Red Hat Enterprise Linux 7 V2R6 (SCAP)

c

The Red Hat Enterprise Linux operating system must be configured so that the cryptographic hash of system files and commands matches vendor values.

RMF Control: CM-5
Severity: H
CCI: CCI-001749
Version: RHEL-07-010020
Vuln IDs: V-71855
Rule IDs: SV-86479r4_rule

Without cryptographic integrity protections, system command and files can be altered by unauthorized users without detection. Cryptographic mechanisms used for protecting the integrity of information include, for example, signed hash functions using asymmetric cryptography enabling distribution of the public key to verify the hash information while maintaining the confidentiality of the key used to generate the hash.

Fix: F-78207r1_fix

Run the following command to determine which package owns the file: # rpm -qf <filename> The package can be reinstalled from a yum repository using the command: # sudo yum reinstall <packagename> Alternatively, the package can be reinstalled from trusted media using the command: # sudo rpm -Uvh <packagename>

b

The Red Hat Enterprise Linux operating system must display the Standard Mandatory DoD Notice and Consent Banner before granting local or remote access to the system via a graphical user logon.

RMF Control: AC-8
Severity: M
CCI: CCI-000048
Version: RHEL-07-010030
Vuln IDs: V-71859
Rule IDs: SV-86483r4_rule

Display of a standardized and approved use notification before granting access to the operating system ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. System use notifications are required only for access via logon interfaces with human users and are not required when such human interfaces do not exist. The banner must be formatted in accordance with applicable DoD policy. Use the following verbiage for operating systems that can accommodate banners of 1300 characters: "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." Satisfies: SRG-OS-000023-GPOS-00006, SRG-OS-000024-GPOS-00007, SRG-OS-000228-GPOS-00088

Fix: F-78211r4_fix

Configure the operating system to display the Standard Mandatory DoD Notice and Consent Banner before granting access to the system. Note: If the system does not have GNOME installed, this requirement is Not Applicable. Create a database to contain the system-wide graphical user logon settings (if it does not already exist) with the following command: # touch /etc/dconf/db/local.d/01-banner-message Add the following line to the [org/gnome/login-screen] section of the "/etc/dconf/db/local.d/01-banner-message": [org/gnome/login-screen] banner-message-enable=true Update the system databases: # dconf update Users must log out and back in again before the system-wide settings take effect.

b

The Red Hat Enterprise Linux operating system must display the approved Standard Mandatory DoD Notice and Consent Banner before granting local or remote access to the system via a graphical user logon.

RMF Control: AC-8
Severity: M
CCI: CCI-000048
Version: RHEL-07-010040
Vuln IDs: V-71861
Rule IDs: SV-86485r4_rule

Display of a standardized and approved use notification before granting access to the operating system ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. System use notifications are required only for access via logon interfaces with human users and are not required when such human interfaces do not exist. The banner must be formatted in accordance with applicable DoD policy. Use the following verbiage for operating systems that can accommodate banners of 1300 characters: "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." Satisfies: SRG-OS-000023-GPOS-00006, SRG-OS-000024-GPOS-00007, SRG-OS-000228-GPOS-00088

Fix: F-78213r5_fix

Configure the operating system to display the approved Standard Mandatory DoD Notice and Consent Banner before granting access to the system. Note: If the system does not have GNOME installed, this requirement is Not Applicable. Create a database to contain the system-wide graphical user logon settings (if it does not already exist) with the following command: # touch /etc/dconf/db/local.d/01-banner-message Add the following line to the [org/gnome/login-screen] section of the "/etc/dconf/db/local.d/01-banner-message": [org/gnome/login-screen] banner-message-enable=true banner-message-text='You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\n-At any time, the USG may inspect and seize data stored on this IS.\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details. ' Note: The "\n " characters are for formatting only. They will not be displayed on the GUI. Run the following command to update the database: # dconf update

b

The Red Hat Enterprise Linux operating system must display the Standard Mandatory DoD Notice and Consent Banner before granting local or remote access to the system via a command line user logon.

RMF Control: AC-8
Severity: M
CCI: CCI-000048
Version: RHEL-07-010050
Vuln IDs: V-71863
Rule IDs: SV-86487r3_rule

Display of a standardized and approved use notification before granting access to the operating system ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. System use notifications are required only for access via logon interfaces with human users and are not required when such human interfaces do not exist. The banner must be formatted in accordance with applicable DoD policy. Use the following verbiage for operating systems that can accommodate banners of 1300 characters: "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." Satisfies: SRG-OS-000023-GPOS-00006, SRG-OS-000024-GPOS-00007

Fix: F-78217r2_fix

Configure the operating system to display the Standard Mandatory DoD Notice and Consent Banner before granting access to the system via the command line by editing the "/etc/issue" file. Replace the default text with the Standard Mandatory DoD Notice and Consent Banner. The DoD required text is: "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details."

b

The Red Hat Enterprise Linux operating system must enable a user session lock until that user re-establishes access using established identification and authentication procedures.

RMF Control: AC-11
Severity: M
CCI: CCI-000056
Version: RHEL-07-010060
Vuln IDs: V-71891
Rule IDs: SV-86515r6_rule

A session lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not want to log out because of the temporary nature of the absence. The session lock is implemented at the point where session activity can be determined. Regardless of where the session lock is determined and implemented, once invoked, the session lock must remain in place until the user reauthenticates. No other activity aside from reauthentication must unlock the system. Satisfies: SRG-OS-000028-GPOS-00009, SRG-OS-000030-GPOS-00011

Fix: F-78243r9_fix

Configure the operating system to enable a user's session lock until that user re-establishes access using established identification and authentication procedures. Create a database to contain the system-wide screensaver settings (if it does not already exist) with the following example: # touch /etc/dconf/db/local.d/00-screensaver Edit the "[org/gnome/desktop/screensaver]" section of the database file and add or update the following lines: # Set this to true to lock the screen when the screensaver activates lock-enabled=true Update the system databases: # dconf update Users must log out and back in again before the system-wide settings take effect.

b

The Red Hat Enterprise Linux operating system must initiate a screensaver after a 15-minute period of inactivity for graphical user interfaces.

RMF Control: AC-11
Severity: M
CCI: CCI-000057
Version: RHEL-07-010070
Vuln IDs: V-71893
Rule IDs: SV-86517r5_rule

A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not log out because of the temporary nature of the absence. Rather than relying on the user to manually lock their operating system session prior to vacating the vicinity, operating systems need to be able to identify when a user's session has idled and take action to initiate the session lock. The session lock is implemented at the point where session activity can be determined and/or controlled.

Fix: F-78245r5_fix

Configure the operating system to initiate a screensaver after a 15-minute period of inactivity for graphical user interfaces. Create a database to contain the system-wide screensaver settings (if it does not already exist) with the following command: # touch /etc/dconf/db/local.d/00-screensaver Edit /etc/dconf/db/local.d/00-screensaver and add or update the following lines: [org/gnome/desktop/session] # Set the lock time out to 900 seconds before the session is considered idle idle-delay=uint32 900 You must include the "uint32" along with the integer key values as shown. Update the system databases: # dconf update Users must log out and back in again before the system-wide settings take effect.

b

The Red Hat Enterprise Linux operating system must have the screen package installed.

RMF Control: AC-11
Severity: M
CCI: CCI-000057
Version: RHEL-07-010090
Vuln IDs: V-71897
Rule IDs: SV-86521r3_rule

: A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not log out because of the temporary nature of the absence. Rather than relying on the user to manually lock their operating system session prior to vacating the vicinity, operating systems need to be able to identify when a user's session has idled and take action to initiate the session lock. The screen and tmux packages allow for a session lock to be implemented and configured.

Fix: F-78249r3_fix

Install the screen package to allow the initiation of a session lock after a 15-minute period of inactivity. Install the screen program (if it is not on the system) with the following command: # yum install screen OR Install the tmux program (if it is not on the system) with the following command: #yum install tmux

b

The Red Hat Enterprise Linux operating system must initiate a session lock for the screensaver after a period of inactivity for graphical user interfaces.

RMF Control: AC-11
Severity: M
CCI: CCI-000057
Version: RHEL-07-010100
Vuln IDs: V-71899
Rule IDs: SV-86523r5_rule

A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not log out because of the temporary nature of the absence. Rather than relying on the user to manually lock their operating system session prior to vacating the vicinity, operating systems need to be able to identify when a user's session has idled and take action to initiate the session lock. The session lock is implemented at the point where session activity can be determined and/or controlled.

Fix: F-78251r2_fix

Configure the operating system to initiate a session lock after a 15-minute period of inactivity for graphical user interfaces. Create a database to contain the system-wide screensaver settings (if it does not already exist) with the following command: # touch /etc/dconf/db/local.d/00-screensaver Add the setting to enable screensaver locking after 15 minutes of inactivity: [org/gnome/desktop/screensaver] idle-activation-enabled=true Update the system databases: # dconf update Users must log out and back in again before the system-wide settings take effect.

b

The Red Hat Enterprise Linux operating system must initiate a session lock for graphical user interfaces when the screensaver is activated.

RMF Control: AC-11
Severity: M
CCI: CCI-000057
Version: RHEL-07-010110
Vuln IDs: V-71901
Rule IDs: SV-86525r3_rule

A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not log out because of the temporary nature of the absence. Rather than relying on the user to manually lock their operating system session prior to vacating the vicinity, operating systems need to be able to identify when a user's session has idled and take action to initiate the session lock. The session lock is implemented at the point where session activity can be determined and/or controlled.

Fix: F-78253r2_fix

Configure the operating system to initiate a session lock for graphical user interfaces when a screensaver is activated. Create a database to contain the system-wide screensaver settings (if it does not already exist) with the following command: # touch /etc/dconf/db/local.d/00-screensaver Add the setting to enable session locking when a screensaver is activated: [org/gnome/desktop/screensaver] lock-delay=uint32 5 The "uint32" must be included along with the integer key values as shown. Update the system databases: # dconf update Users must log out and back in again before the system-wide settings take effect.

b

The Red Hat Enterprise Linux operating system must be configured so that when passwords are changed or new passwords are established, the new password must contain at least one upper-case character.

RMF Control: IA-5
Severity: M
CCI: CCI-000192
Version: RHEL-07-010120
Vuln IDs: V-71903
Rule IDs: SV-86527r3_rule

Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised.

Fix: F-78255r1_fix

Configure the operating system to enforce password complexity by requiring that at least one upper-case character be used by setting the "ucredit" option. Add the following line to "/etc/security/pwquality.conf" (or modify the line to have the required value): ucredit = -1

b

The Red Hat Enterprise Linux operating system must be configured so that when passwords are changed or new passwords are established, the new password must contain at least one lower-case character.

RMF Control: IA-5
Severity: M
CCI: CCI-000193
Version: RHEL-07-010130
Vuln IDs: V-71905
Rule IDs: SV-86529r5_rule

Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised.

Fix: F-78257r6_fix

Configure the system to require at least one lower-case character when creating or changing a password. Add or modify the following line in "/etc/security/pwquality.conf": lcredit = -1

b

The Red Hat Enterprise Linux operating system must be configured so that when passwords are changed or new passwords are assigned, the new password must contain at least one numeric character.

RMF Control: IA-5
Severity: M
CCI: CCI-000194
Version: RHEL-07-010140
Vuln IDs: V-71907
Rule IDs: SV-86531r3_rule

Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised.

Fix: F-78259r1_fix

Configure the operating system to enforce password complexity by requiring that at least one numeric character be used by setting the "dcredit" option. Add the following line to /etc/security/pwquality.conf (or modify the line to have the required value): dcredit = -1

b

The Red Hat Enterprise Linux operating system must be configured so that when passwords are changed or new passwords are established, the new password must contain at least one special character.

RMF Control: IA-5
Severity: M
CCI: CCI-001619
Version: RHEL-07-010150
Vuln IDs: V-71909
Rule IDs: SV-86533r2_rule

Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised.

Fix: F-78261r2_fix

Configure the operating system to enforce password complexity by requiring that at least one special character be used by setting the "ocredit" option. Add the following line to "/etc/security/pwquality.conf" (or modify the line to have the required value): ocredit = -1

b

The Red Hat Enterprise Linux operating system must be configured so that when passwords are changed a minimum of eight of the total number of characters must be changed.

RMF Control: IA-5
Severity: M
CCI: CCI-000195
Version: RHEL-07-010160
Vuln IDs: V-71911
Rule IDs: SV-86535r2_rule

Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised.

Fix: F-78263r1_fix

Configure the operating system to require the change of at least eight of the total number of characters when passwords are changed by setting the "difok" option. Add the following line to "/etc/security/pwquality.conf" (or modify the line to have the required value): difok = 8

b

The Red Hat Enterprise Linux operating system must be configured so that when passwords are changed a minimum of four character classes must be changed.

RMF Control: IA-5
Severity: M
CCI: CCI-000195
Version: RHEL-07-010170
Vuln IDs: V-71913
Rule IDs: SV-86537r2_rule

Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised.

Fix: F-78265r1_fix

Configure the operating system to require the change of at least four character classes when passwords are changed by setting the "minclass" option. Add the following line to "/etc/security/pwquality.conf conf" (or modify the line to have the required value): minclass = 4

b

The Red Hat Enterprise Linux operating system must be configured so that when passwords are changed the number of repeating consecutive characters must not be more than three characters.

RMF Control: IA-5
Severity: M
CCI: CCI-000195
Version: RHEL-07-010180
Vuln IDs: V-71915
Rule IDs: SV-86539r3_rule

Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised.

Fix: F-78267r2_fix

Configure the operating system to require the change of the number of repeating consecutive characters when passwords are changed by setting the "maxrepeat" option. Add the following line to "/etc/security/pwquality.conf conf" (or modify the line to have the required value): maxrepeat = 3

b

The Red Hat Enterprise Linux operating system must be configured so that when passwords are changed the number of repeating characters of the same character class must not be more than four characters.

RMF Control: IA-5
Severity: M
CCI: CCI-000195
Version: RHEL-07-010190
Vuln IDs: V-71917
Rule IDs: SV-86541r2_rule

Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised.

Fix: F-78269r1_fix

Configure the operating system to require the change of the number of repeating characters of the same character class when passwords are changed by setting the "maxclassrepeat" option. Add the following line to "/etc/security/pwquality.conf" conf (or modify the line to have the required value): maxclassrepeat = 4

b

The Red Hat Enterprise Linux operating system must be configured so that the PAM system service is configured to store only encrypted representations of passwords.

RMF Control: IA-5
Severity: M
CCI: CCI-000196
Version: RHEL-07-010200
Vuln IDs: V-71919
Rule IDs: SV-86543r3_rule

Passwords need to be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. Passwords encrypted with a weak algorithm are no more protected than if they are kept in plain text.

Fix: F-78271r4_fix

Configure the operating system to store only SHA512 encrypted representations of passwords. Add the following line in "/etc/pam.d/system-auth": pam_unix.so sha512 shadow try_first_pass use_authtok Add the following line in "/etc/pam.d/password-auth": pam_unix.so sha512 shadow try_first_pass use_authtok Note: Manual changes to the listed files may be overwritten by the "authconfig" program. The "authconfig" program should not be used to update the configurations listed in this requirement.

b

The Red Hat Enterprise Linux operating system must be configured to use the shadow file to store only encrypted representations of passwords.

RMF Control: IA-5
Severity: M
CCI: CCI-000196
Version: RHEL-07-010210
Vuln IDs: V-71921
Rule IDs: SV-86545r2_rule

Passwords need to be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. Passwords encrypted with a weak algorithm are no more protected than if they are kept in plain text.

Fix: F-78273r1_fix

Configure the operating system to store only SHA512 encrypted representations of passwords. Add or update the following line in "/etc/login.defs": ENCRYPT_METHOD SHA512

b

The Red Hat Enterprise Linux operating system must be configured so that user and group account administration utilities are configured to store only encrypted representations of passwords.

RMF Control: IA-5
Severity: M
CCI: CCI-000196
Version: RHEL-07-010220
Vuln IDs: V-71923
Rule IDs: SV-86547r3_rule

Passwords need to be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. Passwords encrypted with a weak algorithm are no more protected than if they are kept in plain text.

Fix: F-78275r1_fix

Configure the operating system to store only SHA512 encrypted representations of passwords. Add or update the following line in "/etc/libuser.conf" in the [defaults] section: crypt_style = sha512

b

The Red Hat Enterprise Linux operating system must be configured so that passwords for new users are restricted to a 24 hours/1 day minimum lifetime.

RMF Control: IA-5
Severity: M
CCI: CCI-000198
Version: RHEL-07-010230
Vuln IDs: V-71925
Rule IDs: SV-86549r2_rule

Enforcing a minimum password lifetime helps to prevent repeated password changes to defeat the password reuse or history enforcement requirement. If users are allowed to immediately and continually change their password, the password could be repeatedly changed in a short period of time to defeat the organization's policy regarding password reuse.

Fix: F-78277r1_fix

Configure the operating system to enforce 24 hours/1 day as the minimum password lifetime. Add the following line in "/etc/login.defs" (or modify the line to have the required value): PASS_MIN_DAYS 1

b

The Red Hat Enterprise Linux operating system must be configured so that passwords are restricted to a 24 hours/1 day minimum lifetime.

RMF Control: IA-5
Severity: M
CCI: CCI-000198
Version: RHEL-07-010240
Vuln IDs: V-71927
Rule IDs: SV-86551r2_rule

Enforcing a minimum password lifetime helps to prevent repeated password changes to defeat the password reuse or history enforcement requirement. If users are allowed to immediately and continually change their password, the password could be repeatedly changed in a short period of time to defeat the organization's policy regarding password reuse.

Fix: F-78279r1_fix

Configure non-compliant accounts to enforce a 24 hours/1 day minimum password lifetime: # chage -m 1 [user]

b

The Red Hat Enterprise Linux operating system must be configured so that passwords for new users are restricted to a 60-day maximum lifetime.

RMF Control: IA-5
Severity: M
CCI: CCI-000199
Version: RHEL-07-010250
Vuln IDs: V-71929
Rule IDs: SV-86553r2_rule

Any password, no matter how complex, can eventually be cracked. Therefore, passwords need to be changed periodically. If the operating system does not limit the lifetime of passwords and force users to change their passwords, there is the risk that the operating system passwords could be compromised.

Fix: F-78281r1_fix

Configure the operating system to enforce a 60-day maximum password lifetime restriction. Add the following line in "/etc/login.defs" (or modify the line to have the required value): PASS_MAX_DAYS 60

b

The Red Hat Enterprise Linux operating system must be configured so that existing passwords are restricted to a 60-day maximum lifetime.

RMF Control: IA-5
Severity: M
CCI: CCI-000199
Version: RHEL-07-010260
Vuln IDs: V-71931
Rule IDs: SV-86555r3_rule

Any password, no matter how complex, can eventually be cracked. Therefore, passwords need to be changed periodically. If the operating system does not limit the lifetime of passwords and force users to change their passwords, there is the risk that the operating system passwords could be compromised.

Fix: F-78283r1_fix

Configure non-compliant accounts to enforce a 60-day maximum password lifetime restriction. # chage -M 60 [user]

b

The Red Hat Enterprise Linux operating system must be configured so that passwords are prohibited from reuse for a minimum of five generations.

RMF Control: IA-5
Severity: M
CCI: CCI-000200
Version: RHEL-07-010270
Vuln IDs: V-71933
Rule IDs: SV-86557r3_rule

Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. If the information system or application allows the user to consecutively reuse their password when that password has exceeded its defined lifetime, the end result is a password that is not changed per policy requirements.

Fix: F-78285r3_fix

Configure the operating system to prohibit password reuse for a minimum of five generations. Add the following line in "/etc/pam.d/system-auth" and "/etc/pam.d/password-auth" (or modify the line to have the required value): password requisite pam_pwhistory.so use_authtok remember=5 retry=3 Note: Manual changes to the listed files may be overwritten by the "authconfig" program. The "authconfig" program should not be used to update the configurations listed in this requirement.

b

The Red Hat Enterprise Linux operating system must be configured so that passwords are a minimum of 15 characters in length.

RMF Control: IA-5
Severity: M
CCI: CCI-000205
Version: RHEL-07-010280
Vuln IDs: V-71935
Rule IDs: SV-86559r2_rule

The shorter the password, the lower the number of possible combinations that need to be tested before the password is compromised. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password length is one factor of several that helps to determine strength and how long it takes to crack a password. Use of more characters in a password helps to exponentially increase the time and/or resources required to compromise the password.

Fix: F-78287r1_fix

Configure operating system to enforce a minimum 15-character password length. Add the following line to "/etc/security/pwquality.conf" (or modify the line to have the required value): minlen = 15

c

The Red Hat Enterprise Linux operating system must not have accounts configured with blank or null passwords.

RMF Control: CM-6
Severity: H
CCI: CCI-000366
Version: RHEL-07-010290
Vuln IDs: V-71937
Rule IDs: SV-86561r3_rule

If an account has an empty password, anyone could log on and run commands with the privileges of that account. Accounts with empty passwords should never be used in operational environments.

Fix: F-78289r3_fix

If an account is configured for password authentication but does not have an assigned password, it may be possible to log on to the account without authenticating. Remove any instances of the "nullok" option in "/etc/pam.d/system-auth" and "/etc/pam.d/password-auth" to prevent logons with empty passwords. Note: Manual changes to the listed files may be overwritten by the "authconfig" program. The "authconfig" program should not be used to update the configurations listed in this requirement.

c

The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon does not allow authentication using an empty password.

RMF Control: IA-2
Severity: H
CCI: CCI-000766
Version: RHEL-07-010300
Vuln IDs: V-71939
Rule IDs: SV-86563r3_rule

Configuring this setting for the SSH daemon provides additional assurance that remote logon via SSH will require a password, even in the event of misconfiguration elsewhere.

Fix: F-78291r2_fix

To explicitly disallow remote logon from accounts with empty passwords, add or correct the following line in "/etc/ssh/sshd_config": PermitEmptyPasswords no The SSH service must be restarted for changes to take effect. Any accounts with empty passwords should be disabled immediately, and PAM configuration should prevent users from being able to assign themselves empty passwords.

b

The Red Hat Enterprise Linux operating system must disable account identifiers (individuals, groups, roles, and devices) if the password expires.

RMF Control: IA-4
Severity: M
CCI: CCI-000795
Version: RHEL-07-010310
Vuln IDs: V-71941
Rule IDs: SV-86565r2_rule

Inactive identifiers pose a risk to systems and applications because attackers may exploit an inactive identifier and potentially obtain undetected access to the system. Owners of inactive accounts will not notice if unauthorized access to their user account has been obtained. Operating systems need to track periods of inactivity and disable application identifiers after zero days of inactivity.

Fix: F-78293r1_fix

Configure the operating system to disable account identifiers (individuals, groups, roles, and devices) after the password expires. Add the following line to "/etc/default/useradd" (or modify the line to have the required value): INACTIVE=0

b

The Red Hat Enterprise Linux operating system must be configured so that users must provide a password for privilege escalation.

RMF Control: IA-11
Severity: M
CCI: CCI-002038
Version: RHEL-07-010340
Vuln IDs: V-71947
Rule IDs: SV-86571r3_rule

Without re-authentication, users may access resources or perform tasks for which they do not have authorization. When operating systems provide the capability to escalate a functional capability, it is critical the user re-authenticate. Satisfies: SRG-OS-000373-GPOS-00156, SRG-OS-000373-GPOS-00157, SRG-OS-000373-GPOS-00158

Fix: F-78299r2_fix

Configure the operating system to require users to supply a password for privilege escalation. Check the configuration of the "/etc/sudoers" file with the following command: # visudo Remove any occurrences of "NOPASSWD" tags in the file. Check the configuration of the /etc/sudoers.d/* files with the following command: # grep -i nopasswd /etc/sudoers.d/* Remove any occurrences of "NOPASSWD" tags in the file.

b

The Red Hat Enterprise Linux operating system must be configured so that users must re-authenticate for privilege escalation.

RMF Control: IA-11
Severity: M
CCI: CCI-002038
Version: RHEL-07-010350
Vuln IDs: V-71949
Rule IDs: SV-86573r3_rule

Without re-authentication, users may access resources or perform tasks for which they do not have authorization. When operating systems provide the capability to escalate a functional capability, it is critical the user reauthenticate. Satisfies: SRG-OS-000373-GPOS-00156, SRG-OS-000373-GPOS-00157, SRG-OS-000373-GPOS-00158

Fix: F-78301r3_fix

Configure the operating system to require users to reauthenticate for privilege escalation. Check the configuration of the "/etc/sudoers" file with the following command: # visudo Remove any occurrences of "!authenticate" tags in the file. Check the configuration of the "/etc/sudoers.d/*" files with the following command: # grep -i authenticate /etc/sudoers /etc/sudoers.d/* Remove any occurrences of "!authenticate" tags in the file(s).

b

The Red Hat Enterprise Linux operating system must be configured so that the delay between logon prompts following a failed console logon attempt is at least four seconds.

RMF Control: CM-6
Severity: M
CCI: CCI-000366
Version: RHEL-07-010430
Vuln IDs: V-71951
Rule IDs: SV-86575r2_rule

Configuring the operating system to implement organization-wide security implementation guides and security checklists verifies compliance with federal standards and establishes a common security baseline across DoD that reflects the most restrictive security posture consistent with operational requirements. Configuration settings are the set of parameters that can be changed in hardware, software, or firmware components of the system that affect the security posture and/or functionality of the system. Security-related parameters are those parameters impacting the security state of the system, including the parameters required to satisfy other security control requirements. Security-related parameters include, for example, registry settings; account, file, and directory permission settings; and settings for functions, ports, protocols, services, and remote connections.

Fix: F-78303r1_fix

Configure the operating system to enforce a delay of at least four seconds between logon prompts following a failed console logon attempt. Modify the "/etc/login.defs" file to set the "FAIL_DELAY" parameter to "4" or greater: FAIL_DELAY 4

c

The Red Hat Enterprise Linux operating system must not allow an unattended or automatic logon to the system via a graphical user interface.

RMF Control: CM-6
Severity: H
CCI: CCI-000366
Version: RHEL-07-010440
Vuln IDs: V-71953
Rule IDs: SV-86577r2_rule

Failure to restrict system access to authenticated users negatively impacts operating system security.

Fix: F-78305r1_fix

Configure the operating system to not allow an unattended or automatic logon to the system via a graphical user interface. Note: If the system does not have GNOME installed, this requirement is Not Applicable. Add or edit the line for the "AutomaticLoginEnable" parameter in the [daemon] section of the "/etc/gdm/custom.conf" file to "false": [daemon] AutomaticLoginEnable=false

c

The Red Hat Enterprise Linux operating system must not allow an unrestricted logon to the system.

RMF Control: CM-6
Severity: H
CCI: CCI-000366
Version: RHEL-07-010450
Vuln IDs: V-71955
Rule IDs: SV-86579r3_rule

Failure to restrict system access to authenticated users negatively impacts operating system security.

Fix: F-78307r2_fix

Configure the operating system to not allow an unrestricted account to log on to the system via a graphical user interface. Note: If the system does not have GNOME installed, this requirement is Not Applicable. Add or edit the line for the "TimedLoginEnable" parameter in the [daemon] section of the "/etc/gdm/custom.conf" file to "false": [daemon] TimedLoginEnable=false

b

The Red Hat Enterprise Linux operating system must not allow users to override SSH environment variables.

RMF Control: CM-6
Severity: M
CCI: CCI-000366
Version: RHEL-07-010460
Vuln IDs: V-71957
Rule IDs: SV-86581r3_rule

Failure to restrict system access to authenticated users negatively impacts operating system security.

Fix: F-78309r2_fix

Configure the operating system to not allow users to override environment variables to the SSH daemon. Edit the "/etc/ssh/sshd_config" file to uncomment or add the line for "PermitUserEnvironment" keyword and set the value to "no": PermitUserEnvironment no The SSH service must be restarted for changes to take effect.

b

The Red Hat Enterprise Linux operating system must not allow a non-certificate trusted host SSH logon to the system.

RMF Control: CM-6
Severity: M
CCI: CCI-000366
Version: RHEL-07-010470
Vuln IDs: V-71959
Rule IDs: SV-86583r3_rule

Failure to restrict system access to authenticated users negatively impacts operating system security.

Fix: F-78311r3_fix

Configure the operating system to not allow a non-certificate trusted host SSH logon to the system. Edit the "/etc/ssh/sshd_config" file to uncomment or add the line for "HostbasedAuthentication" keyword and set the value to "no": HostbasedAuthentication no The SSH service must be restarted for changes to take effect.

c

Red Hat Enterprise Linux operating systems prior to version 7.2 with a Basic Input/Output System (BIOS) must require authentication upon booting into single-user and maintenance modes.

RMF Control: AC-3
Severity: H
CCI: CCI-000213
Version: RHEL-07-010480
Vuln IDs: V-71961
Rule IDs: SV-86585r6_rule

If the system does not require valid root authentication before it boots into single-user or maintenance mode, anyone who invokes single-user or maintenance mode is granted privileged access to all files on the system. GRUB 2 is the default boot loader for RHEL 7 and is designed to require a password to boot into single-user mode or make modifications to the boot menu.

Fix: F-78313r3_fix

Configure the system to encrypt the boot password for root. Generate an encrypted grub2 password for root with the following command: Note: The hash generated is an example. # grub2-mkpasswd-pbkdf2 Enter Password: Reenter Password: PBKDF2 hash of your password is grub.pbkdf2.sha512.10000.F3A7CFAA5A51EED123BE8238C23B25B2A6909AFC9812F0D45 Edit "/etc/grub.d/40_custom" and add the following lines below the comments: # vi /etc/grub.d/40_custom set superusers="root" password_pbkdf2 root {hash from grub2-mkpasswd-pbkdf2 command} Generate a new "grub.conf" file with the new password with the following commands: # grub2-mkconfig --output=/tmp/grub2.cfg # mv /tmp/grub2.cfg /boot/grub2/grub.cfg

c

Red Hat Enterprise Linux operating systems prior to version 7.2 using Unified Extensible Firmware Interface (UEFI) must require authentication upon booting into single-user and maintenance modes.

RMF Control: AC-3
Severity: H
CCI: CCI-000213
Version: RHEL-07-010490
Vuln IDs: V-71963
Rule IDs: SV-86587r4_rule

If the system does not require valid root authentication before it boots into single-user or maintenance mode, anyone who invokes single-user or maintenance mode is granted privileged access to all files on the system. GRUB 2 is the default boot loader for RHEL 7 and is designed to require a password to boot into single-user mode or make modifications to the boot menu.

Fix: F-78315r3_fix

Configure the system to encrypt the boot password for root. Generate an encrypted grub2 password for root with the following command: Note: The hash generated is an example. # grub2-mkpasswd-pbkdf2 Enter Password: Reenter Password: PBKDF2 hash of your password is grub.pbkdf2.sha512.10000.F3A7CFAA5A51EED123BE8238C23B25B2A6909AFC9812F0D45 Edit "/etc/grub.d/40_custom" and add the following lines below the comments: # vi /etc/grub.d/40_custom set superusers="root" password_pbkdf2 root {hash from grub2-mkpasswd-pbkdf2 command} Generate a new "grub.conf" file with the new password with the following commands: # grub2-mkconfig --output=/tmp/grub2.cfg # mv /tmp/grub2.cfg /boot/efi/EFI/redhat/grub.cfg

c

The Red Hat Enterprise Linux operating system must not have the rsh-server package installed.

RMF Control: CM-7
Severity: H
CCI: CCI-000381
Version: RHEL-07-020000
Vuln IDs: V-71967
Rule IDs: SV-86591r2_rule

It is detrimental for operating systems to provide, or install by default, functionality exceeding requirements or mission objectives. These unnecessary capabilities or services are often overlooked and therefore may remain unsecured. They increase the risk to the platform by providing additional attack vectors. Operating systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). The rsh-server service provides an unencrypted remote access service that does not provide for the confidentiality and integrity of user passwords or the remote session and has very weak authentication. If a privileged user were to log on using this service, the privileged user password could be compromised.

Fix: F-78319r1_fix

Configure the operating system to disable non-essential capabilities by removing the rsh-server package from the system with the following command: # yum remove rsh-server

c

The Red Hat Enterprise Linux operating system must not have the ypserv package installed.

RMF Control: CM-7
Severity: H
CCI: CCI-000381
Version: RHEL-07-020010
Vuln IDs: V-71969
Rule IDs: SV-86593r2_rule

Removing the "ypserv" package decreases the risk of the accidental (or intentional) activation of NIS or NIS+ services.

Fix: F-78321r1_fix

Configure the operating system to disable non-essential capabilities by removing the "ypserv" package from the system with the following command: # yum remove ypserv

b

The Red Hat Enterprise Linux operating system must be configured so that a file integrity tool verifies the baseline operating system configuration at least weekly.

RMF Control: CM-3
Severity: M
CCI: CCI-001744
Version: RHEL-07-020030
Vuln IDs: V-71973
Rule IDs: SV-86597r2_rule

Unauthorized changes to the baseline configuration could make the system vulnerable to various attacks or allow unauthorized access to the operating system. Changes to operating system configurations can have unintended side effects, some of which may be relevant to security. Detecting such changes and providing an automated response can help avoid unintended, negative consequences that could ultimately affect the security state of the operating system. The operating system's Information Management Officer (IMO)/Information System Security Officer (ISSO) and System Administrators (SAs) must be notified via email and/or monitoring system trap when there is an unauthorized modification of a configuration item.

Fix: F-78325r2_fix

Configure the file integrity tool to run automatically on the system at least weekly. The following example output is generic. It will set cron to run AIDE daily, but other file integrity tools may be used: # more /etc/cron.daily/aide #!/bin/bash /usr/sbin/aide --check | /bin/mail -s "$HOSTNAME - Daily aide integrity check run" root@sysname.mil

c

The Red Hat Enterprise Linux operating system must prevent the installation of software, patches, service packs, device drivers, or operating system components from a repository without verification they have been digitally signed using a certificate that is issued by a Certificate Authority (CA) that is recognized and approved by the organization.

RMF Control: CM-5
Severity: H
CCI: CCI-001749
Version: RHEL-07-020050
Vuln IDs: V-71977
Rule IDs: SV-86601r2_rule

Changes to any software components can have significant effects on the overall security of the operating system. This requirement ensures the software has not been tampered with and that it has been provided by a trusted vendor. Accordingly, patches, service packs, device drivers, or operating system components must be signed with a certificate recognized and approved by the organization. Verifying the authenticity of the software prior to installation validates the integrity of the patch or upgrade received from a vendor. This verifies the software has not been tampered with and that it has been provided by a trusted vendor. Self-signed certificates are disallowed by this requirement. The operating system should not have to verify the software again. This requirement does not mandate DoD certificates for this purpose; however, the certificate used to verify the software must be from an approved CA.

Fix: F-78329r1_fix

Configure the operating system to verify the signature of packages from a repository prior to install by setting the following option in the "/etc/yum.conf" file: gpgcheck=1

c

The Red Hat Enterprise Linux operating system must prevent the installation of software, patches, service packs, device drivers, or operating system components of local packages without verification they have been digitally signed using a certificate that is issued by a Certificate Authority (CA) that is recognized and approved by the organization.

RMF Control: CM-5
Severity: H
CCI: CCI-001749
Version: RHEL-07-020060
Vuln IDs: V-71979
Rule IDs: SV-86603r2_rule

Changes to any software components can have significant effects on the overall security of the operating system. This requirement ensures the software has not been tampered with and that it has been provided by a trusted vendor. Accordingly, patches, service packs, device drivers, or operating system components must be signed with a certificate recognized and approved by the organization. Verifying the authenticity of the software prior to installation validates the integrity of the patch or upgrade received from a vendor. This verifies the software has not been tampered with and that it has been provided by a trusted vendor. Self-signed certificates are disallowed by this requirement. The operating system should not have to verify the software again. This requirement does not mandate DoD certificates for this purpose; however, the certificate used to verify the software must be from an approved CA.

Fix: F-78331r1_fix

Configure the operating system to verify the signature of local packages prior to install by setting the following option in the "/etc/yum.conf" file: localpkg_gpgcheck=1

b

The Red Hat Enterprise Linux operating system must be configured to disable USB mass storage.

RMF Control: CM-6
Severity: M
CCI: CCI-000366
Version: RHEL-07-020100
Vuln IDs: V-71983
Rule IDs: SV-86607r4_rule

USB mass storage permits easy introduction of unknown devices, thereby facilitating malicious activity. Satisfies: SRG-OS-000114-GPOS-00059, SRG-OS-000378-GPOS-00163, SRG-OS-000480-GPOS-00227

Fix: F-78335r4_fix

Configure the operating system to disable the ability to use the USB Storage kernel module. Create a file under "/etc/modprobe.d" with the following command: # touch /etc/modprobe.d/usb-storage.conf Add the following line to the created file: install usb-storage /bin/true Configure the operating system to disable the ability to use USB mass storage devices. # vi /etc/modprobe.d/blacklist.conf Add or update the line: blacklist usb-storage

b

The Red Hat Enterprise Linux operating system must disable the file system automounter unless required.

RMF Control: CM-6
Severity: M
CCI: CCI-000366
Version: RHEL-07-020110
Vuln IDs: V-71985
Rule IDs: SV-86609r2_rule

Automatically mounting file systems permits easy introduction of unknown devices, thereby facilitating malicious activity. Satisfies: SRG-OS-000114-GPOS-00059, SRG-OS-000378-GPOS-00163, SRG-OS-000480-GPOS-00227

Fix: F-78337r2_fix

Configure the operating system to disable the ability to automount devices. Turn off the automount service with the following commands: # systemctl stop autofs # systemctl disable autofs If "autofs" is required for Network File System (NFS), it must be documented with the ISSO.

a

The Red Hat Enterprise Linux operating system must remove all software components after updated versions have been installed.

RMF Control: SI-2
Severity: L
CCI: CCI-002617
Version: RHEL-07-020200
Vuln IDs: V-71987
Rule IDs: SV-86611r2_rule

Previous versions of software components that are not removed from the information system after updates have been installed may be exploited by adversaries. Some information technology products may remove older versions of software automatically from the information system.

Fix: F-78339r1_fix

Configure the operating system to remove all software components after updated versions have been installed. Set the "clean_requirements_on_remove" option to "1" in the "/etc/yum.conf" file: clean_requirements_on_remove=1

b

The Red Hat Enterprise Linux operating system must define default permissions for all authenticated users in such a way that the user can only read and modify their own files.

RMF Control: CM-6
Severity: M
CCI: CCI-000366
Version: RHEL-07-020240
Vuln IDs: V-71995
Rule IDs: SV-86619r2_rule

Setting the most restrictive default permissions ensures that when new accounts are created, they do not have unnecessary access.

Fix: F-78347r1_fix

Configure the operating system to define default permissions for all authenticated users in such a way that the user can only read and modify their own files. Add or edit the line for the "UMASK" parameter in "/etc/login.defs" file to "077": UMASK 077

c

The Red Hat Enterprise Linux operating system must be a vendor supported release.

RMF Control: CM-6
Severity: H
CCI: CCI-000366
Version: RHEL-07-020250
Vuln IDs: V-71997
Rule IDs: SV-86621r5_rule

An operating system release is considered "supported" if the vendor continues to provide security patches for the product. With an unsupported release, it will not be possible to resolve security issues discovered in the system software.

Fix: F-78349r1_fix

Upgrade to a supported version of the operating system.

a

The Red Hat Enterprise Linux operating system must be configured so that all Group Identifiers (GIDs) referenced in the /etc/passwd file are defined in the /etc/group file.

RMF Control: IA-2
Severity: L
CCI: CCI-000764
Version: RHEL-07-020300
Vuln IDs: V-72003
Rule IDs: SV-86627r2_rule

If a user is assigned the GID of a group not existing on the system, and a group with the GID is subsequently created, the user may have unintended rights to any files associated with the group.

Fix: F-78355r1_fix

Configure the system to define all GIDs found in the "/etc/passwd" file by modifying the "/etc/group" file to add any non-existent group referenced in the "/etc/passwd" file, or change the GIDs referenced in the "/etc/passwd" file to a group that exists in "/etc/group".

c

The Red Hat Enterprise Linux operating system must be configured so that the root account must be the only account having unrestricted access to the system.

RMF Control: CM-6
Severity: H
CCI: CCI-000366
Version: RHEL-07-020310
Vuln IDs: V-72005
Rule IDs: SV-86629r2_rule

If an account other than root also has a User Identifier (UID) of "0", it has root authority, giving that account unrestricted access to the entire operating system. Multiple accounts with a UID of "0" afford an opportunity for potential intruders to guess a password for a privileged account.

Fix: F-78357r1_fix

Change the UID of any account on the system, other than root, that has a UID of "0". If the account is associated with system commands or applications, the UID should be changed to one greater than "0" but less than "1000". Otherwise, assign a UID of greater than "1000" that has not already been assigned.

b

The Red Hat Enterprise Linux operating system must be configured so that all local interactive users have a home directory assigned in the /etc/passwd file.

RMF Control: CM-6
Severity: M
CCI: CCI-000366
Version: RHEL-07-020600
Vuln IDs: V-72011
Rule IDs: SV-86635r2_rule

If local interactive users are not assigned a valid home directory, there is no place for the storage and control of files they should own.

Fix: F-78363r1_fix

Assign home directories to all local interactive users that currently do not have a home directory assigned.

b

The Red Hat Enterprise Linux operating system must be configured so that all local interactive user accounts, upon creation, are assigned a home directory.

RMF Control: CM-6
Severity: M
CCI: CCI-000366
Version: RHEL-07-020610
Vuln IDs: V-72013
Rule IDs: SV-86637r2_rule

If local interactive users are not assigned a valid home directory, there is no place for the storage and control of files they should own.

Fix: F-78365r1_fix

Configure the operating system to assign home directories to all new local interactive users by setting the "CREATE_HOME" parameter in "/etc/login.defs" to "yes" as follows. CREATE_HOME yes

b

The Red Hat Enterprise Linux operating system must be configured so that all local interactive user home directories are defined in the /etc/passwd file.

RMF Control: CM-6
Severity: M
CCI: CCI-000366
Version: RHEL-07-020620
Vuln IDs: V-72015
Rule IDs: SV-86639r2_rule

If a local interactive user has a home directory defined that does not exist, the user may be given access to the / directory as the current working directory upon logon. This could create a Denial of Service because the user would not be able to access their logon configuration files, and it may give them visibility to system files they normally would not be able to access.

Fix: F-78367r2_fix

Create home directories to all local interactive users that currently do not have a home directory assigned. Use the following commands to create the user home directory assigned in "/etc/ passwd": Note: The example will be for the user smithj, who has a home directory of "/home/smithj", a UID of "smithj", and a Group Identifier (GID) of "users" assigned in "/etc/passwd". # mkdir /home/smithj # chown smithj /home/smithj # chgrp users /home/smithj # chmod 0750 /home/smithj

b

The Red Hat Enterprise Linux operating system must prevent files with the setuid and setgid bit set from being executed on file systems that are being imported via Network File System (NFS).

RMF Control: CM-6
Severity: M
CCI: CCI-000366
Version: RHEL-07-021020
Vuln IDs: V-72045
Rule IDs: SV-86669r2_rule

The "nosuid" mount option causes the system to not execute "setuid" and "setgid" files with owner privileges. This option must be used for mounting any file system not containing approved "setuid" and "setguid" files. Executing files from untrusted file systems increases the opportunity for unprivileged users to attain unauthorized administrative access.

Fix: F-78397r2_fix

Configure the "/etc/fstab" to use the "nosuid" option on file systems that are being imported via NFS.

b

The Red Hat Enterprise Linux operating system must be configured so that all world-writable directories are group-owned by root, sys, bin, or an application group.

RMF Control: CM-6
Severity: M
CCI: CCI-000366
Version: RHEL-07-021030
Vuln IDs: V-72047
Rule IDs: SV-86671r4_rule

If a world-writable directory has the sticky bit set and is not group-owned by a privileged Group Identifier (GID), unauthorized users may be able to modify files created by others. The only authorized public directories are those temporary directories supplied with the system or those designed to be temporary file repositories. The setting is normally reserved for directories used by the system and by users for temporary file storage, (e.g., /tmp), and for directories requiring global read/write access.

Fix: F-78399r1_fix

Change the group of the world-writable directories to root with the following command: # chgrp root <directory>

b

The Red Hat Enterprise Linux operating system must be configured so that the cron.allow file, if it exists, is owned by root.

RMF Control: CM-6
Severity: M
CCI: CCI-000366
Version: RHEL-07-021110
Vuln IDs: V-72053
Rule IDs: SV-86677r3_rule

If the owner of the "cron.allow" file is not set to root, the possibility exists for an unauthorized user to view or to edit sensitive information.

Fix: F-78405r1_fix

Set the owner on the "/etc/cron.allow" file to root with the following command: # chown root /etc/cron.allow

b

The Red Hat Enterprise Linux operating system must be configured so that the cron.allow file, if it exists, is group-owned by root.

RMF Control: CM-6
Severity: M
CCI: CCI-000366
Version: RHEL-07-021120
Vuln IDs: V-72055
Rule IDs: SV-86679r2_rule

If the group owner of the "cron.allow" file is not set to root, sensitive information could be viewed or edited by unauthorized users.

Fix: F-78407r1_fix

Set the group owner on the "/etc/cron.allow" file to root with the following command: # chgrp root /etc/cron.allow

a

The Red Hat Enterprise Linux operating system must be configured so that a separate file system is used for user home directories (such as /home or an equivalent).

RMF Control: CM-6
Severity: L
CCI: CCI-000366
Version: RHEL-07-021310
Vuln IDs: V-72059
Rule IDs: SV-86683r2_rule

The use of separate file systems for different paths can protect the system from failures resulting from a file system becoming full or failing.

Fix: F-78411r1_fix

Migrate the "/home" directory onto a separate file system/partition.

a

The Red Hat Enterprise Linux operating system must use a separate file system for /var.

RMF Control: CM-6
Severity: L
CCI: CCI-000366
Version: RHEL-07-021320
Vuln IDs: V-72061
Rule IDs: SV-86685r2_rule

The use of separate file systems for different paths can protect the system from failures resulting from a file system becoming full or failing.

Fix: F-78413r1_fix

Migrate the "/var" path onto a separate file system.

a

The Red Hat Enterprise Linux operating system must use a separate file system for the system audit data path.

RMF Control: CM-6
Severity: L
CCI: CCI-000366
Version: RHEL-07-021330
Vuln IDs: V-72063
Rule IDs: SV-86687r6_rule

The use of separate file systems for different paths can protect the system from failures resulting from a file system becoming full or failing.

Fix: F-78415r1_fix

Migrate the system audit data path onto a separate file system.

a

The Red Hat Enterprise Linux operating system must use a separate file system for /tmp (or equivalent).

RMF Control: CM-6
Severity: L
CCI: CCI-000366
Version: RHEL-07-021340
Vuln IDs: V-72065
Rule IDs: SV-86689r3_rule

The use of separate file systems for different paths can protect the system from failures resulting from a file system becoming full or failing.

Fix: F-78417r2_fix

Start the "tmp.mount" service with the following command: # systemctl enable tmp.mount OR Edit the "/etc/fstab" file and ensure the "/tmp" directory is defined in the fstab with a device and mount point.

c

The Red Hat Enterprise Linux operating system must implement NIST FIPS-validated cryptography for the following: to provision digital signatures, to generate cryptographic hashes, and to protect data requiring data-at-rest protections in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.

RMF Control: AC-17
Severity: H
CCI: CCI-000068
Version: RHEL-07-021350
Vuln IDs: V-72067
Rule IDs: SV-86691r4_rule

Use of weak or untested encryption algorithms undermines the purposes of using encryption to protect data. The operating system must implement cryptographic modules adhering to the higher standards approved by the federal government since this provides assurance they have been tested and validated. Satisfies: SRG-OS-000033-GPOS-00014, SRG-OS-000185-GPOS-00079, SRG-OS-000396-GPOS-00176, SRG-OS-000405-GPOS-00184, SRG-OS-000478-GPOS-00223

Fix: F-78419r3_fix

Configure the operating system to implement DoD-approved encryption by installing the dracut-fips package. To enable strict FIPS compliance, the fips=1 kernel option needs to be added to the kernel command line during system installation so key generation is done with FIPS-approved algorithms and continuous monitoring tests in place. Configure the operating system to implement DoD-approved encryption by following the steps below: The fips=1 kernel option needs to be added to the kernel command line during system installation so that key generation is done with FIPS-approved algorithms and continuous monitoring tests in place. Users should also ensure that the system has plenty of entropy during the installation process by moving the mouse around, or if no mouse is available, ensuring that many keystrokes are typed. The recommended amount of keystrokes is 256 and more. Less than 256 keystrokes may generate a non-unique key. Install the dracut-fips package with the following command: # yum install dracut-fips Recreate the "initramfs" file with the following command: Note: This command will overwrite the existing "initramfs" file. # dracut -f Modify the kernel command line of the current kernel in the "grub.cfg" file by adding the following option to the GRUB_CMDLINE_LINUX key in the "/etc/default/grub" file and then rebuild the "grub.cfg" file: fips=1 Changes to "/etc/default/grub" require rebuilding the "grub.cfg" file as follows: On BIOS-based machines, use the following command: # grub2-mkconfig -o /boot/grub2/grub.cfg On UEFI-based machines, use the following command: # grub2-mkconfig -o /boot/efi/EFI/redhat/grub.cfg If /boot or /boot/efi reside on separate partitions, the kernel parameter boot=<partition of /boot or /boot/efi> must be added to the kernel command line. You can identify a partition by running the df /boot or df /boot/efi command: # df /boot Filesystem 1K-blocks Used Available Use% Mounted on /dev/sda1 495844 53780 416464 12% /boot To ensure the "boot=" configuration option will work even if device naming changes occur between boots, identify the universally unique identifier (UUID) of the partition with the following command: # blkid /dev/sda1 /dev/sda1: UUID="05c000f1-a213-759e-c7a2-f11b7424c797" TYPE="ext4" For the example above, append the following string to the kernel command line: boot=UUID=05c000f1-a213-759e-c7a2-f11b7424c797 Reboot the system for the changes to take effect.

c

The Red Hat Enterprise Linux operating system must not have the telnet-server package installed.

RMF Control: CM-7
Severity: H
CCI: CCI-000381
Version: RHEL-07-021710
Vuln IDs: V-72077
Rule IDs: SV-86701r2_rule

It is detrimental for operating systems to provide, or install by default, functionality exceeding requirements or mission objectives. These unnecessary capabilities or services are often overlooked and therefore may remain unsecured. They increase the risk to the platform by providing additional attack vectors. Operating systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). Examples of non-essential capabilities include, but are not limited to, games, software packages, tools, and demonstration software not related to requirements or providing a wide array of functionality not required for every mission, but which cannot be disabled.

Fix: F-78429r1_fix

Configure the operating system to disable non-essential capabilities by removing the telnet-server package from the system with the following command: # yum remove telnet-server

c

The Red Hat Enterprise Linux operating system must be configured so that auditing is configured to produce records containing information to establish what type of events occurred, where the events occurred, the source of the events, and the outcome of the events. These audit records must also identify individual identities of group account users.

RMF Control: AU-2
Severity: H
CCI: CCI-000126
Version: RHEL-07-030000
Vuln IDs: V-72079
Rule IDs: SV-86703r3_rule

Without establishing what type of events occurred, it would be difficult to establish, correlate, and investigate the events leading up to an outage or attack. Audit record content that may be necessary to satisfy this requirement includes, for example, time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, filenames involved, and access control or flow control rules invoked. Associating event types with detected events in the operating system audit logs provides a means of investigating an attack; recognizing resource utilization or capacity thresholds; or identifying an improperly configured operating system. Satisfies: SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000042-GPOS-00021, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096

Fix: F-78431r2_fix

Configure the operating system to produce audit records containing information to establish when (date and time) the events occurred. Enable the auditd service with the following command: # systemctl start auditd.service

b

The Red Hat Enterprise Linux operating system must shut down upon audit processing failure, unless availability is an overriding concern. If availability is a concern, the system must alert the designated staff (System Administrator [SA] and Information System Security Officer [ISSO] at a minimum) in the event of an audit processing failure.

RMF Control: AU-5
Severity: M
CCI: CCI-000139
Version: RHEL-07-030010
Vuln IDs: V-72081
Rule IDs: SV-86705r4_rule

It is critical for the appropriate personnel to be aware if a system is at risk of failing to process audit logs as required. Without this notification, the security personnel may be unaware of an impending failure of the audit capability, and system operation may be adversely affected. Audit processing failures include software/hardware errors, failures in the audit capturing mechanisms, and audit storage capacity being reached or exceeded. This requirement applies to each audit data storage repository (i.e., distinct information system component where audit records are stored), the centralized audit storage capacity of organizations (i.e., all audit data storage repositories combined), or both. Satisfies: SRG-OS-000046-GPOS-00022, SRG-OS-000047-GPOS-00023

Fix: F-78433r2_fix

Configure the operating system to shut down in the event of an audit processing failure. Add or correct the option to shut down the operating system with the following command: # auditctl -f 2 Edit the "/etc/audit/rules.d/audit.rules" file and add the following line: -f 2 If availability has been determined to be more important, and this decision is documented with the ISSO, configure the operating system to notify system administration staff and ISSO staff in the event of an audit processing failure with the following command: # auditctl -f 1 Edit the "/etc/audit/rules.d/audit.rules" file and add the following line: -f 1 Kernel log monitoring must also be configured to properly alert designated staff. The audit daemon must be restarted for the changes to take effect.

b

The Red Hat Enterprise Linux operating system must off-load audit records onto a different system or media from the system being audited.

RMF Control: AU-4
Severity: M
CCI: CCI-001851
Version: RHEL-07-030300
Vuln IDs: V-72083
Rule IDs: SV-86707r2_rule

Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Off-loading is a common process in information systems with limited audit storage capacity. Satisfies: SRG-OS-000342-GPOS-00133, SRG-OS-000479-GPOS-00224

Fix: F-78435r1_fix

Configure the operating system to off-load audit records onto a different system or media from the system being audited. Set the remote server option in "/etc/audisp/audisp-remote.conf" with the IP address of the log aggregation server.

b

The Red Hat Enterprise Linux operating system must encrypt the transfer of audit records off-loaded onto a different system or media from the system being audited.

RMF Control: AU-4
Severity: M
CCI: CCI-001851
Version: RHEL-07-030310
Vuln IDs: V-72085
Rule IDs: SV-86709r2_rule

Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Off-loading is a common process in information systems with limited audit storage capacity. Satisfies: SRG-OS-000342-GPOS-00133, SRG-OS-000479-GPOS-00224

Fix: F-78437r1_fix

Configure the operating system to encrypt the transfer of off-loaded audit records onto a different system or media from the system being audited. Uncomment the "enable_krb5" option in "/etc/audisp/audisp-remote.conf" and set it with the following line: enable_krb5 = yes

b

The Red Hat Enterprise Linux operating system must be configured so that the audit system takes appropriate action when the audit storage volume is full.

RMF Control: AU-4
Severity: M
CCI: CCI-001851
Version: RHEL-07-030320
Vuln IDs: V-72087
Rule IDs: SV-86711r3_rule

Taking appropriate action in case of a filled audit storage volume will minimize the possibility of losing audit records.

Fix: F-78439r4_fix

Configure the action the operating system takes if the disk the audit records are written to becomes full. Uncomment or edit the "disk_full_action" option in "/etc/audisp/audisp-remote.conf" and set it to "syslog", "single", or "halt", such as the following line: disk_full_action = single

b

The Red Hat Enterprise Linux operating system must immediately notify the System Administrator (SA) and Information System Security Officer (ISSO) (at a minimum) via email when the threshold for the repository maximum audit record storage capacity is reached.

RMF Control: AU-5
Severity: M
CCI: CCI-001855
Version: RHEL-07-030340
Vuln IDs: V-72091
Rule IDs: SV-86715r2_rule

If security personnel are not notified immediately when the threshold for the repository maximum audit record storage capacity is reached, they are unable to expand the audit record storage capacity before records are lost.

Fix: F-78443r1_fix

Configure the operating system to immediately notify the SA and ISSO (at a minimum) when the threshold for the repository maximum audit record storage capacity is reached. Uncomment or edit the "space_left_action" keyword in "/etc/audit/auditd.conf" and set it to "email". space_left_action = email

b

The Red Hat Enterprise Linux operating system must immediately notify the System Administrator (SA) and Information System Security Officer (ISSO) (at a minimum) when the threshold for the repository maximum audit record storage capacity is reached.

RMF Control: AU-5
Severity: M
CCI: CCI-001855
Version: RHEL-07-030350
Vuln IDs: V-72093
Rule IDs: SV-86717r3_rule

If security personnel are not notified immediately when the threshold for the repository maximum audit record storage capacity is reached, they are unable to expand the audit record storage capacity before records are lost.

Fix: F-78445r3_fix

Configure the operating system to immediately notify the SA and ISSO (at a minimum) when the threshold for the repository maximum audit record storage capacity is reached. Uncomment or edit the "action_mail_acct" keyword in "/etc/audit/auditd.conf" and set it to root and any other accounts associated with security personnel. action_mail_acct = root

b

The Red Hat Enterprise Linux operating system must audit all executions of privileged functions.

RMF Control: AC-6
Severity: M
CCI: CCI-002234
Version: RHEL-07-030360
Vuln IDs: V-72095
Rule IDs: SV-86719r7_rule

Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised information system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider threats and the advanced persistent threat.

Fix: F-78447r9_fix

Configure the operating system to audit the execution of privileged functions. Add or update the following rules in "/etc/audit/rules.d/audit.rules": -a always,exit -F arch=b32 -S execve -C uid!=euid -F euid=0 -k setuid -a always,exit -F arch=b64 -S execve -C uid!=euid -F euid=0 -k setuid -a always,exit -F arch=b32 -S execve -C gid!=egid -F egid=0 -k setgid -a always,exit -F arch=b64 -S execve -C gid!=egid -F egid=0 -k setgid The audit daemon must be restarted for the changes to take effect.

b

The Red Hat Enterprise Linux operating system must audit all uses of the chown syscall.

RMF Control: AU-2
Severity: M
CCI: CCI-000126
Version: RHEL-07-030370
Vuln IDs: V-72097
Rule IDs: SV-86721r5_rule

Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). Satisfies: SRG-OS-000064-GPOS-00033, SRG-OS-000392-GPOS-00172, SRG-OS-000458-GPOS-00203, SRG-OS-000474-GPOS-00219

Fix: F-78449r8_fix

Add or update the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F arch=b32 -S chown -F auid>=1000 -F auid!=4294967295 -k perm_mod -a always,exit -F arch=b64 -S chown -F auid>=1000 -F auid!=4294967295 -k perm_mod The audit daemon must be restarted for the changes to take effect.

b

The Red Hat Enterprise Linux operating system must audit all uses of the fchown syscall.

RMF Control: AU-2
Severity: M
CCI: CCI-000126
Version: RHEL-07-030380
Vuln IDs: V-72099
Rule IDs: SV-86723r5_rule

Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). Satisfies: SRG-OS-000064-GPOS-00033, SRG-OS-000392-GPOS-00172, SRG-OS-000458-GPOS-00203, SRG-OS-000474-GPOS-00219

Fix: F-78451r8_fix

Add or update the following rules in "/etc/audit/rules.d/audit.rules": -a always,exit -F arch=b32 -S fchown -F auid>=1000 -F auid!=4294967295 -k perm_mod -a always,exit -F arch=b64 -S fchown -F auid>=1000 -F auid!=4294967295 -k perm_mod The audit daemon must be restarted for the changes to take effect.

b

The Red Hat Enterprise Linux operating system must audit all uses of the lchown syscall.

RMF Control: AU-2
Severity: M
CCI: CCI-000126
Version: RHEL-07-030390
Vuln IDs: V-72101
Rule IDs: SV-86725r5_rule

Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). Satisfies: SRG-OS-000064-GPOS-00033, SRG-OS-000392-GPOS-00172, SRG-OS-000458-GPOS-00203, SRG-OS-000474-GPOS-00219

Fix: F-78453r8_fix

Add or update the following rules in "/etc/audit/rules.d/audit.rules": -a always,exit -F arch=b32 -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod -a always,exit -F arch=b64 -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod The audit daemon must be restarted for the changes to take effect.

b

The Red Hat Enterprise Linux operating system must audit all uses of the fchownat syscall.

RMF Control: AU-2
Severity: M
CCI: CCI-000126
Version: RHEL-07-030400
Vuln IDs: V-72103
Rule IDs: SV-86727r5_rule

Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). Satisfies: SRG-OS-000064-GPOS-00033, SRG-OS-000392-GPOS-00172, SRG-OS-000458-GPOS-00203, SRG-OS-000474-GPOS-00219

Fix: F-78455r7_fix

Add or update the following rules in "/etc/audit/rules.d/audit.rules": -a always,exit -F arch=b32 -S fchownat -F auid>=1000 -F auid!=4294967295 -k perm_mod -a always,exit -F arch=b64 -S fchownat -F auid>=1000 -F auid!=4294967295 -k perm_mod The audit daemon must be restarted for the changes to take effect.

b

The Red Hat Enterprise Linux operating system must audit all uses of the chmod syscall.

RMF Control: AU-12
Severity: M
CCI: CCI-000172
Version: RHEL-07-030410
Vuln IDs: V-72105
Rule IDs: SV-86729r5_rule

Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). Satisfies: SRG-OS-000458-GPOS-00203, SRG-OS-000392-GPOS-00172, SRG-OS-000064-GPOS-00033

Fix: F-78457r7_fix

Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "chmod" syscall occur. Add or update the following rules in "/etc/audit/rules.d/audit.rules": -a always,exit -F arch=b32 -S chmod -F auid>=1000 -F auid!=4294967295 -k perm_mod -a always,exit -F arch=b64 -S chmod -F auid>=1000 -F auid!=4294967295 -k perm_mod The audit daemon must be restarted for the changes to take effect.

b

The Red Hat Enterprise Linux operating system must audit all uses of the fchmod syscall.

RMF Control: AU-12
Severity: M
CCI: CCI-000172
Version: RHEL-07-030420
Vuln IDs: V-72107
Rule IDs: SV-86731r5_rule

Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). Satisfies: SRG-OS-000458-GPOS-00203, SRG-OS-000392-GPOS-00172, SRG-OS-000064-GPOS-00033

Fix: F-78459r9_fix

Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "fchmod" syscall occur. Add or update the following rules in "/etc/audit/rules.d/audit.rules": -a always,exit -F arch=b32 -S fchmod -F auid>=1000 -F auid!=4294967295 -k perm_mod -a always,exit -F arch=b64 -S fchmod -F auid>=1000 -F auid!=4294967295 -k perm_mod The audit daemon must be restarted for the changes to take effect.

b

The Red Hat Enterprise Linux operating system must audit all uses of the fchmodat syscall.

RMF Control: AU-12
Severity: M
CCI: CCI-000172
Version: RHEL-07-030430
Vuln IDs: V-72109
Rule IDs: SV-86733r5_rule

Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). Satisfies: SRG-OS-000458-GPOS-00203, SRG-OS-000392-GPOS-00172, SRG-OS-000064-GPOS-00033

Fix: F-78461r8_fix

Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "fchmodat" syscall occur. Add or update the following rules in "/etc/audit/rules.d/audit.rules": -a always,exit -F arch=b32 -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod -a always,exit -F arch=b64 -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod The audit daemon must be restarted for the changes to take effect.

b

The Red Hat Enterprise Linux operating system must audit all uses of the setxattr syscall.

RMF Control: AU-12
Severity: M
CCI: CCI-000172
Version: RHEL-07-030440
Vuln IDs: V-72111
Rule IDs: SV-86735r5_rule

Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). Satisfies: SRG-OS-000458-GPOS-00203, SRG-OS-000392-GPOS-00172, SRG-OS-000064-GPOS-00033

Fix: F-78463r8_fix

Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "setxattr" syscall occur. Add or update the following rules in "/etc/audit/rules.d/audit.rules": -a always,exit -F arch=b32 -S setxattr -F auid>=1000 -F auid!=4294967295 -k perm_mod -a always,exit -F arch=b64 -S setxattr -F auid>=1000 -F auid!=4294967295 -k perm_mod The audit daemon must be restarted for the changes to take effect.

b

The Red Hat Enterprise Linux operating system must audit all uses of the fsetxattr syscall.

RMF Control: AU-12
Severity: M
CCI: CCI-000172
Version: RHEL-07-030450
Vuln IDs: V-72113
Rule IDs: SV-86737r5_rule

Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). Satisfies: SRG-OS-000458-GPOS-00203, SRG-OS-000392-GPOS-00172, SRG-OS-000064-GPOS-00033

Fix: F-78465r7_fix

Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "fsetxattr" syscall occur. Add or update the following rules in "/etc/audit/rules.d/audit.rules": -a always,exit -F arch=b32 -S fsetxattr -F auid>=1000 -F auid!=4294967295 -k perm_mod -a always,exit -F arch=b64 -S fsetxattr -F auid>=1000 -F auid!=4294967295 -k perm_mod The audit daemon must be restarted for the changes to take effect.

b

The Red Hat Enterprise Linux operating system must audit all uses of the lsetxattr syscall.

RMF Control: AU-12
Severity: M
CCI: CCI-000172
Version: RHEL-07-030460
Vuln IDs: V-72115
Rule IDs: SV-86739r5_rule

Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). Satisfies: SRG-OS-000458-GPOS-00203, SRG-OS-000392-GPOS-00172, SRG-OS-000064-GPOS-00033

Fix: F-78467r10_fix

Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "lsetxattr" syscall occur. Add or update the following rules in "/etc/audit/rules.d/audit.rules": -a always,exit -F arch=b32 -S lsetxattr -F auid>=1000 -F auid!=4294967295 -k perm_mod -a always,exit -F arch=b64 -S lsetxattr -F auid>=1000 -F auid!=4294967295 -k perm_mod The audit daemon must be restarted for the changes to take effect.

b

The Red Hat Enterprise Linux operating system must audit all uses of the removexattr syscall.

RMF Control: AU-12
Severity: M
CCI: CCI-000172
Version: RHEL-07-030470
Vuln IDs: V-72117
Rule IDs: SV-86741r5_rule

Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). Satisfies: SRG-OS-000458-GPOS-00203, SRG-OS-000392-GPOS-00172, SRG-OS-000064-GPOS-00033

Fix: F-78469r7_fix

Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "removexattr" syscall occur. Add or update the following rules in "/etc/audit/rules.d/audit.rules": -a always,exit -F arch=b32 -S removexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod -a always,exit -F arch=b64 -S removexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod The audit daemon must be restarted for the changes to take effect.

b

The Red Hat Enterprise Linux operating system must audit all uses of the fremovexattr syscall.

RMF Control: AU-12
Severity: M
CCI: CCI-000172
Version: RHEL-07-030480
Vuln IDs: V-72119
Rule IDs: SV-86743r5_rule

Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). Satisfies: SRG-OS-000458-GPOS-00203, SRG-OS-000392-GPOS-00172, SRG-OS-000064-GPOS-00033

Fix: F-78471r6_fix

Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "fremovexattr" syscall occur. Add or update the following rules in "/etc/audit/rules.d/audit.rules": -a always,exit -F arch=b32 -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod -a always,exit -F arch=b64 -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod The audit daemon must be restarted for the changes to take effect.

b

The Red Hat Enterprise Linux operating system must audit all uses of the lremovexattr syscall.

RMF Control: AU-12
Severity: M
CCI: CCI-000172
Version: RHEL-07-030490
Vuln IDs: V-72121
Rule IDs: SV-86745r5_rule

Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). Satisfies: SRG-OS-000458-GPOS-00203, SRG-OS-000392-GPOS-00172, SRG-OS-000064-GPOS-00033

Fix: F-78473r7_fix

Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "lremovexattr" syscall occur. Add or update the following rules in "/etc/audit/rules.d/audit.rules": -a always,exit -F arch=b32 -S lremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod -a always,exit -F arch=b64 -S lremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod The audit daemon must be restarted for the changes to take effect.

b

The Red Hat Enterprise Linux operating system must audit all uses of the creat syscall.

RMF Control: AU-12
Severity: M
CCI: CCI-000172
Version: RHEL-07-030500
Vuln IDs: V-72123
Rule IDs: SV-86747r5_rule

Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). Satisfies: SRG-OS-000064-GPOS-00033, SRG-OS-000458-GPOS-00203, SRG-OS-000461-GPOS-00205, SRG-OS-000392-GPOS-00172

Fix: F-78475r7_fix

Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "creat" syscall occur. Add or update the following rules in "/etc/audit/rules.d/audit.rules: -a always,exit -F arch=b32 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access -a always,exit -F arch=b32 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access -a always,exit -F arch=b64 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access -a always,exit -F arch=b64 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access The audit daemon must be restarted for the changes to take effect.

b

The Red Hat Enterprise Linux operating system must audit all uses of the open syscall.

RMF Control: AU-12
Severity: M
CCI: CCI-000172
Version: RHEL-07-030510
Vuln IDs: V-72125
Rule IDs: SV-86749r5_rule

Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). Satisfies: SRG-OS-000064-GPOS-00033, SRG-OS-000458-GPOS-00203, SRG-OS-000461-GPOS-00205, SRG-OS-000392-GPOS-00172

Fix: F-78477r7_fix

Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "open" syscall occur. Add or update the following rules in "/etc/audit/rules.d/audit.rules": -a always,exit -F arch=b32 -S open -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access -a always,exit -F arch=b32 -S open -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access -a always,exit -F arch=b64 -S open -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access -a always,exit -F arch=b64 -S open -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access The audit daemon must be restarted for the changes to take effect.

b

The Red Hat Enterprise Linux operating system must audit all uses of the openat syscall.

RMF Control: AU-12
Severity: M
CCI: CCI-000172
Version: RHEL-07-030520
Vuln IDs: V-72127
Rule IDs: SV-86751r5_rule

Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). Satisfies: SRG-OS-000064-GPOS-00033, SRG-OS-000458-GPOS-00203, SRG-OS-000461-GPOS-00205, SRG-OS-000392-GPOS-00172

Fix: F-78479r8_fix

Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "openat" syscall occur. Add or update the following rules in "/etc/audit/rules.d/audit.rules": -a always,exit -F arch=b32 -S openat -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access -a always,exit -F arch=b32 -S openat -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access -a always,exit -F arch=b64 -S openat -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access -a always,exit -F arch=b64 -S openat -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access The audit daemon must be restarted for the changes to take effect.

b

The Red Hat Enterprise Linux operating system must audit all uses of the open_by_handle_at syscall.

RMF Control: AU-12
Severity: M
CCI: CCI-000172
Version: RHEL-07-030530
Vuln IDs: V-72129
Rule IDs: SV-86753r5_rule

Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). Satisfies: SRG-OS-000064-GPOS-00033, SRG-OS-000458-GPOS-00203, SRG-OS-000461-GPOS-00205, SRG-OS-000392-GPOS-00172

Fix: F-78481r8_fix

Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "open_by_handle_at" syscall occur. Add or update the following rules in "/etc/audit/rules.d/audit.rules": -a always,exit -F arch=b32 -S open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access -a always,exit -F arch=b32 -S open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access -a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access -a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access The audit daemon must be restarted for the changes to take effect.

b

The Red Hat Enterprise Linux operating system must audit all uses of the truncate syscall.

RMF Control: AU-12
Severity: M
CCI: CCI-000172
Version: RHEL-07-030540
Vuln IDs: V-72131
Rule IDs: SV-86755r5_rule

Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). Satisfies: SRG-OS-000064-GPOS-00033, SRG-OS-000458-GPOS-00203, SRG-OS-000461-GPOS-00205, SRG-OS-000392-GPOS-00172

Fix: F-78483r7_fix

Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "truncate" syscall occur. Add or update the following rules in "/etc/audit/rules.d/audit.rules": -a always,exit -F arch=b32 -S truncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access -a always,exit -F arch=b32 -S truncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access -a always,exit -F arch=b64 -S truncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access -a always,exit -F arch=b64 -S truncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access The audit daemon must be restarted for the changes to take effect.

b

The Red Hat Enterprise Linux operating system must audit all uses of the ftruncate syscall.

RMF Control: AU-12
Severity: M
CCI: CCI-000172
Version: RHEL-07-030550
Vuln IDs: V-72133
Rule IDs: SV-86757r5_rule

Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). Satisfies: SRG-OS-000064-GPOS-00033, SRG-OS-000458-GPOS-00203, SRG-OS-000461-GPOS-00205, SRG-OS-000392-GPOS-00172

Fix: F-78485r8_fix

Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "ftruncate" syscall occur. Add or update the following rules in "/etc/audit/rules.d/audit.rules": -a always,exit -F arch=b32 -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access -a always,exit -F arch=b32 -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access -a always,exit -F arch=b64 -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access -a always,exit -F arch=b64 -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access The audit daemon must be restarted for the changes to take effect.

b

The Red Hat Enterprise Linux operating system must audit all uses of the semanage command.

RMF Control: AU-12
Severity: M
CCI: CCI-000172
Version: RHEL-07-030560
Vuln IDs: V-72135
Rule IDs: SV-86759r4_rule

Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). Satisfies: SRG-OS-000392-GPOS-00172, SRG-OS-000463-GPOS-00207, SRG-OS-000465-GPOS-00209

Fix: F-78487r5_fix

Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "semanage" command occur. Add or update the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/sbin/semanage -F auid>=1000 -F auid!=4294967295 -k privileged-priv_change The audit daemon must be restarted for the changes to take effect.

b

The Red Hat Enterprise Linux operating system must audit all uses of the setsebool command.

RMF Control: AU-12
Severity: M
CCI: CCI-000172
Version: RHEL-07-030570
Vuln IDs: V-72137
Rule IDs: SV-86761r4_rule

Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). Satisfies: SRG-OS-000392-GPOS-00172, SRG-OS-000463-GPOS-00207, SRG-OS-000465-GPOS-00209

Fix: F-78489r6_fix

Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "setsebool" command occur. Add or update the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/sbin/setsebool -F auid>=1000 -F auid!=4294967295 -k privileged-priv_change The audit daemon must be restarted for the changes to take effect.

b

The Red Hat Enterprise Linux operating system must audit all uses of the chcon command.

RMF Control: AU-12
Severity: M
CCI: CCI-000172
Version: RHEL-07-030580
Vuln IDs: V-72139
Rule IDs: SV-86763r4_rule

Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). Satisfies: SRG-OS-000392-GPOS-00172, SRG-OS-000463-GPOS-00207, SRG-OS-000465-GPOS-00209

Fix: F-78491r6_fix

Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "chcon" command occur. Add or update the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/bin/chcon -F auid>=1000 -F auid!=4294967295 -k privileged-priv_change The audit daemon must be restarted for the changes to take effect.

b

The Red Hat Enterprise Linux operating system must audit all uses of the setfiles command.

RMF Control: AU-12
Severity: M
CCI: CCI-000172
Version: RHEL-07-030590
Vuln IDs: V-72141
Rule IDs: SV-86765r5_rule

Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). Satisfies: SRG-OS-000392-GPOS-00172, SRG-OS-000463-GPOS-00207, SRG-OS-000465-GPOS-00209

Fix: F-78493r7_fix

Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "setfiles" command occur. Add or update the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/sbin/setfiles -F auid>=1000 -F auid!=4294967295 -k privileged-priv_change The audit daemon must be restarted for the changes to take effect.

b

The Red Hat Enterprise Linux operating system must generate audit records for all unsuccessful account access events.

RMF Control: AU-2
Severity: M
CCI: CCI-000126
Version: RHEL-07-030610
Vuln IDs: V-72145
Rule IDs: SV-86769r4_rule

Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). Satisfies: SRG-OS-000392-GPOS-00172, SRG-OS-000470-GPOS-00214, SRG-OS-000473-GPOS-00218

Fix: F-78497r4_fix

Configure the operating system to generate audit records when unsuccessful account access events occur. Add or update the following rule in "/etc/audit/rules.d/audit.rules": -w /var/run/faillock -p wa -k logins The audit daemon must be restarted for the changes to take effect.

b

The Red Hat Enterprise Linux operating system must generate audit records for all successful account access events.

RMF Control: AU-2
Severity: M
CCI: CCI-000126
Version: RHEL-07-030620
Vuln IDs: V-72147
Rule IDs: SV-86771r3_rule

Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). Satisfies: SRG-OS-000392-GPOS-00172, SRG-OS-000470-GPOS-00214, SRG-OS-000473-GPOS-00218

Fix: F-78499r3_fix

Configure the operating system to generate audit records when successful account access events occur. Add or update the following rule in "/etc/audit/rules.d/audit.rules": -w /var/log/lastlog -p wa -k logins The audit daemon must be restarted for the changes to take effect.

b

The Red Hat Enterprise Linux operating system must audit all uses of the passwd command.

RMF Control: AU-3
Severity: M
CCI: CCI-000135
Version: RHEL-07-030630
Vuln IDs: V-72149
Rule IDs: SV-86773r5_rule

Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information. At a minimum, the organization must audit the full-text recording of privileged password commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise. Satisfies: SRG-OS-000042-GPOS-00020, SRG-OS-000392-GPOS-00172, SRG-OS-000471-GPOS-00215

Fix: F-78501r6_fix

Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "passwd" command occur. Add or update the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/bin/passwd -F auid>=1000 -F auid!=4294967295 -k privileged-passwd The audit daemon must be restarted for the changes to take effect.

b

The Red Hat Enterprise Linux operating system must audit all uses of the unix_chkpwd command.

RMF Control: AU-3
Severity: M
CCI: CCI-000135
Version: RHEL-07-030640
Vuln IDs: V-72151
Rule IDs: SV-86775r5_rule

Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information. At a minimum, the organization must audit the full-text recording of privileged password commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise. Satisfies: SRG-OS-000042-GPOS-00020, SRG-OS-000392-GPOS-00172, SRG-OS-000471-GPOS-00215

Fix: F-78503r8_fix

Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "unix_chkpwd" command occur. Add or update the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/sbin/unix_chkpwd -F auid>=1000 -F auid!=4294967295 -k privileged-passwd The audit daemon must be restarted for the changes to take effect.

b

The Red Hat Enterprise Linux operating system must audit all uses of the gpasswd command.

RMF Control: AU-3
Severity: M
CCI: CCI-000135
Version: RHEL-07-030650
Vuln IDs: V-72153
Rule IDs: SV-86777r5_rule

Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information. At a minimum, the organization must audit the full-text recording of privileged password commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise. Satisfies: SRG-OS-000042-GPOS-00020, SRG-OS-000392-GPOS-00172, SRG-OS-000471-GPOS-00215

Fix: F-78505r5_fix

Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "gpasswd" command occur. Add or update the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/bin/gpasswd -F auid>=1000 -F auid!=4294967295 -k privileged-passwd The audit daemon must be restarted for the changes to take effect.

b

The Red Hat Enterprise Linux operating system must audit all uses of the chage command.

RMF Control: AU-3
Severity: M
CCI: CCI-000135
Version: RHEL-07-030660
Vuln IDs: V-72155
Rule IDs: SV-86779r5_rule

Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information. At a minimum, the organization must audit the full-text recording of privileged password commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise. Satisfies: SRG-OS-000042-GPOS-00020, SRG-OS-000392-GPOS-00172, SRG-OS-000471-GPOS-00215

Fix: F-78507r5_fix

Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "chage" command occur. Add or update the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/bin/chage -F auid>=1000 -F auid!=4294967295 -k privileged-passwd The audit daemon must be restarted for the changes to take effect.

b

The Red Hat Enterprise Linux operating system must audit all uses of the userhelper command.

RMF Control: AU-3
Severity: M
CCI: CCI-000135
Version: RHEL-07-030670
Vuln IDs: V-72157
Rule IDs: SV-86781r5_rule

Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information. At a minimum, the organization must audit the full-text recording of privileged password commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise. Satisfies: SRG-OS-000042-GPOS-00020, SRG-OS-000392-GPOS-00172, SRG-OS-000471-GPOS-00215

Fix: F-78509r5_fix

Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "userhelper" command occur. Add or update the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/sbin/userhelper -F auid>=1000 -F auid!=4294967295 -k privileged-passwd The audit daemon must be restarted for the changes to take effect.

b

The Red Hat Enterprise Linux operating system must audit all uses of the su command.

RMF Control: AU-3
Severity: M
CCI: CCI-000130
Version: RHEL-07-030680
Vuln IDs: V-72159
Rule IDs: SV-86783r5_rule

Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information. At a minimum, the organization must audit the full-text recording of privileged access commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215

Fix: F-78511r6_fix

Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "su" command occur. Add or update the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/bin/su -F auid>=1000 -F auid!=4294967295 -k privileged-priv_change The audit daemon must be restarted for the changes to take effect.

b

The Red Hat Enterprise Linux operating system must audit all uses of the sudo command.

RMF Control: AU-3
Severity: M
CCI: CCI-000130
Version: RHEL-07-030690
Vuln IDs: V-72161
Rule IDs: SV-86785r4_rule

Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information. At a minimum, the organization must audit the full-text recording of privileged access commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215

Fix: F-78513r5_fix

Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "sudo" command occur. Add or update the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/bin/sudo -F auid>=1000 -F auid!=4294967295 -k privileged-priv_change The audit daemon must be restarted for the changes to take effect.

b

The Red Hat Enterprise Linux operating system must audit all uses of the sudoers file and all files in the /etc/sudoers.d/ directory.

RMF Control: AU-3
Severity: M
CCI: CCI-000130
Version: RHEL-07-030700
Vuln IDs: V-72163
Rule IDs: SV-86787r5_rule

Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information. At a minimum, the organization must audit the full-text recording of privileged access commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215

Fix: F-78517r6_fix

Configure the operating system to generate audit records when successful/unsuccessful attempts to access the "/etc/sudoers" file and files in the "/etc/sudoers.d/" directory. Add or update the following rule in "/etc/audit/rules.d/audit.rules": -w /etc/sudoers -p wa -k privileged-actions -w /etc/sudoers.d/ -p wa -k privileged-actions The audit daemon must be restarted for the changes to take effect.

b

The Red Hat Enterprise Linux operating system must audit all uses of the newgrp command.

RMF Control: AU-3
Severity: M
CCI: CCI-000130
Version: RHEL-07-030710
Vuln IDs: V-72165
Rule IDs: SV-86789r4_rule

Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information. At a minimum, the organization must audit the full-text recording of privileged access commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215

Fix: F-78519r5_fix

Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "newgrp" command occur. Add or update the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/bin/newgrp -F auid>=1000 -F auid!=4294967295 -k privileged-priv_change The audit daemon must be restarted for the changes to take effect.

b

The Red Hat Enterprise Linux operating system must audit all uses of the chsh command.

RMF Control: AU-3
Severity: M
CCI: CCI-000130
Version: RHEL-07-030720
Vuln IDs: V-72167
Rule IDs: SV-86791r4_rule

Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information. At a minimum, the organization must audit the full-text recording of privileged access commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215

Fix: F-78521r5_fix

Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "chsh" command occur. Add or update the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/bin/chsh -F auid>=1000 -F auid!=4294967295 -k privileged-priv_change The audit daemon must be restarted for the changes to take effect.

b

The Red Hat Enterprise Linux operating system must audit all uses of the mount command and syscall.

RMF Control: AU-3
Severity: M
CCI: CCI-000135
Version: RHEL-07-030740
Vuln IDs: V-72171
Rule IDs: SV-86795r7_rule

Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information. At a minimum, the organization must audit the full-text recording of privileged mount commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise. Satisfies: SRG-OS-000042-GPOS-00020, SRG-OS-000392-GPOS-00172

Fix: F-78525r9_fix

Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "mount" command and syscall occur. Add or update the following rules in "/etc/audit/rules.d/audit.rules": -a always,exit -F arch=b32 -S mount -F auid>=1000 -F auid!=4294967295 -k privileged-mount -a always,exit -F arch=b64 -S mount -F auid>=1000 -F auid!=4294967295 -k privileged-mount -a always,exit -F path=/usr/bin/mount -F auid>=1000 -F auid!=4294967295 -k privileged-mount The audit daemon must be restarted for the changes to take effect.

b

The Red Hat Enterprise Linux operating system must audit all uses of the umount command.

RMF Control: AU-3
Severity: M
CCI: CCI-000135
Version: RHEL-07-030750
Vuln IDs: V-72173
Rule IDs: SV-86797r5_rule

Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information. At a minimum, the organization must audit the full-text recording of privileged mount commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise. Satisfies: SRG-OS-000042-GPOS-00020, SRG-OS-000392-GPOS-00172

Fix: F-78527r5_fix

Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "umount" command occur. Add or update the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/bin/umount -F auid>=1000 -F auid!=4294967295 -k privileged-mount The audit daemon must be restarted for the changes to take effect.

b

The Red Hat Enterprise Linux operating system must audit all uses of the postdrop command.

RMF Control: AU-3
Severity: M
CCI: CCI-000135
Version: RHEL-07-030760
Vuln IDs: V-72175
Rule IDs: SV-86799r4_rule

Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information. At a minimum, the organization must audit the full-text recording of privileged postfix commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise. Satisfies: SRG-OS-000042-GPOS-00020, SRG-OS-000392-GPOS-00172

Fix: F-78529r5_fix

Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "postdrop" command occur. Add or update the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/sbin/postdrop -F auid>=1000 -F auid!=4294967295 -k privileged-postfix The audit daemon must be restarted for the changes to take effect.

b

The Red Hat Enterprise Linux operating system must audit all uses of the postqueue command.

RMF Control: AU-3
Severity: M
CCI: CCI-000135
Version: RHEL-07-030770
Vuln IDs: V-72177
Rule IDs: SV-86801r3_rule

Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information. At a minimum, the organization must audit the full-text recording of privileged postfix commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise. Satisfies: SRG-OS-000042-GPOS-00020, SRG-OS-000392-GPOS-00172

Fix: F-78531r5_fix

Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "postqueue" command occur. Add or update the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/sbin/postqueue -F auid>=1000 -F auid!=4294967295 -k privileged-postfix The audit daemon must be restarted for the changes to take effect.

b

The Red Hat Enterprise Linux operating system must audit all uses of the ssh-keysign command.

RMF Control: AU-3
Severity: M
CCI: CCI-000135
Version: RHEL-07-030780
Vuln IDs: V-72179
Rule IDs: SV-86803r3_rule

Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information. At a minimum, the organization must audit the full-text recording of privileged ssh commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise. Satisfies: SRG-OS-000042-GPOS-00020, SRG-OS-000392-GPOS-00172, SRG-OS-000471-GPOS-00215

Fix: F-78533r4_fix

Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "ssh-keysign" command occur. Add or update the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/libexec/openssh/ssh-keysign -F auid>=1000 -F auid!=4294967295 -k privileged-ssh The audit daemon must be restarted for the changes to take effect.

b

The Red Hat Enterprise Linux operating system must audit all uses of the crontab command.

RMF Control: AU-3
Severity: M
CCI: CCI-000135
Version: RHEL-07-030800
Vuln IDs: V-72183
Rule IDs: SV-86807r3_rule

Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information. At a minimum, the organization must audit the full-text recording of privileged commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise. Satisfies: SRG-OS-000042-GPOS-00020, SRG-OS-000392-GPOS-00172, SRG-OS-000471-GPOS-00215

Fix: F-78537r4_fix

Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "crontab" command occur. Add or update the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/bin/crontab -F auid>=1000 -F auid!=4294967295 -k privileged-cron The audit daemon must be restarted for the changes to take effect.

b

The Red Hat Enterprise Linux operating system must audit all uses of the pam_timestamp_check command.

RMF Control: AU-12
Severity: M
CCI: CCI-000172
Version: RHEL-07-030810
Vuln IDs: V-72185
Rule IDs: SV-86809r4_rule

Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.

Fix: F-78539r4_fix

Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "pam_timestamp_check" command occur. Add or update the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/sbin/pam_timestamp_check -F auid>=1000 -F auid!=4294967295 -k privileged-pam The audit daemon must be restarted for the changes to take effect.

b

The Red Hat Enterprise Linux operating system must audit all uses of the init_module syscall.

RMF Control: AU-12
Severity: M
CCI: CCI-000172
Version: RHEL-07-030820
Vuln IDs: V-72187
Rule IDs: SV-86811r5_rule

Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). Satisfies: SRG-OS-000471-GPOS-00216, SRG-OS-000477-GPOS-00222

Fix: F-78541r7_fix

Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "init_module" syscall occur. Add or update the following rules in "/etc/audit/rules.d/audit.rules": -a always,exit -F arch=b32 -S init_module -k module-change -a always,exit -F arch=b64 -S init_module -k module-change The audit daemon must be restarted for the changes to take effect.

b

The Red Hat Enterprise Linux operating system must audit all uses of the delete_module syscall.

RMF Control: AU-12
Severity: M
CCI: CCI-000172
Version: RHEL-07-030830
Vuln IDs: V-72189
Rule IDs: SV-86813r5_rule

Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). Satisfies: SRG-OS-000471-GPOS-00216, SRG-OS-000477-GPOS-00222

Fix: F-78543r7_fix

Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "delete_module" syscall occur. Add or update the following rules in "/etc/audit/rules.d/audit.rules": -a always,exit -F arch=b32 -S delete_module -k module-change -a always,exit -F arch=b64 -S delete_module -k module-change The audit daemon must be restarted for the changes to take effect.

b

The Red Hat Enterprise Linux operating system must audit all uses of the kmod command.

RMF Control: AU-12
Severity: M
CCI: CCI-000172
Version: RHEL-07-030840
Vuln IDs: V-72191
Rule IDs: SV-86815r5_rule

Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). Satisfies: SRG-OS-000471-GPOS-00216, SRG-OS-000477-GPOS-00222

Fix: F-78545r10_fix

Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "kmod" command occur. Add or update the following rule in "/etc/audit/rules.d/audit.rules": -w /usr/bin/kmod -p x -F auid!=4294967295 -k module-change The audit daemon must be restarted for the changes to take effect.

b

The Red Hat Enterprise Linux operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/passwd.

RMF Control: AC-2
Severity: M
CCI: CCI-000018
Version: RHEL-07-030870
Vuln IDs: V-72197
Rule IDs: SV-86821r5_rule

Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). Satisfies: SRG-OS-000004-GPOS-00004, SRG-OS-000239-GPOS-00089, SRG-OS-000240-GPOS-00090, SRG-OS-000241-GPOS-00091, SRG-OS-000303-GPOS-00120, SRG-OS-000476-GPOS-00221

Fix: F-78551r4_fix

Configure the operating system to generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/passwd". Add or update the following rule "/etc/audit/rules.d/audit.rules": -w /etc/passwd -p wa -k identity The audit daemon must be restarted for the changes to take effect.

b

The Red Hat Enterprise Linux operating system must audit all uses of the rename syscall.

RMF Control: AU-12
Severity: M
CCI: CCI-000172
Version: RHEL-07-030880
Vuln IDs: V-72199
Rule IDs: SV-86823r5_rule

If the system is not configured to audit certain activities and write them to an audit log, it is more difficult to detect and track system compromises and damages incurred during a system compromise. Satisfies: SRG-OS-000466-GPOS-00210, SRG-OS-000467-GPOS-00210, SRG-OS-000468-GPOS-00212, SRG-OS-000392-GPOS-00172

Fix: F-78553r7_fix

Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "rename" syscall occur. Add the following rules in "/etc/audit/rules.d/audit.rules": -a always,exit -F arch=b32 -S rename -F auid>=1000 -F auid!=4294967295 -k delete -a always,exit -F arch=b64 -S rename -F auid>=1000 -F auid!=4294967295 -k delete The audit daemon must be restarted for the changes to take effect.

b

The Red Hat Enterprise Linux operating system must audit all uses of the renameat syscall.

RMF Control: AU-12
Severity: M
CCI: CCI-000172
Version: RHEL-07-030890
Vuln IDs: V-72201
Rule IDs: SV-86825r5_rule

If the system is not configured to audit certain activities and write them to an audit log, it is more difficult to detect and track system compromises and damages incurred during a system compromise. Satisfies: SRG-OS-000466-GPOS-00210, SRG-OS-000467-GPOS-00210, SRG-OS-000468-GPOS-00212, SRG-OS-000392-GPOS-00172

Fix: F-78555r8_fix

Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "renameat" syscall occur. Add the following rules in "/etc/audit/rules.d/audit.rules": -a always,exit -F arch=b32 -S renameat -F auid>=1000 -F auid!=4294967295 -k delete -a always,exit -F arch=b64 -S renameat -F auid>=1000 -F auid!=4294967295 -k delete The audit daemon must be restarted for the changes to take effect.

b

The Red Hat Enterprise Linux operating system must audit all uses of the rmdir syscall.

RMF Control: AU-12
Severity: M
CCI: CCI-000172
Version: RHEL-07-030900
Vuln IDs: V-72203
Rule IDs: SV-86827r5_rule

If the system is not configured to audit certain activities and write them to an audit log, it is more difficult to detect and track system compromises and damages incurred during a system compromise. Satisfies: SRG-OS-000466-GPOS-00210, SRG-OS-000467-GPOS-00210, SRG-OS-000468-GPOS-00212, SRG-OS-000392-GPOS-00172

Fix: F-78557r9_fix

Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "rmdir" syscall occur. Add the following rules in "/etc/audit/rules.d/audit.rules": -a always,exit -F arch=b32 -S rmdir -F auid>=1000 -F auid!=4294967295 -k delete -a always,exit -F arch=b64 -S rmdir -F auid>=1000 -F auid!=4294967295 -k delete The audit daemon must be restarted for the changes to take effect.

b

The Red Hat Enterprise Linux operating system must audit all uses of the unlink syscall.

RMF Control: AU-12
Severity: M
CCI: CCI-000172
Version: RHEL-07-030910
Vuln IDs: V-72205
Rule IDs: SV-86829r5_rule

If the system is not configured to audit certain activities and write them to an audit log, it is more difficult to detect and track system compromises and damages incurred during a system compromise. Satisfies: SRG-OS-000466-GPOS-00210, SRG-OS-000467-GPOS-00210, SRG-OS-000468-GPOS-00212, SRG-OS-000392-GPOS-00172

Fix: F-78559r7_fix

Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "unlink" syscall occur. Add the following rules in "/etc/audit/rules.d/audit.rules": -a always,exit -F arch=b32 -S unlink -F auid>=1000 -F auid!=4294967295 -k delete -a always,exit -F arch=b64 -S unlink -F auid>=1000 -F auid!=4294967295 -k delete The audit daemon must be restarted for the changes to take effect.

b

The Red Hat Enterprise Linux operating system must audit all uses of the unlinkat syscall.

RMF Control: AU-12
Severity: M
CCI: CCI-000172
Version: RHEL-07-030920
Vuln IDs: V-72207
Rule IDs: SV-86831r5_rule

If the system is not configured to audit certain activities and write them to an audit log, it is more difficult to detect and track system compromises and damages incurred during a system compromise. Satisfies: SRG-OS-000466-GPOS-00210, SRG-OS-000467-GPOS-00210, SRG-OS-000468-GPOS-00212, SRG-OS-000392-GPOS-00172

Fix: F-78561r10_fix

Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "unlinkat" syscall occur. Add the following rules in "/etc/audit/rules.d/audit.rules": -a always,exit -F arch=b32 -S unlinkat -F auid>=1000 -F auid!=4294967295 -k delete -a always,exit -F arch=b64 -S unlinkat -F auid>=1000 -F auid!=4294967295 -k delete The audit daemon must be restarted for the changes to take effect.

a

The Red Hat Enterprise Linux operating system must limit the number of concurrent sessions to 10 for all accounts and/or account types.

RMF Control: AC-10
Severity: L
CCI: CCI-000054
Version: RHEL-07-040000
Vuln IDs: V-72217
Rule IDs: SV-86841r3_rule

Operating system management includes the ability to control the number of users and user sessions that utilize an operating system. Limiting the number of allowed users and sessions per user is helpful in reducing the risks related to DoS attacks. This requirement addresses concurrent sessions for information system accounts and does not address concurrent sessions by single users via multiple system accounts. The maximum number of concurrent sessions should be defined based on mission needs and the operational environment for each system.

Fix: F-78571r2_fix

Configure the operating system to limit the number of concurrent sessions to "10" for all accounts and/or account types. Add the following line to the top of the /etc/security/limits.conf or in a ".conf" file defined in /etc/security/limits.d/ : * hard maxlogins 10

b

The Red Hat Enterprise Linux operating system must use a FIPS 140-2 approved cryptographic algorithm for SSH communications.

RMF Control: AC-17
Severity: M
CCI: CCI-000068
Version: RHEL-07-040110
Vuln IDs: V-72221
Rule IDs: SV-86845r3_rule

Unapproved mechanisms that are used for authentication to the cryptographic module are not verified and therefore cannot be relied upon to provide confidentiality or integrity, and DoD data may be compromised. Operating systems utilizing encryption are required to use FIPS-compliant mechanisms for authenticating to cryptographic modules. FIPS 140-2 is the current standard for validating that mechanisms used to access cryptographic modules utilize authentication that meets DoD requirements. This allows for Security Levels 1, 2, 3, or 4 for use on a general purpose computing system. Satisfies: SRG-OS-000033-GPOS-00014, SRG-OS-000120-GPOS-00061, SRG-OS-000125-GPOS-00065, SRG-OS-000250-GPOS-00093, SRG-OS-000393-GPOS-00173

Fix: F-78575r3_fix

Configure SSH to use FIPS 140-2 approved cryptographic algorithms. Add the following line (or modify the line to have the required value) to the "/etc/ssh/sshd_config" file (this file may be named differently or be in a different location if using a version of SSH that is provided by a third-party vendor). Ciphers aes128-ctr,aes192-ctr,aes256-ctr The SSH service must be restarted for changes to take effect.

b

The Red Hat Enterprise Linux operating system must display the Standard Mandatory DoD Notice and Consent Banner immediately prior to, or as part of, remote access logon prompts.

RMF Control: AC-8
Severity: M
CCI: CCI-000048
Version: RHEL-07-040170
Vuln IDs: V-72225
Rule IDs: SV-86849r4_rule

Display of a standardized and approved use notification before granting access to the publicly accessible operating system ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. System use notifications are required only for access via logon interfaces with human users and are not required when such human interfaces do not exist. The banner must be formatted in accordance with applicable DoD policy. Use the following verbiage for operating systems that can accommodate banners of 1300 characters: "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." Satisfies: SRG-OS-000023-GPOS-00006, SRG-OS-000024-GPOS-00007 , SRG-OS-000228-GPOS-00088

Fix: F-78579r4_fix

Configure the operating system to display the Standard Mandatory DoD Notice and Consent Banner before granting access to the system via the ssh. Edit the "/etc/ssh/sshd_config" file to uncomment the banner keyword and configure it to point to a file that will contain the logon banner (this file may be named differently or be in a different location if using a version of SSH that is provided by a third-party vendor). An example configuration line is: banner /etc/issue Either create the file containing the banner or replace the text in the file with the Standard Mandatory DoD Notice and Consent Banner. The DoD required text is: "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." The SSH service must be restarted for changes to take effect.

b

The Red Hat Enterprise Linux operating system must be configured so that all networked systems have SSH installed.

RMF Control: SC-8
Severity: M
CCI: CCI-002418
Version: RHEL-07-040300
Vuln IDs: V-72233
Rule IDs: SV-86857r3_rule

Without protection of the transmitted information, confidentiality and integrity may be compromised because unprotected communications can be intercepted and either read or altered. This requirement applies to both internal and external networks and all types of information system components from which information can be transmitted (e.g., servers, mobile devices, notebook computers, printers, copiers, scanners, and facsimile machines). Communication paths outside the physical protection of a controlled boundary are exposed to the possibility of interception and modification. Protecting the confidentiality and integrity of organizational information can be accomplished by physical means (e.g., employing physical distribution systems) or by logical means (e.g., employing cryptographic techniques). If physical means of protection are employed, logical means (cryptography) do not have to be employed, and vice versa. Satisfies: SRG-OS-000423-GPOS-00187, SRG-OS-000424-GPOS-00188, SRG-OS-000425-GPOS-00189, SRG-OS-000426-GPOS-00190

Fix: F-78587r3_fix

Install SSH packages onto the host with the following commands: # yum install openssh-server.x86_64

b

The Red Hat Enterprise Linux operating system must be configured so that all network connections associated with SSH traffic are terminated at the end of the session or after 10 minutes of inactivity, except to fulfill documented and validated mission requirements.

RMF Control: SC-10
Severity: M
CCI: CCI-001133
Version: RHEL-07-040320
Vuln IDs: V-72237
Rule IDs: SV-86861r4_rule

Terminating an idle SSH session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled on the console or console port that has been left unattended. In addition, quickly terminating an idle SSH session will also free up resources committed by the managed network element. Terminating network connections associated with communications sessions includes, for example, de-allocating associated TCP/IP address/port pairs at the operating system level and de-allocating networking assignments at the application level if multiple application sessions are using a single operating system-level network connection. This does not mean that the operating system terminates all sessions or network access; it only ends the inactive session and releases the resources associated with that session. Satisfies: SRG-OS-000163-GPOS-00072, SRG-OS-000279-GPOS-00109

Fix: F-78591r2_fix

Configure the operating system to automatically terminate a user session after inactivity time-outs have expired or at shutdown. Add the following line (or modify the line to have the required value) to the "/etc/ssh/sshd_config" file (this file may be named differently or be in a different location if using a version of SSH that is provided by a third-party vendor): ClientAliveInterval 600 The SSH service must be restarted for changes to take effect.

b

The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon does not allow authentication using RSA rhosts authentication.

RMF Control: CM-6
Severity: M
CCI: CCI-000366
Version: RHEL-07-040330
Vuln IDs: V-72239
Rule IDs: SV-86863r4_rule

Configuring this setting for the SSH daemon provides additional assurance that remote logon via SSH will require a password, even in the event of misconfiguration elsewhere.

Fix: F-78593r4_fix

Configure the SSH daemon to not allow authentication using RSA rhosts authentication. Add the following line in "/etc/ssh/sshd_config", or uncomment the line and set the value to "no": RhostsRSAAuthentication no The SSH service must be restarted for changes to take effect.

b

The Red Hat Enterprise Linux operating system must be configured so that all network connections associated with SSH traffic terminate after a period of inactivity.

RMF Control: SC-10
Severity: M
CCI: CCI-001133
Version: RHEL-07-040340
Vuln IDs: V-72241
Rule IDs: SV-86865r4_rule

Terminating an idle SSH session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled on the console or console port that has been left unattended. In addition, quickly terminating an idle SSH session will also free up resources committed by the managed network element. Terminating network connections associated with communications sessions includes, for example, de-allocating associated TCP/IP address/port pairs at the operating system level and de-allocating networking assignments at the application level if multiple application sessions are using a single operating system-level network connection. This does not mean that the operating system terminates all sessions or network access; it only ends the inactive session and releases the resources associated with that session. Satisfies: SRG-OS-000163-GPOS-00072, SRG-OS-000279-GPOS-00109

Fix: F-78595r4_fix

Configure the operating system to terminate automatically a user session after inactivity time-outs have expired or at shutdown. Add the following line (or modify the line to have the required value) to the "/etc/ssh/sshd_config" file (this file may be named differently or be in a different location if using a version of SSH that is provided by a third-party vendor): ClientAliveCountMax 0 The SSH service must be restarted for changes to take effect.

b

The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon does not allow authentication using rhosts authentication.

RMF Control: CM-6
Severity: M
CCI: CCI-000366
Version: RHEL-07-040350
Vuln IDs: V-72243
Rule IDs: SV-86867r3_rule

Configuring this setting for the SSH daemon provides additional assurance that remote logon via SSH will require a password, even in the event of misconfiguration elsewhere.

Fix: F-78597r2_fix

Configure the SSH daemon to not allow authentication using known hosts authentication. Add the following line in "/etc/ssh/sshd_config", or uncomment the line and set the value to "yes": IgnoreRhosts yes

b

The Red Hat Enterprise Linux operating system must display the date and time of the last successful account logon upon an SSH logon.

RMF Control: CM-6
Severity: M
CCI: CCI-000366
Version: RHEL-07-040360
Vuln IDs: V-72245
Rule IDs: SV-86869r3_rule

Providing users with feedback on when account accesses via SSH last occurred facilitates user recognition and reporting of unauthorized account use.

Fix: F-78599r3_fix

Configure SSH to provide users with feedback on when account accesses last occurred by setting the required configuration options in "/etc/pam.d/sshd" or in the "sshd_config" file used by the system ("/etc/ssh/sshd_config" will be used in the example) (this file may be named differently or be in a different location if using a version of SSH that is provided by a third-party vendor). Modify the "PrintLastLog" line in "/etc/ssh/sshd_config" to match the following: PrintLastLog yes The SSH service must be restarted for changes to "sshd_config" to take effect.

b

The Red Hat Enterprise Linux operating system must not permit direct logons to the root account using remote access via SSH.

RMF Control: CM-6
Severity: M
CCI: CCI-000366
Version: RHEL-07-040370
Vuln IDs: V-72247
Rule IDs: SV-86871r3_rule

Even though the communications channel may be encrypted, an additional layer of security is gained by extending the policy of not logging on directly as root. In addition, logging on with a user-specific account provides individual accountability of actions performed on the system.

Fix: F-78601r2_fix

Configure SSH to stop users from logging on remotely as the root user. Edit the appropriate "/etc/ssh/sshd_config" file to uncomment or add the line for the "PermitRootLogin" keyword and set its value to "no" (this file may be named differently or be in a different location if using a version of SSH that is provided by a third-party vendor): PermitRootLogin no The SSH service must be restarted for changes to take effect.

b

The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon does not allow authentication using known hosts authentication.

RMF Control: CM-6
Severity: M
CCI: CCI-000366
Version: RHEL-07-040380
Vuln IDs: V-72249
Rule IDs: SV-86873r3_rule

Configuring this setting for the SSH daemon provides additional assurance that remote logon via SSH will require a password, even in the event of misconfiguration elsewhere.

Fix: F-78603r2_fix

Configure the SSH daemon to not allow authentication using known hosts authentication. Add the following line in "/etc/ssh/sshd_config", or uncomment the line and set the value to "yes": IgnoreUserKnownHosts yes The SSH service must be restarted for changes to take effect.

c

The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon is configured to only use the SSHv2 protocol.

RMF Control: IA-5
Severity: H
CCI: CCI-000197
Version: RHEL-07-040390
Vuln IDs: V-72251
Rule IDs: SV-86875r4_rule

SSHv1 is an insecure implementation of the SSH protocol and has many well-known vulnerability exploits. Exploits of the SSH daemon could provide immediate root access to the system. Satisfies: SRG-OS-000074-GPOS-00042, SRG-OS-000480-GPOS-00227

Fix: F-78605r2_fix

Remove all Protocol lines that reference version "1" in "/etc/ssh/sshd_config" (this file may be named differently or be in a different location if using a version of SSH that is provided by a third-party vendor). The "Protocol" line must be as follows: Protocol 2 The SSH service must be restarted for changes to take effect.

b

The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon is configured to only use Message Authentication Codes (MACs) employing FIPS 140-2 approved cryptographic hash algorithms.

RMF Control: AC-17
Severity: M
CCI: CCI-001453
Version: RHEL-07-040400
Vuln IDs: V-72253
Rule IDs: SV-86877r3_rule

DoD information systems are required to use FIPS 140-2 approved cryptographic hash functions. The only SSHv2 hash algorithm meeting this requirement is SHA.

Fix: F-78607r2_fix

Edit the "/etc/ssh/sshd_config" file to uncomment or add the line for the "MACs" keyword and set its value to "hmac-sha2-256" and/or "hmac-sha2-512" (this file may be named differently or be in a different location if using a version of SSH that is provided by a third-party vendor): MACs hmac-sha2-256,hmac-sha2-512 The SSH service must be restarted for changes to take effect.

b

The Red Hat Enterprise Linux operating system must be configured so that the SSH public host key files have mode 0644 or less permissive.

RMF Control: CM-6
Severity: M
CCI: CCI-000366
Version: RHEL-07-040410
Vuln IDs: V-72255
Rule IDs: SV-86879r2_rule

If a public host key file is modified by an unauthorized user, the SSH service may be compromised.

Fix: F-78609r1_fix

Note: SSH public key files may be found in other directories on the system depending on the installation. Change the mode of public host key files under "/etc/ssh" to "0644" with the following command: # chmod 0644 /etc/ssh/*.key.pub

b

The Red Hat Enterprise Linux operating system must be configured so that the SSH private host key files have mode 0640 or less permissive.

RMF Control: CM-6
Severity: M
CCI: CCI-000366
Version: RHEL-07-040420
Vuln IDs: V-72257
Rule IDs: SV-86881r3_rule

If an unauthorized user obtains the private SSH host key file, the host could be impersonated.

Fix: F-78611r5_fix

Configure the mode of SSH private host key files under "/etc/ssh" to "0640" with the following command: # chmod 0640 /path/to/file/ssh_host*key

b

The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon does not permit Generic Security Service Application Program Interface (GSSAPI) authentication unless needed.

RMF Control: CM-3
Severity: M
CCI: CCI-000318
Version: RHEL-07-040430
Vuln IDs: V-72259
Rule IDs: SV-86883r3_rule

GSSAPI authentication is used to provide additional authentication mechanisms to applications. Allowing GSSAPI authentication through SSH exposes the system's GSSAPI to remote hosts, increasing the attack surface of the system. GSSAPI authentication must be disabled unless needed.

Fix: F-78613r2_fix

Uncomment the "GSSAPIAuthentication" keyword in "/etc/ssh/sshd_config" (this file may be named differently or be in a different location if using a version of SSH that is provided by a third-party vendor) and set the value to "no": GSSAPIAuthentication no The SSH service must be restarted for changes to take effect. If GSSAPI authentication is required, it must be documented, to include the location of the configuration file, with the ISSO.

b

The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon does not permit Kerberos authentication unless needed.

RMF Control: CM-3
Severity: M
CCI: CCI-000318
Version: RHEL-07-040440
Vuln IDs: V-72261
Rule IDs: SV-86885r3_rule

Kerberos authentication for SSH is often implemented using Generic Security Service Application Program Interface (GSSAPI). If Kerberos is enabled through SSH, the SSH daemon provides a means of access to the system's Kerberos implementation. Vulnerabilities in the system's Kerberos implementation may then be subject to exploitation. To reduce the attack surface of the system, the Kerberos authentication mechanism within SSH must be disabled for systems not using this capability.

Fix: F-78615r2_fix

Uncomment the "KerberosAuthentication" keyword in "/etc/ssh/sshd_config" (this file may be named differently or be in a different location if using a version of SSH that is provided by a third-party vendor) and set the value to "no": KerberosAuthentication no The SSH service must be restarted for changes to take effect. If Kerberos authentication is required, it must be documented, to include the location of the configuration file, with the ISSO.

b

The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon performs strict mode checking of home directory configuration files.

RMF Control: CM-6
Severity: M
CCI: CCI-000366
Version: RHEL-07-040450
Vuln IDs: V-72263
Rule IDs: SV-86887r3_rule

If other users have access to modify user-specific SSH configuration files, they may be able to log on to the system as another user.

Fix: F-78617r4_fix

Uncomment the "StrictModes" keyword in "/etc/ssh/sshd_config" (this file may be named differently or be in a different location if using a version of SSH that is provided by a third-party vendor) and set the value to "yes": StrictModes yes The SSH service must be restarted for changes to take effect.

b

The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon uses privilege separation.

RMF Control: CM-6
Severity: M
CCI: CCI-000366
Version: RHEL-07-040460
Vuln IDs: V-72265
Rule IDs: SV-86889r3_rule

SSH daemon privilege separation causes the SSH process to drop root privileges when not needed, which would decrease the impact of software vulnerabilities in the unprivileged section.

Fix: F-78619r2_fix

Uncomment the "UsePrivilegeSeparation" keyword in "/etc/ssh/sshd_config" (this file may be named differently or be in a different location if using a version of SSH that is provided by a third-party vendor) and set the value to "sandbox" or "yes": UsePrivilegeSeparation sandbox The SSH service must be restarted for changes to take effect.

b

The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon does not allow compression or only allows compression after successful authentication.

RMF Control: CM-6
Severity: M
CCI: CCI-000366
Version: RHEL-07-040470
Vuln IDs: V-72267
Rule IDs: SV-86891r3_rule

If compression is allowed in an SSH connection prior to authentication, vulnerabilities in the compression software could result in compromise of the system from an unauthenticated connection, potentially with root privileges.

Fix: F-78621r2_fix

Uncomment the "Compression" keyword in "/etc/ssh/sshd_config" (this file may be named differently or be in a different location if using a version of SSH that is provided by a third-party vendor) on the system and set the value to "delayed" or "no": Compression no The SSH service must be restarted for changes to take effect.

a

The Red Hat Enterprise Linux operating system must display the date and time of the last successful account logon upon logon.

RMF Control: CM-6
Severity: L
CCI: CCI-000366
Version: RHEL-07-040530
Vuln IDs: V-72275
Rule IDs: SV-86899r4_rule

Providing users with feedback on when account accesses last occurred facilitates user recognition and reporting of unauthorized account use.

Fix: F-78629r4_fix

Configure the operating system to provide users with feedback on when account accesses last occurred by setting the required configuration options in "/etc/pam.d/postlogin". Add the following line to the top of "/etc/pam.d/postlogin": session required pam_lastlog.so showfailed

c

The Red Hat Enterprise Linux operating system must not contain .shosts files.

RMF Control: CM-6
Severity: H
CCI: CCI-000366
Version: RHEL-07-040540
Vuln IDs: V-72277
Rule IDs: SV-86901r2_rule

The .shosts files are used to configure host-based authentication for individual users or the system via SSH. Host-based authentication is not sufficient for preventing unauthorized access to the system, as it does not require interactive identification and authentication of a connection request, or for the use of two-factor authentication.

Fix: F-78631r1_fix

Remove any found ".shosts" files from the system. # rm /[path]/[to]/[file]/.shosts

c

The Red Hat Enterprise Linux operating system must not contain shosts.equiv files.

RMF Control: CM-6
Severity: H
CCI: CCI-000366
Version: RHEL-07-040550
Vuln IDs: V-72279
Rule IDs: SV-86903r2_rule

The shosts.equiv files are used to configure host-based authentication for the system via SSH. Host-based authentication is not sufficient for preventing unauthorized access to the system, as it does not require interactive identification and authentication of a connection request, or for the use of two-factor authentication.

Fix: F-78633r1_fix

Remove any found "shosts.equiv" files from the system. # rm /[path]/[to]/[file]/shosts.equiv

a

For Red Hat Enterprise Linux operating systems using DNS resolution, at least two name servers must be configured.

RMF Control: CM-6
Severity: L
CCI: CCI-000366
Version: RHEL-07-040600
Vuln IDs: V-72281
Rule IDs: SV-86905r2_rule

To provide availability for name resolution services, multiple redundant name servers are mandated. A failure in name resolution could lead to the failure of security functions requiring name resolution, which may include time synchronization, centralized authentication, and remote system logging.

Fix: F-78635r1_fix

Configure the operating system to use two or more name servers for DNS resolution. Edit the "/etc/resolv.conf" file to uncomment or add the two or more "nameserver" option lines with the IP address of local authoritative name servers. If local host resolution is being performed, the "/etc/resolv.conf" file must be empty. An empty "/etc/resolv.conf" file can be created as follows: # echo -n > /etc/resolv.conf And then make the file immutable with the following command: # chattr +i /etc/resolv.conf If the "/etc/resolv.conf" file must be mutable, the required configuration must be documented with the Information System Security Officer (ISSO) and the file must be verified by the system file integrity tool.

b

The Red Hat Enterprise Linux operating system must not forward Internet Protocol version 4 (IPv4) source-routed packets.

RMF Control: CM-6
Severity: M
CCI: CCI-000366
Version: RHEL-07-040610
Vuln IDs: V-72283
Rule IDs: SV-86907r2_rule

Source-routed packets allow the source of the packet to suggest that routers forward the packet along a different path than configured on the router, which can be used to bypass network security measures. This requirement applies only to the forwarding of source-routed traffic, such as when IPv4 forwarding is enabled and the system is functioning as a router.

Fix: F-78637r3_fix

Set the system to the required kernel parameter by adding the following line to "/etc/sysctl.conf" or a configuration file in the /etc/sysctl.d/ directory (or modify the line to have the required value): net.ipv4.conf.all.accept_source_route = 0 Issue the following command to make the changes take effect: # sysctl -system

b

The Red Hat Enterprise Linux operating system must not forward Internet Protocol version 4 (IPv4) source-routed packets by default.

RMF Control: CM-6
Severity: M
CCI: CCI-000366
Version: RHEL-07-040620
Vuln IDs: V-72285
Rule IDs: SV-86909r2_rule

Source-routed packets allow the source of the packet to suggest that routers forward the packet along a different path than configured on the router, which can be used to bypass network security measures. This requirement applies only to the forwarding of source-routed traffic, such as when IPv4 forwarding is enabled and the system is functioning as a router.

Fix: F-78639r2_fix

Set the system to the required kernel parameter by adding the following line to "/etc/sysctl.conf" or a configuration file in the /etc/sysctl.d/ directory (or modify the line to have the required value): net.ipv4.conf.default.accept_source_route = 0 Issue the following command to make the changes take effect: # sysctl --system

b

The Red Hat Enterprise Linux operating system must not respond to Internet Protocol version 4 (IPv4) Internet Control Message Protocol (ICMP) echoes sent to a broadcast address.

RMF Control: CM-6
Severity: M
CCI: CCI-000366
Version: RHEL-07-040630
Vuln IDs: V-72287
Rule IDs: SV-86911r2_rule

Responding to broadcast (ICMP) echoes facilitates network mapping and provides a vector for amplification attacks.

Fix: F-78641r2_fix

Set the system to the required kernel parameter by adding the following line to "/etc/sysctl.conf" or a configuration file in the /etc/sysctl.d/ directory (or modify the line to have the required value): net.ipv4.icmp_echo_ignore_broadcasts = 1 Issue the following command to make the changes take effect: # sysctl --system

b

The Red Hat Enterprise Linux operating system must prevent Internet Protocol version 4 (IPv4) Internet Control Message Protocol (ICMP) redirect messages from being accepted.

RMF Control: CM-6
Severity: M
CCI: CCI-000366
Version: RHEL-07-040640
Vuln IDs: V-72289
Rule IDs: SV-86913r3_rule

ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular destination. These messages modify the host's route table and are unauthenticated. An illicit ICMP redirect message could result in a man-in-the-middle attack.

Fix: F-78643r3_fix

Set the system to not accept IPv4 ICMP redirect messages by adding the following line to "/etc/sysctl.conf" or a configuration file in the /etc/sysctl.d/ directory (or modify the line to have the required value): net.ipv4.conf.default.accept_redirects = 0 Issue the following command to make the changes take effect: # sysctl --system

b

The Red Hat Enterprise Linux operating system must not allow interfaces to perform Internet Protocol version 4 (IPv4) Internet Control Message Protocol (ICMP) redirects by default.

RMF Control: CM-6
Severity: M
CCI: CCI-000366
Version: RHEL-07-040650
Vuln IDs: V-72291
Rule IDs: SV-86915r4_rule

ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular destination. These messages contain information from the system's route table, possibly revealing portions of the network topology.

Fix: F-78645r4_fix

Configure the system to not allow interfaces to perform IPv4 ICMP redirects by default. Set the system to the required kernel parameter by adding the following line to "/etc/sysctl.conf" or a configuration file in the /etc/sysctl.d/ directory (or modify the line to have the required value): net.ipv4.conf.default.send_redirects = 0 Issue the following command to make the changes take effect: # sysctl --system

b

The Red Hat Enterprise Linux operating system must not send Internet Protocol version 4 (IPv4) Internet Control Message Protocol (ICMP) redirects.

RMF Control: CM-6
Severity: M
CCI: CCI-000366
Version: RHEL-07-040660
Vuln IDs: V-72293
Rule IDs: SV-86917r3_rule

ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular destination. These messages contain information from the system's route table, possibly revealing portions of the network topology.

Fix: F-78647r3_fix

Configure the system to not allow interfaces to perform IPv4 ICMP redirects. Set the system to the required kernel parameter by adding the following line to "/etc/sysctl.conf" or a configuration file in the /etc/sysctl.d/ directory (or modify the line to have the required value): net.ipv4.conf.all.send_redirects = 0 Issue the following command to make the changes take effect: # sysctl --system

c

The Red Hat Enterprise Linux operating system must not have a File Transfer Protocol (FTP) server package installed unless needed.

RMF Control: CM-6
Severity: H
CCI: CCI-000366
Version: RHEL-07-040690
Vuln IDs: V-72299
Rule IDs: SV-86923r3_rule

The FTP service provides an unencrypted remote access that does not provide for the confidentiality and integrity of user passwords or the remote session. If a privileged user were to log on using this service, the privileged user password could be compromised. SSH or other encrypted file transfer methods must be used in place of this service.

Fix: F-78653r3_fix

Document the "vsftpd" package with the ISSO as an operational requirement or remove it from the system with the following command: # yum remove vsftpd

c

The Red Hat Enterprise Linux operating system must not have the Trivial File Transfer Protocol (TFTP) server package installed if not required for operational support.

RMF Control: CM-3
Severity: H
CCI: CCI-000318
Version: RHEL-07-040700
Vuln IDs: V-72301
Rule IDs: SV-86925r2_rule

If TFTP is required for operational support (such as the transmission of router configurations) its use must be documented with the Information System Security Officer (ISSO), restricted to only authorized personnel, and have access control rules established.

Fix: F-78655r2_fix

Remove the TFTP package from the system with the following command: # yum remove tftp-server

c

The Red Hat Enterprise Linux operating system must be configured so that remote X connections for interactive users are encrypted.

RMF Control: CM-6
Severity: H
CCI: CCI-000366
Version: RHEL-07-040710
Vuln IDs: V-72303
Rule IDs: SV-86927r4_rule

Open X displays allow an attacker to capture keystrokes and execute commands remotely.

Fix: F-78657r6_fix

Configure SSH to encrypt connections for interactive users. Edit the "/etc/ssh/sshd_config" file to uncomment or add the line for the "X11Forwarding" keyword and set its value to "yes" (this file may be named differently or be in a different location if using a version of SSH that is provided by a third-party vendor): X11Forwarding yes The SSH service must be restarted for changes to take effect: # systemctl restart sshd

b

The Red Hat Enterprise Linux operating system must not have an X Windows display manager installed unless approved.

RMF Control: CM-6
Severity: M
CCI: CCI-000366
Version: RHEL-07-040730
Vuln IDs: V-72307
Rule IDs: SV-86931r4_rule

Internet services that are not required for system or application processes must not be active to decrease the attack surface of the system. X Windows has a long history of security vulnerabilities and will not be used unless approved and documented.

Fix: F-78661r2_fix

Document the requirement for an X Windows server with the ISSO or remove the related packages with the following commands: # rpm -e xorg-x11-server-common

b

The Red Hat Enterprise Linux operating system must not be performing packet forwarding unless the system is a router.

RMF Control: CM-6
Severity: M
CCI: CCI-000366
Version: RHEL-07-040740
Vuln IDs: V-72309
Rule IDs: SV-86933r2_rule

Routing protocol daemons are typically used on routers to exchange network topology information with other routers. If this software is used when not required, system network information may be unnecessarily transmitted across the network.

Fix: F-78663r2_fix

Set the system to the required kernel parameter by adding the following line to "/etc/sysctl.conf" or a configuration file in the /etc/sysctl.d/ directory (or modify the line to have the required value): net.ipv4.ip_forward = 0 Issue the following command to make the changes take effect: # sysctl --system

c

SNMP community strings on the Red Hat Enterprise Linux operating system must be changed from the default.

RMF Control: CM-6
Severity: H
CCI: CCI-000366
Version: RHEL-07-040800
Vuln IDs: V-72313
Rule IDs: SV-86937r2_rule

Whether active or not, default Simple Network Management Protocol (SNMP) community strings must be changed to maintain security. If the service is running with the default authenticators, anyone can gather data about the system and the network and use the information to potentially compromise the integrity of the system or network(s). It is highly recommended that SNMP version 3 user authentication and message encryption be used in place of the version 2 community strings.

Fix: F-78667r1_fix

If the "/etc/snmp/snmpd.conf" file exists, modify any lines that contain a community string value of "public" or "private" to another string value.

b

The Red Hat Enterprise Linux operating system must not forward IPv6 source-routed packets.

RMF Control: CM-6
Severity: M
CCI: CCI-000366
Version: RHEL-07-040830
Vuln IDs: V-72319
Rule IDs: SV-86943r2_rule

Source-routed packets allow the source of the packet to suggest that routers forward the packet along a different path than configured on the router, which can be used to bypass network security measures. This requirement applies only to the forwarding of source-routed traffic, such as when IPv6 forwarding is enabled and the system is functioning as a router.

Fix: F-78673r2_fix

Set the system to the required kernel parameter, if IPv6 is enabled, by adding the following line to "/etc/sysctl.conf" or a configuration file in the /etc/sysctl.d/ directory (or modify the line to have the required value): net.ipv6.conf.all.accept_source_route = 0 Issue the following command to make the changes take effect: # sysctl --system

b

The Red Hat Enterprise Linux operating system must have the required packages for multifactor authentication installed.

RMF Control: IA-2
Severity: M
CCI: CCI-001948
Version: RHEL-07-041001
Vuln IDs: V-72417
Rule IDs: SV-87041r4_rule

Using an authentication device, such as a CAC or token that is separate from the information system, ensures that even if the information system is compromised, that compromise will not affect credentials stored on the authentication device. Multifactor solutions that require devices separate from information systems gaining access include, for example, hardware tokens providing time-based or challenge-response authenticators and smart cards such as the U.S. Government Personal Identity Verification card and the DoD Common Access Card. A privileged account is defined as an information system account with authorizations of a privileged user. Remote access is access to DoD nonpublic information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless. This requirement only applies to components where this is specific to the function of the device or has the concept of an organizational user (e.g., VPN, proxy capability). This does not apply to authentication for the purpose of configuring the device itself (management). Satisfies: SRG-OS-000375-GPOS-00160, SRG-OS-000375-GPOS-00161, SRG-OS-000375-GPOS-00162

Fix: F-78769r4_fix

Configure the operating system to implement multifactor authentication by installing the required packages. Install the "esc" and "pam_pkcs11" packages on the system with the following command: # yum install esc pam_pkcs11

b

The Red Hat Enterprise Linux operating system must implement multifactor authentication for access to privileged accounts via pluggable authentication modules (PAM).

RMF Control: IA-2
Severity: M
CCI: CCI-001948
Version: RHEL-07-041002
Vuln IDs: V-72427
Rule IDs: SV-87051r4_rule

Using an authentication device, such as a CAC or token that is separate from the information system, ensures that even if the information system is compromised, that compromise will not affect credentials stored on the authentication device. Multifactor solutions that require devices separate from information systems gaining access include, for example, hardware tokens providing time-based or challenge-response authenticators and smart cards such as the U.S. Government Personal Identity Verification card and the DoD Common Access Card. A privileged account is defined as an information system account with authorizations of a privileged user. Remote access is access to DoD nonpublic information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless. This requirement only applies to components where this is specific to the function of the device or has the concept of an organizational user (e.g., VPN, proxy capability). This does not apply to authentication for the purpose of configuring the device itself (management). Satisfies: SRG-OS-000375-GPOS-00160, SRG-OS-000375-GPOS-00161, SRG-OS-000375-GPOS-00162

Fix: F-78779r3_fix

Configure the operating system to implement multifactor authentication for remote access to privileged accounts via pluggable authentication modules (PAM). Modify all of the services lines in "/etc/sssd/sssd.conf" or in configuration files found under "/etc/sssd/conf.d" to include pam.

b

The Red Hat Enterprise Linux operating system must implement certificate status checking for PKI authentication.

RMF Control: IA-2
Severity: M
CCI: CCI-001948
Version: RHEL-07-041003
Vuln IDs: V-72433
Rule IDs: SV-87057r5_rule

Using an authentication device, such as a CAC or token that is separate from the information system, ensures that even if the information system is compromised, that compromise will not affect credentials stored on the authentication device. Multifactor solutions that require devices separate from information systems gaining access include, for example, hardware tokens providing time-based or challenge-response authenticators and smart cards such as the U.S. Government Personal Identity Verification card and the DoD Common Access Card. A privileged account is defined as an information system account with authorizations of a privileged user. Remote access is access to DoD nonpublic information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless. This requirement only applies to components where this is specific to the function of the device or has the concept of an organizational user (e.g., VPN, proxy capability). This does not apply to authentication for the purpose of configuring the device itself (management). Satisfies: SRG-OS-000375-GPOS-00160, SRG-OS-000375-GPOS-00161, SRG-OS-000375-GPOS-00162

Fix: F-78785r3_fix

Configure the operating system to do certificate status checking for PKI authentication. Modify all of the "cert_policy" lines in "/etc/pam_pkcs11/pam_pkcs11.conf" to include "ocsp_on".

b

The Red Hat Enterprise Linux operating system must prevent a user from overriding the screensaver lock-delay setting for the graphical user interface.

RMF Control: AC-11
Severity: M
CCI: CCI-000057
Version: RHEL-07-010081
Vuln IDs: V-73155
Rule IDs: SV-87807r4_rule

A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not log out because of the temporary nature of the absence. Rather than relying on the user to manually lock their operating system session prior to vacating the vicinity, operating systems need to be able to identify when a user's session has idled and take action to initiate the session lock. The session lock is implemented at the point where session activity can be determined and/or controlled.

Fix: F-79601r2_fix

Configure the operating system to prevent a user from overriding a screensaver lock after a 15-minute period of inactivity for graphical user interfaces. Create a database to contain the system-wide screensaver settings (if it does not already exist) with the following command: Note: The example below is using the database "local" for the system, so if the system is using another database in "/etc/dconf/profile/user", the file should be created under the appropriate subdirectory. # touch /etc/dconf/db/local.d/locks/session Add the setting to lock the screensaver lock delay: /org/gnome/desktop/screensaver/lock-delay

b

The Red Hat Enterprise Linux operating system must be configured so that when passwords are changed or new passwords are established, pwquality must be used.

RMF Control: IA-5
Severity: M
CCI: CCI-000192
Version: RHEL-07-010119
Vuln IDs: V-73159
Rule IDs: SV-87811r4_rule

Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. "pwquality" enforces complex password construction configuration and has the ability to limit brute-force attacks on the system.

Fix: F-79605r5_fix

Configure the operating system to use "pwquality" to enforce password complexity rules. Add the following line to "/etc/pam.d/system-auth" (or modify the line to have the required value): password required pam_pwquality.so retry=3 Note: The value of "retry" should be between "1" and "3".

b

The Red Hat Enterprise Linux operating system must prevent binary files from being executed on file systems that are being imported via Network File System (NFS).

RMF Control: CM-6
Severity: M
CCI: CCI-000366
Version: RHEL-07-021021
Vuln IDs: V-73161
Rule IDs: SV-87813r2_rule

The "noexec" mount option causes the system to not execute binary files. This option must be used for mounting any file system not containing approved binary files as they may be incompatible. Executing files from untrusted file systems increases the opportunity for unprivileged users to attain unauthorized administrative access.

Fix: F-79607r2_fix

Configure the "/etc/fstab" to use the "noexec" option on file systems that are being imported via NFS.

b

The Red Hat Enterprise Linux operating system must be configured so that the audit system takes appropriate action when there is an error sending audit records to a remote system.

RMF Control: AU-4
Severity: M
CCI: CCI-001851
Version: RHEL-07-030321
Vuln IDs: V-73163
Rule IDs: SV-87815r3_rule

Taking appropriate action when there is an error sending audit records to a remote system will minimize the possibility of losing audit records.

Fix: F-79609r2_fix

Configure the action the operating system takes if there is an error sending audit records to a remote system. Uncomment the "network_failure_action" option in "/etc/audisp/audisp-remote.conf" and set it to "syslog", "single", or "halt". network_failure_action = syslog

b

The Red Hat Enterprise Linux operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/group.

RMF Control: AC-2
Severity: M
CCI: CCI-000018
Version: RHEL-07-030871
Vuln IDs: V-73165
Rule IDs: SV-87817r3_rule

Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter).

Fix: F-79611r3_fix

Configure the operating system to generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/group". Add or update the following rule in "/etc/audit/rules.d/audit.rules": -w /etc/group -p wa -k identity The audit daemon must be restarted for the changes to take effect.

b

The Red Hat Enterprise Linux operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/gshadow.

RMF Control: AC-2
Severity: M
CCI: CCI-000018
Version: RHEL-07-030872
Vuln IDs: V-73167
Rule IDs: SV-87819r4_rule

Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter).

Fix: F-79613r3_fix

Configure the operating system to generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/gshadow". Add or update the following rule in "/etc/audit/rules.d/audit.rules": -w /etc/gshadow -p wa -k identity The audit daemon must be restarted for the changes to take effect.

b

The Red Hat Enterprise Linux operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/shadow.

RMF Control: AC-2
Severity: M
CCI: CCI-000018
Version: RHEL-07-030873
Vuln IDs: V-73171
Rule IDs: SV-87823r4_rule

Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter).

Fix: F-79617r4_fix

Configure the operating system to generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/shadow. Add or update the following file system rule in "/etc/audit/rules.d/audit.rules": -w /etc/shadow -p wa -k identity The audit daemon must be restarted for the changes to take effect.

b

The Red Hat Enterprise Linux operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/opasswd.

RMF Control: AC-2
Severity: M
CCI: CCI-000018
Version: RHEL-07-030874
Vuln IDs: V-73173
Rule IDs: SV-87825r5_rule

Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter).

Fix: F-79619r6_fix

Configure the operating system to generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/opasswd. Add or update the following file system rule in "/etc/audit/rules.d/audit.rules": -w /etc/security/opasswd -p wa -k identity The audit daemon must be restarted for the changes to take effect: # systemctl restart auditd

b

The Red Hat Enterprise Linux operating system must ignore Internet Protocol version 4 (IPv4) Internet Control Message Protocol (ICMP) redirect messages.

RMF Control: CM-6
Severity: M
CCI: CCI-000366
Version: RHEL-07-040641
Vuln IDs: V-73175
Rule IDs: SV-87827r4_rule

ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular destination. These messages modify the host's route table and are unauthenticated. An illicit ICMP redirect message could result in a man-in-the-middle attack.

Fix: F-79621r3_fix

Set the system to ignore IPv4 ICMP redirect messages by adding the following line to "/etc/sysctl.conf" or a configuration file in the /etc/sysctl.d/ directory (or modify the line to have the required value): net.ipv4.conf.all.accept_redirects = 0 Issue the following command to make the changes take effect: # sysctl --system

b

The Red Hat Enterprise Linux operating system must uniquely identify and must authenticate users using multifactor authentication via a graphical user logon.

RMF Control: IA-2
Severity: M
CCI: CCI-001948
Version: RHEL-07-010061
Vuln IDs: V-77819
Rule IDs: SV-92515r2_rule

To assure accountability and prevent unauthenticated access, users must be identified and authenticated to prevent potential misuse and compromise of the system. Multifactor solutions that require devices separate from information systems gaining access include, for example, hardware tokens providing time-based or challenge-response authenticators and smart cards such as the U.S. Government Personal Identity Verification card and the DoD Common Access Card. Satisfies: SRG-OS-000375-GPOS-00161,SRG-OS-000375-GPOS-00162

Fix: F-84519r4_fix

Configure the operating system to uniquely identify and authenticate users using multifactor authentication via a graphical user logon. Note: If the system does not have GNOME installed, this requirement is Not Applicable. Create a database to contain the system-wide screensaver settings (if it does not already exist) with the following command: Note: The example is using the database local for the system, so if the system is using another database in "/etc/dconf/profile/user", the file should be created under the appropriate subdirectory. # touch /etc/dconf/db/local.d/00-defaults Edit "[org/gnome/login-screen]" and add or update the following line: enable-smartcard-authentication=true Update the system databases: # dconf update

b

The Red Hat Enterprise Linux operating system must be configured so that the Datagram Congestion Control Protocol (DCCP) kernel module is disabled unless required.

RMF Control: IA-3
Severity: M
CCI: CCI-001958
Version: RHEL-07-020101
Vuln IDs: V-77821
Rule IDs: SV-92517r3_rule

Disabling DCCP protects the system against exploitation of any flaws in the protocol implementation.

Fix: F-84521r3_fix

Configure the operating system to disable the ability to use the DCCP kernel module. Create a file under "/etc/modprobe.d" with the following command: # touch /etc/modprobe.d/dccp.conf Add the following line to the created file: install dccp /bin/true Ensure that the DCCP module is blacklisted: # vi /etc/modprobe.d/blacklist.conf Add or update the line: blacklist dccp

b

The Red Hat Enterprise Linux operating system must require authentication upon booting into single-user and maintenance modes.

RMF Control: AC-3
Severity: M
CCI: CCI-000213
Version: RHEL-07-010481
Vuln IDs: V-77823
Rule IDs: SV-92519r2_rule

If the system does not require valid root authentication before it boots into single-user or maintenance mode, anyone who invokes single-user or maintenance mode is granted privileged access to all files on the system.

Fix: F-84523r2_fix

Configure the operating system to require authentication upon booting into single-user and maintenance modes. Add or modify the "ExecStart" line in "/usr/lib/systemd/system/rescue.service" to include "/usr/sbin/sulogin": ExecStart=-/bin/sh -c "/usr/sbin/sulogin; /usr/bin/systemctl --fail --no-block default"

b

The Red Hat Enterprise Linux operating system must implement virtual address space randomization.

RMF Control: CM-6
Severity: M
CCI: CCI-000366
Version: RHEL-07-040201
Vuln IDs: V-77825
Rule IDs: SV-92521r2_rule

Address space layout randomization (ASLR) makes it more difficult for an attacker to predict the location of attack code he or she has introduced into a process's address space during an attempt at exploitation. Additionally, ASLR also makes it more difficult for an attacker to know the location of existing code in order to repurpose it using return-oriented programming (ROP) techniques.

Fix: F-84531r2_fix

Configure the operating system implement virtual address space randomization. Set the system to the required kernel parameter by adding the following line to "/etc/sysctl.conf" or a config file in the /etc/sysctl.d/ directory (or modify the line to have the required value): kernel.randomize_va_space = 2 Issue the following command to make the changes take effect: # sysctl --system

b

The Red Hat Enterprise Linux operating system must prevent a user from overriding the screensaver idle-activation-enabled setting for the graphical user interface.

RMF Control: AC-11
Severity: M
CCI: CCI-000057
Version: RHEL-07-010101
Vuln IDs: V-78997
Rule IDs: SV-93703r2_rule

A session lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not want to log out because of the temporary nature of the absence. The session lock is implemented at the point where session activity can be determined. The ability to enable/disable a session lock is given to the user by default. Disabling the user's ability to disengage the graphical user interface session lock provides the assurance that all sessions will lock after the specified period of time.

Fix: F-85747r1_fix

Configure the operating system to prevent a user from overriding a screensaver lock after a 15-minute period of inactivity for graphical user interfaces. Create a database to contain the system-wide screensaver settings (if it does not already exist) with the following command: Note: The example below is using the database "local" for the system, so if the system is using another database in "/etc/dconf/profile/user", the file should be created under the appropriate subdirectory. # touch /etc/dconf/db/local.d/locks/session Add the setting to lock the screensaver idle-activation-enabled setting: /org/gnome/desktop/screensaver/idle-activation-enabled

b

The Red Hat Enterprise Linux operating system must audit all uses of the create_module syscall.

RMF Control: AU-12
Severity: M
CCI: CCI-000172
Version: RHEL-07-030819
Vuln IDs: V-78999
Rule IDs: SV-93705r3_rule

Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). Satisfies: SRG-OS-000471-GPOS-00216, SRG-OS-000477-GPOS-00222

Fix: F-85749r4_fix

Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "create_module" syscall occur. Add or update the following rules in "/etc/audit/rules.d/audit.rules": -a always,exit -F arch=b32 -S create_module -k module-change -a always,exit -F arch=b64 -S create_module -k module-change The audit daemon must be restarted for the changes to take effect.

b

The Red Hat Enterprise Linux operating system must audit all uses of the finit_module syscall.

RMF Control: AU-12
Severity: M
CCI: CCI-000172
Version: RHEL-07-030821
Vuln IDs: V-79001
Rule IDs: SV-93707r3_rule

Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). Satisfies: SRG-OS-000471-GPOS-00216, SRG-OS-000477-GPOS-00222

Fix: F-85751r3_fix

Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "finit_module" syscall occur. Add or update the following rules in "/etc/audit/rules.d/audit.rules": -a always,exit -F arch=b32 -S finit_module -k module-change -a always,exit -F arch=b64 -S finit_module -k module-change The audit daemon must be restarted for the changes to take effect.

b

The Red Hat Enterprise Linux operating system must be configured so that /etc/pam.d/passwd implements /etc/pam.d/system-auth when changing passwords.

RMF Control: IA-5
Severity: M
CCI: CCI-000192
Version: RHEL-07-010118
Vuln IDs: V-81003
Rule IDs: SV-95715r1_rule

Pluggable authentication modules (PAM) allow for a modular approach to integrating authentication methods. PAM operates in a top-down processing model and if the modules are not listed in the correct order, an important security function could be bypassed if stack entries are not centralized.

Fix: F-87837r1_fix

Configure PAM to utilize /etc/pam.d/system-auth when changing passwords. Add the following line to "/etc/pam.d/passwd" (or modify the line to have the required value): password substack system-auth

c

Red Hat Enterprise Linux operating systems version 7.2 or newer with a Basic Input/Output System (BIOS) must require authentication upon booting into single-user and maintenance modes.

RMF Control: AC-3
Severity: H
CCI: CCI-000213
Version: RHEL-07-010482
Vuln IDs: V-81005
Rule IDs: SV-95717r1_rule

If the system does not require valid root authentication before it boots into single-user or maintenance mode, anyone who invokes single-user or maintenance mode is granted privileged access to all files on the system. GRUB 2 is the default boot loader for RHEL 7 and is designed to require a password to boot into single-user mode or make modifications to the boot menu.

Fix: F-87839r2_fix

Configure the system to encrypt the boot password for root. Generate an encrypted grub2 password for root with the following command: Note: The hash generated is an example. # grub2-setpassword Enter password: Confirm password: Edit the /boot/grub2/grub.cfg file and add or modify the following lines in the "### BEGIN /etc/grub.d/01_users ###" section: set superusers="root" export superusers

c

Red Hat Enterprise Linux operating systems version 7.2 or newer using Unified Extensible Firmware Interface (UEFI) must require authentication upon booting into single-user and maintenance modes.

RMF Control: AC-3
Severity: H
CCI: CCI-000213
Version: RHEL-07-010491
Vuln IDs: V-81007
Rule IDs: SV-95719r1_rule

If the system does not require valid root authentication before it boots into single-user or maintenance mode, anyone who invokes single-user or maintenance mode is granted privileged access to all files on the system. GRUB 2 is the default boot loader for RHEL 7 and is designed to require a password to boot into single-user mode or make modifications to the boot menu.

Fix: F-87841r2_fix

Configure the system to encrypt the boot password for root. Generate an encrypted grub2 password for root with the following command: Note: The hash generated is an example. # grub2-setpassword Enter password: Confirm password: Edit the /boot/efi/EFI/redhat/grub.cfg file and add or modify the following lines in the "### BEGIN /etc/grub.d/01_users ###" section: set superusers="root" export superusers

b

The Red Hat Enterprise Linux operating system must be configured to use the au-remote plugin.

RMF Control: AU-4
Severity: M
CCI: CCI-001851
Version: RHEL-07-030200
Vuln IDs: V-81015
Rule IDs: SV-95727r1_rule

Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Off-loading is a common process in information systems with limited audit storage capacity. Without the configuration of the "au-remote" plugin, the audisp-remote daemon will not off-load the logs from the system being audited. Satisfies: SRG-OS-000342-GPOS-00133, SRG-OS-000479-GPOS-00224

Fix: F-87849r2_fix

Edit the /etc/audisp/plugins.d/au-remote.conf file and change the value of "active" to "yes". The audit daemon must be restarted for changes to take effect: # service auditd restart

b

The Red Hat Enterprise Linux operating system must configure the au-remote plugin to off-load audit logs using the audisp-remote daemon.

RMF Control: AU-4
Severity: M
CCI: CCI-001851
Version: RHEL-07-030201
Vuln IDs: V-81017
Rule IDs: SV-95729r1_rule

Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Off-loading is a common process in information systems with limited audit storage capacity. Without the configuration of the "au-remote" plugin, the audisp-remote daemon will not off load the logs from the system being audited. Satisfies: SRG-OS-000342-GPOS-00133, SRG-OS-000479-GPOS-00224

Fix: F-87851r2_fix

Edit the /etc/audisp/plugins.d/au-remote.conf file and add or update the following values: direction = out path = /sbin/audisp-remote type = always The audit daemon must be restarted for changes to take effect: # service auditd restart

b

The Red Hat Enterprise Linux operating system must take appropriate action when the audisp-remote buffer is full.

RMF Control: AU-4
Severity: M
CCI: CCI-001851
Version: RHEL-07-030210
Vuln IDs: V-81019
Rule IDs: SV-95731r1_rule

Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Off-loading is a common process in information systems with limited audit storage capacity. When the remote buffer is full, audit logs will not be collected and sent to the central log server. Satisfies: SRG-OS-000342-GPOS-00133, SRG-OS-000479-GPOS-00224

Fix: F-87853r3_fix

Edit the /etc/audisp/audispd.conf file and add or update the "overflow_action" option: overflow_action = syslog The audit daemon must be restarted for changes to take effect: # service auditd restart

b

The Red Hat Enterprise Linux operating system must label all off-loaded audit logs before sending them to the central log server.

RMF Control: AU-4
Severity: M
CCI: CCI-001851
Version: RHEL-07-030211
Vuln IDs: V-81021
Rule IDs: SV-95733r1_rule

Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Off-loading is a common process in information systems with limited audit storage capacity. When audit logs are not labeled before they are sent to a central log server, the audit data will not be able to be analyzed and tied back to the correct system. Satisfies: SRG-OS-000342-GPOS-00133, SRG-OS-000479-GPOS-00224

Fix: F-87855r2_fix

Edit the /etc/audisp/audispd.conf file and add or update the "name_format" option: name_format = hostname The audit daemon must be restarted for changes to take effect: # service auditd restart