IDs
SV-281153r1166411_rule
The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing discretionary access control (DAC) modifications can facilitate the identification of patterns of abuse among both authorized and unauthorized users. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215
Fix: F-85619r1166410_fix

Configure RHEL 10 to generate audit records upon successful and unsuccessful uses of the "umount2" system call by adding or updating the following rules in a file in "/etc/audit/rules.d": -a always,exit -F arch=b32 -S umount2 -F auid>=1000 -F auid!=unset -k privileged-umount -a always,exit -F arch=b64 -S umount2 -F auid>=1000 -F auid!=unset -k privileged-umount Restart the audit daemon with the following command for the changes to take effect: $ sudo service auditd restart

b
RHEL 10 must generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/sudoers".
RMF Control
AC-2
Severity
M
CCI
CCI-000018
Version
RHEL-10-500680
Vuln IDs
V-281154
Rule IDs
SV-281154r1166414_rule
The actions taken by system administrators must be audited to keep a record of what was executed on the system, as well as for accountability purposes. Editing the "sudoers" file may be sign of an attacker trying to establish persistent methods to a system. Auditing the editing of the "sudoers" files mitigates this risk. Satisfies: SRG-OS-000004-GPOS-00004, SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000304-GPOS-00121, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000470-GPOS-00214, SRG-OS-000471-GPOS-00215, SRG-OS-000239-GPOS-00089, SRG-OS-000240-GPOS-00090, SRG-OS-000241-GPOS-00091, SRG-OS-000303-GPOS-00120, SRG-OS-000466-GPOS-00210, SRG-OS-000476-GPOS-00221
Fix: F-85620r1166413_fix

Configure RHEL 10 to generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/sudoers". Add or update the following file system rule to "/etc/audit/rules.d/audit.rules": -a always,exit -F arch=b32 -F path=/etc/sudoers -F perm=wa -F key=logins -a always,exit -F arch=b64 -F path=/etc/sudoers -F perm=wa -F key=logins Restart the audit daemon with the following command for the changes to take effect: $ sudo service auditd restart

b
RHEL 10 must generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/group".
RMF Control
AC-2
Severity
M
CCI
CCI-000018
Version
RHEL-10-500700
Vuln IDs
V-281156
Rule IDs
SV-281156r1166420_rule
In addition to auditing new user and group accounts, these watches will alert the system administrator(s) to any modifications. Any unexpected users, groups, or modifications must be investigated for legitimacy. Satisfies: SRG-OS-000004-GPOS-00004, SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000304-GPOS-00121, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000470-GPOS-00214, SRG-OS-000471-GPOS-00215, SRG-OS-000239-GPOS-00089, SRG-OS-000240-GPOS-00090, SRG-OS-000241-GPOS-00091, SRG-OS-000303-GPOS-00120, SRG-OS-000466-GPOS-00210, SRG-OS-000476-GPOS-00221
Fix: F-85622r1166419_fix

Configure RHEL 10 to generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/group". Add or update the following file system rule to "/etc/audit/rules.d/audit.rules": -a always,exit -F arch=b32 -F path=/etc/group -F perm=wa -F key=identity -a always,exit -F arch=b64 -F path=/etc/group -F perm=wa -F key=identity Restart the audit daemon with the following command for the changes to take effect: $ sudo service auditd restart

b
RHEL 10 must generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/gshadow".
RMF Control
AC-2
Severity
M
CCI
CCI-000018
Version
RHEL-10-500710
Vuln IDs
V-281157
Rule IDs
SV-281157r1166423_rule
In addition to auditing new user and group accounts, these watches will alert the system administrator(s) to any modifications. Any unexpected users, groups, or modifications should be investigated for legitimacy. Satisfies: SRG-OS-000004-GPOS-00004, SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000304-GPOS-00121, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000470-GPOS-00214, SRG-OS-000471-GPOS-00215, SRG-OS-000239-GPOS-00089, SRG-OS-000240-GPOS-00090, SRG-OS-000241-GPOS-00091, SRG-OS-000303-GPOS-00120, SRG-OS-000466-GPOS-00210, SRG-OS-000476-GPOS-00221
Fix: F-85623r1166422_fix

Configure RHEL 10 to generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/gshadow". Add or update the following file system rule to "/etc/audit/rules.d/audit.rules": -a always,exit -F arch=b32 -F path=/etc/gshadow -F perm=wa -F key=identity -a always,exit -F arch=b64 -F path=/etc/gshadow -F perm=wa -F key=identity Restart the audit daemon with the following command for the changes to take effect: $ sudo service auditd restart

b
RHEL 10 must generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/opasswd".
RMF Control
AC-2
Severity
M
CCI
CCI-000018
Version
RHEL-10-500720
Vuln IDs
V-281158
Rule IDs
SV-281158r1166426_rule
In addition to auditing new user and group accounts, these watches will alert the system administrator(s) to any modifications. Any unexpected users, groups, or modifications should be investigated for legitimacy. Satisfies: SRG-OS-000004-GPOS-00004, SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000304-GPOS-00121, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000470-GPOS-00214, SRG-OS-000471-GPOS-00215, SRG-OS-000239-GPOS-00089, SRG-OS-000240-GPOS-00090, SRG-OS-000241-GPOS-00091, SRG-OS-000303-GPOS-00120, SRG-OS-000466-GPOS-00210, SRG-OS-000476-GPOS-00221
Fix: F-85624r1166425_fix

Configure RHEL 10 to generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/security/opasswd". Add or update the following file system rule to "/etc/audit/rules.d/audit.rules": -a always,exit -F arch=b32 -F path=/etc/security/opasswd -F perm=wa -F key=identity -a always,exit -F arch=b64 -F path=(/etc/security/opasswd -F perm=wa -F key=identity Restart the audit daemon with the following command for the changes to take effect: $ sudo service auditd restart

b
RHEL 10 must generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/passwd".
RMF Control
AC-2
Severity
M
CCI
CCI-000018
Version
RHEL-10-500730
Vuln IDs
V-281159
Rule IDs
SV-281159r1166429_rule
In addition to auditing new user and group accounts, these watches will alert the system administrator(s) to any modifications. Any unexpected users, groups, or modifications should be investigated for legitimacy. Satisfies: SRG-OS-000004-GPOS-00004, SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000304-GPOS-00121, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000470-GPOS-00214, SRG-OS-000471-GPOS-00215, SRG-OS-000239-GPOS-00089, SRG-OS-000240-GPOS-00090, SRG-OS-000241-GPOS-00091, SRG-OS-000303-GPOS-00120, SRG-OS-000466-GPOS-00210, SRG-OS-000476-GPOS-00221, SRG-OS-000274-GPOS-00104, SRG-OS-000275-GPOS-00105, SRG-OS-000276-GPOS-00106, SRG-OS-000277-GPOS-00107
Fix: F-85625r1166428_fix

Configure RHEL 10 to generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/passwd". Add or update the following file system rule to "/etc/audit/rules.d/audit.rules": -a always,exit -F arch=b32 -F path=/etc/passwd -F perm=wa -F key=identity -a always,exit -F arch=b64 -F path=/etc/passwd -F perm=wa -F key=identity Restart the audit daemon with the following command for the changes to take effect: $ sudo service auditd restart

b
RHEL 10 must generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/shadow".
RMF Control
AC-2
Severity
M
CCI
CCI-000018
Version
RHEL-10-500740
Vuln IDs
V-281160
Rule IDs
SV-281160r1184695_rule
In addition to auditing new user and group accounts, these watches will alert the system administrator(s) to any modifications. Any unexpected users, groups, or modifications should be investigated for legitimacy. Satisfies: SRG-OS-000004-GPOS-00004, SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000304-GPOS-00121, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000470-GPOS-00214, SRG-OS-000471-GPOS-00215, SRG-OS-000239-GPOS-00089, SRG-OS-000240-GPOS-00090, SRG-OS-000241-GPOS-00091, SRG-OS-000303-GPOS-00120, SRG-OS-000466-GPOS-00210, SRG-OS-000476-GPOS-00221
Fix: F-85626r1166431_fix

Configure RHEL 10 to generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/shadow". Add or update the following file system rule to "/etc/audit/rules.d/audit.rules": -a always,exit -F arch=b32 -F path=/etc/shadow -F perm=wa -F key=identity -a always,exit -F arch=b64 -F path=/etc/shadow -F perm=wa -F key=identity Restart the audit daemon with the following command for the changes to take effect: $ sudo service auditd restart

b
RHEL 10 must generate audit records for all account creations, modifications, disabling, and termination events that affect "/var/log/faillock".
RMF Control
MA-4
Severity
M
CCI
CCI-002884
Version
RHEL-10-500750
Vuln IDs
V-281161
Rule IDs
SV-281161r1166435_rule
Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Satisfies: SRG-OS-000392-GPOS-00172, SRG-OS-000470-GPOS-00214, SRG-OS-000473-GPOS-00218
Fix: F-85627r1166434_fix

Configure RHEL 10 to generate audit records for all account creations, modifications, disabling, and termination events that affect "/var/log/faillock". Add or update the following file system rule to "/etc/audit/rules.d/audit.rules": -a always,exit -F arch=b32 -F path=/var/log/faillock -F perm=wa -F key=identity -a always,exit -F arch=b64 -F path=/var/log/faillock -F perm=wa -F key=identity Restart the audit daemon with the following command for the changes to take effect: $ sudo service auditd restart

b
RHEL 10 must generate audit records for all account creations, modifications, disabling, and termination events that affect "/var/log/lastlog".
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
RHEL-10-500760
Vuln IDs
V-281162
Rule IDs
SV-281162r1166438_rule
Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215, SRG-OS-000473-GPOS-00218, SRG-OS-000470-GPOS-00214
Fix: F-85628r1166437_fix

Configure RHEL 10 to generate audit records for all account creations, modifications, disabling, and termination events that affect "/var/log/lastlog". Add or update the following file system rule to "/etc/audit/rules.d/audit.rules": -a always,exit -F arch=b32 -F path=/var/log/lastlog -F perm=wa -F key=logins -a always,exit -F arch=b64 -F path=/var/log/lastlog -F perm=wa -F key=logins Restart the audit daemon with the following command for the changes to take effect: $ sudo service auditd restart

b
RHEL 10 must generate audit records for all uses of the "chmod", "fchmod", "fchmodat", and "fchmodat2" syscalls.
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
RHEL-10-500780
Vuln IDs
V-281163
Rule IDs
SV-281163r1166441_rule
Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each syscall made by all programs on the system. Therefore, it is very important to use syscall rules only when absolutely necessary because these affect performance. More rules lead to poorer performance. The performance can be helped, however, by combining syscalls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215, SRG-OS-000064-GPOS-00033, SRG-OS-000466-GPOS-00210, SRG-OS-000458-GPOS-00203
Fix: F-85629r1166440_fix

Configure RHEL 10 to generate audit records upon successful and unsuccessful attempts to use the "chmod", "fchmod", "fchmodat", and "fchmodat2" syscalls. Add or update the following rules in "/etc/audit/rules.d/audit.rules": -a always,exit -F arch=b32 -S chmod,fchmod,fchmodat,fchmodat2 -F auid>=1000 -F auid!=unset -k perm_mod -a always,exit -F arch=b64 -S chmod,fchmod,fchmodat,fchmodat2 -F auid>=1000 -F auid!=unset -k perm_mod Restart the audit daemon with the following command for the changes to take effect: $ sudo service auditd restart

b
RHEL 10 must generate audit records for all uses of the "chown", "fchown", "fchownat", and "lchown" syscalls.
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
RHEL-10-500790
Vuln IDs
V-281164
Rule IDs
SV-281164r1166444_rule
Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each syscall made by all programs on the system. Therefore, it is very important to use syscall rules only when absolutely necessary because these affect performance. More rules lead to poorer performance. The performance can be helped, however, by combining syscalls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215, SRG-OS-000064-GPOS-00033, SRG-OS-000466-GPOS-00210, SRG-OS-000458-GPOS-00203, SRG-OS-000474-GPOS-00219
Fix: F-85630r1166443_fix

Configure RHEL 10 to generate audit records upon successful/unsuccessful attempts to use the "chown", "fchown", "fchownat", and "lchown"" syscalls. Add or update the following rules in "/etc/audit/rules.d/audit.rules": -a always,exit -F arch=b32 -S chown,fchown,fchownat,lchown -F auid>=1000 -F auid!=unset -k perm_mod -a always,exit -F arch=b64 -S chown,fchown,fchownat,lchown -F auid>=1000 -F auid!=unset -k perm_mod Restart the audit daemon with the following command for the changes to take effect: $ sudo service auditd restart

b
RHEL 10 must generate audit records for all uses of the "rename", "unlink", "rmdir", "renameat", "renameat2", and "unlinkat" system calls.
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
RHEL-10-500810
Vuln IDs
V-281165
Rule IDs
SV-281165r1166447_rule
Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each syscall made by all programs on the system. Therefore, it is very important to use syscall rules only when absolutely necessary because these affect performance. More rules lead to poorer performance. The performance can be helped, however, by combining syscalls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215, SRG-OS-000466-GPOS-00210, SRG-OS-000467-GPOS-00211, SRG-OS-000468-GPOS-00212
Fix: F-85631r1166446_fix

Configure RHEL 10 to generate an audit event for any successful/unsuccessful use of the "rename", "unlink", "rmdir", "renameat", "renameat2", and "unlinkat" system calls by adding or updating the following rules in the "/etc/audit/rules.d/audit.rules" file: -a always,exit -F arch=b32 -S rename,unlink,rmdir,renameat,renameat2,unlinkat -F auid>=1000 -F auid!=unset -k delete -a always,exit -F arch=b64 -S rename,unlink,rmdir,renameat,renameat2,unlinkat -F auid>=1000 -F auid!=unset -k delete Restart the audit daemon with the following command for the changes to take effect: $ sudo service auditd restart

b
RHEL 10 must require a boot loader superuser password.
RMF Control
AC-3
Severity
M
CCI
CCI-000213
Version
RHEL-10-600000
Vuln IDs
V-281166
Rule IDs
SV-281166r1166450_rule
To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DOD-approved PKIs, all DOD systems (e.g., web servers and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement. Password protection on the boot loader configuration ensures users with physical access cannot trivially alter important bootloader settings. These include which kernel to use and whether to enter single-user mode.
Fix: F-85632r1166449_fix

Configure RHEL 10 to require a grub bootloader password for the grub superuser account. Generate an encrypted grub2 password for the grub superuser account with the following command: $ sudo grub2-setpassword Enter password: Confirm password:

b
RHEL 10 must not assign an interactive login shell for system accounts.
RMF Control
SI-6
Severity
M
CCI
CCI-002696
Version
RHEL-10-600020
Vuln IDs
V-281168
Rule IDs
SV-281168r1195416_rule
Ensuring shells are not given to system accounts upon login makes it more difficult for attackers to use system accounts.
Fix: F-85634r1166455_fix

Configure RHEL 10 so that all noninteractive accounts on the system do not have an interactive shell assigned to them. If the system account needs a shell assigned for mission operations, document the need with the ISSO. Run the following command to disable the interactive shell for a specific noninteractive user account: Replace <user> with the user that has a login shell. $ sudo usermod --shell /sbin/nologin <user> Do not perform the steps in this section on the root account. Doing so will cause the system to become inaccessible.

b
RHEL 10 must, for new users or password changes, have a 60-day maximum password lifetime restriction for user account passwords in "/etc/login.defs".
RMF Control
Severity
M
CCI
CCI-004066
Version
RHEL-10-600100
Vuln IDs
V-281169
Rule IDs
SV-281169r1166459_rule
Any password, no matter how complex, can eventually be cracked; therefore, passwords must be changed periodically. If the operating system does not limit the lifetime of passwords and force users to change their passwords, there is the risk that the operating system passwords could be compromised. Setting the password maximum age ensures users are required to periodically change their passwords. Requiring shorter password lifetimes increases the risk of users writing down the password in a convenient location subject to physical compromise.
Fix: F-85635r1166458_fix

Configure RHEL 10 to enforce a 60-day maximum password lifetime. Add or modify the following line in the "/etc/login.defs" file: PASS_MAX_DAYS 60

b
RHEL 10 must assign a home directory for local interactive user accounts upon creation.
RMF Control
SI-16
Severity
M
CCI
CCI-002824
Version
RHEL-10-600120
Vuln IDs
V-281171
Rule IDs
SV-281171r1166465_rule
If local interactive users are not assigned a valid home directory, there is no place for the storage and control of files they should own.
Fix: F-85637r1166464_fix

Configure RHEL 10 to assign home directories to all new local interactive users by setting the "CREATE_HOME" parameter in "/etc/login.defs" to "yes" as follows: CREATE_HOME yes

b
RHEL 10 must not allow duplicate user IDs (UIDs) to exist for interactive users.
RMF Control
IA-2
Severity
M
CCI
CCI-000764
Version
RHEL-10-600130
Vuln IDs
V-281172
Rule IDs
SV-281172r1166468_rule
To ensure accountability and prevent unauthenticated access, interactive users must be identified and authenticated to prevent potential misuse and compromise of the system. Satisfies: SRG-OS-000104-GPOS-00051, SRG-OS-000121-GPOS-00062
Fix: F-85638r1166467_fix

Configure RHEL 10 to not allow duplicate UIDs to exist for interactive users. Edit the file "/etc/passwd", and provide each interactive user account that has a duplicate UID with a unique UID.

b
RHEL 10 must assign a primary group to all interactive users.
RMF Control
IA-2
Severity
M
CCI
CCI-000764
Version
RHEL-10-600150
Vuln IDs
V-281174
Rule IDs
SV-281174r1166474_rule
If a user is assigned the group identifier (GID) of a group that does not exist on the system, and a group with the GID is subsequently created, the user may have unintended rights to any files associated with the group.
Fix: F-85640r1166473_fix

Configure RHEL 10 so that all GIDs referenced in "/etc/passwd" are defined in "/etc/group". Edit the file "/etc/passwd" and ensure that every user's GID is a valid GID.

b
RHEL 10 must disable account identifiers (individuals, groups, roles, and devices) after 35 days of inactivity.
RMF Control
Severity
M
CCI
CCI-003627
Version
RHEL-10-600160
Vuln IDs
V-281175
Rule IDs
SV-281175r1197238_rule
Inactive identifiers pose a risk to systems and applications because attackers may exploit an inactive identifier and potentially obtain undetected access to the system. Disabling inactive accounts ensures accounts that may not have been responsibly removed are not available to attackers who may have compromised their credentials. Owners of inactive accounts will not notice if unauthorized access to their user account has been obtained. Satisfies: SRG-OS-000118-GPOS-00060, SRG-OS-000590-GPOS-00110
Fix: F-85641r1166476_fix

Configure RHEL 10 to disable account identifiers after 35 days of inactivity after the password expiration. Run the following command to change the configuration for "useradd": $ sudo useradd -D -f 35 A recommendation is 35 days, but a lower value is acceptable.

b
RHEL 10 must assign a home directory to all local interactive users in the "/etc/passwd" file.
RMF Control
SC-5
Severity
M
CCI
CCI-002385
Version
RHEL-10-600180
Vuln IDs
V-281177
Rule IDs
SV-281177r1184748_rule
If local interactive users are not assigned a valid home directory, there is no place for the storage and control of files they should own.
Fix: F-85643r1166482_fix

Configure RHEL 10 interactive users to have a home directory assigned in the "/etc/passwd" file. Create and assign home directories to all local interactive users on RHEL 10 that do not have a home directory assigned.

b
RHEL 10 must enforce a delay of at least four seconds between login prompts following a failed login attempt.
RMF Control
AC-7
Severity
M
CCI
CCI-002238
Version
RHEL-10-600200
Vuln IDs
V-281179
Rule IDs
SV-281179r1166489_rule
Increasing the time between a failed authentication attempt and reprompting to enter credentials helps to slow a single-threaded brute-force attack.
Fix: F-85645r1166488_fix

Configure RHEL 10 to enforce a delay of at least four seconds between login prompts following a failed console login attempt. Modify the "/etc/login.defs" file to set the "FAIL_DELAY" parameter to "4" or greater: FAIL_DELAY 4

b
RHEL 10 must enforce that passwords be created with a minimum of 15 characters.
RMF Control
Severity
M
CCI
CCI-004066
Version
RHEL-10-600220
Vuln IDs
V-281181
Rule IDs
SV-281181r1195421_rule
The shorter the password, the lower the number of possible combinations that must be tested before the password is compromised. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password length is one factor of several that helps to determine strength and how long it takes to crack a password. Use of more characters in a password helps to increase exponentially the time and/or resources required to compromise the password. RHEL 10 uses "pwquality" as a mechanism to enforce password complexity. Configurations are set in the "etc/security/pwquality.conf" file. The "minlen", sometimes noted as minimum length, acts as a "score" of complexity based on the credit components of the "pwquality" module. By setting the credit components to a negative value, those components will not only be required but will not count toward the total "score" of "minlen". This will enable "minlen" to require a 15-character minimum. The DOD minimum password requirement is 15 characters.
Fix: F-85647r1195420_fix

Configure RHEL 10 to enforce a minimum 15-character password length. Add or update the following line in the "/etc/security/pwquality.conf" file or a configuration file in the "/etc/security/pwquality.conf.d/" directory to contain the "minlen" parameter: minlen = 15

b
RHEL 10 must enforce password complexity by requiring at least one special character to be used.
RMF Control
Severity
M
CCI
CCI-004066
Version
RHEL-10-600230
Vuln IDs
V-281182
Rule IDs
SV-281182r1195424_rule
Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that must be tested before the password is compromised. RHEL 10 uses "pwquality" as a mechanism to enforce password complexity. Note that to require special characters without degrading the "minlen" value, the credit value must be expressed as a negative number in "/etc/security/pwquality.conf".
Fix: F-85648r1195423_fix

Configure RHEL 10 to enforce password complexity by requiring that at least one special character be used by setting the "ocredit" option. Add or update the following line in the "/etc/security/pwquality.conf" file or a configuration file in the "/etc/security/pwquality.conf.d/" directory to contain the "ocredit" parameter: ocredit = -1

b
RHEL 10 must enforce password complexity by requiring that at least one lowercase character be used.
RMF Control
Severity
M
CCI
CCI-004066
Version
RHEL-10-600240
Vuln IDs
V-281183
Rule IDs
SV-281183r1195427_rule
Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that must be tested before the password is compromised. Requiring a minimum number of lowercase characters makes password guessing attacks more difficult by ensuring a larger search space.
Fix: F-85649r1195426_fix

Configure RHEL 10 to enforce password complexity by requiring that at least one lowercase character be used by setting the "lcredit" option. Add or update the following line in the "/etc/security/pwquality.conf" file or a configuration file in the "/etc/security/pwquality.conf.d/" directory to contain the "lcredit" parameter: lcredit = -1

b
RHEL 10 must enforce password complexity by requiring that at least one uppercase character be used.
RMF Control
Severity
M
CCI
CCI-004066
Version
RHEL-10-600250
Vuln IDs
V-281184
Rule IDs
SV-281184r1197239_rule
Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that must be tested before the password is compromised. Requiring a minimum number of uppercase characters makes password guessing attacks more difficult by ensuring a larger search space. Satisfies: SRG-OS-000069-GPOS-00037, SRG-OS-000070-GPOS-00038
Fix: F-85650r1195429_fix

Configure RHEL 10 to enforce password complexity by requiring that at least one uppercase character be used by setting the "ucredit" option. Add or update the following line in the "/etc/security/pwquality.conf" file or a configuration file in the "/etc/security/pwquality.conf.d/" directory to contain the "ucredit" parameter: ucredit = -1

b
RHEL 10 must require the change of at least eight characters when passwords are changed.
RMF Control
Severity
M
CCI
CCI-004066
Version
RHEL-10-600260
Vuln IDs
V-281185
Rule IDs
SV-281185r1195433_rule
Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute–force attacks. Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that must be tested before the password is compromised. Requiring a minimum number of different characters during password changes ensures that newly changed passwords should not resemble previously compromised ones. Note that passwords that are changed on compromised systems will still be compromised.
Fix: F-85651r1195432_fix

Configure RHEL 10 to require the change of at least eight of the total number of characters when passwords are changed by setting the "difok" option. Add or update the following line in the "/etc/security/pwquality.conf" file or a configuration file in the "/etc/security/pwquality.conf.d/" directory to contain the "difok" parameter: difok = 8

b
RHEL 10 must require the maximum number of repeating characters of the same character class to be limited to four when passwords are changed.
RMF Control
Severity
M
CCI
CCI-004066
Version
RHEL-10-600280
Vuln IDs
V-281187
Rule IDs
SV-281187r1195436_rule
Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password complexity is one factor of several that determines how long it takes to crack a password. The more complex a password is, the greater the number of possible combinations that must be tested before the password is compromised. Satisfies: SRG-OS-000072-GPOS-00040, SRG-OS-000730-GPOS-00190
Fix: F-85653r1195435_fix

Configure RHEL 10 to require the change of the number of repeating characters of the same character class when passwords are changed by setting the "maxclassrepeat" option. Add or update the following line in the "/etc/security/pwquality.conf" file or a configuration file in the "/etc/security/pwquality.conf.d/" directory to contain the "maxclassrepeat" parameter: maxclassrepeat = 4

b
RHEL 10 must require that the maximum number of repeating characters be limited to three when passwords are changed.
RMF Control
Severity
M
CCI
CCI-004066
Version
RHEL-10-600290
Vuln IDs
V-281188
Rule IDs
SV-281188r1195439_rule
Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password complexity is one factor of several that determines how long it takes to crack a password. The more complex a password is, the greater the number of possible combinations that must be tested before the password is compromised.
Fix: F-85654r1195438_fix

Configure RHEL 10 to require the change of the number of repeating consecutive characters when passwords are changed by setting the "maxrepeat" option. Add or update the following line in the "/etc/security/pwquality.conf" file or a configuration file in the "/etc/security/pwquality.conf.d/" directory to contain the "maxrepeat" parameter: maxrepeat = 3

b
RHEL 10 must require the change of at least four character classes when passwords are changed.
RMF Control
Severity
M
CCI
CCI-004066
Version
RHEL-10-600300
Vuln IDs
V-281189
Rule IDs
SV-281189r1195442_rule
Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password complexity is one factor of several that determines how long it takes to crack a password. The more complex a password is, the greater the number of possible combinations that must be tested before the password is compromised.
Fix: F-85655r1195441_fix

Configure RHEL 10 to require the change of at least four character classes when passwords are changed by setting the "minclass" option. Add or update the following line in the "/etc/security/pwquality.conf" file or a configuration file in the "/etc/security/pwquality.conf.d/" directory to contain the "minclass" parameter: minclass = 4

b
RHEL 10 must enforce password complexity by requiring that at least one numeric character be used.
RMF Control
Severity
M
CCI
CCI-004066
Version
RHEL-10-600310
Vuln IDs
V-281190
Rule IDs
SV-281190r1195445_rule
Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password is, the greater the number of possible combinations that must be tested before the password is compromised. Requiring digits makes password guessing attacks more difficult by ensuring a larger search space.
Fix: F-85656r1195444_fix

Configure RHEL 10 to enforce password complexity by requiring that at least one numeric character be used by setting the "dcredit" option. Add or update the following line in the "/etc/security/pwquality.conf" file or a configuration file in the "/etc/security/pwquality.conf.d/" directory to contain the "dcredit" parameter: dcredit = -1

b
RHEL 10 must prevent the use of dictionary words for passwords.
RMF Control
Severity
M
CCI
CCI-004066
Version
RHEL-10-600320
Vuln IDs
V-281191
Rule IDs
SV-281191r1195448_rule
Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. If RHEL 10 allows the user to select passwords based on dictionary words, this increases the chances of password compromise by increasing the opportunity for successful guesses and brute-force attacks. Satisfies: SRG-OS-000480-GPOS-00225, SRG-OS-000072-GPOS-00040
Fix: F-85657r1195447_fix

Configure RHEL 10 to prevent the use of dictionary words for passwords. Add or update the following line in the "/etc/security/pwquality.conf" file or a configuration file in the "/etc/security/pwquality.conf.d/" directory to contain the "dictcheck" parameter: dictcheck=1

b
RHEL 10 must allow only the root account to have unrestricted access to the system.
RMF Control
AC-3
Severity
M
CCI
CCI-000213
Version
RHEL-10-600400
Vuln IDs
V-281192
Rule IDs
SV-281192r1166528_rule
An account has root authority if it has a user identifier (UID) of "0". Multiple accounts with a UID of "0" afford more opportunity for potential intruders to guess a password for a privileged account. Proper configuration of sudo is recommended to afford multiple system administrators access to root privileges in an accountable manner.
Fix: F-85658r1166527_fix

Configure RHEL 10 so that only the "root" account has a UID assignment of "0". Change the UID of any account on the system, other than "root", that has a UID of "0". If the account is associated with system commands or applications, the UID should be changed to one greater than "0" but less than "1000". Otherwise, assign a UID of greater than "1000" that has not already been assigned.

b
RHEL 10 must enforce password complexity rules for the "root" account.
RMF Control
Severity
M
CCI
CCI-004066
Version
RHEL-10-600405
Vuln IDs
V-281193
Rule IDs
SV-281193r1166531_rule
Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that must be tested before the password is compromised. Satisfies: SRG-OS-000072-GPOS-00040, SRG-OS-000071-GPOS-00039, SRG-OS-000070-GPOS-00038, SRG-OS-000266-GPOS-00101, SRG-OS-000078-GPOS-00046, SRG-OS-000480-GPOS-00225, SRG-OS-000069-GPOS-00037
Fix: F-85659r1166530_fix

Configure RHEL 10 to enforce password complexity on the "root" account. Add or update the following line in the "/etc/security/pwquality.conf" file or a configuration file in the "/etc/security/pwquality.conf.d/" directory to contain the "enforce_for_root" parameter: enforce_for_root

b
RHEL 10 must automatically lock an account when three unsuccessful login attempts occur.
RMF Control
AC-7
Severity
M
CCI
CCI-002238
Version
RHEL-10-600410
Vuln IDs
V-281194
Rule IDs
SV-281194r1166534_rule
By limiting the number of failed login attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute-force attacks, is reduced. Limits are imposed by locking the account. Satisfies: SRG-OS-000329-GPOS-00128, SRG-OS-000021-GPOS-00005
Fix: F-85660r1166533_fix

Configure RHEL 10 to lock an account when three unsuccessful login attempts occur. Add/modify the "/etc/security/faillock.conf" file to match the following line: deny = 3

b
RHEL 10 must automatically lock the root account until the root account is released by an administrator when three unsuccessful login attempts occur during a 15-minute time period.
RMF Control
AC-7
Severity
M
CCI
CCI-002238
Version
RHEL-10-600415
Vuln IDs
V-281195
Rule IDs
SV-281195r1166537_rule
By limiting the number of failed login attempts, the risk of unauthorized system access via user password guessing, also known as brute-forcing, is reduced. Limits are imposed by locking the account. Satisfies: SRG-OS-000329-GPOS-00128, SRG-OS-000021-GPOS-00005
Fix: F-85661r1166536_fix

Configure RHEL 10 to lock out the "root" account after a number of incorrect login attempts using "pam_faillock.so". Enable the feature using the following command: $ sudo authselect enable-feature with-faillock Edit the "/etc/security/faillock.conf" by uncommenting or adding the following line: even_deny_root

b
RHEL 10 must automatically lock an account when three unsuccessful login attempts occur during a 15-minute time period.
RMF Control
AC-7
Severity
M
CCI
CCI-002238
Version
RHEL-10-600420
Vuln IDs
V-281196
Rule IDs
SV-281196r1166540_rule
By limiting the number of failed login attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute-forcing, is reduced. Limits are imposed by locking the account. Satisfies: SRG-OS-000329-GPOS-00128, SRG-OS-000021-GPOS-00005
Fix: F-85662r1166539_fix

Configure RHEL 10 to lock out the "root" account after a number of incorrect login attempts within 15 minutes using "pam_faillock.so". Enable the feature using the following command: $ authselect enable-feature with-faillock Edit the "/etc/security/faillock.conf" file as follows: fail_interval = 900

b
RHEL 10 must maintain an account lock until the locked account is released by an administrator.
RMF Control
AC-7
Severity
M
CCI
CCI-002238
Version
RHEL-10-600425
Vuln IDs
V-281197
Rule IDs
SV-281197r1166543_rule
By limiting the number of failed login attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute-forcing, is reduced. Limits are imposed by locking the account. Satisfies: SRG-OS-000329-GPOS-00128, SRG-OS-000021-GPOS-00005
Fix: F-85663r1166542_fix

Configure RHEL 10 to lock an account after three unsuccessful login attempts until released by an administrator with the following command: $ authselect enable-feature with-faillock Edit the "/etc/security/faillock.conf" file as follows: unlock_time = 0

b
RHEL 10 must ensure account lockouts persist.
RMF Control
AC-7
Severity
M
CCI
CCI-000044
Version
RHEL-10-600430
Vuln IDs
V-281198
Rule IDs
SV-281198r1166546_rule
Having lockouts persist across reboots ensures that an account is unlocked only by an administrator. If the lockouts did not persist across reboots, an attacker could reboot the system to continue brute force attacks against the accounts on the system. Satisfies: SRG-OS-000021-GPOS-00005, SRG-OS-000329-GPOS-00128
Fix: F-85664r1166545_fix

Configure RHEL 10 to maintain the contents of the "faillock" directory after a reboot. Add/modify the "/etc/security/faillock.conf" file to match the following line: dir = /var/log/faillock

b
RHEL 10 must not allow blank or null passwords.
RMF Control
Severity
M
CCI
CCI-004066
Version
RHEL-10-600455
Vuln IDs
V-281200
Rule IDs
SV-281200r1166552_rule
If an account has an empty password, anyone could log in and run commands with the privileges of that account. Accounts with empty passwords must never be used in operational environments.
Fix: F-85666r1166551_fix

Configure RHEL 10 to prohibit the use of null passwords. If PAM is managed with "authselect", use the following command to remove instances of "nullok": $ sudo authselect enable-feature without-nullok Otherwise, remove any instances of the "nullok" option in the "/etc/pam.d/password-auth" and "/etc/pam.d/system-auth" files to prevent logins with empty passwords. Note: Manual changes to the listed file may be overwritten by the "authselect" program.

b
RHEL 10 must not have accounts configured with blank or null passwords.
RMF Control
Severity
M
CCI
CCI-004066
Version
RHEL-10-600460
Vuln IDs
V-281201
Rule IDs
SV-281201r1166555_rule
If an account has an empty password, anyone could log in and run commands with the privileges of that account. Accounts with empty passwords should never be used in operational environments.
Fix: F-85667r1166554_fix

Configure RHEL 10 so that all accounts have a password, or lock the account with the following commands: Perform a password reset: $ sudo passwd [username] To lock an account: $ sudo passwd -l [username]

b
RHEL 10 must have a unique group ID (GID) for each group in "/etc/group".
RMF Control
IA-2
Severity
M
CCI
CCI-000764
Version
RHEL-10-600470
Vuln IDs
V-281202
Rule IDs
SV-281202r1166558_rule
To ensure accountability and prevent unauthenticated access, groups must be identified uniquely to prevent potential misuse and compromise of the system.
Fix: F-85668r1166557_fix

Configure RHEL 10 to contain no duplicate GIDs for interactive users. Edit the file "/etc/group", and provide each group that has a duplicate GID with a unique GID.

b
RHEL 10 must ensure the password complexity module in the system-auth file is configured for three or fewer retries.
RMF Control
Severity
M
CCI
CCI-004066
Version
RHEL-10-600485
Vuln IDs
V-281204
Rule IDs
SV-281204r1197240_rule
Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. "pwquality" enforces complex password construction configuration and has the ability to limit brute-force attacks on the system. RHEL 10 uses "pwquality" as a mechanism to enforce password complexity. This is set in both of the following: "/etc/pam.d/password-auth" "/etc/pam.d/system-auth" By limiting the number of attempts to meet the pwquality module complexity requirements before returning with an error, the system will audit abnormal attempts at password changes.
Fix: F-85670r1166563_fix

Configure RHEL 10 to limit the "pwquality" retry option to "3". Add or update the following line in the "/etc/security/pwquality.conf" file or a file in the "/etc/security/pwquality.conf.d/" directory to contain the "retry" parameter: retry = 3

b
RHEL 10 must restrict the use of the "su" command.
RMF Control
IA-11
Severity
M
CCI
CCI-002038
Version
RHEL-10-600500
Vuln IDs
V-281205
Rule IDs
SV-281205r1166567_rule
The "su" program allows commands to be run with a substitute user and group ID. It is commonly used to run commands as the root user. Limiting access to such commands is considered a good security practice. Satisfies: SRG-OS-000373-GPOS-00156, SRG-OS-000312-GPOS-00123
Fix: F-85671r1166566_fix

Configure RHEL 10 to require users to be in the "wheel" group to run the "su" command. Edit the configuration file: $ sudo vi /etc/pam.d/su Add the following lines: auth required pam_wheel.so use_uid $ sed '/^[[:space:]]*#[[:space:]]*auth[[:space:]]\+required[[:space:]]\+pam_wheel\.so[[:space:]]\+use_uid$/s/^[[:space:]]*#//' -i /etc/pam.d/su If necessary, create a "wheel" group and add administrative users to the group.

b
RHEL 10 must be configured to not bypass password requirements for privilege escalation.
RMF Control
IA-11
Severity
M
CCI
CCI-002038
Version
RHEL-10-600510
Vuln IDs
V-281206
Rule IDs
SV-281206r1166570_rule
Without reauthentication, users may access resources or perform tasks for which they do not have authorization. When operating systems provide the capability to escalate a functional capability, it is critical the user reauthenticate. Satisfies: SRG-OS-000373-GPOS-00156, SRG-OS-000373-GPOS-00157, SRG-OS-000373-GPOS-00158
Fix: F-85672r1166569_fix

Configure RHEL 10 to require users to supply a password for privilege escalation. Remove any occurrences of " pam_succeed_if " in the "/etc/pam.d/sudo" file.

b
RHEL 10 must restrict privilege elevation to authorized personnel.
RMF Control
SI-6
Severity
M
CCI
CCI-002696
Version
RHEL-10-600520
Vuln IDs
V-281207
Rule IDs
SV-281207r1166573_rule
If the "sudoers" file is not configured correctly, any user defined on the system can initiate privileged actions on the target system.
Fix: F-85673r1166572_fix

Configure RHEL 10 to restrict privilege elevation to authorized personnel. Remove the following entries from the "/etc/sudoers" file or configuration file under "/etc/sudoers.d/": ALL ALL=(ALL) ALL ALL ALL=(ALL:ALL) ALL

b
RHEL 10 must require users to reauthenticate for privilege escalation.
RMF Control
IA-11
Severity
M
CCI
CCI-002038
Version
RHEL-10-600530
Vuln IDs
V-281208
Rule IDs
SV-281208r1166576_rule
Without reauthentication, users may access resources or perform tasks for which they do not have authorization. When operating systems provide the capability to escalate a functional capability, it is critical that the user reauthenticate. Satisfies: SRG-OS-000373-GPOS-00156, SRG-OS-000373-GPOS-00157, SRG-OS-000373-GPOS-00158
Fix: F-85674r1166575_fix

Configure RHEL 10 to not allow users to execute privileged actions without authenticating. Remove any occurrence of "!authenticate" found in the "/etc/sudoers" file or files in the "/etc/sudoers.d" directory: $ sudo sed -i '/\!authenticate/ s/^/# /g' /etc/sudoers /etc/sudoers.d/*

b
RHEL 10 must require reauthentication when using the "sudo" command.
RMF Control
IA-11
Severity
M
CCI
CCI-002038
Version
RHEL-10-600540
Vuln IDs
V-281209
Rule IDs
SV-281209r1166579_rule
Without reauthentication, users may access resources or perform tasks for which they do not have authorization. When operating systems provide the capability to escalate a functional capability, it is critical that the organization requires the user to reauthenticate when using the "sudo" command. If the value is set to an integer less than "0", the user's time stamp will not expire, and the user will not have to reauthenticate for privileged actions until the user's session is terminated. Satisfies: SRG-OS-000373-GPOS-00156, SRG-OS-000373-GPOS-00157, SRG-OS-000373-GPOS-00158
Fix: F-85675r1166578_fix

Configure RHEL 10 to reauthenticate "sudo" commands after the specified timeout. Add the following line to "/etc/sudoers" or a file in "/etc/sudoers.d": Defaults timestamp_timeout=0

b
RHEL 10 must use the invoking user's password for privilege escalation when using "sudo".
RMF Control
IA-11
Severity
M
CCI
CCI-002038
Version
RHEL-10-600550
Vuln IDs
V-281210
Rule IDs
SV-281210r1166582_rule
If the "rootpw", "targetpw", or "runaspw" flags are defined and not disabled, by default the operating system will prompt the invoking user for the "root" user password.
Fix: F-85676r1166581_fix

Configure RHEL 10 to use the invoking user's password for privilege escalation when using "sudo". Define the following in the Defaults section of the /etc/sudoers file or a single configuration file in the /etc/sudoers.d/ directory: Defaults !targetpw Defaults !rootpw Defaults !runaspw

c
RHEL 10 must require users to provide a password for privilege escalation.
RMF Control
IA-11
Severity
H
CCI
CCI-002038
Version
RHEL-10-600560
Vuln IDs
V-281211
Rule IDs
SV-281211r1166585_rule
Without reauthentication, users may access resources or perform tasks for which they do not have authorization. When operating systems provide the capability to escalate a functional capability, it is critical that the user reauthenticate. Satisfies: SRG-OS-000373-GPOS-00156, SRG-OS-000373-GPOS-00157, SRG-OS-000373-GPOS-00158
Fix: F-85677r1166584_fix

Configure RHEL 10 to not allow users to execute privileged actions without authenticating with a password. Remove any occurrence of "NOPASSWD" found in the "/etc/sudoers" file or files in the "/etc/sudoers.d" directory: $ sudo find /etc/sudoers /etc/sudoers.d -type f -exec sed -i '/NOPASSWD/ s/^/# /g' {} \;

b
RHEL 10 must ensure the password complexity module is enabled in the "password-auth" file.
RMF Control
Severity
M
CCI
CCI-004066
Version
RHEL-10-600620
Vuln IDs
V-281214
Rule IDs
SV-281214r1166594_rule
Enabling Pluggable Authentication Module (PAM) password complexity permits enforcement of strong passwords and consequently makes the system less prone to dictionary attacks. Satisfies: SRG-OS-000069-GPOS-00037, SRG-OS-000070-GPOS-00038
Fix: F-85680r1166593_fix

Configure RHEL 10 to use "pwquality" to enforce password complexity rules. Add the following line to the "/etc/pam.d/password-auth" file (or modify the line to have the required value): password required pam_pwquality.so

b
RHEL 10 must ensure the password complexity module is enabled in the "system-auth" file.
RMF Control
Severity
M
CCI
CCI-004066
Version
RHEL-10-600630
Vuln IDs
V-281215
Rule IDs
SV-281215r1166597_rule
Enabling Pluggable Authentication Module (PAM) password complexity permits enforcement of strong passwords and consequently makes the system less prone to dictionary attacks.
Fix: F-85681r1166596_fix

Configure RHEL 10 to use "pwquality" to enforce password complexity rules. Add the following line to the "/etc/pam.d/system-auth" file (or modify the line to have the required value): password required pam_pwquality.so

b
RHEL 10 must ensure that the pam_unix.so module is configured in the password-auth file to use a FIPS 140-3-approved cryptographic hashing algorithm for system authentication.
RMF Control
Severity
M
CCI
CCI-004062
Version
RHEL-10-600650
Vuln IDs
V-281217
Rule IDs
SV-281217r1195450_rule
Unapproved mechanisms that are used for authentication to the cryptographic module are not verified; therefore, they cannot be relied on to provide confidentiality or integrity, and DOD data may be compromised. RHEL 10 systems using encryption are required to use FIPS-compliant mechanisms for authenticating to cryptographic modules. FIPS 140-3 is the current standard for validating that mechanisms used to access cryptographic modules use authentication that meets DOD requirements. This allows for Security Levels 1, 2, 3, or 4 for use on a general-purpose computing system. Satisfies: SRG-OS-000073-GPOS-00041, SRG-OS-000120-GPOS-00061
Fix: F-85683r1195449_fix

Configure RHEL 10 to use the sha512 cryptographic hashing algorithm for local account passwords. Edit/modify the following line in the "/etc/pam.d/password-auth" file to include the sha512 option for pam_unix.so: password sufficient pam_unix.so sha512

b
RHEL 10 must be configured to use a sufficient number of hashing rounds for the shadow password suite.
RMF Control
Severity
M
CCI
CCI-004062
Version
RHEL-10-600700
Vuln IDs
V-281218
Rule IDs
SV-281218r1166606_rule
Passwords must be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. Passwords that are encrypted with a weak algorithm are no more protected than if they are kept in plain text. Using more hashing rounds makes password cracking attacks more difficult. Satisfies: SRG-OS-000073-GPOS-00041, SRG-OS-000120-GPOS-00061
Fix: F-85684r1166605_fix

Configure RHEL 10 to use a sufficient number of hashing rounds for shadow password suite. Add or modify the following line in "/etc/pam.d/system-auth" and set "rounds" to 100000: password sufficient pam_unix.so sha512 rounds=100000

b
RHEL 10 must be configured to use a FIPS 140-3-approved cryptographic hashing algorithm for system authentication by ensuring that the pam_unix.so module is configured in the "system-auth" file.
RMF Control
Severity
M
CCI
CCI-004062
Version
RHEL-10-600710
Vuln IDs
V-281219
Rule IDs
SV-281219r1166609_rule
Unapproved mechanisms that are used for authentication to the cryptographic module are not verified and therefore cannot be relied on to provide confidentiality or integrity, and DOD data may be compromised. RHEL 10 systems using encryption are required to use FIPS-compliant mechanisms for authenticating to cryptographic modules. FIPS 140-3 is the current standard for validating that mechanisms used to access cryptographic modules use authentication that meets DOD requirements. This allows for Security Levels 1, 2, 3, or 4 for use on a general-purpose computing system. Satisfies: SRG-OS-000073-GPOS-00041, SRG-OS-000120-GPOS-00061
Fix: F-85685r1166608_fix

Configure RHEL 10 to use a FIPS 140-3-approved cryptographic hashing algorithm for system authentication in "/etc/pam.d/system-auth" via the "pam_unix.so" module. Edit/modify the following line in the "/etc/pam.d/system-auth" file to include the sha512 option for pam_unix.so: password sufficient pam_unix.so sha512

b
RHEL 10 must be configured so that password-auth uses a sufficient number of hashing rounds.
RMF Control
Severity
M
CCI
CCI-004062
Version
RHEL-10-600720
Vuln IDs
V-281220
Rule IDs
SV-281220r1166612_rule
Passwords must be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. Passwords that are encrypted with a weak algorithm are no more protected than if they are kept in plain text. Using more hashing rounds makes password cracking attacks more difficult. Satisfies: SRG-OS-000073-GPOS-00041, SRG-OS-000120-GPOS-00061
Fix: F-85686r1166611_fix

Configure RHEL 10 to use "100000" hashing rounds for hashing passwords. Add or modify the following line in "/etc/pam.d/password-auth" and set "rounds" to "100000": password sufficient pam_unix.so sha512 rounds=100000

c
RHEL 10 must employ FIPS 140-3-approved cryptographic hashing algorithms for all stored passwords.
RMF Control
Severity
H
CCI
CCI-004062
Version
RHEL-10-600730
Vuln IDs
V-281221
Rule IDs
SV-281221r1208797_rule
The system must use a strong hashing algorithm to store the password. Passwords must be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. Satisfies: SRG-OS-000073-GPOS-00041, SRG-OS-000120-GPOS-00061
Fix: F-85687r1166614_fix

Configure RHEL 10 to employ FIPS 140-3-approved cryptographic hashing algorithms for all stored passwords. Lock all interactive user accounts not using SHA-512 hashing until the passwords can be regenerated with SHA-512.

c
RHEL 10 must be configured to use the shadow file to store only encrypted representations of passwords.
RMF Control
Severity
H
CCI
CCI-004062
Version
RHEL-10-600740
Vuln IDs
V-281222
Rule IDs
SV-281222r1184626_rule
Passwords must be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. Passwords that are encrypted with a weak algorithm are no more protected than if they are kept in plain text. This setting ensures user and group account administration utilities are configured to store only encrypted representations of passwords. Additionally, the "crypt_style" configuration option ensures the use of a strong hashing algorithm that makes password cracking attacks more difficult.
Fix: F-85688r1166617_fix

Configure RHEL 10 to store only SHA512 encrypted representations of passwords. Add or update the following line in the "/etc/login.defs" file: ENCRYPT_METHOD SHA512

c
RHEL 10 must be configured so that user and group account administration utilities are configured to store only encrypted representations of passwords.
RMF Control
Severity
H
CCI
CCI-004062
Version
RHEL-10-600750
Vuln IDs
V-281223
Rule IDs
SV-281223r1208798_rule
Passwords must be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. Passwords that are encrypted with a weak algorithm are no more protected than if they are kept in plain text. This setting ensures user and group account administration utilities are configured to store only encrypted representations of passwords. Additionally, the "crypt_style" configuration option ensures the use of a strong hashing algorithm that makes password cracking attacks more difficult.
Fix: F-85689r1166620_fix

Configure RHEL 10 to use the SHA-512 algorithm for password hashing. Add or change the following line in the "[default]" section of the "/etc/libuser.conf" file: crypt_style = sha512

b
RHEL 10 must display the Standard Mandatory DOD Notice and Consent Banner before granting local or remote access to the system via a Secure Shell (SSH) login.
RMF Control
AC-3
Severity
M
CCI
CCI-000213
Version
RHEL-10-700010
Vuln IDs
V-281224
Rule IDs
SV-281224r1184753_rule
The warning message reinforces policy awareness during the login process and facilitates possible legal action against attackers. Alternatively, systems whose ownership should not be obvious should ensure use of a banner that does not provide easy attribution. OpenSSH uses the first occurrence of a keyword it sees, and drop-in files are read in lexicographical order at the start of the configuration. Red Hat recommends using drop-in files rather than changing base configuration files.
Fix: F-85690r1166623_fix

Configure RHEL 10 to display the Standard Mandatory DOD Notice and Consent Banner before granting access to the system via SSH. Edit a file in "/etc/ssh/sshd_config.d" to uncomment or add the banner keyword and configure it to point to a file that will contain the login banner (this file may be named differently or be in a different location if using a version of SSH that is provided by a third-party vendor). An example configuration line is: Banner /etc/issue

b
RHEL 10 must prevent a user from overriding the banner-message-enable setting for the graphical user interface.
RMF Control
AC-8
Severity
M
CCI
CCI-000048
Version
RHEL-10-700030
Vuln IDs
V-281226
Rule IDs
SV-281226r1166630_rule
Display of a standardized and approved use notification before granting access to the operating system ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. For U.S. Government systems, system use notifications are required only for access via login interfaces with human users and are not required when such human interfaces do not exist. Satisfies: SRG-OS-000023-GPOS-00006, SRG-OS-000228-GPOS-00088
Fix: F-85692r1166629_fix

Configure RHEL 10 to prevent a user from overriding the banner setting for graphical user interfaces. Create a database to contain the systemwide graphical user login settings (if it does not already exist) with the following command: $ sudo vi /etc/dconf/db/local.d/locks/session Add the following setting to prevent nonprivileged users from modifying it: /org/gnome/login-screen/banner-message-enable Run the following command to update the database: $ sudo dconf update

b
RHEL 10 must prevent special devices on file systems that are imported via Network File System (NFS).
RMF Control
AC-3
Severity
M
CCI
CCI-000213
Version
RHEL-10-700100
Vuln IDs
V-281228
Rule IDs
SV-281228r1166636_rule
The "nodev" mount option causes the system to not interpret character or block special devices. Executing character or block special devices from untrusted file systems increases the opportunity for nonprivileged users to attain unauthorized administrative access.
Fix: F-85694r1166635_fix

Configure RHEL 10 to prevent special devices on file systems that are imported via NFS. Update each NFS mounted file system to use the "nodev" option on file systems that are being imported via NFS.

b
RHEL 10 must prevent code from being executed on file systems that are imported via Network File System (NFS).
RMF Control
AC-3
Severity
M
CCI
CCI-000213
Version
RHEL-10-700105
Vuln IDs
V-281229
Rule IDs
SV-281229r1166639_rule
The "noexec" mount option causes the system not to execute binary files. This option must be used for mounting any file system not containing approved binary as they may be incompatible. Executing files from untrusted file systems increases the opportunity for nonprivileged users to attain unauthorized administrative access.
Fix: F-85695r1166638_fix

Configure RHEL 10 to prevent code from being executed on file systems that are imported via NFS. Update each NFS mounted file system to use the "noexec" option on file systems that are being imported via NFS.

b
RHEL 10 must prevent files with the "setuid" and "setgid" bit set from being executed on file systems that are imported via Network File System (NFS).
RMF Control
AC-3
Severity
M
CCI
CCI-000213
Version
RHEL-10-700110
Vuln IDs
V-281230
Rule IDs
SV-281230r1166642_rule
The "nosuid" mount option causes the system not to execute "setuid" and "setgid" files with owner privileges. This option must be used for mounting any file system not containing approved "setuid" and "setguid" files. Executing files from untrusted file systems increases the opportunity for nonprivileged users to attain unauthorized administrative access.
Fix: F-85696r1166641_fix

Configure RHEL 10 to prevent files with the "setuid" and "setgid" bit set from being executed on file systems that are imported via NFS. Update each NFS mounted file system to use the "nosuid" option on file systems that are being imported via NFS.

b
RHEL 10 must be configured so that the Network File System (NFS) is configured to use RPCSEC_GSS.
RMF Control
AC-3
Severity
M
CCI
CCI-000213
Version
RHEL-10-700115
Vuln IDs
V-281231
Rule IDs
SV-281231r1166645_rule
When an NFS server is configured to use RPCSEC_SYS, a selected userid and groupid are used to handle requests from the remote user. The userid and groupid could mistakenly or maliciously be set incorrectly. The RPCSEC_GSS method of authentication uses certificates on the server and client systems to more securely authenticate the remote mount request.
Fix: F-85697r1166644_fix

Configure RHEL 10 so that the "/etc/fstab" file "sec" option is defined for each NFS mounted file system, and the "sec" option does not have the "sys" setting. Ensure the "sec" option is defined as "krb5p:krb5i:krb5".

b
RHEL 10 must mount "/boot" with the "nodev" option.
RMF Control
CM-7
Severity
M
CCI
CCI-001764
Version
RHEL-10-700120
Vuln IDs
V-281232
Rule IDs
SV-281232r1166648_rule
The only legitimate location for device files is the "/dev" directory located on the root partition. The only exception to this is chroot jails.
Fix: F-85698r1166647_fix

Configure RHEL 10 to mount "/boot" with the "nodev" option. Modify "/etc/fstab" to use the "nodev" option on the "/boot" directory. To reload all implicit mount units and update the dependency graph so that new options will apply correctly at next remount, run the following command: $ sudo systemctl daemon-reload Use the following command to apply the changes immediately without a reboot: $ sudo mount -o remount /boot

b
RHEL 10 must prevent files with the "setuid" and "setgid" bit set from being executed on the "/boot" directory.
RMF Control
CM-7
Severity
M
CCI
CCI-001764
Version
RHEL-10-700125
Vuln IDs
V-281233
Rule IDs
SV-281233r1166651_rule
The "nosuid" mount option causes the system not to execute "setuid" and "setgid" files with owner privileges. This option must be used for mounting any file system not containing approved "setuid" and "setguid" files. Executing files from untrusted file systems increases the opportunity for nonprivileged users to attain unauthorized administrative access.
Fix: F-85699r1166650_fix

Configure RHEL 10 to prevent files with the "setuid" and "setgid" bit set from being executed on the "/boot" directory. Modify "/etc/fstab" to use the "nosuid" option on the "/boot" directory. To reload all implicit mount units and update the dependency graph so that new options will apply correctly at next remount, run the following command: $ sudo systemctl daemon-reload Use the following command to apply the changes immediately without a reboot: $ sudo mount -o remount /boot

b
RHEL 10 must prevent files with the "setuid" and "setgid" bit set from being executed on the "/boot/efi" directory.
RMF Control
AC-3
Severity
M
CCI
CCI-000213
Version
RHEL-10-700130
Vuln IDs
V-281234
Rule IDs
SV-281234r1166654_rule
The "nosuid" mount option causes the system not to execute "setuid" and "setgid" files with owner privileges. This option must be used for mounting any file system not containing approved "setuid" and "setguid" files. Executing files from untrusted file systems increases the opportunity for nonprivileged users to attain unauthorized administrative access.
Fix: F-85700r1166653_fix

Configure RHEL 10 to prevent files with the "setuid" and "setgid" bit set from being executed on the "/boot/efi" directory. Modify "/etc/fstab" to use the "nosuid" option on the "/boot/efi" directory. To reload all implicit mount units and update the dependency graph so that new options will apply correctly at next remount, run the following command: $ sudo systemctl daemon-reload Use the following command to apply the changes immediately without a reboot: $ sudo mount -o remount /boot/efi

b
RHEL 10 must mount "/dev/shm" with the "nodev" option.
RMF Control
CM-7
Severity
M
CCI
CCI-001764
Version
RHEL-10-700135
Vuln IDs
V-281235
Rule IDs
SV-281235r1166657_rule
The "nodev" mount option causes the system to not interpret character or block special devices. Executing character or block special devices from untrusted file systems increases the opportunity for nonprivileged users to attain unauthorized administrative access. The only legitimate location for device files is the "/dev" directory located on the root partition, with the exception of chroot jails if implemented.
Fix: F-85701r1166656_fix

Configure RHEL 10 to mount "/dev/shm" with the "nodev" option. Modify "/etc/fstab" to use the "nodev" option on the "/dev/shm" file system. To reload all implicit mount units and update the dependency graph so that new options will apply correctly at next remount, run the following command: $ sudo systemctl daemon-reload Use the following command to apply the changes immediately without a reboot: $ sudo mount -o remount /dev/shm

b
RHEL 10 must mount "/dev/shm" with the "noexec" option.
RMF Control
CM-7
Severity
M
CCI
CCI-001764
Version
RHEL-10-700140
Vuln IDs
V-281236
Rule IDs
SV-281236r1166660_rule
The "noexec" mount option causes the system to not execute binary files. This option must be used for mounting any file system not containing approved binary files, as they may be incompatible. Executing files from untrusted file systems increases the opportunity for nonprivileged users to attain unauthorized administrative access.
Fix: F-85702r1166659_fix

Configure RHEL 10 to mount "/dev/shm" with the "noexec" option. Modify "/etc/fstab" to use the "noexec" option on the "/dev/shm" file system. To reload all implicit mount units and update the dependency graph so that new options will apply correctly at next remount, run the following command: $ sudo systemctl daemon-reload Use the following command to apply the changes immediately without a reboot: $ sudo mount -o remount /dev/shm

b
RHEL 10 must mount "/dev/shm" with the "nosuid" option.
RMF Control
CM-7
Severity
M
CCI
CCI-001764
Version
RHEL-10-700145
Vuln IDs
V-281237
Rule IDs
SV-281237r1166663_rule
The "nosuid" mount option causes the system to not execute "setuid" and "setgid" files with owner privileges. This option must be used for mounting any file system not containing approved "setuid" and "setguid" files. Executing files from untrusted file systems increases the opportunity for nonprivileged users to attain unauthorized administrative access.
Fix: F-85703r1166662_fix

Configure RHEL 10 to mount "/dev/shm" with the "nosuid" option. Modify "/etc/fstab" to use the "nosuid" option on the "/dev/shm" file system. To reload all implicit mount units and update the dependency graph so that new options will apply correctly at next remount, run the following command: $ sudo systemctl daemon-reload Use the following command to apply the changes immediately without a reboot: $ sudo mount -o remount /dev/shm

b
RHEL 10 must mount "/tmp" with the "nodev" option.
RMF Control
CM-7
Severity
M
CCI
CCI-001764
Version
RHEL-10-700150
Vuln IDs
V-281238
Rule IDs
SV-281238r1166666_rule
The "nodev" mount option causes the system to not interpret character or block special devices. Executing character or block special devices from untrusted file systems increases the opportunity for nonprivileged users to attain unauthorized administrative access. The only legitimate location for device files is the "/dev" directory located on the root partition, with the exception of chroot jails if implemented.
Fix: F-85704r1166665_fix

Configure RHEL 10 to mount "/tmp" with the "nodev" option. Modify "/etc/fstab" to use the "nodev" option on the "/tmp" directory. To reload all implicit mount units and update the dependency graph so that new options will apply correctly at next remount, run the following command: $ sudo systemctl daemon-reload Use the following command to apply the changes immediately without a reboot: $ sudo mount -o remount /tmp

b
RHEL 10 must enable the SELinux targeted policy.
RMF Control
SI-6
Severity
M
CCI
CCI-002696
Version
RHEL-10-700400
Vuln IDs
V-281249
Rule IDs
SV-281249r1197242_rule
Setting the SELinux policy to "targeted" or a more specialized policy ensures the system will confine processes that are likely to be targeted for exploitation, such as network or system services. Note: During the development or debugging of SELinux modules, it is common to temporarily place nonproduction systems in "permissive" mode. In such temporary cases, SELinux policies should be developed, and once work is completed, the system should be reconfigured to "targeted".
Fix: F-85715r1197241_fix

Configure RHEL 10 to use the targeted SELINUX policy. Edit the file "/etc/selinux/config" and add or modify the following line: SELINUXTYPE=targeted A reboot is required for the changes to take effect.

b
RHEL 10 must elevate the SELinux context when an administrator calls the sudo command.
RMF Control
AC-6
Severity
M
CCI
CCI-002235
Version
RHEL-10-700410
Vuln IDs
V-281250
Rule IDs
SV-281250r1184704_rule
Without verification of the security functions, security functions may not operate correctly and the failure may go unnoticed. Security function is defined as the hardware, software, and/or firmware of the information system responsible for enforcing the system security policy and supporting the isolation of code and data on which the protection is based. Security functionality includes, but is not limited to, establishing system accounts, configuring access authorizations (i.e., permissions, privileges), setting events to be audited, and setting intrusion detection parameters. This requirement applies to operating systems performing security function verification/testing and/or systems and environments that require this functionality. Preventing nonprivileged users from executing privileged functions mitigates the risk that unauthorized individuals or processes may gain unnecessary access to information or privileges. Privileged functions include, for example, establishing accounts, performing system integrity checks, or administering cryptographic key management activities. Nonprivileged users are individuals who do not possess appropriate authorizations. Circumventing intrusion detection and prevention mechanisms or malicious code protection mechanisms are examples of privileged functions that require protection from nonprivileged users.
Fix: F-85716r1184703_fix

Configure RHEL 10 to elevate the SELinux context when an administrator calls the sudo command. Edit a file in the "/etc/sudoers.d" directory with the following command: $ sudo visudo -f /etc/sudoers.d/ Use the following example to build the file in the "/etc/sudoers.d" directory to allow any administrator belonging to a designated sudoers admin group to elevate their SELinux context with the use of the sudo command: %{designated_group_or_user_name} ALL=(ALL) TYPE=sysadm_t ROLE=sysadm_r ALL Remove any configurations that conflict with the above from the following locations: /etc/sudoers /etc/sudoers.d/

b
RHEL 10 must be configured so that Secure Shell (SSH) public host key files have mode "0644" or less permissive.
RMF Control
SI-6
Severity
M
CCI
CCI-002696
Version
RHEL-10-700500
Vuln IDs
V-281253
Rule IDs
SV-281253r1184654_rule
If a public host key file is modified by an unauthorized user, the SSH service may be compromised.
Fix: F-85719r1166710_fix

Configure RHEL 10 SSH public host key files to have mode "0644" or less permissive. Change the mode of public host key files under "/etc/ssh" to "0644" with the following command: $ sudo chmod 0644 /etc/ssh/*key.pub Restart the SSH daemon with the following command for the changes to take effect: $ sudo systemctl restart sshd.service

c
RHEL 10 must not allow users to override Secure Shell (SSH) environment variables.
RMF Control
CM-7
Severity
H
CCI
CCI-000381
Version
RHEL-10-700640
Vuln IDs
V-281267
Rule IDs
SV-281267r1184767_rule
SSH environment options potentially allow users to bypass access restriction in some configurations. OpenSSH uses the first occurrence of a keyword it sees, and drop-in files are read in lexicographical order at the start of the configuration. Red Hat recommends using drop-in files rather than changing base configuration files.
Fix: F-85733r1166752_fix

Configure RHEL 10 to disable unattended or automatic login via SSH. In "/etc/ssh/sshd_config.d", create a drop file that will lexicographically precede 50-redhat.conf and add the following line: PermitUserEnvironment no Restart the SSH daemon with the following command for the setting to take effect: $ sudo systemctl restart sshd.service

c
RHEL 10 must force a frequent session key renegotiation for Secure Shell (SSH) connections to the server.
RMF Control
SC-8
Severity
H
CCI
CCI-002418
Version
RHEL-10-700650
Vuln IDs
V-281268
Rule IDs
SV-281268r1184768_rule
Without protection of the transmitted information, confidentiality and integrity may be compromised because unprotected communications can be intercepted and either read or altered. This requirement applies to both internal and external networks and all types of information system components from which information can be transmitted (e.g., servers, mobile devices, notebook computers, printers, copiers, scanners, and facsimile machines). Communication paths outside the physical protection of a controlled boundary are exposed to the possibility of interception and modification. Protecting the confidentiality and integrity of organizational information can be accomplished by physical means (e.g., employing physical distribution systems) or by logical means (e.g., employing cryptographic techniques). If physical means of protection are employed, then logical means (cryptography) do not have to be employed, and vice versa. Session key regeneration limits the chances of a session key becoming compromised. OpenSSH uses the first occurrence of a keyword it sees, and drop-in files are read in lexicographical order at the start of the configuration. Red Hat recommends using drop-in files rather than changing base configuration files. Satisfies: SRG-OS-000423-GPOS-00187, SRG-OS-000033-GPOS-00014, SRG-OS-000424-GPOS-00188
Fix: F-85734r1166755_fix

Configure RHEL 10 to force a frequent session key renegotiation for SSH connections to the server. In "/etc/ssh/sshd_config.d", create a drop file that will lexicographically precede 50-redhat.conf and add the following line: RekeyLimit 1G 1h Restart the SSH daemon with the following command for the settings to take effect: $ sudo systemctl restart sshd.service

c
RHEL 10 must not allow unattended or automatic login via the graphical user interface.
RMF Control
AC-3
Severity
H
CCI
CCI-000213
Version
RHEL-10-700720
Vuln IDs
V-281275
Rule IDs
SV-281275r1166777_rule
Failure to restrict system access to authenticated users negatively impacts operating system security.
Fix: F-85741r1166776_fix

Configure RHEL 10 so that the GNOME desktop display manager disables automatic login. Update the "/etc/gdm/custom.conf" file to disable automatic login to the GNOME desktop: $ sudo vi /etc/gdm/custom.conf [daemon] AutomaticLoginEnable=false

b
RHEL 10 must prevent a user from overriding the session lock-delay setting for the graphical user interface.
RMF Control
AC-11
Severity
M
CCI
CCI-000057
Version
RHEL-10-700780
Vuln IDs
V-281281
Rule IDs
SV-281281r1166795_rule
A session timeout lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not log out because of the temporary nature of the absence. Rather than relying on the user to manually lock their operating system session prior to vacating the vicinity, the GNOME desktop can be configured to identify when a user's session has idled and take action to initiate the session lock. Therefore, users should not be allowed to change session settings. Satisfies: SRG-OS-000029-GPOS-00010, SRG-OS-000031-GPOS-00012
Fix: F-85747r1166794_fix

Configure RHEL 10 to prevent a user from overriding settings for graphical user interfaces. Note: The example below is using the database "local" for the system. If the system is using another database in "/etc/dconf/profile/user", the file should be created under the appropriate subdirectory. Update the "/etc/dconf/db/local.d/locks/session" file to prevent nonprivileged users from modifying the lock-delay setting: $ sudo vi /etc/dconf/db/local.d/locks/session /org/gnome/desktop/screensaver/lock-delay Run the following command to update the database: $ sudo dconf update

b
RHEL 10 must prevent a user from overriding the disable-restart-buttons setting for the graphical user interface.
RMF Control
SI-6
Severity
M
CCI
CCI-002696
Version
RHEL-10-700810
Vuln IDs
V-281284
Rule IDs
SV-281284r1197247_rule
A user who is at the console can reboot the system at the login screen. If restart or shutdown buttons are pressed at the login screen, this can create the risk of short-term loss of availability of systems due to reboot.
Fix: F-85750r1166803_fix

Configure RHEL 10 to prevent a user from overriding the disable-restart-buttons setting for graphical user interfaces. Note: The example below is using the database "local" for the system. If the system is using another database in "/etc/dconf/profile/user", the file should be created under the appropriate subdirectory. Update the "/etc/dconf/db/local.d/locks/session" file to prevent nonprivileged users from modifying the disable-restart-buttons setting: $ sudo vi /etc/dconf/db/local.d/locks/session /org/gnome/login-screen/disable-restart-buttons Run the following command to update the database: $ sudo dconf update

b
RHEL 10 must prevent a user from overriding the Ctrl-Alt-Del sequence settings for the graphical user interface.
RMF Control
SC-5
Severity
M
CCI
CCI-002385
Version
RHEL-10-700820
Vuln IDs
V-281285
Rule IDs
SV-281285r1197249_rule
A locally logged-in user who presses Ctrl-Alt-Del when at the console can reboot the system. If accidentally pressed, as could happen in the case of a mixed operating system environment, this can create the risk of short-term loss of systems' availability due to unintentional reboot.
Fix: F-85751r1166806_fix

Configure RHEL 10 to disallow the user changing the Ctrl-Alt-Del sequence in the GNOME desktop. Note: The example below is using the database "local" for the system. If the system is using another database in "/etc/dconf/profile/user", the file should be created under the appropriate subdirectory. Update the "/etc/dconf/db/local.d/locks/session" file to prevent nonprivileged users from modifying the Ctrl-Alt-Del setting: $ sudo vi /etc/dconf/db/local.d/locks/session /org/gnome/settings-daemon/plugins/media-keys/logout Run the following command to update the database: $ sudo dconf update

b
RHEL 10 must disable the user list at login for graphical user interfaces.
RMF Control
CM-7
Severity
M
CCI
CCI-000381
Version
RHEL-10-700840
Vuln IDs
V-281287
Rule IDs
SV-281287r1166813_rule
Leaving the user list enabled is a security risk because it allows anyone with physical access to the system to enumerate known user accounts without authenticated access to the system.
Fix: F-85753r1166812_fix

Configure RHEL 10 to disable the user list at login for graphical user interfaces. Note: The example below is using the database "local" for the system. If the system is using another database in "/etc/dconf/profile/user", the file should be created under the appropriate subdirectory. Create a database to contain the systemwide screensaver settings (if it does not already exist) with the following command: $ sudo vi /etc/dconf/db/local.d/02-login-screen [org/gnome/login-screen] disable-user-list=true Update the system databases: $ sudo dconf update

b
RHEL 10 must be configured to disable USB mass storage.
RMF Control
IA-3
Severity
M
CCI
CCI-000778
Version
RHEL-10-700850
Vuln IDs
V-281288
Rule IDs
SV-281288r1166816_rule
USB mass storage permits easy introduction of unknown devices, thereby facilitating malicious activity. Satisfies: SRG-OS-000114-GPOS-00059, SRG-OS-000378-GPOS-00163
Fix: F-85754r1166815_fix

Configure RHEL 10 to prevent the usb-storage kernel module from being loaded. Add the following lines to the file "/etc/modprobe.d/usb-storage.conf" (or create "usb-storage.conf" if it does not exist): $ sudo vi /etc/modprobe.d/usb-storage.conf install usb-storage /bin/false blacklist usb-storage

b
RHEL 10 must disable Bluetooth.
RMF Control
CM-7
Severity
M
CCI
CCI-000381
Version
RHEL-10-700860
Vuln IDs
V-281289
Rule IDs
SV-281289r1166819_rule
This requirement applies to wireless peripheral technologies (e.g., wireless mice, keyboards, displays, etc.) used with RHEL 10 systems. Wireless peripherals (e.g., Wi-Fi/Bluetooth/IR keyboards, mice and pointing devices, and near field communications [NFC]) present a unique challenge by creating an open, unsecured port on a computer. Wireless peripherals must meet DOD requirements for wireless data transmission and be approved for use by the authorizing official. Even though some wireless peripherals, such as mice and pointing devices, do not ordinarily carry information that must be protected, modification of communications with these wireless peripherals may be used to compromise the RHEL 10 operating system. Satisfies: SRG-OS-000095-GPOS-00049, SRG-OS-000300-GPOS-00118
Fix: F-85755r1166818_fix

Configure RHEL 10 to disable the Bluetooth adapter when not in use. Add the following lines to the file "/etc/modprobe.d/bluetooth.conf" (or create "bluetooth.conf" if it does not exist): $ sudo vi /etc/modprobe.d/bluetooth.conf install bluetooth /bin/false blacklist bluetooth Reboot the system for the settings to take effect.

b
RHEL 10 must disable the graphical user interface automounter unless required.
RMF Control
IA-3
Severity
M
CCI
CCI-000778
Version
RHEL-10-700880
Vuln IDs
V-281291
Rule IDs
SV-281291r1166825_rule
Automatically mounting file systems permits easy introduction of unknown devices, thereby facilitating malicious activity. Satisfies: SRG-OS-000114-GPOS-00059, SRG-OS-000378-GPOS-00163
Fix: F-85757r1166824_fix

Configure RHEL 10 GNOME to disable automated mount of removable media. Note: The example below is using the database "local" for the system. If the system is using another database in "/etc/dconf/profile/user", the file should be created under the appropriate subdirectory. Update the "/etc/dconf/db/local.d/00-security-settings" database file with the following lines: $ sudo vi /etc/dconf/db/local.d/00-security-settings [org/gnome/desktop/media-handling] automount-open=false Update the dconf system databases: $ sudo dconf update

b
RHEL 10 must automatically exit interactive command shell user sessions after 15 minutes of inactivity.
RMF Control
SC-10
Severity
M
CCI
CCI-001133
Version
RHEL-10-700920
Vuln IDs
V-281295
Rule IDs
SV-281295r1208800_rule
Terminating an idle interactive command shell user session within a short time period reduces the window of opportunity for unauthorized personnel to take control of it when left unattended in a virtual terminal or physical console. Satisfies: SRG-OS-000163-GPOS-00072, SRG-OS-000029-GPOS-00010
Fix: F-85761r1208391_fix

Configure RHEL 10 to exit interactive command shell user sessions after 10 minutes of inactivity. Add or edit the following line in "/etc/profile.d/tmout.sh": #!/bin/bash declare -xr TMOUT=600

b
RHEL 10 must be configured with a timeout interval for the Secure Shell (SSH) daemon.
RMF Control
SC-10
Severity
M
CCI
CCI-001133
Version
RHEL-10-700930
Vuln IDs
V-281296
Rule IDs
SV-281296r1184670_rule
Terminating an idle SSH session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled on the console or console port that has been left unattended. In addition, quickly terminating an idle SSH session will also free up resources committed by the managed network element. Terminating network connections associated with communications sessions includes, for example, deallocating associated TCP/IP address/port pairs at the operating system level and deallocating networking assignments at the application level if multiple application sessions are using a single operating system-level network connection. This does not mean that the operating system terminates all sessions or network access; it only ends the inactive session and releases the resources associated with that session. RHEL 10 uses "/etc/ssh/sshd_config" for configurations of OpenSSH. Within the "sshd_config", the product of the values of "ClientAliveInterval" and "ClientAliveCountMax" are used to establish the inactivity threshold. The "ClientAliveInterval" is a timeout interval in seconds after which if no data has been received from the client, sshd will send a message through the encrypted channel to request a response from the client. The "ClientAliveCountMax" is the number of client alive messages that may be sent without sshd receiving any messages back from the client. If this threshold is met, sshd will disconnect the client. For more information on these settings and others, refer to the sshd_config man pages. Satisfies: SRG-OS-000163-GPOS-00072, SRG-OS-000279-GPOS-00109, SRG-OS-000395-GPOS-00175
Fix: F-85762r1166839_fix

Configure RHEL 10 to automatically terminate all network connections associated with SSH traffic at the end of a session or after 10 minutes of inactivity. Note: This setting must be applied in conjunction with RHEL-10-700660 to function correctly. In "/etc/ssh/sshd_config.d", create a drop file that will lexicographically precede 50-redhat.conf and add the following line: ClientAliveInterval 600 Restart the SSH daemon with the following command for the changes to take effect: $ sudo systemctl restart sshd.service

b
RHEL 10 must not default to the graphical display manager unless approved.
RMF Control
CM-7
Severity
M
CCI
CCI-000381
Version
RHEL-10-700940
Vuln IDs
V-281297
Rule IDs
SV-281297r1166843_rule
Unnecessary service packages must not be installed to decrease the attack surface of the system. Graphical display managers have a long history of security vulnerabilities and must not be used unless approved and documented.
Fix: F-85763r1166842_fix

Configure RHEL 10 to boot to the command line by setting the default target to "multi-user" with the following command: $ sudo systemctl set-default multi-user.target

c
RHEL 10 must disable the systemd Ctrl-Alt-Delete burst key sequence.
RMF Control
AC-6
Severity
H
CCI
CCI-002235
Version
RHEL-10-700950
Vuln IDs
V-281298
Rule IDs
SV-281298r1166846_rule
A locally logged-on user who presses Ctrl-Alt-Delete when at the console can reboot the system. If accidentally pressed, as could happen in the case of a mixed operating system environment, this can create the risk of short-term loss of availability of systems due to unintentional reboot. In a graphical user environment, risk of unintentional reboot from the Ctrl-Alt-Delete sequence is reduced because the user will be prompted before any action is taken.
Fix: F-85764r1166845_fix

Configure RHEL 10 to disable the "CtrlAltDelBurstAction". Update the "/etc/systemd/system.conf" configuration file as follows: $ sudo vi /etc/systemd/system.conf CtrlAltDelBurstAction=none Reload the daemon for this change to take effect: $ sudo systemctl daemon-reload

c
RHEL 10 must disable the x86 Ctrl-Alt-Delete key sequence.
RMF Control
AC-6
Severity
H
CCI
CCI-002235
Version
RHEL-10-700960
Vuln IDs
V-281299
Rule IDs
SV-281299r1166849_rule
A locally logged-on user who presses Ctrl-Alt-Delete when at the console can reboot the system. If accidentally pressed, as could happen in the case of a mixed operating system environment, this can create the risk of short-term loss of systems availability due to unintentional reboot. In a graphical user environment, risk of unintentional reboot from the Ctrl-Alt-Delete sequence is reduced because the user will be prompted before any action is taken.
Fix: F-85765r1166848_fix

Configure RHEL 10 to disable the "ctrl-alt-del.target" with the following command: $ sudo systemctl disable --now ctrl-alt-del.target $ sudo systemctl mask --now ctrl-alt-del.target

b
RHEL 10 must disable the ability of systemd to spawn an interactive boot process.
RMF Control
CM-7
Severity
M
CCI
CCI-000381
Version
RHEL-10-700980
Vuln IDs
V-281300
Rule IDs
SV-281300r1167050_rule
Using interactive or recovery boot, the console user could disable auditing, firewalls, or other services, weakening system security.
Fix: F-85766r1167049_fix

Configure RHEL 10 so that the current GRUB 2 configuration disables the ability of systemd to spawn an interactive boot process with the following command: $ sudo grubby --update-kernel=ALL --remove-args="systemd.confirm_spawn"

b
RHEL 10 must disable virtual system calls.
RMF Control
SC-3
Severity
M
CCI
CCI-001084
Version
RHEL-10-700990
Vuln IDs
V-281301
Rule IDs
SV-281301r1184700_rule
System calls are special routines in the Linux kernel, which userspace applications ask to do privileged tasks. Invoking a system call is an expensive operation because the processor must interrupt the currently executing task and switch context to kernel mode and then back to userspace after the system call completes. Virtual system calls map into user space a page that contains some variables and the implementation of some system calls. This allows the system calls to be executed in userspace to alleviate the context-switching expense. Virtual system calls provide an opportunity of attack for a user who has control of the return instruction pointer. Disabling virtual system calls help to prevent return-oriented programming attacks via buffer overflows and overruns.
Fix: F-85767r1167052_fix

Configure RHEL 10 to disable virtual system calls with the following command: $ sudo grubby --update-kernel=ALL --args="vsyscall=none"

b
RHEL 10 must clear the page allocator to prevent use-after-free attacks.
RMF Control
SC-3
Severity
M
CCI
CCI-001084
Version
RHEL-10-701000
Vuln IDs
V-281302
Rule IDs
SV-281302r1167056_rule
Poisoning writes an arbitrary value to freed pages, so any modification or reference to that page after being freed or before being initialized will be detected and prevented. This prevents many types of use-after-free vulnerabilities at little performance cost. It also prevents data leakage and detection of corrupted memory.
Fix: F-85768r1167055_fix

Configure RHEL 10 to enable page poisoning with the following commands: $ sudo grubby --update-kernel=ALL --args="page_poison=1"

b
RHEL 10 must clear memory when it is freed to prevent use-after-free attacks.
RMF Control
SC-3
Severity
M
CCI
CCI-001084
Version
RHEL-10-701010
Vuln IDs
V-281303
Rule IDs
SV-281303r1167059_rule
Some adversaries launch attacks with the intent of executing code in nonexecutable regions of memory or in memory locations that are prohibited. Security safeguards employed to protect memory include, for example, data execution prevention and address space layout randomization. Data execution prevention safeguards can be either hardware-enforced or software-enforced, with hardware providing the greater strength of mechanism. Poisoning writes an arbitrary value to freed pages, so any modification or reference to that page after being freed or before being initialized will be detected and prevented. This prevents many types of use-after-free vulnerabilities at little performance cost. It also prevents data leakage and detection of corrupted memory. "init_on_free" is a Linux kernel boot parameter that enhances security by initializing memory regions when they are freed, preventing data leakage. This process ensures that stale data in freed memory cannot be accessed by malicious programs. SLUB canaries add a randomized value (canary) at the end of SLUB-allocated objects to detect memory corruption caused by buffer overflows or underflows. Redzoning adds padding (red zones) around SLUB-allocated objects to detect overflows or underflows by triggering a fault when adjacent memory is accessed. SLUB canaries are often more efficient and provide stronger detection against buffer overflows compared to redzoning. SLUB canaries are supported in hardened Linux kernels such as the ones provided by Linux-hardened. SLAB objects are blocks of physically contiguous memory. SLUB is the unqueued SLAB allocator.
Fix: F-85769r1167058_fix

Configure RHEL 10 to enable "init_on_free" with the following command: $ sudo grubby --update-kernel=ALL --args="init_on_free=1"

b
RHEL 10 must enable mitigations against processor-based vulnerabilities.
RMF Control
SI-16
Severity
M
CCI
CCI-002824
Version
RHEL-10-701020
Vuln IDs
V-281304
Rule IDs
SV-281304r1167062_rule
Kernel page-table isolation is a kernel feature that mitigates the Meltdown security vulnerability and hardens the kernel against attempts to bypass kernel address space layout randomization (KASLR). Satisfies: SRG-OS-000433-GPOS-00193, SRG-OS-000095-GPOS-00049
Fix: F-85770r1167061_fix

Configure RHEL 10 to enable kernel page-table isolation with the following command: $ sudo grubby --update-kernel=ALL --args="pti=on"

b
RHEL 10 must restrict access to the kernel message buffer.
RMF Control
SC-2
Severity
M
CCI
CCI-001082
Version
RHEL-10-701030
Vuln IDs
V-281305
Rule IDs
SV-281305r1167065_rule
Preventing unauthorized information transfers mitigates the risk of information, including encrypted representations of information, produced by the actions of prior users/roles (or the actions of processes acting on behalf of prior users/roles) from being available to any current users/roles (or current processes) that obtain access to shared system resources (e.g., registers, main memory, hard disks) after those resources have been released back to information systems. The control of information in shared resources is also commonly referred to as object reuse and residual information protection. This requirement generally applies to the design of an information technology product, but it can also apply to the configuration of information system components that are, or use, such products. This can be verified by acceptance/validation processes in DOD or other government agencies. There may be shared resources with configurable protections (e.g., files in storage) that may be assessed on specific information system components. Restricting access to the kernel message buffer limits access to only root. This prevents attackers from gaining additional system information as a nonprivileged user. Satisfies: SRG-OS-000132-GPOS-00067, SRG-OS-000138-GPOS-00069
Fix: F-85771r1167064_fix

Configure RHEL 10 to restrict access to the kernel message buffer. Create a drop-in if it does not already exist: $ sudo vi /etc/sysctl.d/99-dmesg_restrict.conf Add the following to the file: kernel.dmesg_restrict = 1 Reload settings from all system configuration files with the following command: $ sudo sysctl --system

b
RHEL 10 must prevent kernel profiling by nonprivileged users.
RMF Control
SC-2
Severity
M
CCI
CCI-001082
Version
RHEL-10-701040
Vuln IDs
V-281306
Rule IDs
SV-281306r1167068_rule
Preventing unauthorized information transfers mitigates the risk of information, including encrypted representations of information, produced by the actions of prior users/roles (or the actions of processes acting on behalf of prior users/roles) from being available to any current users/roles (or current processes) that obtain access to shared system resources (e.g., registers, main memory, hard disks) after those resources have been released back to information systems. The control of information in shared resources is also commonly referred to as object reuse and residual information protection. This requirement generally applies to the design of an information technology product, but it can also apply to the configuration of information system components that are, or use, such products. This can be verified by acceptance/validation processes in DOD or other government agencies. There may be shared resources with configurable protections (e.g., files in storage) that may be assessed on specific information system components. Setting the "kernel.perf_event_paranoid" kernel parameter to "2" prevents attackers from gaining additional system information as a nonprivileged user. Satisfies: SRG-OS-000132-GPOS-00067, SRG-OS-000138-GPOS-00069
Fix: F-85772r1167067_fix

Configure RHEL 10 to prevent kernel profiling by nonprivileged users. Create a drop-in if it does not already exist: $ sudo vi /etc/sysctl.d/99-kernel_perf_event_paranoid.conf Add the following to the file: kernel.perf_event_paranoid = 2 Reload settings from all system configuration files with the following command: $ sudo sysctl --system

c
RHEL 10 must prevent the loading of a new kernel for later execution.
RMF Control
Severity
H
CCI
CCI-003992
Version
RHEL-10-701050
Vuln IDs
V-281307
Rule IDs
SV-281307r1184629_rule
Changes to any software components can have significant effects on the overall security of the operating system. This requirement ensures the software has not been tampered with and has been provided by a trusted vendor. Disabling kexec_load prevents an unsigned kernel image (that could be a windows kernel or modified vulnerable kernel) from being loaded. Kexec can be used to subvert the entire secureboot process and should be avoided at all costs, especially because it can load unsigned kernel images.
Fix: F-85773r1184628_fix

Configure RHEL 10 to disable kernel image loading. Create a drop-in if it does not already exist: $ sudo vi /etc/sysctl.d/99-kernel_kexec_load_disabled.conf Add the following to the file: kernel.kexec_load_disabled = 1 Reload settings from all system configuration files with the following command: $ sudo sysctl --system

b
RHEL 10 must restrict exposed kernel pointer address access.
RMF Control
SC-2
Severity
M
CCI
CCI-001082
Version
RHEL-10-701060
Vuln IDs
V-281308
Rule IDs
SV-281308r1167074_rule
Exposing kernel pointers (through procfs or "seq_printf()") exposes kernel writable structures, which may contain functions pointers. If a write vulnerability occurs in the kernel, allowing write access to any of this structure, the kernel can be compromised. This option disallows any program without the CAP_SYSLOG capability to get the addresses of kernel pointers by replacing them with "0". Satisfies: SRG-OS-000132-GPOS-00067, SRG-OS-000433-GPOS-00192
Fix: F-85774r1167073_fix

Configure RHEL 10 to restrict exposed kernel pointer address access. Create a drop-in if it does not already exist: $ sudo vi /etc/sysctl.d/99-kernel_kptr_restrict.conf Add the following to the file: kernel.kptr_restrict = 1 Reload settings from all system configuration files with the following command: $ sudo sysctl --system

b
RHEL 10 must enable kernel parameters to enforce discretionary access control (DAC) on hardlinks.
RMF Control
AC-3
Severity
M
CCI
CCI-002165
Version
RHEL-10-701070
Vuln IDs
V-281309
Rule IDs
SV-281309r1184631_rule
By enabling the "fs.protected_hardlinks" kernel parameter, users can no longer create soft or hard links to files they do not own. Disallowing such hardlinks mitigates vulnerabilities based on insecure file systems accessed by privileged programs, avoiding an exploitation vector exploiting unsafe use of open() or creat(). Satisfies: SRG-OS-000312-GPOS-00122, SRG-OS-000312-GPOS-00123, SRG-OS-000324-GPOS-00125
Fix: F-85775r1184630_fix

Configure RHEL 10 to enable DAC on hardlinks. Create a drop-in if it does not already exist: $ sudo vi /etc/sysctl.d/99-fs_protected_hardlinks.conf Add the following to the file: fs.protected_hardlinks = 1 Reload settings from all system configuration files with the following command: $ sudo sysctl --system

b
RHEL 10 must enable kernel parameters to enforce discretionary access control (DAC) on symlinks.
RMF Control
AC-3
Severity
M
CCI
CCI-002165
Version
RHEL-10-701080
Vuln IDs
V-281310
Rule IDs
SV-281310r1167080_rule
By enabling the "fs.protected_symlinks" kernel parameter, symbolic links are permitted to be followed only when outside a sticky world-writable directory, or when the user identifier (UID) of the link and follower match, or when the directory owner matches the symlink's owner. Disallowing such symlinks helps mitigate vulnerabilities based on insecure file systems accessed by privileged programs, avoiding an exploitation vector exploiting unsafe use of open() or creat(). Satisfies: SRG-OS-000312-GPOS-00122, SRG-OS-000312-GPOS-00123, SRG-OS-000324-GPOS-00125
Fix: F-85776r1167079_fix

Configure RHEL 10 to enable DAC on symlinks with the following: Create a drop-in if it does not already exist: $ sudo vi /etc/sysctl.d/99-fs_protected_symlinks.conf Add the following to the file: fs.protected_symlinks = 1 Reload settings from all system configuration files with the following command: $ sudo sysctl --system

b
RHEL 10 must disable the "kernel.core_pattern".
RMF Control
CM-7
Severity
M
CCI
CCI-000381
Version
RHEL-10-701090
Vuln IDs
V-281311
Rule IDs
SV-281311r1167083_rule
A core dump includes a memory image taken at the time the operating system terminates an application. The memory image could contain sensitive data and is generally useful only for developers trying to debug problems.
Fix: F-85777r1167082_fix

Configure RHEL 10 to disable storing core dumps. Create a drop-in if it does not already exist: $ sudo vi /etc/sysctl.d/99-kernel_core_pattern.conf Add the following to the file: kernel.core_pattern = |/bin/false Reload settings from all system configuration files with the following command: $ sudo sysctl --system

b
RHEL 10 must be configured to disable the Controller Area Network (CAN) kernel module.
RMF Control
CM-7
Severity
M
CCI
CCI-000381
Version
RHEL-10-701100
Vuln IDs
V-281312
Rule IDs
SV-281312r1167086_rule
Disabling CAN protects the system against exploitation of any flaws in its implementation.
Fix: F-85778r1167085_fix

Configure RHEL 10 to disable the ability to load the CAN kernel module. Create a drop-in if it does not already exist: $ sudo vi /etc/modprobe.d/can.conf Add the following lines to the file: install can /bin/false blacklist can

b
RHEL 10 must implement address space layout randomization (ASLR) to protect its memory from unauthorized code execution.
RMF Control
SI-16
Severity
M
CCI
CCI-002824
Version
RHEL-10-701130
Vuln IDs
V-281315
Rule IDs
SV-281315r1208802_rule
ASLR makes it more difficult for an attacker to predict the location of attack code they have introduced into a process's address space during an attempt at exploitation. Additionally, ASLR makes it more difficult for an attacker to know the location of existing code to repurpose it using return-oriented programming techniques.
Fix: F-85781r1208801_fix

Configure RHEL 10 to implement ASLR. $ echo 'kernel.randomize_va_space = 2' | sudo tee /etc/sysctl.d/99-kernel_randomize_va_space.conf Remove any configurations that conflict with the above from the following locations: /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf /usr/lib/sysctl.d/*.conf /lib/sysctl.d/*.conf /etc/sysctl.conf /etc/sysctl.d/*.conf Issue the following command to make the changes take effect: $ sudo sysctl --system

c
RHEL 10 must be a vendor-supported release.
RMF Control
SA-22
Severity
H
CCI
CCI-003376
Version
RHEL-10-001000
Vuln IDs
V-282965
Rule IDs
SV-282965r1197252_rule
An operating system release is considered "supported" if the vendor continues to provide security patches for the product. With an unsupported release, it will not be possible to resolve security issues discovered in the system software. Red Hat offers the Extended Update Support (EUS) add-on to a Red Hat Enterprise Linux subscription, for a fee, for customers who wish to standardize on a specific minor release for an extended period. End-of-life dates for Red Hat Linux 10 releases are as follows: - Current end of Full Support for Red Hat Linux 10 is 31 May 2030. - Current end of Maintenance Support for Red Hat Linux 10 is 31 May 2035. - Current end of Extended Life Cycle Support (ELS) for Red Hat Linux 9 is 31 May 2038.
Fix: F-87432r1195333_fix

Upgrade to a supported version of RHEL 10.