Cyber Trackr - Free Compliance Library
Cyber Trackr
The Free Compliance Library

Amazon Linux 2023 Security Technical Implementation Guide - V1R2

  • Version/Release: V1R2
  • Published: 2025-11-20
  • Released: 2026-01-05
  • Expand All:
  • Severity:
  • Sort:
Compare

Select any two versions of this STIG to compare the individual requirements

View

Select any old version/release of this STIG to view the previous requirements

This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DOD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.
c
Amazon Linux 2023 local disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at rest protection.
SC-28 - High - CCI-001199 - V-273994 - SV-273994r1119970_rule
RMF Control
SC-28
Severity
High
CCI
CCI-001199
Version
AZLX-23-000100
Vuln IDs
  • V-273994
Rule IDs
  • SV-273994r1119970_rule
Information at rest refers to the state of information when it is located on a secondary storage device (e.g., disk drive and tape drive, when used for backups) within an operating system. This requirement addresses protection of user-generated data, as well as operating system-specific configuration data. Organizations may choose to employ different mechanisms to achieve confidentiality and integrity protections, as appropriate, in accordance with the security category and/or classification of the information. Satisfies: SRG-OS-000185-GPOS-00079, SRG-OS-000404-GPOS-00183, SRG-OS-000405-GPOS-00184
Checks: C-78085r1119968_chk

Verify Amazon Linux 2023 is configured so that all partitions are encrypted with the following command: $ sudo blkid /dev/xvda1: UUID="ed0acbe9-bd05-495e-a9ac-cb615b29327d" TYPE="crypto_LUKS" Every persistent disk partition present must be of "Type" "crypto_LUKS". If any partitions other than the boot partition, bios partition or pseudo file systems (such as /proc or /sys) are not type "crypto_LUKS", this is a finding.

Fix: F-77990r1119969_fix

Configure Amazon Linux 2023 to protect the confidentiality and integrity of all information at rest. Encrypting a partition in an already installed system is more difficult, because existing partitions will need to be resized and changed. To encrypt an entire partition, dedicate a partition for encryption in the partition layout.

b
Amazon Linux 2023 must ensure cryptographic verification of vendor software packages.
- Medium - CCI-003992 - V-273995 - SV-273995r1119973_rule
RMF Control
Severity
Medium
CCI
CCI-003992
Version
AZLX-23-000110
Vuln IDs
  • V-273995
Rule IDs
  • SV-273995r1119973_rule
Cryptographic verification of vendor software packages ensures that all software packages are obtained from a valid source and protects against spoofing that could lead to installation of malware on the system. Amazon Linux cryptographically signs all software packages, which includes updates, with a GPG key to Verify they are valid.
Checks: C-78086r1119971_chk

Verify Amazon Linux 2023 package-signing keys are installed on the system and verify their fingerprints match vendor values. Note: For Amazon Linux 2023 software packages, AWS uses GPG keys defined in key file "/etc/pki/rpm-gpg/RPM-GPG-KEY-amazon-linux-2023" by default. List Amazon Linux GPG keys installed on the system: $ sudo rpm -q gpg-pubkey --qf "%{NAME}-%{VERSION}-%{RELEASE} %{SUMMARY}\n" gpg-pubkey-d832c631-6515c85e Amazon Linux <amazon-linux@amazon.com> public key If there is no Amazon Linux GPG key installed, this is a finding. Extract the fingerprint from the key with this command: $ sudo gpg -q --keyid-format short --with-fingerprint /etc/pki/rpm-gpg/RPM-GPG-KEY-amazon-linux-2023 pub rsa4096/D832C631 2022-12-08 [SC] Key fingerprint = B21C 50FA 44A9 9720 EAA7 2F7F E951 904A D832 C631 uid Amazon Linux <amazon-linux@amazon.com> Compare the Key fingerprint with the key fingerprint from Amazon Documentation and instructions at https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/verify-keys.html If key fingerprints do not match, or the key file is missing, this is a finding.

Fix: F-77991r1119972_fix

Configure Amazon Linux 2023 to have the public key for verifying RPM packages to be installed with the "system-release" package. Install the system-release installation with the following command: $ sudo dnf install -y system-release Ensure cryptographic verification of software packages is enabled by editing /etc/dnf/dnf.conf and under '[main]' in the configuration file add: gpgcheck=1

c
Amazon Linux 2023 must check the GPG signature of locally installed software packages before installation.
- High - CCI-003992 - V-273996 - SV-273996r1119976_rule
RMF Control
Severity
High
CCI
CCI-003992
Version
AZLX-23-000115
Vuln IDs
  • V-273996
Rule IDs
  • SV-273996r1119976_rule
Changes to any software components can have significant effects on the overall security of Amazon Linux 2023. This requirement ensures the software has not been tampered with and that it has been provided by a trusted vendor. All software packages must be signed with a cryptographic key recognized and approved by the organization. Verifying the authenticity of software prior to installation validates the integrity of the software package received from a vendor. This verifies the software has not been tampered with and that it has been provided by a trusted vendor.
Checks: C-78087r1119974_chk

Verify Amazon Linux 2023 is configured so that dnf always checks the GPG signature of locally installed software packages before installation: $ grep localpkg_gpgcheck /etc/dnf/dnf.conf localpkg_gpgcheck=1 If "localpkg_gpgcheck" is not set to "1" or "True", or if the option is missing or commented out, ask the system administrator how the GPG signatures of local software packages are being verified. If there is no process to verify GPG signatures approved by the organization, this is a finding.

Fix: F-77992r1119975_fix

Configure Amazon Linux 2023 to always check the GPG signature of local software packages before installation. Add or update the following line in the [main] section of the /etc/dnf/dnf.conf file: localpkg_gpgcheck=1

c
Amazon Linux 2023 must check the GPG signature of software packages originating from external software repositories before installation.
- High - CCI-003992 - V-273997 - SV-273997r1119979_rule
RMF Control
Severity
High
CCI
CCI-003992
Version
AZLX-23-000120
Vuln IDs
  • V-273997
Rule IDs
  • SV-273997r1119979_rule
Changes to any software components can have significant effects on the overall security of Amazon Linux 2023. This requirement ensures the software has not been tampered with and that it has been provided by a trusted vendor. All software packages must be signed with a cryptographic key recognized and approved by the organization. Verifying the authenticity of software prior to installation validates the integrity of the software package received from a vendor. This verifies the software has not been tampered with and that it has been provided by a trusted vendor.
Checks: C-78088r1119977_chk

Verify Amazon Linux 2023 is configured so that dnf always checks the GPG signature of software packages originating from external software repositories before installation: $ grep -w gpgcheck /etc/dnf/dnf.conf gpgcheck=1 If "gpgcheck" is not set to "1" or "True", or if the option is missing or commented out, ask the system administrator how the GPG signatures of software packages are being verified. If there is no process to verify GPG signatures approved by the organization, this is a finding.

Fix: F-77993r1119978_fix

Configure Amazon Linux 2023 to always check the GPG signature of software packages originating from external software repositories before installation. Add or update the following line in the [main] section of the /etc/dnf/dnf.conf file: gpgcheck=1

c
Amazon Linux 2023 must have GPG signature verification enabled for all software repositories.
- High - CCI-003992 - V-273998 - SV-273998r1119982_rule
RMF Control
Severity
High
CCI
CCI-003992
Version
AZLX-23-000125
Vuln IDs
  • V-273998
Rule IDs
  • SV-273998r1119982_rule
Changes to any software components can have significant effects on the overall security of Amazon Linux 2023. This requirement ensures the software has not been tampered with and that it has been provided by a trusted vendor. All software packages must be signed with a cryptographic key recognized and approved by the organization. Verifying the authenticity of software prior to installation validates the integrity of the software package received from a vendor. This verifies the software has not been tampered with and that it has been provided by a trusted vendor.
Checks: C-78089r1119980_chk

Verify Amazon Linux 2023 software repositories enforce a signature check on the packages prior to allowing installation with the following command: $ grep -w gpgcheck /etc/yum.repos.d/*.repo | more /etc/yum.repos.d/amazonlinux.repo:gpgcheck=1 /etc/yum.repos.d/amazonlinux.repo:gpgcheck=1 /etc/yum.repos.d/amazonlinux.repo:gpgcheck=1 /etc/yum.repos.d/kernel-livepatch.repo:gpgcheck=1 /etc/yum.repos.d/kernel-livepatch.repo:gpgcheck=1 If any repository has "gpgcheck=0" or "False", or if the option is commented out, this is a finding.

Fix: F-77994r1119981_fix

Configure Amazon Linux 2023 to verify the signature of packages from a repository prior to installation by setting the following option in the "/etc/yum.repos.d/[your_repo_name].repo" file: gpgcheck=1

c
Amazon Linux 2023 must be a vendor-supported release.
SI-2 - High - CCI-002605 - V-273999 - SV-273999r1155171_rule
RMF Control
SI-2
Severity
High
CCI
CCI-002605
Version
AZLX-23-000130
Vuln IDs
  • V-273999
Rule IDs
  • SV-273999r1155171_rule
An operating system release is considered "supported" if the vendor continues to provide security patches for the product. With an unsupported release, it will not be possible to resolve security issues discovered in the system software. Amazon Linux 2023 (AL2023) was released in March 2023 and will be supported until June 30, 2029. Standard support ends June 30, 2027. Maintenance (security and critical fixes only) ends June 30, 2029. To check the support status and dates of individual packages, use the following command: $ sudo dnf supportinfo --pkg To get information on all currently installed packages, use: $ sudo dnf supportinfo --show installed
Checks: C-78090r1119983_chk

Verify Amazon Linux 2023 is a vendor-supported version with the following command: $ cat /etc/amazon-linux-release Amazon Linux release 2023.6.20250203 (Amazon Linux) If the installed version of Amazon Linux 2023 is not supported, this is a finding.

Fix: F-77995r1119984_fix

Configure Amazon Linux 2023 to be a vendor supported release. Upgrade to a supported version of Amazon Linux 2023.

b
Amazon Linux 2023 systemd-journald service must be enabled.
SC-24 - Medium - CCI-001665 - V-274000 - SV-274000r1119988_rule
RMF Control
SC-24
Severity
Medium
CCI
CCI-001665
Version
AZLX-23-000135
Vuln IDs
  • V-274000
Rule IDs
  • SV-274000r1119988_rule
Failure to a known state can address safety or security in accordance with the mission/business needs of the organization. Failure to a known secure state helps prevent a loss of confidentiality, integrity, or availability in the event of a failure of the information system or a component of the system. Preserving operating system state information helps to facilitate operating system restart and return to the operational mode of the organization with least disruption to mission/business processes.
Checks: C-78091r1119986_chk

Verify Amazon Linux 2023 is configured so that "systemd-journald" is active with the following command: $ systemctl is-active systemd-journald active If the systemd-journald service is not active, this is a finding.

Fix: F-77996r1119987_fix

Configure Amazon Linux 2023 to enable the systemd-journald service with the following command: $ sudo systemctl enable --now systemd-journald

b
Amazon Linux 2023 must restrict access to the kernel message buffer.
SC-2 - Medium - CCI-001082 - V-274001 - SV-274001r1119991_rule
RMF Control
SC-2
Severity
Medium
CCI
CCI-001082
Version
AZLX-23-000200
Vuln IDs
  • V-274001
Rule IDs
  • SV-274001r1119991_rule
Preventing unauthorized information transfers mitigates the risk of information, including encrypted representations of information, produced by the actions of prior users/roles (or the actions of processes acting on behalf of prior users/roles) from being available to any current users/roles (or current processes) that obtain access to shared system resources (e.g., registers, main memory, hard disks) after those resources have been released back to information systems. The control of information in shared resources is also commonly referred to as object reuse and residual information protection. This requirement generally applies to the design of an information technology product, but it can also apply to the configuration of particular information system components that are, or use, such products. This can be verified by acceptance/validation processes in DOD or other government agencies. There may be shared resources with configurable protections (e.g., files in storage) that may be assessed on specific information system components. Restricting access to the kernel message buffer limits access to only root. This prevents attackers from gaining additional system information as a nonprivileged user. Satisfies: SRG-OS-000132-GPOS-00067, SRG-OS-000138-GPOS-00069
Checks: C-78092r1119989_chk

Verify Amazon Linux 2023 is configured to restrict access to the kernel message buffer with the following commands: Check the status of the kernel.dmesg_restrict kernel parameter. $ sudo sysctl kernel.dmesg_restrict kernel.dmesg_restrict = 1 If "kernel.dmesg_restrict" is not set to "1" or is missing, this is a finding.

Fix: F-77997r1119990_fix

Configure Amazon Linux 2023 to restrict access to the kernel message buffer. Add or edit the following line in a system configuration file, in the "/etc/sysctl.d/" directory: kernel.dmesg_restrict = 1 Load settings from all system configuration files with the following command: $ sudo sysctl --system

b
Amazon Linux 2023 must prevent kernel profiling by nonprivileged users.
SC-2 - Medium - CCI-001082 - V-274002 - SV-274002r1119994_rule
RMF Control
SC-2
Severity
Medium
CCI
CCI-001082
Version
AZLX-23-000205
Vuln IDs
  • V-274002
Rule IDs
  • SV-274002r1119994_rule
Preventing unauthorized information transfers mitigates the risk of information, including encrypted representations of information, produced by the actions of prior users/roles (or the actions of processes acting on behalf of prior users/roles) from being available to any current users/roles (or current processes) that obtain access to shared system resources (e.g., registers, main memory, hard disks) after those resources have been released back to information systems. The control of information in shared resources is also commonly referred to as object reuse and residual information protection. This requirement generally applies to the design of an information technology product, but it can also apply to the configuration of particular information system components that are, or use, such products. This can be verified by acceptance/validation processes in DOD or other government agencies. There may be shared resources with configurable protections (e.g., files in storage) that may be assessed on specific information system components. Setting the kernel.perf_event_paranoid kernel parameter to "2" prevents attackers from gaining additional system information as a nonprivileged user. Satisfies: SRG-OS-000132-GPOS-00067, SRG-OS-000138-GPOS-00069
Checks: C-78093r1119992_chk

Verify Amazon Linux 2023 is configured to prevent kernel profiling by nonprivileged users with the following commands: Check the status of the kernel.perf_event_paranoid kernel parameter. $ sudo sysctl kernel.perf_event_paranoid kernel.perf_event_paranoid = 2 If "kernel.perf_event_paranoid" is not set to "2" or is missing, this is a finding.

Fix: F-77998r1119993_fix

Configure Amazon Linux 2023 to prevent kernel profiling by nonprivileged users. Add or edit the following line in a system configuration file, in the "/etc/sysctl.d/" directory: kernel.perf_event_paranoid = 2 Load settings from all system configuration files with the following command: $ sudo sysctl --system

b
Amazon Linux 2023 must restrict exposed kernel pointer addresses access.
SC-2 - Medium - CCI-001082 - V-274003 - SV-274003r1119997_rule
RMF Control
SC-2
Severity
Medium
CCI
CCI-001082
Version
AZLX-23-000210
Vuln IDs
  • V-274003
Rule IDs
  • SV-274003r1119997_rule
Exposing kernel pointers (through procfs or "seq_printf()") exposes kernel writeable structures, which may contain functions pointers. If a write vulnerability occurs in the kernel, allowing write access to any of this structure, the kernel can be compromised. This option disallows any program without the CAP_SYSLOG capability to get the addresses of kernel pointers by replacing them with "0". Satisfies: SRG-OS-000132-GPOS-00067, SRG-OS-000433-GPOS-00192
Checks: C-78094r1119995_chk

Verify Amazon Linux 2023 restricts exposed kernel pointer addresses access by validating the runtime status of the Amazon Linux 2023 kernel.kptr_restrict kernel parameter with the following command: $ sudo sysctl kernel.kptr_restrict kernel.kptr_restrict = 1 If "kernel.kptr_restrict" is not set to "1" or is missing, this is a finding.

Fix: F-77999r1119996_fix

Configure Amazon Linux 2023 to restrict exposed kernel pointer addresses access. Add or edit the following line in a system configuration file in the "/etc/sysctl.d/" directory: kernel.kptr_restrict = 1 Reload settings from all system configuration files with the following command: $ sudo sysctl --system

b
Amazon Linux 2023 must disable access to network bpf system call from nonprivileged processes.
SC-2 - Medium - CCI-001082 - V-274004 - SV-274004r1120000_rule
RMF Control
SC-2
Severity
Medium
CCI
CCI-001082
Version
AZLX-23-000215
Vuln IDs
  • V-274004
Rule IDs
  • SV-274004r1120000_rule
Loading and accessing the packet filters programs and maps using the bpf() system call has the potential of revealing sensitive information about the kernel state.
Checks: C-78095r1119998_chk

Verify Amazon Linux 2023 prevents privilege escalation through the kernel by disabling access to the bpf system call with the following commands: $ sudo sysctl kernel.unprivileged_bpf_disabled kernel.unprivileged_bpf_disabled = 1 If the returned line does not have a value of "1", or a line is not returned, this is a finding.

Fix: F-78000r1119999_fix

Configure Amazon Linux 2023 to prevent privilege escalation through the kernel by disabling access to the bpf syscall by adding the following line to a file, in the "/etc/sysctl.d" directory: kernel.unprivileged_bpf_disabled = 1 The system configuration files must be reloaded for the changes to take effect. To reload the contents of the files, run the following command: $ sudo sysctl --system

b
Amazon Linux 2023 must restrict usage of ptrace to descendant processes.
SC-2 - Medium - CCI-001082 - V-274005 - SV-274005r1120003_rule
RMF Control
SC-2
Severity
Medium
CCI
CCI-001082
Version
AZLX-23-000220
Vuln IDs
  • V-274005
Rule IDs
  • SV-274005r1120003_rule
Unrestricted usage of ptrace allows compromised binaries to run ptrace on other processes of the user. Like this, the attacker can steal sensitive information from the target processes (e.g., SSH sessions, web browser, etc.) without any additional assistance from the user (i.e., without resorting to phishing).
Checks: C-78096r1120001_chk

Verify Amazon Linux 2023 restricts usage of ptrace to descendant processes with the following commands: $ sudo sysctl kernel.yama.ptrace_scope kernel.yama.ptrace_scope = 1 If the returned line does not have a value of "1", or a line is not returned, this is a finding.

Fix: F-78001r1120002_fix

Configure Amazon Linux 2023 to restrict usage of ptrace to descendant processes by adding the following line to a file, in the "/etc/sysctl.d" directory: kernel.yama.ptrace_scope = 1 The system configuration files need to be reloaded for the changes to take effect. To reload the contents of the files, run the following command: $ sudo sysctl --system

b
Amazon Linux 2023 must implement address space layout randomization (ASLR) to protect its memory from unauthorized code execution.
SI-16 - Medium - CCI-002824 - V-274006 - SV-274006r1120006_rule
RMF Control
SI-16
Severity
Medium
CCI
CCI-002824
Version
AZLX-23-000225
Vuln IDs
  • V-274006
Rule IDs
  • SV-274006r1120006_rule
ASLR makes it more difficult for an attacker to predict the location of attack code they have introduced into a process' address space during an attempt at exploitation. Additionally, ASLR makes it more difficult for an attacker to know the location of existing code to repurpose it using return oriented programming (ROP) techniques.
Checks: C-78097r1120004_chk

Verify Amazon Linux 2023 is implementing ASLR with the following command: $ sysctl kernel.randomize_va_space kernel.randomize_va_space = 2 Check that the configuration files are present to enable this kernel parameter. Verify the configuration of the kernel.kptr_restrict kernel parameter with the following command: $ sudo /usr/lib/systemd/systemd-sysctl --cat-config | egrep -v '^(#|;)' | grep -F kernel.randomize_va_space | tail -1 kernel.randomize_va_space = 2 If "kernel.randomize_va_space" is not set to "2" or is missing, this is a finding.

Fix: F-78002r1120005_fix

Configure Amazon Linux 2023 to enable ASLR to enhance memory protection. Enable ASLR by setting the kernel parameter with the following command: echo 2 | sudo tee /proc/sys/kernel/randomize_va_space Add or edit the following line in a system configuration file in the "/etc/sysctl.d/" directory: kernel.randomize_va_space = 2 Reload settings from all system configuration files with the following command: $ sudo sysctl --system

c
Amazon Linux 2023 must not have the vsftpd package installed.
IA-5 - High - CCI-000197 - V-274007 - SV-274007r1120009_rule
RMF Control
IA-5
Severity
High
CCI
CCI-000197
Version
AZLX-23-000300
Vuln IDs
  • V-274007
Rule IDs
  • SV-274007r1120009_rule
It is detrimental for operating systems to provide, or install by default, functionality exceeding requirements or mission objectives. These unnecessary capabilities or services are often overlooked and therefore, may remain unsecured. They increase the risk to the platform by providing additional attack vectors. Operating systems are capable of providing a variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). Examples of nonessential capabilities include, but are not limited to, games, software packages, tools, and demonstration software, not related to requirements or providing a wide array of functionality not required for every mission, but which cannot be disabled. Satisfies: SRG-OS-000074-GPOS-00042, SRG-OS-000095-GPOS-00049
Checks: C-78098r1120007_chk

Verify Amazon Linux 2023 does not have the vsftpd package installed with the following command: $ dnf list --installed vsftpd Error: No matching Packages to list If the "vsftpd" package is installed, this is a finding.

Fix: F-78003r1120008_fix

Configure Amazon Linux 2023 to not have the vsftpd package installed with the following command: $ sudo dnf -y remove vsftpd

b
Amazon Linux 2023 must not have the sendmail package installed.
CM-7 - Medium - CCI-000381 - V-274008 - SV-274008r1120012_rule
RMF Control
CM-7
Severity
Medium
CCI
CCI-000381
Version
AZLX-23-000305
Vuln IDs
  • V-274008
Rule IDs
  • SV-274008r1120012_rule
It is detrimental for operating systems to provide, or install by default, functionality exceeding requirements or mission objectives. These unnecessary capabilities or services are often overlooked and therefore, may remain unsecured. They increase the risk to the platform by providing additional attack vectors. Operating systems are capable of providing a variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). Examples of nonessential capabilities include, but are not limited to, games, software packages, tools, and demonstration software, not related to requirements or providing a wide array of functionality not required for every mission, but which cannot be disabled.
Checks: C-78099r1120010_chk

Verify Amazon Linux 2023 does not have the sendmail package installed with the following command: $ dnf list --installed sendmail Error: No matching Packages to list If the "sendmail" package is installed, this is a finding.

Fix: F-78004r1120011_fix

Configure Amazon Linux 2023 to not have the sendmail package installed with the following command: $ sudo dnf -y remove sendmail

b
Amazon Linux 2023 must not have the nfs-utils package installed.
CM-7 - Medium - CCI-000381 - V-274009 - SV-274009r1120015_rule
RMF Control
CM-7
Severity
Medium
CCI
CCI-000381
Version
AZLX-23-000310
Vuln IDs
  • V-274009
Rule IDs
  • SV-274009r1120015_rule
It is detrimental for operating systems to provide, or install by default, functionality exceeding requirements or mission objectives. These unnecessary capabilities or services are often overlooked and therefore, may remain unsecured. They increase the risk to the platform by providing additional attack vectors. Operating systems are capable of providing a variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). Examples of nonessential capabilities include, but are not limited to, games, software packages, tools, and demonstration software, not related to requirements or providing a wide array of functionality not required for every mission, but which cannot be disabled.
Checks: C-78100r1120013_chk

Verify Amazon Linux 2023 does not have the nfs-utils package installed with the following command: $ dnf list --installed nfs-utils Error: No matching Packages to list If the "nfs-utils" package is installed, this is a finding.

Fix: F-78005r1120014_fix

Configure Amazon Linux 2023 to not have the nfs-utils package installed with the following command: $ sudo dnf -y remove nfs-utils

b
Amazon Linux 2023 must not have the telnet-server package installed.
CM-7 - Medium - CCI-000381 - V-274010 - SV-274010r1120018_rule
RMF Control
CM-7
Severity
Medium
CCI
CCI-000381
Version
AZLX-23-000315
Vuln IDs
  • V-274010
Rule IDs
  • SV-274010r1120018_rule
It is detrimental for operating systems to provide, or install by default, functionality exceeding requirements or mission objectives. These unnecessary capabilities or services are often overlooked and therefore, may remain unsecured. They increase the risk to the platform by providing additional attack vectors. Operating systems are capable of providing a variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). Examples of nonessential capabilities include, but are not limited to, games, software packages, tools, and demonstration software, not related to requirements or providing a wide array of functionality not required for every mission, but which cannot be disabled.
Checks: C-78101r1120016_chk

Verify Amazon Linux 2023 does not have the telnet-server package installed with the following command: $ dnf list --installed telnet-server Error: No matching Packages to list If the "telnet-server" package is installed, this is a finding.

Fix: F-78006r1120017_fix

Configure Amazon Linux 2023 to not have the telnet-server package installed with the following command: $ sudo dnf -y remove telnet-server

b
Amazon Linux 2023 must not have the gssproxy package installed.
CM-7 - Medium - CCI-000381 - V-274011 - SV-274011r1120021_rule
RMF Control
CM-7
Severity
Medium
CCI
CCI-000381
Version
AZLX-23-000320
Vuln IDs
  • V-274011
Rule IDs
  • SV-274011r1120021_rule
It is detrimental for operating systems to provide, or install by default, functionality exceeding requirements or mission objectives. These unnecessary capabilities or services are often overlooked and therefore may remain unsecured. They increase the risk to the platform by providing additional attack vectors. Operating systems are capable of providing a variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). Examples of nonessential capabilities include, but are not limited to, games, software packages, tools, and demonstration software, not related to requirements or providing a wide array of functionality not required for every mission, but which cannot be disabled.
Checks: C-78102r1120019_chk

Verify Amazon Linux 2023 does not have the gssproxy package installed with the following command: $ dnf list --installed gssproxy Error: No matching Packages to list If the "gssproxy" package is installed, this is a finding.

Fix: F-78007r1120020_fix

Configure Amazon Linux 2023 to not have the gssproxy package installed. The gssproxy package can be removed with the following command: $ sudo dnf -y remove gssproxy

b
Amazon Linux 2023 must have the sudo package installed.
AC-6 - Medium - CCI-002235 - V-274012 - SV-274012r1120710_rule
RMF Control
AC-6
Severity
Medium
CCI
CCI-002235
Version
AZLX-23-001000
Vuln IDs
  • V-274012
Rule IDs
  • SV-274012r1120710_rule
The "sudo" program is designed to allow a system administrator to give limited root privileges to users and log root activity. The basic philosophy is to give as few privileges as possible but still allow system users to get their work done.
Checks: C-78103r1120709_chk

Verify Amazon Linux 2023 has the sudo package installed with the following command: $ dnf list --installed sudo Installed Packages sudo.x86_64 1.9.15-1.p5.amzn2023.0.1 @System If the "sudo" package is not installed, this is a finding.

Fix: F-78008r1120023_fix

Configure Amazon Linux 2023 to have the sudo package installed with the following command: $ sudo dnf install -y sudo

b
Amazon Linux 2023 must not be configured to bypass password requirements for privilege escalation.
AC-3 - Medium - CCI-002165 - V-274013 - SV-274013r1120027_rule
RMF Control
AC-3
Severity
Medium
CCI
CCI-002165
Version
AZLX-23-001005
Vuln IDs
  • V-274013
Rule IDs
  • SV-274013r1120027_rule
Without reauthentication, users may access resources or perform tasks for which they do not have authorization. When operating systems provide the capability to escalate a functional capability, it is critical the user reauthenticate.
Checks: C-78104r1120025_chk

Verify Amazon Linux 2023 is not configured to bypass password requirements for privilege escalation with the following command: $ sudo grep pam_succeed_if /etc/pam.d/sudo If any occurrences of "pam_succeed_if" are returned, this is a finding.

Fix: F-78009r1120026_fix

Configure Amazon Linux 2023 to require users to supply a password for privilege escalation. Remove any occurrences of "pam_succeed_if " in the "/etc/pam.d/sudo" file.

b
Amazon Linux 2023 must require reauthentication when using the "sudo" command.
IA-11 - Medium - CCI-002038 - V-274014 - SV-274014r1120030_rule
RMF Control
IA-11
Severity
Medium
CCI
CCI-002038
Version
AZLX-23-001010
Vuln IDs
  • V-274014
Rule IDs
  • SV-274014r1120030_rule
Without reauthentication, users may access resources or perform tasks for which they do not have authorization.
Checks: C-78105r1120028_chk

Verify Amazon Linux 2023 requires reauthentication when using the "sudo" command to elevate privileges with the following command: $ sudo grep -ir 'timestamp_timeout' /etc/sudoers /etc/sudoers.d/ /etc/sudoers:Defaults timestamp_timeout=0 If results are returned from more than one file location, this is a finding. If "timestamp_timeout" is set to a negative number, is commented out, or no results are returned, this is a finding.

Fix: F-78010r1120029_fix

Configure Amazon Linux 2023 to reauthenticate "sudo" commands after the specified timeout: Add the following line to "/etc/sudoers" or a file in "/etc/sudoers.d": Defaults timestamp_timeout=0

b
Amazon Linux 2023 must require users to reauthenticate for privilege escalation.
IA-11 - Medium - CCI-002038 - V-274015 - SV-274015r1120033_rule
RMF Control
IA-11
Severity
Medium
CCI
CCI-002038
Version
AZLX-23-001015
Vuln IDs
  • V-274015
Rule IDs
  • SV-274015r1120033_rule
Without reauthentication, users may access resources or perform tasks for which they do not have authorization.
Checks: C-78106r1120031_chk

Verify Amazon Linux 2023 requires users to reauthenticate for privilege escalation. Ensure that "/etc/sudoers" has no occurrences of "!authenticate" with the following command: $ sudo grep -ir '!authenticate' /etc/sudoers /etc/sudoers.d/ If any occurrences of "!authenticate" are returned, this is a finding.

Fix: F-78011r1120032_fix

Configure Amazon Linux 2023 to not allow users to execute privileged actions without authenticating. Remove any occurrence of "!authenticate" found in "/etc/sudoers" file or files in the "/etc/sudoers.d" directory. $ sudo sed -i '/\!authenticate/ s/^/# /g' /etc/sudoers /etc/sudoers.d/*

b
Amazon Linux 2023 must require users to provide a password for privilege escalation.
CM-6 - Medium - CCI-000366 - V-274016 - SV-274016r1120036_rule
RMF Control
CM-6
Severity
Medium
CCI
CCI-000366
Version
AZLX-23-001020
Vuln IDs
  • V-274016
Rule IDs
  • SV-274016r1120036_rule
Without reauthentication, users may access resources or perform tasks for which they do not have authorization.
Checks: C-78107r1120034_chk

Verify Amazon Linux 2023 requires users to provide a password for privilege escalation. Ensure that "/etc/sudoers" has no occurrences of "NOPASSWD" with the following command: $ sudo grep -ri nopasswd /etc/sudoers /etc/sudoers.d/ If any occurrences of "NOPASSWD" are returned, this is a finding.

Fix: F-78012r1120035_fix

Configure Amazon Linux 2023 to not allow users to execute privileged actions without authenticating with a password. Remove any occurrence of "NOPASSWD" found in "/etc/sudoers" file or files in the "/etc/sudoers.d" directory. $ sudo sed -i '/NOPASSWD/ s/^/# /g' /etc/sudoers /etc/sudoers.d/*

b
Amazon Linux 2023 must have the audit package installed.
AU-12 - Medium - CCI-000169 - V-274017 - SV-274017r1120039_rule
RMF Control
AU-12
Severity
Medium
CCI
CCI-000169
Version
AZLX-23-001025
Vuln IDs
  • V-274017
Rule IDs
  • SV-274017r1120039_rule
Successful incident response and auditing relies on timely, accurate system information and analysis to allow the organization to identify and respond to potential incidents in a proficient manner. If Amazon Linux 2023 does not provide the ability to centrally review Amazon Linux 2023 logs, forensic analysis is negatively impacted. Segregation of logging data to multiple disparate computer systems is counterproductive and makes log analysis and log event alarming difficult to implement and manage, particularly when the system has multiple logging components writing to different locations or systems. To support the centralized capability, Amazon Linux 2023 must be able to provide the information in a format that can be extracted and used, allowing the application performing the centralization of the log records to meet this requirement. Satisfies: SRG-OS-000062-GPOS-00031, SRG-OS-000042-GPOS-00021, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SRG-OS-000055-GPOS-00026
Checks: C-78108r1120037_chk

Verify Amazon Linux 2023 has the audit package installed with the following command: $ dnf list --installed audit Installed Packages audit.x86_64 3.0.6-1.amzn2023.0.2 @System If the "audit" package is not installed, this is a finding.

Fix: F-78013r1120038_fix

Configure Amazon Linux 2023 so that the audit service to produce audit records containing the information needed to establish when (date and time) an event occurred. Install the audit service (if the audit service is not already installed) with the following command: $ sudo dnf install -y audit

b
Amazon Linux 2023 must produce audit records containing information to establish what type of events occurred.
AU-3 - Medium - CCI-000130 - V-274018 - SV-274018r1120042_rule
RMF Control
AU-3
Severity
Medium
CCI
CCI-000130
Version
AZLX-23-001030
Vuln IDs
  • V-274018
Rule IDs
  • SV-274018r1120042_rule
Without establishing what type of events occurred, it would be difficult to establish, correlate, and investigate the events leading up to an outage or attack. Audit record content that may be necessary to satisfy this requirement includes, for example, time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, filenames involved, and access control or flow control rules invoked. Associating event types with detected events in Amazon Linux 2023 audit logs provides a means of investigating an attack; recognizing resource utilization or capacity thresholds; or identifying an improperly configured operating system. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000062-GPOS-00031, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SRG-OS-000755-GPOS-00220
Checks: C-78109r1120040_chk

Verify Amazon Linux 2023 is configured to produce audit records with the following command: $ sudo systemctl status auditd.service auditd.service - Security Auditing Service Loaded:loaded (/usr/lib/systemd/system/auditd.service; enabled; preset: enabled) Active: active (running) since Wed 2024-01-131 12:56:56 EST; 1 weeks 0 days ago If the audit service is not "active" and "running", this is a finding.

Fix: F-78014r1120041_fix

Configure Amazon Linux 2023 so that the audit service to produce audit records containing the information needed to establish when an event occurred with the following commands: $ sudo systemctl enable auditd.service $ sudo systemctl start auditd.service

b
Amazon Linux 2023 audispd-plugins package must be installed.
AU-4 - Medium - CCI-001851 - V-274019 - SV-274019r1120045_rule
RMF Control
AU-4
Severity
Medium
CCI
CCI-001851
Version
AZLX-23-001035
Vuln IDs
  • V-274019
Rule IDs
  • SV-274019r1120045_rule
The "audispd-plugins" package provides plugins for the real-time interface to the audit subsystem, "audispd". These plugins can, for example, relay events to remote machines or analyze events for suspicious behavior.
Checks: C-78110r1120043_chk

Verify Amazon Linux 2023 has the audispd-plugins package installed with the following command: $ sudo dnf list --installed audispd-plugins Installed Packages audispd-plugins.x86_64 3.0.6-1.amzn2023.0.2 @amazonlinux If the "audispd-plugins" package is not installed, this is a finding.

Fix: F-78015r1120044_fix

Configure Amazon Linux 2023 to have the audispd-plugins package installed. Install the audispd-plugins package with the following command: $ sudo dnf install -y audispd-plugins

b
Amazon Linux 2023 must have the rsyslog package installed.
AU-6 - Medium - CCI-000154 - V-274020 - SV-274020r1155173_rule
RMF Control
AU-6
Severity
Medium
CCI
CCI-000154
Version
AZLX-23-001040
Vuln IDs
  • V-274020
Rule IDs
  • SV-274020r1155173_rule
Successful incident response and auditing relies on timely, accurate system information and analysis allow the organization to identify and respond to potential incidents in a proficient manner. If Amazon Linux 2023 does not provide the ability to centrally review Amazon Linux 2023 logs, forensic analysis is negatively impacted. Segregation of logging data to multiple disparate computer systems is counterproductive and makes log analysis and log event alarming difficult to implement and manage, particularly when the system has multiple logging components writing to different locations or systems. To support the centralized capability, Amazon Linux 2023 must be able to provide the information in a format that can be extracted and used, allowing the application performing the centralization of the log records to meet this requirement. Satisfies: SRG-OS-000051-GPOS-00024, SRG-OS-000479-GPOS-00224
Checks: C-78111r1155172_chk

Verify Amazon Linux 2023 is configured to collect system failure events with the following command: $ dnf list --installed rsyslog Installed Packages rsyslog.x86_64 8.2204.0-3.amzn2023.0.4 @amazonlinux If the "rsyslog" package is not installed, this is a finding. Check that the log service is enabled with the following command: systemctl is-enabled rsyslog enabled If the command above returns "disabled", this is a finding.

Fix: F-78016r1120047_fix

Configure Amazon Linux 2023 to monitor all remote access methods by installing rsyslog with the following command: $ sudo dnf install -y rsyslog Enable the log service with the following command: $ sudo systemctl enable --now rsyslog

b
Amazon Linux 2023 must monitor remote access methods.
AC-17 - Medium - CCI-000067 - V-274021 - SV-274021r1120695_rule
RMF Control
AC-17
Severity
Medium
CCI
CCI-000067
Version
AZLX-23-001045
Vuln IDs
  • V-274021
Rule IDs
  • SV-274021r1120695_rule
Remote access services, such as those providing remote access to network devices and information systems, which lack automated monitoring capabilities, increase risk and make remote user access management difficult at best.
Checks: C-78112r1120049_chk

Verify Amazon Linux 2023 monitors all remote access methods. Check that remote access methods are being logged by running the following command: $ sudo grep -E '(auth.*|authpriv.*|daemon.*)' /etc/rsyslog.conf auth.*;authpriv.*;daemon.* /var/log/secure If "auth.*", "authpriv.*", or "daemon.*" are not configured to be logged, this is a finding.

Fix: F-78017r1120050_fix

Configure Amazon Linux 2023 to monitor all remote access methods by installing rsyslog with the following command: $ sudo yum install rsyslog Then add or update the following lines to the "/etc/rsyslog.conf" file: auth.*;authpriv.*;daemon.* /var/log/secure The "rsyslog" service must be restarted for the changes to take effect. To restart the "rsyslog" service, run the following command: $ sudo systemctl restart rsyslog.service

b
Amazon Linux 2023 must have the chrony package installed.
- Medium - CCI-004923 - V-274022 - SV-274022r1120054_rule
RMF Control
Severity
Medium
CCI
CCI-004923
Version
AZLX-23-001050
Vuln IDs
  • V-274022
Rule IDs
  • SV-274022r1120054_rule
Inaccurate time stamps make it more difficult to correlate events and can lead to an inaccurate analysis. Determining the correct time a particular event occurred on a system is critical when conducting forensic analysis and investigating system events. Sources outside the configured acceptable allowance (drift) may be inaccurate.
Checks: C-78113r1120052_chk

Verify Amazon Linux 2023 has the chrony package installed with the following command: $ sudo dnf list --installed chrony Installed Packages chrony.x86_64 4.3-1.amzn2023.0.5 @System If the "chrony" package is not installed, this is a finding.

Fix: F-78018r1120053_fix

Configure Amazon Linux 2023 to have the chrony package installed. The chrony package can be installed with the following command: $ sudo dnf install -y chrony

b
Amazon Linux 2023 chronyd service must be enabled.
- Medium - CCI-004923 - V-274023 - SV-274023r1120057_rule
RMF Control
Severity
Medium
CCI
CCI-004923
Version
AZLX-23-001055
Vuln IDs
  • V-274023
Rule IDs
  • SV-274023r1120057_rule
Inaccurate time stamps make it more difficult to correlate events and can lead to an inaccurate analysis. Determining the correct time a particular event occurred on a system is critical when conducting forensic analysis and investigating system events. Sources outside the configured acceptable allowance (drift) may be inaccurate.
Checks: C-78114r1120055_chk

Verify Amazon Linux 2023 has the chronyd service set to active with the following command: $ systemctl is-active chronyd active If the chronyd service is not active, this is a finding.

Fix: F-78019r1120056_fix

Configure Amazon Linux 2023 to have the chronyd service set to active with the following command: $ sudo systemctl enable --now chronyd

b
Amazon Linux 2023 must have the Advanced Intrusion Detection Environment (AIDE) package installed.
CM-3 - Medium - CCI-001744 - V-274024 - SV-274024r1120060_rule
RMF Control
CM-3
Severity
Medium
CCI
CCI-001744
Version
AZLX-23-001060
Vuln IDs
  • V-274024
Rule IDs
  • SV-274024r1120060_rule
Without verification of the security functions, security functions may not operate correctly, and the failure may go unnoticed. Security function is defined as the hardware, software, and/or firmware of the information system responsible for enforcing the system security policy and supporting the isolation of code and data on which the protection is based. Security functionality includes, but is not limited to, establishing system accounts, configuring access authorizations (i.e., permissions, privileges), setting events to be audited, and setting intrusion detection parameters. Satisfies: SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199, SRG-OS-000358-GPOS-00145
Checks: C-78115r1120058_chk

Verify Amazon Linux 2023 has the AIDE package installed with the following command: $ dnf list --installed aide Installed Packages aide.x86_64 0.18.6-1.amzn2023.0.1 @amazonlinux If AIDE is not installed, ask the system administrator (SA) how file integrity checks are performed on the system. If there is no application installed to perform integrity checks, this is a finding. If AIDE is installed, check if it has been initialized with the following command: $ sudo /usr/sbin/aide --check If the output is "Couldn't open file /var/lib/aide/aide.db.gz for reading", this is a finding.

Fix: F-78020r1120059_fix

Configure Amazon Linux 2023 to have the AIDE package installed. Install AIDE with the following commands: Install AIDE: $ sudo dnf install -y aide Initialize AIDE: $ sudo /usr/sbin/aide --init sudo mv /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz Perform a manual check: $ sudo /usr/sbin/aide --check Example output: 2023-06-05 10:16:08 -0600 (AIDE 0.16) AIDE found NO differences between database and filesystem. Looks okay!!

b
Amazon Linux 2023 must routinely check the baseline configuration for unauthorized changes and notify the system administrator when anomalies in the operation of any security functions are discovered.
CM-3 - Medium - CCI-001744 - V-274025 - SV-274025r1120723_rule
RMF Control
CM-3
Severity
Medium
CCI
CCI-001744
Version
AZLX-23-001065
Vuln IDs
  • V-274025
Rule IDs
  • SV-274025r1120723_rule
Unauthorized changes to the baseline configuration could make the system vulnerable to various attacks or allow unauthorized access to Amazon Linux 2023. Changes to operating system configurations can have unintended side effects, some of which may be relevant to security. Detecting such changes and providing an automated response can help avoid unintended, negative consequences that could ultimately affect the security state of Amazon Linux 2023. Amazon Linux 2023's information management officer (IMO)/information system security officer (ISSO) and system administrators (SAs) must be notified via email and/or monitoring system trap when there is an unauthorized modification of a configuration item. Notifications provided by information systems include messages to local computer consoles, and/or hardware indications, such as lights. This capability must take into account operational requirements for availability for selecting an appropriate response. The organization may choose to shut down or restart the information system upon security function anomaly detection. Satisfies: SRG-OS-000363-GPOS-00150, SRG-OS-000446-GPOS-00200, SRG-OS-000447-GPOS-00201
Checks: C-78116r1120061_chk

Verify Amazon Linux 2023 routinely executes a file integrity scan for changes to the system baseline. The commands used in the example will use a daily occurrence. Check the cron directories for scripts controlling the execution and notification of results of the file integrity application. For example, if Advanced Intrusion Detection Environment (AIDE) is installed on the system, use the following commands: $ ls -al /etc/cron.daily | grep aide -rwxr-xr-x 1 root root 29 Nov 22 2015 aide $ sudo grep aide /etc/crontab /var/spool/cron/root /etc/crontab: 30 04 * * * root usr/sbin/aide /var/spool/cron/root: 30 04 * * * root usr/sbin/aide $ sudo more /etc/cron.daily/aide #!/bin/bash /usr/sbin/aide --check | /bin/mail -s "$HOSTNAME - Daily aide integrity check run" root@sysname.mil If the file integrity application does not exist, or a script file controlling the execution of the file integrity application does not exist, or the file integrity application does not notify designated personnel of changes, this is a finding.

Fix: F-78021r1120722_fix

Configure Amazon Linux 2023 so that the file integrity tool runs automatically on the system at least weekly and notifies designated personnel if baseline configurations are changed in an unauthorized manner. The AIDE tool can be configured to email designated personnel with the use of the cron system. The following example output is generic. It will set cron to run AIDE daily and to send email at the completion of the analysis. $ sudo more /etc/cron.daily/aide #!/bin/bash /usr/sbin/aide --check | /bin/mail -s "$HOSTNAME - Daily aide integrity check run" root@sysname.mil

b
Amazon Linux 2023 must use cryptographic mechanisms to protect the integrity of audit tools.
AU-9 - Medium - CCI-001493 - V-274026 - SV-274026r1120066_rule
RMF Control
AU-9
Severity
Medium
CCI
CCI-001493
Version
AZLX-23-001070
Vuln IDs
  • V-274026
Rule IDs
  • SV-274026r1120066_rule
Protecting the integrity of the tools used for auditing purposes is a critical step toward ensuring the integrity of audit information. Audit information includes all information (e.g., audit records, audit settings, and audit reports) needed to successfully audit information system activity. Audit tools include, but are not limited to, vendor-provided and open-source audit tools needed to successfully view and manipulate audit information system activity and records. Audit tools include custom queries and report generators. It is not uncommon for attackers to replace the audit tools or inject code into the existing tools to provide the capability to hide or erase system activity from the audit logs. To address this risk, audit tools must be cryptographically signed to provide the capability to identify when the audit tools have been modified, manipulated, or replaced. An example is a checksum hash of the file or files. Satisfies: SRG-OS-000256-GPOS-00097, SRG-OS-000257-GPOS-00098, SRG-OS-000258-GPOS-00099, SRG-OS-000278-GPOS-00108
Checks: C-78117r1120064_chk

Verify Amazon Linux 2023 is properly configured to protect the integrity of the Advanced Intrusion Detection Environment (AIDE) audit tools with the following command: $ sudo grep /usr/sbin/au /etc/aide.conf /usr/sbin/auditctl p+i+n+u+g+s+b+acl+xattrs+sha512 /usr/sbin/auditd p+i+n+u+g+s+b+acl+xattrs+sha512 /usr/sbin/ausearch p+i+n+u+g+s+b+acl+xattrs+sha512 /usr/sbin/aureport p+i+n+u+g+s+b+acl+xattrs+sha512 /usr/sbin/autrace p+i+n+u+g+s+b+acl+xattrs+sha512 /usr/sbin/augenrules p+i+n+u+g+s+b+acl+xattrs+sha512 If AIDE is not installed, ask the system administrator (SA) how file integrity checks are performed on the system. If any of the audit tools listed above do not have a corresponding line, ask the SA to indicate what cryptographic mechanisms are being used to protect the integrity of the audit tools. If there is no evidence of integrity protection, this is a finding.

Fix: F-78022r1120065_fix

Configure Amazon Linux 2023 to protect the integrity of the AIDE audit tools. Add or update the following lines to "/etc/aide.conf", to protect the integrity of the audit tools. /usr/sbin/auditctl p+i+n+u+g+s+b+acl+xattrs+sha512 /usr/sbin/auditd p+i+n+u+g+s+b+acl+xattrs+sha512 /usr/sbin/ausearch p+i+n+u+g+s+b+acl+xattrs+sha512 /usr/sbin/aureport p+i+n+u+g+s+b+acl+xattrs+sha512 /usr/sbin/autrace p+i+n+u+g+s+b+acl+xattrs+sha512 /usr/sbin/augenrules p+i+n+u+g+s+b+acl+xattrs+sha512

b
Amazon Linux 2023 must have the firewalld package installed.
CM-7 - Medium - CCI-000382 - V-274027 - SV-274027r1120069_rule
RMF Control
CM-7
Severity
Medium
CCI
CCI-000382
Version
AZLX-23-001075
Vuln IDs
  • V-274027
Rule IDs
  • SV-274027r1120069_rule
To prevent unauthorized connection of devices, unauthorized transfer of information, or unauthorized tunneling (i.e., embedding of data types within data types), organizations must disable or restrict unused or unnecessary physical and logical ports/protocols on information systems. Operating systems are capable of providing a wide variety of functions and services. Some of the functions and services provided by default may not be necessary to support essential organizational operations. Additionally, it is sometimes convenient to provide multiple services from a single component (e.g., VPN and IPS); however, doing so increases risk over limiting the services provided by any one component. To support the requirements and principles of least functionality, Amazon Linux 2023 must support the organizational requirements, providing only essential capabilities and limiting the use of ports, protocols, and/or services to only those required, authorized, and approved to conduct official business or to address authorized quality of life issues. Satisfies: SRG-OS-000096-GPOS-00050, SRG-OS-000297-GPOS-00115, SRG-OS-000298-GPOS-00116, SRG-OS-000480-GPOS-00232, SRG-OS-000304-GPOS-00121
Checks: C-78118r1120067_chk

Verify Amazon Linux 2023 has the firewalld package installed with the following command: $ dnf list --installed firewalld Installed Packages firewalld.noarch 1.2.3-1.amzn2023 @amazonlinux If the "firewalld" package is not installed, this is a finding.

Fix: F-78023r1120068_fix

Configure Amazon Linux 2023 to have the firewalld package installed with the following command: $ sudo dnf install -y firewalld

b
Amazon Linux 2023 must have the firewalld servicew active.
CM-7 - Medium - CCI-000382 - V-274028 - SV-274028r1120072_rule
RMF Control
CM-7
Severity
Medium
CCI
CCI-000382
Version
AZLX-23-001080
Vuln IDs
  • V-274028
Rule IDs
  • SV-274028r1120072_rule
To prevent unauthorized connection of devices, unauthorized transfer of information, or unauthorized tunneling (i.e., embedding of data types within data types), organizations must disable or restrict unused or unnecessary physical and logical ports/protocols on information systems. Operating systems are capable of providing a variety of functions and services. Some of the functions and services provided by default may not be necessary to support essential organizational operations. Additionally, it is sometimes convenient to provide multiple services from a single component (e.g., VPN and IPS); however, doing so increases risk over limiting the services provided by any one component. To support the requirements and principles of least functionality, Amazon Linux 2023 must support the organizational requirements, providing only essential capabilities and limiting the use of ports, protocols, and/or services to only those required, authorized, and approved to conduct official business or to address authorized quality of life issues. Satisfies: SRG-OS-000096-GPOS-00050, SRG-OS-000297-GPOS-00115, SRG-OS-000298-GPOS-00116, SRG-OS-000480-GPOS-00232, SRG-OS-000304-GPOS-00121
Checks: C-78119r1120070_chk

Verify Amazon Linux 2023 firewalld service is active with the following command: $ systemctl is-active firewalld active If the "firewalld" service is not active, this is a finding.

Fix: F-78024r1120071_fix

Configure Amazon Linux 2023 to enable the firewalld service with the following command: $ sudo systemctl enable --now firewalld

b
Amazon Linux 2023 must be configured to disable nonessential capabilities.
CM-7 - Medium - CCI-000381 - V-274029 - SV-274029r1120075_rule
RMF Control
CM-7
Severity
Medium
CCI
CCI-000381
Version
AZLX-23-001085
Vuln IDs
  • V-274029
Rule IDs
  • SV-274029r1120075_rule
It is detrimental for operating systems to provide, or install by default, functionality exceeding requirements or mission objectives. These unnecessary capabilities or services are often overlooked and therefore may remain unsecured. They increase the risk to the platform by providing additional attack vectors. Operating systems are capable of providing a variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). Examples of nonessential capabilities include, but are not limited to, games, software packages, tools, and demonstration software, not related to requirements or providing a wide array of functionality not required for every mission, but which cannot be disabled.
Checks: C-78120r1120073_chk

Verify Amazon Linux 2023 is configured to disable nonessential capabilities. Inspect the list of enabled firewall ports and verify they are configured correctly by running the following command: $ sudo firewall-cmd --list-all Ask the system administrator for the site or program Ports, Protocols, and Services Management Component Local Service Assessment (PPSM CLSA). Verify the services allowed by the firewall match the PPSM CLSA. If there are additional ports, protocols, or services that are not in the PPSM CLSA, or there are ports, protocols, or services that are prohibited by the PPSM Category Assurance List (CAL), or there are no firewall rules configured, this is a finding.

Fix: F-78025r1120074_fix

Configure Amazon Linux 2023 to allow approved settings and/or running services to comply with the PPSM CLSA for the site or program and the PPSM CAL. To open a port for a service, configure firewalld using the following command: $ sudo firewall-cmd --permanent --add-port=port_number/tcp or $ sudo firewall-cmd --permanent --add-service=service_name

b
Amazon Linux 2023 must manage excess capacity, bandwidth, or other redundancy to limit the effects of information flooding types of denial-of-service (DoS) attacks.
SC-5 - Medium - CCI-001095 - V-274030 - SV-274030r1120078_rule
RMF Control
SC-5
Severity
Medium
CCI
CCI-001095
Version
AZLX-23-001090
Vuln IDs
  • V-274030
Rule IDs
  • SV-274030r1120078_rule
DoS is a condition when a resource is not available for legitimate users. When this occurs, the organization either cannot accomplish its mission or must operate at degraded capacity. Managing excess capacity ensures that sufficient capacity is available to counter flooding attacks. Employing increased capacity and service redundancy may reduce the susceptibility to some DoS attacks. Managing excess capacity may include, for example, establishing selected usage priorities, quotas, or partitioning.
Checks: C-78121r1120076_chk

Verify Amazon Linux 2023 manages excess capacity, bandwidth, or other redundancy to limit the effects of information flooding types of DoS attacks. Verify nftables is configured to allow rate limits on any connection to the system with the following command: $ sudo grep -i firewallbackend /etc/firewalld/firewalld.conf FirewallBackend=nftables

Fix: F-78026r1120077_fix

Configure Amazon Linux 2023 to manage excess capacity, bandwidth, or other redundancy to limit the effects of information flooding types of DoS attacks. Configure "nftables" to be the default "firewallbackend" for "firewalld" by adding or editing the following line in "etc/firewalld/firewalld.conf": FirewallBackend=nftables Establish rate-limiting rules based on organization-defined types of DoS attacks on impacted network interfaces.

b
Amazon Linux 2023 must have the s-nail package installed.
CM-3 - Medium - CCI-001744 - V-274031 - SV-274031r1120081_rule
RMF Control
CM-3
Severity
Medium
CCI
CCI-001744
Version
AZLX-23-001095
Vuln IDs
  • V-274031
Rule IDs
  • SV-274031r1120081_rule
The "s-nail" package provides the mail command required to allow sending email notifications of unauthorized configuration changes to designated personnel.
Checks: C-78122r1120079_chk

Verify Amazon Linux 2023 has the "s-nail" package is installed on the system with the following command: $ dnf list --installed s-nail Installed Packages s-nail.x86_64 14.9.24-6.amzn2023 @amazonlinux If the "s-nail" package is not installed, this is a finding.

Fix: F-78027r1120080_fix

Configure Amazon Linux 2023 to have the s-nail package installed with the following command: $ sudo dnf install -y s-nail

b
Amazon Linux 2023 must have the libreswan package installed.
IA-7 - Medium - CCI-000803 - V-274032 - SV-274032r1120084_rule
RMF Control
IA-7
Severity
Medium
CCI
CCI-000803
Version
AZLX-23-001105
Vuln IDs
  • V-274032
Rule IDs
  • SV-274032r1120084_rule
Unapproved mechanisms that are used for authentication to the cryptographic module are not verified and therefore, cannot be relied upon to provide confidentiality or integrity, and DOD data may be compromised. Operating systems utilizing encryption are required to use FIPS-compliant mechanisms for authenticating to cryptographic modules. FIPS 140-2/140-3 is the current standard for validating that mechanisms used to access cryptographic modules utilize authentication that meets DOD requirements. This allows for Security Levels 1, 2, 3, or 4 for use on a general purpose computing system.
Checks: C-78123r1120082_chk

Verify Amazon Linux 2023 has the libreswan package installed with the following command: $ dnf list --installed libreswan Installed Packages libreswan.x86_64 4.12-3.amzn2023.0.2 @amazonlinux If the "libreswan" package is not installed, this is a finding.

Fix: F-78028r1120083_fix

Configure Amazon Linux 2023 to have the libreswan package installed with the following command: $ sudo dnf install -y libreswan

b
Amazon Linux 2023 must have the policycoreutils package installed.
SC-3 - Medium - CCI-001084 - V-274033 - SV-274033r1120087_rule
RMF Control
SC-3
Severity
Medium
CCI
CCI-001084
Version
AZLX-23-001110
Vuln IDs
  • V-274033
Rule IDs
  • SV-274033r1120087_rule
An isolation boundary provides access control and protects the integrity of the hardware, software, and firmware that perform security functions. Security functions are the hardware, software, and/or firmware of the information system responsible for enforcing the system security policy and supporting the isolation of code and data on which the protection is based. Operating systems implement code separation (i.e., separation of security functions from nonsecurity functions) in a number of ways, including through the provision of security kernels via processor rings or processor modes. For nonkernel code, security function isolation is often achieved through file system protections that serve to protect the code on disk and address space protections that protect executing code. Developers and implementers can increase the assurance in security functions by employing well-defined security policy models; structured, disciplined, and rigorous hardware and software development techniques; and sound system/security engineering principles. Implementation may include isolation of memory space and libraries. Operating systems restrict access to security functions through the use of access control mechanisms and by implementing least privilege capabilities.
Checks: C-78124r1120085_chk

Verify Amazon Linux 2023 has the policycoreutils package installed with the following command: $ dnf list --installed policycoreutils Installed Packages policycoreutils.x86_64 3.4-6.amzn2023.0.2 @System If the "policycoreutils" package is not installed, this is a finding.

Fix: F-78029r1120086_fix

Configure Amazon Linux 2023 to have the policycoreutils package installed with the following command: $ sudo dnf install -y policycoreutils

b
Amazon Linux 2023 must have the pcsc-lite package installed.
- Medium - CCI-004046 - V-274034 - SV-274034r1120090_rule
RMF Control
Severity
Medium
CCI
CCI-004046
Version
AZLX-23-001115
Vuln IDs
  • V-274034
Rule IDs
  • SV-274034r1120090_rule
The pcsc-lite package must be installed if it is to be available for multifactor authentication using smart cards.
Checks: C-78125r1120088_chk

Verify Amazon Linux 2023 has the pcsc-lite package installed with the following command: $ dnf list --installed pcsc-lite Installed Packages pcsc-lite.x86_64 1.9.1-1.amzn2023.0.4 @amazonlinux If the "pcsc-lite" package is not installed, this is a finding.

Fix: F-78030r1120089_fix

Configure Amazon Linux 2023 to have the pcsc-lite package installed with the following command: $ sudo dnf install -y pcsc-lite

b
Amazon Linux 2023 must have the packages required for encrypting off-loaded audit logs installed.
IA-7 - Medium - CCI-000803 - V-274035 - SV-274035r1120093_rule
RMF Control
IA-7
Severity
Medium
CCI
CCI-000803
Version
AZLX-23-001120
Vuln IDs
  • V-274035
Rule IDs
  • SV-274035r1120093_rule
Unapproved mechanisms used for authentication to the cryptographic module are not verified and therefore, cannot be relied upon to provide confidentiality or integrity, and DOD data may be compromised. Operating systems utilizing encryption are required to use FIPS-compliant mechanisms for authenticating to cryptographic modules. FIPS 140-2/140-3 is the current standard for validating that mechanisms used to access cryptographic modules utilize authentication that meets DOD requirements. This allows for Security Levels 1, 2, 3, or 4 for use on a general purpose computing system.
Checks: C-78126r1120091_chk

Verify Amazon Linux 2023 has the rsyslog-openssl package installed with the following command: $ dnf list --installed rsyslog-openssl Installed Packages rsyslog-openssl.x86_64 8.2204.0-3.amzn2023.0.4 @amazonlinux If the "rsyslog-openssl" package is not installed, this is a finding.

Fix: F-78031r1120092_fix

Configure Amazon Linux 2023 to have the rsyslog-openssl package installed with the following command: $ sudo dnf install -y rsyslog-openssl

b
Amazon Linux 2023 must have the opensc package installed.
- Medium - CCI-004046 - V-274036 - SV-274036r1120096_rule
RMF Control
Severity
Medium
CCI
CCI-004046
Version
AZLX-23-001125
Vuln IDs
  • V-274036
Rule IDs
  • SV-274036r1120096_rule
The use of PIV credentials facilitates standardization and reduces the risk of unauthorized access. The DOD has mandated the use of the Common Access Card (CAC) to support identity management and personal authentication for systems covered under Homeland Security Presidential Directive (HSPD) 12, as well as making the CAC a primary component of layered protection for national security systems. Satisfies: SRG-OS-000375-GPOS-00160, SRG-OS-000376-GPOS-00161
Checks: C-78127r1120094_chk

Verify Amazon Linux 2023 has the opensc package installed with the following command: $ sudo dnf list --installed opensc Installed Packages opensc.x86_64 0.24.0-1.amzn2023.0.4 @amazonlinux If the "opensc" package is not installed, this is a finding.

Fix: F-78032r1120095_fix

Configure Amazon Linux 2023 to have the opensc package installed with the following command: $ sudo dnf install -y opensc

b
Amazon Linux 2023 must have the openssl-pkcs11 package installed.
- Medium - CCI-004046 - V-274037 - SV-274037r1120099_rule
RMF Control
Severity
Medium
CCI
CCI-004046
Version
AZLX-23-001130
Vuln IDs
  • V-274037
Rule IDs
  • SV-274037r1120099_rule
Without the use of multifactor authentication, the ease of access to privileged functions is greatly increased. Multifactor authentication requires using two or more factors to achieve authentication. A privileged account is defined as an information system account with authorizations of a privileged user. The DOD Common Access Card (CAC) with DOD-approved PKI is an example of multifactor authentication. Satisfies: SRG-OS-000375-GPOS-00160, SRG-OS-000376-GPOS-00161, SRG-OS-000377-GPOS-00162
Checks: C-78128r1120097_chk

Verify Amazon Linux 2023 has the openssl-pkcs11 package installed with the following command: $ dnf list --installed openssl-pkcs11 Installed Packages openssl-pkcs11.x86_64 0.4.12-3.amzn2023.0.1 @System If the "openssl-pkcs11" package is not installed, this is a finding.

Fix: F-78033r1120098_fix

Configure Amazon Linux 2023 to have the openssl-pkcs11 package installed with the following command: $ sudo dnf install -y openssl-pkcs11

c
Amazon Linux 2023 must have SSH installed.
IA-2 - High - CCI-001941 - V-274038 - SV-274038r1120102_rule
RMF Control
IA-2
Severity
High
CCI
CCI-001941
Version
AZLX-23-001180
Vuln IDs
  • V-274038
Rule IDs
  • SV-274038r1120102_rule
Without protection of the transmitted information, confidentiality and integrity may be compromised because unprotected communications can be intercepted and either read or altered. Satisfies: SRG-OS-000112-GPOS-00057, SRG-OS-000113-GPOS-00058, SRG-OS-000423-GPOS-00187, SRG-OS-000424-GPOS-00188, SRG-OS-000425-GPOS-00189, SRG-OS-000426-GPOS-00190
Checks: C-78129r1120100_chk

Verify Amazon Linux 2023 has the openssh-server package installed with the following command: $ dnf list --installed openssh-server Installed Packages openssh-server.x86_64 8.7p1-8.amzn2023.0.13 @amazonlinux If the "openssh-server" package is not installed, this is a finding.

Fix: F-78034r1120101_fix

Configure Amazon Linux 2023 to have the openssh-server package installed with the following command: $ sudo dnf install -y openssh-server

c
Amazon Linux 2023 must implement SSH to protect the confidentiality and integrity of transmitted and received information, as well as information during preparation for transmission.
IA-2 - High - CCI-001941 - V-274039 - SV-274039r1120105_rule
RMF Control
IA-2
Severity
High
CCI
CCI-001941
Version
AZLX-23-001185
Vuln IDs
  • V-274039
Rule IDs
  • SV-274039r1120105_rule
Encrypting information for transmission protects information from unauthorized disclosure and modification. Cryptographic mechanisms implemented to protect information integrity include, for example, cryptographic hash functions that have common application in digital signatures, checksums, and message authentication codes. Use of this requirement will be limited to situations where the data owner has a strict requirement for ensuring data integrity and confidentiality is maintained at every step of the data transfer and handling process. When transmitting data, operating systems need to leverage transmission protection mechanisms such as TLS, SSL VPNs, or IPSec. Satisfies: SRG-OS-000112-GPOS-00057, SRG-OS-000113-GPOS-00058, SRG-OS-000423-GPOS-00187, SRG-OS-000424-GPOS-00188, SRG-OS-000425-GPOS-00189, SRG-OS-000426-GPOS-00190
Checks: C-78130r1120103_chk

Verify Amazon Linux 2023 has "sshd" set to active with the following command: $ systemctl is-active sshd active If the "sshd" service is not active, this is a finding.

Fix: F-78035r1120104_fix

Configure Amazon Linux 2023 to enable the sshd service run the following command: $ sudo systemctl enable --now sshd

b
Amazon Linux 2023 must have the crypto-policies package installed.
SC-13 - Medium - CCI-002450 - V-274040 - SV-274040r1120108_rule
RMF Control
SC-13
Severity
Medium
CCI
CCI-002450
Version
AZLX-23-001195
Vuln IDs
  • V-274040
Rule IDs
  • SV-274040r1120108_rule
Centralized cryptographic policies simplify applying secure ciphers across an operating system and the applications that run on that operating system. Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. Satisfies: SRG-OS-000396-GPOS-00176, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174, SRG-OS-000424-GPOS-00188
Checks: C-78131r1120106_chk

Verify Amazon Linux 2023 crypto-policies package is installed with the following command: $ dnf list --installed crypto-policies Installed Packages crypto-policies.noarch 20240828-2.git626aa59.amzn2023.0.1 @System If the "crypto-policies" package is not installed, this is a finding.

Fix: F-78036r1120107_fix

Configure Amazon Linux 2023 to have the crypto-policies package installed with the following command: $ sudo dnf install -y crypto-policies

b
Amazon Linux 2023 SSH server must be configured to use systemwide crypto policies.
AC-17 - Medium - CCI-001453 - V-274041 - SV-274041r1120111_rule
RMF Control
AC-17
Severity
Medium
CCI
CCI-001453
Version
AZLX-23-001200
Vuln IDs
  • V-274041
Rule IDs
  • SV-274041r1120111_rule
Without cryptographic integrity protections, information can be altered by unauthorized users without detection. Remote access (e.g., RDP) is access to DOD nonpublic information systems by an authorized user (or an information system) communicating through an external, nonorganization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless. Cryptographic mechanisms used for protecting the integrity of information include, for example, signed hash functions using asymmetric cryptography enabling distribution of the public key to verify the hash information while maintaining the confidentiality of the secret key used to generate the hash.
Checks: C-78132r1120109_chk

Verify Amazon Linux 2023 employs systemwide crypto policies for SSH with the following command: $ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH '^\s*include' /etc/ssh/sshd_config:Include /etc/ssh/sshd_config.d/*.conf /etc/ssh/sshd_config.d/50-redhat.conf:Include /etc/crypto-policies/back-ends/opensshserver.config If "Include /etc/ssh/sshd_config.d/*.conf" or "Include /etc/crypto-policies/back-ends/opensshserver.config" are not included in the system sshd config or the file /etc/ssh/sshd_config.d/50-redhat.conf is missing, this is a finding.

Fix: F-78037r1120110_fix

Configure Amazon Linux 2023 so that the SSH daemon uses systemwide crypto policies by running the following commands: $ sudo dnf reinstall -y openssh-server

b
Amazon Linux 2023 server must be configured to use only DOD-approved encryption ciphers employing FIPS 140-2/140-3 validated cryptographic hash algorithms to protect the confidentiality of SSH server connections.
AC-17 - Medium - CCI-001453 - V-274042 - SV-274042r1120114_rule
RMF Control
AC-17
Severity
Medium
CCI
CCI-001453
Version
AZLX-23-001205
Vuln IDs
  • V-274042
Rule IDs
  • SV-274042r1120114_rule
Without cryptographic integrity protections, information can be altered by unauthorized users without detection. Remote access (e.g., RDP) is access to DOD nonpublic information systems by an authorized user (or an information system) communicating through an external, nonorganization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless. Cryptographic mechanisms used for protecting the integrity of information include, for example, signed hash functions using asymmetric cryptography enabling distribution of the public key to verify the hash information while maintaining the confidentiality of the secret key used to generate the hash. Amazon Server 2023 incorporates systemwide crypto policies by default. The SSH configuration file has no effect on the ciphers, MACs, or algorithms unless specifically defined in the /etc/sysconfig/sshd file. The employed algorithms can be viewed in the /etc/crypto-policies/back-ends/opensshserver.config file.
Checks: C-78133r1120112_chk

Verify Amazon Linux 2023 SSH server is configured to use only ciphers employing FIPS 140-2/140-3 approved algorithms with the following command: $ sudo grep -i Ciphers /etc/crypto-policies/back-ends/opensshserver.config Ciphers aes256-gcm@openssh.com,aes256-ctr,aes128-gcm@openssh.com,aes128-ctr If the cipher entries in the "opensshserver.config" file have any ciphers other than "aes256-gcm@openssh.com,aes256-ctr,aes128-gcm@openssh.com,aes128-ctr", or they are missing or commented out, this is a finding.

Fix: F-78038r1120113_fix

Configure Amazon Linux 2023 so that the SSH server uses only ciphers employing FIPS 140-2/140-3 approved algorithms. Reinstall crypto-policies with the following command: $ sudo dnf -y reinstall crypto-policies Set the crypto-policy to FIPS with the following command: $ sudo update-crypto-policies --set FIPS Setting system policy to FIPS Note: Systemwide crypto policies are applied on application startup. It is recommended to restart the system for the change of policies to fully take place.

b
Amazon Linux 2023 SSH server must be configured to use only Message Authentication Codes (MACs) employing FIPS 140-2/140-3 validated cryptographic hash algorithms to protect the confidentiality of SSH server connections.
AC-17 - Medium - CCI-001453 - V-274043 - SV-274043r1120117_rule
RMF Control
AC-17
Severity
Medium
CCI
CCI-001453
Version
AZLX-23-001210
Vuln IDs
  • V-274043
Rule IDs
  • SV-274043r1120117_rule
Without cryptographic integrity protections, information can be altered by unauthorized users without detection. Remote access (e.g., RDP) is access to DOD nonpublic information systems by an authorized user (or an information system) communicating through an external, nonorganization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless. Cryptographic mechanisms used for protecting the integrity of information include, for example, signed hash functions using asymmetric cryptography enabling distribution of the public key to verify the hash information while maintaining the confidentiality of the secret key used to generate the hash. Amazon Linux 2023 incorporates systemwide crypto policies by default. The SSH configuration file has no effect on the ciphers, MACs, or algorithms unless specifically defined in the /etc/sysconfig/sshd file. The employed algorithms can be viewed in the /etc/crypto-policies/back-ends/opensshserver.config file.
Checks: C-78134r1120115_chk

Verify Amazon Linux 2023 SSH server is configured to use only MACs employing FIPS 140-2/140-3 approved algorithms. To verify the MACs in the systemwide SSH configuration file, use the following command: $ sudo grep -i MACs /etc/crypto-policies/back-ends/opensshserver.config MACs hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512 If the MACs entries in the "opensshserver.config" file have any hashes other than "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512", or they are missing or commented out, this is a finding.

Fix: F-78039r1120116_fix

Configure Amazon Linux 2023 so that the SSH server uses only MACs employing FIPS 140-2/140-3 approved algorithms. Reinstall crypto-policies with the following command: $ sudo dnf -y reinstall crypto-policies Set the crypto-policy to FIPS with the following command: $ sudo update-crypto-policies --set FIPS Setting system policy to FIPS Note: Systemwide crypto policies are applied on application startup. It is recommended to restart the system for the change of policies to fully take place.

b
Amazon Linux 2023 SSH daemon must not allow Generic Security Service Application Program Interface (GSSAPI) authentication.
CM-5 - Medium - CCI-001813 - V-274044 - SV-274044r1120120_rule
RMF Control
CM-5
Severity
Medium
CCI
CCI-001813
Version
AZLX-23-001215
Vuln IDs
  • V-274044
Rule IDs
  • SV-274044r1120120_rule
GSSAPI authentication is used to provide additional authentication mechanisms to applications. Allowing GSSAPI authentication through SSH exposes the system's GSSAPI to remote hosts, increasing the attack surface of the system.
Checks: C-78135r1120118_chk

Verify Amazon Linux 2023 is configured so that the SSH daemon does not allow GSSAPI authentication with the following command: $ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH '^\s*gssapiauthentication' /etc/ssh/sshd_config.d/50-redhat.conf:GSSAPIAuthentication no If the value is returned as "yes", the returned line is commented out, no output is returned, and the use of GSSAPI authentication has not been documented with the information system security officer (ISSO), this is a finding. If the required value is not set, this is a finding.

Fix: F-78040r1120119_fix

Configure Amazon Linux 2023 so that the SSH daemon does not allow GSSAPI authentication. Add or uncomment the following line to "/etc/ssh/sshd_config" or to a file in "/etc/ssh/sshd_config.d" and set the value to "no": GSSAPIAuthentication no The SSH service must be restarted for changes to take effect: $ sudo systemctl restart sshd.service

b
Amazon Linux 2023 SSH daemon must not allow Kerberos authentication.
CM-5 - Medium - CCI-001813 - V-274045 - SV-274045r1120123_rule
RMF Control
CM-5
Severity
Medium
CCI
CCI-001813
Version
AZLX-23-001220
Vuln IDs
  • V-274045
Rule IDs
  • SV-274045r1120123_rule
Kerberos authentication for SSH is often implemented using Generic Security Service Application Program Interface (GSSAPI). If Kerberos is enabled through SSH, the SSH daemon provides a means of access to the system's Kerberos implementation. Vulnerabilities in the system's Kerberos implementations may be subject to exploitation.
Checks: C-78136r1120121_chk

Verify Amazon Linux 2023 is configured so that the SSH daemon does not allow Kerberos authentication with the following command: $ [ec2-user@ip-172-31-12-63 ~]$ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH '^\s*kerberosauthentication' /etc/ssh/sshd_config.d/93-KerberosAuthentication.conf:KerberosAuthentication no If the value is returned as "yes", the returned line is commented out, no output is returned, and the use of Kerberos authentication has not been documented with the information system security officer (ISSO), this is a finding.

Fix: F-78041r1120122_fix

Configure Amazon Linux 2023 so that the SSH daemon does not allow Kerberos authentication. Add the following line in "/etc/ssh/sshd_config" or to a file in "/etc/ssh/sshd_config.d" or uncomment the line and set the value to "no": KerberosAuthentication no The SSH service must be restarted for changes to take effect: $ sudo systemctl restart sshd.service

c
Amazon Linux 2023 must force a frequent session key renegotiation for SSH connections to the server.
SC-8 - High - CCI-002418 - V-274046 - SV-274046r1120126_rule
RMF Control
SC-8
Severity
High
CCI
CCI-002418
Version
AZLX-23-001225
Vuln IDs
  • V-274046
Rule IDs
  • SV-274046r1120126_rule
Without protection of the transmitted information, confidentiality and integrity may be compromised because unprotected communications can be intercepted and either read or altered. This requirement applies to both internal and external networks and all types of information system components from which information can be transmitted (e.g., servers, mobile devices, notebook computers, printers, copiers, scanners, and facsimile machines). Communication paths outside the physical protection of a controlled boundary are exposed to the possibility of interception and modification. Protecting the confidentiality and integrity of organizational information can be accomplished by physical means (e.g., employing physical distribution systems) or by logical means (e.g., employing cryptographic techniques). If physical means of protection are employed, then logical means (cryptography) do not have to be employed, and vice versa. Session key regeneration limits the chances of a session key becoming compromised. Satisfies: SRG-OS-000423-GPOS-00187, SRG-OS-000033-GPOS-00014, SRG-OS-000424-GPOS-00188
Checks: C-78137r1120124_chk

Verify Amazon Linux 2023 is configured so that the SSH forces frequent session key renegotiation with the following command: $ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH '^\s*rekeylimit' RekeyLimit 1G 1h If "RekeyLimit" does not have a maximum data amount and maximum time defined, is missing, or is commented out, this is a finding.

Fix: F-78042r1120125_fix

Configure Amazon Linux 2023 to force a frequent session key renegotiation for SSH connections to the server by adding or modifying the following line in the "/etc/ssh/sshd_config" file or in a file in "/etc/ssh/sshd_config.d": RekeyLimit 1G 1h Restart the SSH daemon for the settings to take effect. $ sudo systemctl restart sshd.service

b
Amazon Linux 2023 SSHD must accept public key authentication.
IA-2 - Medium - CCI-000765 - V-274047 - SV-274047r1120129_rule
RMF Control
IA-2
Severity
Medium
CCI
CCI-000765
Version
AZLX-23-001230
Vuln IDs
  • V-274047
Rule IDs
  • SV-274047r1120129_rule
Without the use of multifactor authentication, the ease of access to privileged functions is greatly increased. Multifactor authentication requires using two or more factors to achieve authentication. Factors include: 1. Something a user knows (e.g., password/PIN); 2. Something a user has (e.g., cryptographic identification device, token); and 3. Something a user is (e.g., biometric). A privileged account is defined as an information system account with authorizations of a privileged user. Network access is defined as access to an information system by a user (or a process acting on behalf of a user) communicating through a network (e.g., local area network, wide area network, or the internet). The DOD Common Access Card (CAC) with DOD-approved PKI is an example of multifactor authentication. Satisfies: SRG-OS-000105-GPOS-00052, SRG-OS-000106-GPOS-00053, SRG-OS-000107-GPOS-00054, SRG-OS-000108-GPOS-00055
Checks: C-78138r1120127_chk

Verify Amazon Linux 2023 is configured so that the SSH daemon accepts public key encryption with the following command: $ sudo grep -ir PubkeyAuthentication /etc/ssh/sshd_config /etc/ssh/sshd_config.d/ /etc/ssh/sshd_config:#PubkeyAuthentication yes /etc/ssh/sshd_config.d/90-PubkeyAuth:PubkeyAuthentication yes If "PubkeyAuthentication" is set to no, the line is commented out, or the line is missing, this is a finding.

Fix: F-78043r1120128_fix

Configure Amazon Linux 2023 to use public key authentication for SSHD by adding or modifying the following line in "/etc/ssh/sshd_config" or in a file in "/etc/ssh/sshd_config.d". PubkeyAuthentication yes Restart the SSH daemon for the settings to take effect: $ sudo systemctl restart sshd.service

b
Amazon Linux 2023 SSHD must not allow blank passwords.
IA-2 - Medium - CCI-000766 - V-274048 - SV-274048r1120132_rule
RMF Control
IA-2
Severity
Medium
CCI
CCI-000766
Version
AZLX-23-001235
Vuln IDs
  • V-274048
Rule IDs
  • SV-274048r1120132_rule
If an account has an empty password, anyone could log on and run commands with the privileges of that account. Accounts with empty passwords must never be used in operational environments. Satisfies: SRG-OS-000106-GPOS-00053, SRG-OS-000480-GPOS-00229
Checks: C-78139r1120130_chk

Verify Amazon Linux 2023 remote access using SSH prevents logging on with a blank password with the following command: $ sudo grep -ir PermitEmptyPasswords /etc/ssh/sshd_config /etc/ssh/sshd_config.d/ /etc/ssh/sshd_config:PermitEmptyPasswords no If the "PermitEmptyPassword" keyword is set to "yes", is missing, or is commented out, this is a finding.

Fix: F-78044r1120131_fix

Configure Amazon Linux 2023 to prevent SSH users from logging on with blank passwords. Edit the following line in "etc/ssh/sshd_config" or in a file in "/etc/ssh/sshd_config.d": PermitEmptyPasswords no Restart the SSH daemon for the settings to take effect: $ sudo systemctl restart sshd.service

b
Amazon Linux 2023 must not permit direct logons to the root account using remote access via SSH.
- Medium - CCI-004045 - V-274049 - SV-274049r1120747_rule
RMF Control
Severity
Medium
CCI
CCI-004045
Version
AZLX-23-001240
Vuln IDs
  • V-274049
Rule IDs
  • SV-274049r1120747_rule
To ensure individual accountability and prevent unauthorized access, organizational users must be individually identified and authenticated. Additionally, an additional layer of security is gained by extending the policy of not logging directly on as root, even though the communications channel may be encrypted. A group authenticator is a generic account used by multiple individuals. Use of a group authenticator alone does not uniquely identify individual users. Examples of the group authenticator are the Unix OS "root" user account, the Windows "Administrator" account, the "sa" account, or a "helpdesk" account. For example, the Unix and Windows operating systems offer a "switch user" capability allowing users to authenticate with their individual credentials and, when needed, switch" to the administrator role. This method provides for unique individual authentication prior to using a group authenticator. Users (and any processes acting on behalf of users) need to be uniquely identified and authenticated for all accesses other than those accesses explicitly identified and documented by the organization, which outlines specific user actions that can be performed on Amazon Linux 2023 without identification or authentication. Requiring individuals to be authenticated with an individual authenticator prior to using a group authenticator allows for traceability of actions, as well as adding an additional level of protection of the actions that can be taken with group account knowledge.
Checks: C-78140r1120133_chk

Verify Amazon Linux 2023 remote access using SSH prevents users from logging on directly as "root" with the following command: $ sudo grep -ir PermitRootLogin /etc/ssh/sshd_config /etc/ssh/sshd_config.d/ /etc/ssh/sshd_config:PermitRootLogin no If the "PermitRootLogin" keyword is set to "yes", is missing, or is commented out, this is a finding.

Fix: F-78045r1120134_fix

Configure Amazon Linux 2023 to prevent SSH users from logging on directly as root add or modify the following line in "/etc/ssh/sshd_config" or in a file in "/etc/ssh/sshd_config.d". PermitRootLogin no Restart the SSH daemon for the settings to take effect: $ sudo systemctl restart sshd.service

b
Amazon Linux 2023 must be configured so that all network connections associated with SSH traffic are terminated after 10 minutes of becoming unresponsive.
SC-10 - Medium - CCI-001133 - V-274050 - SV-274050r1120138_rule
RMF Control
SC-10
Severity
Medium
CCI
CCI-001133
Version
AZLX-23-001245
Vuln IDs
  • V-274050
Rule IDs
  • SV-274050r1120138_rule
Terminating an idle session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled on the console or console port that has been left unattended. In addition, quickly terminating an idle session will also free up resources committed by the managed network element. Terminating network connections associated with communications sessions includes, for example, de-allocating associated TCP/IP address/port pairs at Amazon Linux 2023 level, and de-allocating networking assignments at the application level if multiple application sessions are using a single operating system-level network connection. This does not mean that Amazon Linux 2023 terminates all sessions or network access; it only ends the inactive session and releases the resources associated with that session. Satisfies: SRG-OS-000163-GPOS-00072, SRG-OS-000279-GPOS-00109, SRG-OS-000395-GPOS-00175
Checks: C-78141r1120136_chk

Verify Amazon Linux 2023 has the "ClientAliveInterval" variable set to a value of "600" or less by performing the following command: $ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH '^\s*clientaliveinterval' /etc/ssh/sshd_config.d/91-ClientAliveInterval.conf:ClientAliveInterval 600 If "ClientAliveInterval" does not exist, does not have a value of "600" or less in "/etc/ssh/sshd_config" or a dropfile in "/etc/ssh/sshd_config.d", or is commented out, this is a finding.

Fix: F-78046r1120137_fix

Configure Amazon Linux 2023 SSH server to terminate a user session automatically after the SSH client has been unresponsive for 10 minutes. Note: This setting must be applied in conjunction with "ClientAliveCountMax 1" to function correctly. Modify or append the following lines in the "/etc/ssh/sshd_config" or a dropfile in "/etc/ssh/sshd_config.d" file: ClientAliveInterval 600 For the changes to take effect, the SSH daemon must be restarted. $ sudo systemctl restart sshd.service

b
Amazon Linux 2023 must be configured so that all network connections associated with SSH traffic terminate after becoming unresponsive.
SC-10 - Medium - CCI-001133 - V-274051 - SV-274051r1120141_rule
RMF Control
SC-10
Severity
Medium
CCI
CCI-001133
Version
AZLX-23-001250
Vuln IDs
  • V-274051
Rule IDs
  • SV-274051r1120141_rule
Terminating an idle session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled on the console or console port that has been left unattended. In addition, quickly terminating an idle session will also free up resources committed by the managed network element. Terminating network connections associated with communications sessions includes, for example, de-allocating associated TCP/IP address/port pairs at Amazon Linux 2023 level, and de-allocating networking assignments at the application level if multiple application sessions are using a single operating system-level network connection. This does not mean that Amazon Linux 2023 terminates all sessions or network access; it only ends the inactive session and releases the resources associated with that session. Satisfies: SRG-OS-000163-GPOS-00072, SRG-OS-000279-GPOS-00109
Checks: C-78142r1120139_chk

Verify Amazon Linux 2023 SSHD has the "ClientAliveCountMax" set to "1" by performing the following command: $ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH '^\s*clientalivecountmax' /etc/ssh/sshd_config.d/92-ClientAliveCountMax.conf:ClientAliveCountMax 1 If "ClientAliveCountMax" do not exist, is not set to a value of "1" in "/etc/ssh/sshd_config" or a dropfile in "/etc/ssh/sshd_config.d" , or is commented out, this is a finding.

Fix: F-78047r1120140_fix

Configure Amazon Linux 2023 SSHD to terminate a user session automatically after the SSH client has become unresponsive. Note: This setting must be applied in conjunction with AZLX-23-000820 to function correctly. Modify or append the following lines in the "/etc/ssh/sshd_config" file or a dropfile in "/etc/ssh/sshd_config.d": ClientAliveCountMax 1 For the changes to take effect, the SSH daemon must be restarted. $ sudo systemctl restart sshd.service

c
Amazon Linux 2023 must enable the Pluggable Authentication Module (PAM) interface for SSHD.
MA-4 - High - CCI-000877 - V-274052 - SV-274052r1120144_rule
RMF Control
MA-4
Severity
High
CCI
CCI-000877
Version
AZLX-23-001255
Vuln IDs
  • V-274052
Rule IDs
  • SV-274052r1120144_rule
If maintenance tools are used by unauthorized personnel, they may accidentally or intentionally damage or compromise the system. The act of managing systems and applications includes the ability to access sensitive application information, such as system configuration details, diagnostic information, user information, and potentially sensitive application data. Some maintenance and test tools are either standalone devices with their own operating systems or are applications bundled with an operating system. Nonlocal maintenance and diagnostic activities are those activities conducted by individuals communicating through a network, either an external network (e.g., the internet) or an internal network. Local maintenance and diagnostic activities are those activities carried out by individuals physically present at the information system or information system component and not communicating across a network connection. Typically, strong authentication requires authenticators that are resistant to replay attacks and employ multifactor authentication. Strong authenticators include, for example, PKI where certificates are stored on a token protected by a password, passphrase, or biometric.
Checks: C-78143r1120142_chk

Verify Amazon Linux 2023 SSHD is configured to allow for the UsePAM interface with the following command: $ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH '^\s*usepam' /etc/ssh/sshd_config.d/50-redhat.conf:UsePAM yes If the "UsePAM" keyword is set to "no", is missing, or is commented out, this is a finding.

Fix: F-78048r1120143_fix

Configure Amazon Linux 2023 SSHD to use the UsePAM interface. Add or modify the following line in "/etc/ssh/sshd_config": UsePAM yes Restart the SSH daemon for the settings to take effect: $ sudo systemctl restart sshd.service

b
Amazon Linux 2023 must implement DOD-approved encryption in the OpenSSL package.
AC-17 - Medium - CCI-001453 - V-274053 - SV-274053r1120147_rule
RMF Control
AC-17
Severity
Medium
CCI
CCI-001453
Version
AZLX-23-001260
Vuln IDs
  • V-274053
Rule IDs
  • SV-274053r1120147_rule
Without cryptographic integrity protections, information can be altered by unauthorized users without detection. Remote access (e.g., RDP) is access to DOD nonpublic information systems by an authorized user (or an information system) communicating through an external, nonorganization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless. Cryptographic mechanisms used for protecting the integrity of information include, for example, signed hash functions using asymmetric cryptography enabling distribution of the public key to verify the hash information while maintaining the confidentiality of the secret key used to generate the hash.
Checks: C-78144r1120145_chk

Verify Amazon Linux 2023 is configured so that the OpenSSL library uses only ciphers employing FIPS 140-2/140-3 approved algorithms with the following command: $ sudo grep -i opensslcnf.config /etc/pki/tls/openssl.cnf .include = /etc/crypto-policies/back-ends/opensslcnf.config If the "opensslcnf.config" is not defined in the "/etc/pki/tls/openssl.cnf" file, this is a finding.

Fix: F-78049r1120146_fix

Configure Amazon Linux 2023 OpenSSL library to use the system wide cryptographic policy. Edit the "/etc/pki/tls/openssl.cnf" and add or modify the following line: .include = /etc/crypto-policies/back-ends/opensslcnf.config

b
Amazon Linux 2023 must implement DOD-approved TLS encryption in the OpenSSL package.
AC-17 - Medium - CCI-001453 - V-274054 - SV-274054r1120150_rule
RMF Control
AC-17
Severity
Medium
CCI
CCI-001453
Version
AZLX-23-001265
Vuln IDs
  • V-274054
Rule IDs
  • SV-274054r1120150_rule
Without cryptographic integrity protections, information can be altered by unauthorized users without detection. Remote access (e.g., RDP) is access to DOD nonpublic information systems by an authorized user (or an information system) communicating through an external, nonorganization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless. Cryptographic mechanisms used for protecting the integrity of information include, for example, signed hash functions using asymmetric cryptography enabling distribution of the public key to verify the hash information while maintaining the confidentiality of the secret key used to generate the hash.
Checks: C-78145r1120148_chk

Verify Amazon Linux 2023 is configured so that the OpenSSL library uses TLS 1.2 encryption or stronger with following command: $ grep -i minprotocol /etc/crypto-policies/back-ends/opensslcnf.config TLS.MinProtocol = TLSv1.2 DTLS.MinProtocol = DTLSv1.2 If the "TLS.MinProtocol" is set to anything older than "TLSv1.2" or the "DTLS.MinProtocol" is set to anything older than "DTLSv1.2", this is a finding.

Fix: F-78050r1120149_fix

Configure Amazon Linux 2023 OpenSSL library to use only DOD-approved TLS encryption by editing the following line in the "/etc/crypto-policies/back-ends/opensslcnf.config" file: TLS.MinProtocol = TLSv1.2 DTLS.MinProtocol = DTLSv1.2 A reboot is required for the changes to take effect.

b
Amazon Linux 2023 must implement a FIPS 140-2/140-3 compliant systemwide cryptographic policy.
IA-7 - Medium - CCI-000803 - V-274055 - SV-274055r1120153_rule
RMF Control
IA-7
Severity
Medium
CCI
CCI-000803
Version
AZLX-23-001270
Vuln IDs
  • V-274055
Rule IDs
  • SV-274055r1120153_rule
Centralized cryptographic policies simplify applying secure ciphers across an operating system and the applications that run on that operating system. Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. Satisfies: SRG-OS-000120-GPOS-00061, SRG-OS-000396-GPOS-00176, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174, SRG-OS-000424-GPOS-00188
Checks: C-78146r1120151_chk

Verify Amazon Linux 2023 is set to use a FIPS 140-2/140-3 compliant systemwide cryptographic policy. $ update-crypto-policies --show FIPS If the systemwide crypto policy is not set to "FIPS", this is a finding. Inspect the contents of the REQUIRE.pmod file (if it exists) to verify only authorized modifications to the current policy are included with the following command: $ cat /etc/crypto-policies/policies/modules/REQUIRE.pmod Note: If subpolicies have been configured, they could be listed in a colon-separated list starting with FIPS as follows FIPS:<SUBPOLICY-NAME>:<SUBPOLICY-NAME>. This is not a finding. If the AD-SUPPORT subpolicy module is included (e.g., "FIPS:AD-SUPPORT"), and Active Directory support is not documented as an operational requirement with the information system security officer (ISSO), this is a finding. If the NO-ENFORCE-EMS subpolicy module is included (e.g., "FIPS:NO-ENFORCE-EMS"), and not enforcing EMS is not documented as an operational requirement with the ISSO, this is a finding. Verify the current minimum crypto-policy configuration with the following commands: $ grep -E 'rsa_size|hash' /etc/crypto-policies/state/CURRENT.pol hash = SHA2-256 SHA2-384 SHA2-512 SHA2-224 SHA3-256 SHA3-384 SHA3-512 SHAKE-256 min_rsa_size = 2048 If the "hash" values do not include at least the following FIPS 140-2/140-3 compliant algorithms "SHA2-256 SHA2-384 SHA2-512 SHA2-224 SHA3-256 SHA3-384 SHA3-512 SHAKE-256", this is a finding. If there are algorithms that include "SHA1" or a hash value less than "256" this is a finding. If the "min_rsa_size" is not set to a value of at least 2048, this is a finding. If these commands do not return any output, this is a finding.

Fix: F-78051r1120152_fix

Configure Amazon Linux 2023 to use a FIPS 140-2/140-3 compliant systemwide cryptographic policy. Create subpolicies for enhancements to the systemwide crypto-policy with the following commands: Create or edit the SCOPES-AND-WILDCARDS policy module in a text editor and insert options that modify the systemwide cryptographic policy as follows: $ sudo vi /etc/crypto-policies/policies/modules/SCOPES-AND-WILDCARDS.pmod Add the following lines to the policy: # Disable CHACHA20-POLY1305 for the TLS protocol (OpenSSL, GnuTLS, NSS, and OpenJDK) cipher@TLS = -CHACHA20-POLY1305 # Disable all CBC mode ciphers for the SSH protocol (libssh and OpenSSH) cipher@SSH = -*-CBC Create or edit the OPENSSH-SUBPOLICY module in a text editor and insert options that modify the systemwide crypto-policy as follows: $ sudo vi /etc/crypto-policies/policies/modules/OPENSSH-SUBPOLICY.pmod Add the following lines to the policy: # Define ciphers for OpenSSH cipher@SSH=AES-256-GCM AES-128-GCM AES-256-CTR AES-128-CTR # Define MACs for OpenSSH mac@SSH=HMAC-SHA2-512 HMAC-SHA2-256 Create or edit the REQUIRE.pmod file and add the following lines to include the subpolicies in the FIPS configuration with the following command: $ sudo vi /etc/crypto-policies/policies/modules/REQUIRE.pmod Add the following lines to REQUIRE.pmod: @OPENSSH-SUBPOLICY @SCOPES-AND-WILDCARDS Apply the policy enhancements to the FIPS systemwide cryptographic policy level with the following command: $ sudo update-crypto-policies --set FIPS Note: If additional subpolicies are being employed, they should be added to the REQUIRE.pmod as well. REQUIRE.pmod is included in the systemwide crypto-policy when it is set. To make the cryptographic settings effective for already running services and applications, restart the system: $ sudo reboot

c
Amazon Linux 2023 must implement DOD-approved encryption to protect the confidentiality of remote access sessions.
AC-17 - High - CCI-000068 - V-274056 - SV-274056r1120156_rule
RMF Control
AC-17
Severity
High
CCI
CCI-000068
Version
AZLX-23-001275
Vuln IDs
  • V-274056
Rule IDs
  • SV-274056r1120156_rule
Without confidentiality protection mechanisms, unauthorized individuals may gain access to sensitive information via a remote access session. Remote access is access to DOD nonpublic information systems by an authorized user (or an information system) communicating through an external, nonorganization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless. Encryption provides a means to secure the remote connection to prevent unauthorized access to the data traversing the remote access connection (e.g., RDP), thereby providing a degree of confidentiality. The encryption strength of a mechanism is selected based on the security categorization of the information.
Checks: C-78147r1120154_chk

Verify Amazon Linux 2023 is configured so that the SSH server uses only ciphers employing FIPS 140-2/140-3 approved algorithms with the following command: $ sudo grep -i ciphers /etc/crypto-policies/back-ends/opensshserver.config Ciphers aes256-gcm@openssh.com,aes256-ctr,aes128-gcm@openssh.com,aes128-ctr If the cipher entries in the "opensshserver.config" file have any ciphers other than "aes256-gcm@openssh.com,aes256-ctr,aes128-gcm@openssh.com,aes128-ctr", they are missing, or commented out, this is a finding.

Fix: F-78052r1120155_fix

Configure Amazon Linux 2023 SSH server to use only ciphers employing FIPS 140-2/140-3 approved algorithms by updating the "/etc/crypto-policies/back-ends/opensshserver.config" file with the following line: Ciphers aes256-gcm@openssh.com,aes256-ctr,aes128-gcm@openssh.com,aes128-ctr A reboot is required for the changes to take effect.

c
Amazon Linux 2023 must enable FIPS mode.
AC-17 - High - CCI-000068 - V-274057 - SV-274057r1120159_rule
RMF Control
AC-17
Severity
High
CCI
CCI-000068
Version
AZLX-23-001280
Vuln IDs
  • V-274057
Rule IDs
  • SV-274057r1120159_rule
Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. Amazon Linux 2023 must implement cryptographic modules adhering to the higher standards approved by the federal government since this provides assurance they have been tested and validated. Satisfies: SRG-OS-000033-GPOS-00014, SRG-OS-000125-GPOS-00065, SRG-OS-000396-GPOS-00176, SRG-OS-000423-GPOS-00187, SRG-OS-000478-GPOS-00223
Checks: C-78148r1120157_chk

Verify Amazon Linux 2023 is in FIPS mode with the following command: $ sudo fips-mode-setup --check FIPS mode is enabled. If FIPS mode is not enabled, this is a finding.

Fix: F-78053r1120158_fix

Configure Amazon Linux 2023 to implement FIPS mode with the following commands: $ sudo fips-mode-setup --enable Reboot the system for the changes to take effect.

b
Amazon Linux 2023 crypto policy must not be overridden.
SC-13 - Medium - CCI-002450 - V-274058 - SV-274058r1120162_rule
RMF Control
SC-13
Severity
Medium
CCI
CCI-002450
Version
AZLX-23-001285
Vuln IDs
  • V-274058
Rule IDs
  • SV-274058r1120162_rule
Centralized cryptographic policies simplify applying secure ciphers across an operating system and the applications that run on that operating system. Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. Satisfies: SRG-OS-000396-GPOS-00176, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174, SRG-OS-000424-GPOS-00188, SRG-OS-000073-GPOS-00041, SRG-OS-000120-GPOS-00061
Checks: C-78149r1120160_chk

Verify Amazon Linux 2023 custom crypto policies are loaded correctly with the following command: $ ls -l /etc/crypto-policies/back-ends/ lrwxrwxrwx. 1 root root 40 Mar 7 19:22 bind.config -> /usr/share/crypto-policies/FIPS/bind.txt lrwxrwxrwx. 1 root root 42 Mar 7 19:22 gnutls.config -> /usr/share/crypto-policies/FIPS/gnutls.txt lrwxrwxrwx. 1 root root 40 Mar 7 19:22 java.config -> /usr/share/crypto-policies/FIPS/java.txt lrwxrwxrwx. 1 root root 46 Mar 7 19:22 javasystem.config -> /usr/share/crypto-policies/FIPS/javasystem.txt lrwxrwxrwx. 1 root root 40 Mar 7 19:22 krb5.config -> /usr/share/crypto-policies/FIPS/krb5.txt lrwxrwxrwx. 1 root root 45 Mar 7 19:22 libreswan.config -> /usr/share/crypto-policies/FIPS/libreswan.txt lrwxrwxrwx. 1 root root 42 Mar 7 19:22 libssh.config -> /usr/share/crypto-policies/FIPS/libssh.txt -rw-r--r--. 1 root root 398 Mar 7 19:22 nss.config lrwxrwxrwx. 1 root root 43 Mar 7 19:22 openssh.config -> /usr/share/crypto-policies/FIPS/openssh.txt lrwxrwxrwx. 1 root root 49 Mar 7 19:22 opensshserver.config -> /usr/share/crypto-policies/FIPS/opensshserver.txt lrwxrwxrwx. 1 root root 43 Mar 7 19:22 openssl.config -> /usr/share/crypto-policies/FIPS/openssl.txt lrwxrwxrwx. 1 root root 48 Mar 7 19:22 openssl_fips.config -> /usr/share/crypto-policies/FIPS/openssl_fips.txt lrwxrwxrwx. 1 root root 46 Mar 7 19:22 opensslcnf.config -> /usr/share/crypto-policies/FIPS/opensslcnf.txt If the paths do not point to the respective files under /usr/share/crypto-policies/FIPS path, this is a finding. Note: nss.config must not be hyperlinked.

Fix: F-78054r1120161_fix

Configure Amazon Linux 2023 to correctly implement the systemwide cryptographic policies by reinstalling the crypto-policies package contents. Reinstall crypto-policies with the following command: $ sudo dnf -y reinstall crypto-policies Set the crypto-policy to FIPS with the following command: $ sudo update-crypto-policies --set FIPS Setting system policy to FIPS Note: Systemwide crypto policies are applied on application startup. It is recommended to restart the system for the change of policies to fully take place.

b
Amazon Linux 2023 must enable certificate-based smart card authentication.
- Medium - CCI-004046 - V-274059 - SV-274059r1120165_rule
RMF Control
Severity
Medium
CCI
CCI-004046
Version
AZLX-23-001290
Vuln IDs
  • V-274059
Rule IDs
  • SV-274059r1120165_rule
Without the use of multifactor authentication, the ease of access to privileged functions is greatly increased. Multifactor authentication requires using two or more factors to achieve authentication. A privileged account is defined as an information system account with authorizations of a privileged user. The DOD Common Access Card (CAC) with DOD-approved PKI is an example of multifactor authentication. Satisfies: SRG-OS-000375-GPOS-00160, SRG-OS-000705-GPOS-00150
Checks: C-78150r1120163_chk

Note: If the system administrator demonstrates the use of an approved alternate multifactor authentication method, this requirement is not applicable. Verify Amazon Linux 2023 has smart cards enabled in System Security Services Daemon (SSSD), run the following command: $ sudo grep -ir pam_cert_auth /etc/sssd/sssd.conf /etc/sssd/conf.d/ /etc/sssd/sssd.conf:pam_cert_auth = True If "pam_cert_auth" is not set to "True", the line is commented out, or the line is missing, this is a finding.

Fix: F-78055r1120164_fix

Configure Amazon Linux 2023 to have smart cards enabled in SSSD. Edit the file "/etc/sssd/sssd.conf" or a configuration file in "/etc/sssd/conf.d" and add or edit the following line: pam_cert_auth = True

b
Amazon Linux 2023 must map the authenticated identity to the user or group account for PKI-based authentication.
IA-5 - Medium - CCI-000187 - V-274060 - SV-274060r1120168_rule
RMF Control
IA-5
Severity
Medium
CCI
CCI-000187
Version
AZLX-23-001295
Vuln IDs
  • V-274060
Rule IDs
  • SV-274060r1120168_rule
Without mapping the certificate used to authenticate to the user account, the ability to determine the identity of the individual user or group will not be available for forensic analysis.
Checks: C-78151r1120166_chk

Note: If the system administrator (SA) demonstrates the use of an approved alternate multifactor authentication method, this requirement is not applicable. Verify the certificate of the user or group is mapped to the corresponding user or group in the "sssd.conf" file with the following command: $ sudo find /etc/sssd/sssd.conf /etc/sssd/conf.d/ -type f -exec cat {} \; [sssd] config_file_version = 2 services = pam, sudo, ssh domains = testing.test [pam] pam_cert_auth = True offline_credentials_expiration = 1 [domain/testing.test] id_provider = ldap [certmap/testing.test/rule_name] matchrule =<SAN>.*EDIPI@mil maprule = (userCertificate;binary={cert!bin}) domains = testing.test If the certmap section does not exist, ask the SA to indicate how certificates are mapped to accounts. If there is no evidence of certificate mapping, this is a finding.

Fix: F-78056r1120167_fix

Configure Amazon Linux 2023 to map the authenticated identity to the user or group account by adding or modifying the certmap section of the "/etc/sssd/sssd.conf file based on the following example: [certmap/testing.test/rule_name] matchrule =<SAN>.*EDIPI@mil maprule = (userCertificate;binary={cert!bin}) domains = testing.test The "sssd" service must be restarted for the changes to take effect. To restart the "sssd" service, run the following command: $ sudo systemctl restart sssd.service

b
Amazon Linux 2023 must implement certificate status checking for multifactor authentication.
- Medium - CCI-004046 - V-274061 - SV-274061r1120171_rule
RMF Control
Severity
Medium
CCI
CCI-004046
Version
AZLX-23-001300
Vuln IDs
  • V-274061
Rule IDs
  • SV-274061r1120171_rule
Using an authentication device, such as a DOD Common Access Card (CAC) or token that is separate from the information system, ensures that even if the information system is compromised, credentials stored on the authentication device will not be affected. Multifactor solutions that require devices separate from information systems gaining access include, for example, hardware tokens providing time-based or challenge-response authenticators and smart cards such as the U.S. Government Personal Identity Verification (PIV) card and the DOD CAC. Amazon Linux 2023 includes multiple options for configuring certificate status checking, but for this requirement focuses on the System Security Services Daemon (SSSD). By default, SSSD performs Online Certificate Status Protocol (OCSP) checking and certificate verification using a sha256 digest function. Satisfies: SRG-OS-000375-GPOS-00160, SRG-OS-000377-GPOS-00162
Checks: C-78152r1120169_chk

Note: If the system administrator (SA) demonstrates the use of an approved alternate multifactor authentication method, this requirement is not applicable. Verify Amazon Linux 2023 implements Online Certificate Status Protocol (OCSP) and is using the proper digest value on the system with the following command: $ sudo grep -ir certificate_verification /etc/sssd/sssd.conf /etc/sssd/conf.d/ | grep -v "^#" certificate_verification = ocsp_dgst=sha512 If the certificate_verification line is missing from the [sssd] section, or is missing "ocsp_dgst=sha512", ask the administrator to indicate what type of multifactor authentication is being utilized and how the system implements certificate status checking. If there is no evidence of certificate status checking being used, this is a finding.

Fix: F-78057r1120170_fix

Configure Amazon Linux 2023 to implement certificate status checking for multifactor authentication. Review the "/etc/sssd/conf.d/certificate_verification.conf" file to determine if the system is configured to prevent OCSP or certificate verification. Add the following line to the "/etc/sssd/conf.d/certificate_verification.conf" file: certificate_verification = ocsp_dgst=sha512 Set the correct ownership and permissions on the "/etc/sssd/conf.d/certificate_verification.conf" file by running these commands: $ sudo chown root:root "/etc/sssd/conf.d/certificate_verification.conf" $ sudo chmod 600 "/etc/sssd/conf.d/certificate_verification.conf" The "sssd" service must be restarted for the changes to take effect. To restart the "sssd" service, run the following command: $ sudo systemctl restart sssd.service

b
Amazon Linux 2023 must prohibit the use of cached authenticators after one day.
IA-5 - Medium - CCI-002007 - V-274062 - SV-274062r1120174_rule
RMF Control
IA-5
Severity
Medium
CCI
CCI-002007
Version
AZLX-23-001305
Vuln IDs
  • V-274062
Rule IDs
  • SV-274062r1120174_rule
If cached authentication information is out-of-date, the validity of the authentication information may be questionable.
Checks: C-78153r1120172_chk

Verify Amazon Linux 2023 is configured so that the System Security Services Daemon (SSSD) prohibits the use of cached authentications after one day. Note: Cached authentication settings should be configured even if smart card authentication is not used on the system. Check that SSSD allows cached authentications with the following command: $ sudo grep -ir cache_credentials /etc/sssd/sssd.conf /etc/sssd/conf.d/ /etc/sssd/sssd.conf:cache_credentials = true If "cache_credentials" is set to "false" or missing from the configuration file, this is not a finding and no further checks are required. If "cache_credentials" is set to "true", check that SSSD prohibits the use of cached authentications after one day with the following command: $ sudo grep -ir offline_credentials_expiration /etc/sssd/sssd.conf /etc/sssd/conf.d/ /etc/sssd/sssd.conf:offline_credentials_expiration = 1 If "offline_credentials_expiration" is not set to a value of "1", this is a finding.

Fix: F-78058r1120173_fix

Configure Amazon Linux 2023 SSSD service to prohibit the use of cached authentications after one day. Add or change the following line in "/etc/sssd/sssd.conf" just below the line [pam]: offline_credentials_expiration = 1

b
Amazon Linux 2023, for PKI-based authentication, must validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor.
IA-5 - Medium - CCI-000185 - V-274063 - SV-274063r1120712_rule
RMF Control
IA-5
Severity
Medium
CCI
CCI-000185
Version
AZLX-23-001310
Vuln IDs
  • V-274063
Rule IDs
  • SV-274063r1120712_rule
Without path validation, an informed trust decision by the relying party cannot be made when presented with any certificate not already explicitly trusted. A trust anchor is an authoritative entity represented via a public key and associated data. It is used in the context of public key infrastructures, X.509 digital certificates, and DNSSEC. When there is a chain of trust, usually the top entity to be trusted becomes the trust anchor; it can be, for example, a Certification Authority (CA). A certification path starts with the subject certificate and proceeds through a number of intermediate certificates up to a trusted root certificate, typically issued by a trusted CA. This requirement verifies that a certification path to an accepted trust anchor is used for certificate validation and that the path includes status information. Path validation is necessary for a relying party to make an informed trust decision when presented with any certificate not already explicitly trusted. Status information for certification paths includes certificate revocation lists or online certificate status protocol responses. Validation of the certificate status information is out of scope for this requirement. Satisfies: SRG-OS-000066-GPOS-00034, SRG-OS-000775-GPOS-00230, SRG-OS-000384-GPOS-00167, SRG-OS-000403-GPOS-00182
Checks: C-78154r1120175_chk

Note: If the system administrator (SA) demonstrates the use of an approved alternate multifactor authentication method, this requirement is not applicable. Verify Amazon Linux 2023 for PKI-based authentication has valid certificates by constructing a certification path (which includes status information) to an accepted trust anchor. Check that the system has a valid DOD root CA installed with the following command: $ sudo openssl x509 -text -in /etc/sssd/pki/sssd_auth_ca_db.pem Certificate: Data: Version: 3 (0x2) Serial Number: 1 (0x1) Signature Algorithm: sha256WithRSAEncryption Issuer: C = US, O = U.S. Government, OU = DOD, OU = PKI, CN = DOD Root CA 3 Validity Not Before: Mar 20 18:46:41 2012 GMT Not After : Dec 30 18:46:41 2029 GMT Subject: C = US, O = U.S. Government, OU = DOD, OU = PKI, CN = DOD Root CA 3 Subject Public Key Info: Public Key Algorithm: rsaEncryption If the root ca file is not a DOD-issued certificate with a valid date and installed in the /etc/sssd/pki/sssd_auth_ca_db.pem location, this is a finding.

Fix: F-78059r1120711_fix

Configure Amazon Linux 2023 to have valid certificates by using AWS Certificate Manager (ACM) or another certificate manager to manage SSL/TLS certificates. In the AWS Management Console, request or import the necessary SSL/TLS certificates into ACM. ACM will handle the certificate lifecycle management, including validation and trust chain establishment.

b
Amazon Linux 2023, for PKI-based authentication, must enforce authorized access to the corresponding private key.
IA-5 - Medium - CCI-000186 - V-274064 - SV-274064r1120180_rule
RMF Control
IA-5
Severity
Medium
CCI
CCI-000186
Version
AZLX-23-001315
Vuln IDs
  • V-274064
Rule IDs
  • SV-274064r1120180_rule
If the private key is discovered, an attacker can use the key to authenticate as an authorized user and gain access to the network infrastructure. The cornerstone of the PKI is the private key used to encrypt or digitally sign information. If the private key is stolen, this will lead to the compromise of the authentication and nonrepudiation gained through PKI because the attacker can use the private key to digitally sign documents and pretend to be the authorized user. Both the holders of a digital certificate and the issuing authority must protect the computers, storage devices, or whatever they use to keep the private keys.
Checks: C-78155r1120178_chk

Verify Amazon Linux 2023 SSH private key files have a passcode. For each private key stored on the system, use the following command: $ sudo ssh-keygen -y -f /path/to/file If the contents of the key are displayed, this is a finding.

Fix: F-78060r1120179_fix

Configure Amazon Linux 2023 SSH private key files to have a passcode. Create a new private and public key pair that utilizes a passcode with the following command: $ sudo ssh-keygen -n [passphrase]

b
Amazon Linux 2023 must display the Standard Mandatory DOD Notice and Consent Banner before granting local or remote access to the system.
AC-8 - Medium - CCI-000048 - V-274065 - SV-274065r1120699_rule
RMF Control
AC-8
Severity
Medium
CCI
CCI-000048
Version
AZLX-23-002000
Vuln IDs
  • V-274065
Rule IDs
  • SV-274065r1120699_rule
Display of a standardized and approved use notification before granting access to Amazon Linux 2023 ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. System use notifications are required only for access via logon interfaces with human users and are not required when such human interfaces do not exist. The banner must be formatted in accordance with applicable DOD policy. Use the following verbiage for operating systems that can accommodate banners of 1300 characters: "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." Use the following verbiage for operating systems that have severe limitations on the number of characters that can be displayed in the banner: "I've read & consent to terms in IS user agreem't."
Checks: C-78156r1120698_chk

Verify Amazon Linux 2023 displays the Standard Mandatory DOD Notice and Consent Banner before granting access to the system over any publicly accessible connection. View the file specified by the banner keyword to check that it matches the text of the Standard Mandatory DOD Notice and Consent Banner with the following command: $ more /etc/issue "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." If the system does not display a logon banner or the banner text does not match the Standard Mandatory DOD Notice and Consent Banner, this is a finding.

Fix: F-78061r1120182_fix

Configure Amazon Linux 2023 to display the Standard Mandatory DOD Notice and Consent Banner before granting access to the system via the ssh. Edit the "/etc/issue" file to replace the default text with the Standard Mandatory DOD Notice and Consent Banner. The DOD-required text is: "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests -- not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details."

b
Amazon Linux 2023 must display the Standard Mandatory DOD Notice and Consent Banner before granting local or remote access to the system via a SSH logon.
AC-8 - Medium - CCI-001384 - V-274066 - SV-274066r1120186_rule
RMF Control
AC-8
Severity
Medium
CCI
CCI-001384
Version
AZLX-23-002005
Vuln IDs
  • V-274066
Rule IDs
  • SV-274066r1120186_rule
Display of a standardized and approved use notification before granting access to the publicly accessible operating system ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. System use notifications are required only for access via logon interfaces with human users and are not required when such human interfaces do not exist. The banner must be formatted in accordance with applicable DOD policy. Use the following verbiage for operating systems that can accommodate banners of 1300 characters: "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." Use the following verbiage for operating systems that have severe limitations on the number of characters that can be displayed in the banner: "I've read & consent to terms in IS user agreem't."
Checks: C-78157r1120184_chk

Verify Amazon Linux 2023 displays the Standard Mandatory DOD Notice and Consent Banner before granting access to the system from any SSH connection. Check for the location of the banner file being used with the following command: $ sudo /usr/sbin/sshd -dd 2&gt;&amp;1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH '^\s*banner' /etc/ssh/sshd_config.d/80-bannerPointer.conf:Banner /etc/issue This command will return the banner keyword and the name of the file that contains the SSH banner (in this case "/etc/issue"). If the line is commented out, this is a finding.

Fix: F-78062r1120185_fix

Configure Amazon Linux 2023 to display the Standard Mandatory DOD Notice and Consent Banner before granting access to the system via ssh. Edit the "etc/ssh/sshd_config" file or a file in "/etc/ssh/sshd_config.d" to uncomment the banner keyword and configure it to point to a file that will contain the logon banner (this file may be named differently or be in a different location if using a version of SSH that is provided by a third-party vendor). An example configuration line is: Banner /etc/issue

b
Amazon Linux 2023 must allocate audit record storage capacity to store at least one week's worth of audit records, when audit records are not immediately sent to a central audit record storage facility.
AU-4 - Medium - CCI-001849 - V-274067 - SV-274067r1120653_rule
RMF Control
AU-4
Severity
Medium
CCI
CCI-001849
Version
AZLX-23-002015
Vuln IDs
  • V-274067
Rule IDs
  • SV-274067r1120653_rule
To ensure operating systems have a sufficient storage capacity in which to write the audit logs, operating systems must be able to allocate audit record storage capacity.
Checks: C-78158r1120187_chk

Verify Amazon Linux 2023 allocates audit record storage capacity to store at least one week of audit records when audit records are not immediately sent to a central audit record storage facility. Note: The partition size needed to capture a week of audit records is based on the activity level of the system and the total storage capacity available. Typically 10.0 GB of storage space for audit records should be sufficient. Determine which partition the audit records are being written to with the following command: $ sudo grep log_file /etc/audit/auditd.conf log_file = /var/log/audit/audit.log Check the size of the partition that audit records are written to with the following command and verify whether it is sufficiently large: # df -h /var/log/audit/ /dev/sda2 24G 10.4G 13.6G 43% /var/log/audit If the audit record partition is not allocated for sufficient storage capacity, this is a finding.

Fix: F-78063r1120652_fix

Configure Amazon Linux 2023 to provide adequate storage for at least one-week of audit logs when audit records are not immediately sent to a central audit record storage facility. If the storage partition is not large enough for at least one week of audit logs, then either: 1. Resize the partition to ensure there is enough storage capacity. 2. Create a new partition for the audit logs.

a
Amazon Linux 2023 must use a separate file system for the system audit data path.
AU-4 - Low - CCI-001849 - V-274068 - SV-274068r1120192_rule
RMF Control
AU-4
Severity
Low
CCI
CCI-001849
Version
AZLX-23-002020
Vuln IDs
  • V-274068
Rule IDs
  • SV-274068r1120192_rule
Placing "/var/log/audit" in its own partition enables better separation between audit files and other system files and helps ensure that auditing cannot be halted due to the partition running out of space.
Checks: C-78159r1120190_chk

Verify Amazon Linux 2023 has a separate file system/partition created for the system audit data path with the following command: Note: /var/log/audit is used as the example as it is a common location. $ mount | grep /var/log/audit UUID=2efb2979-45ac-82d7-0ae632d11f51 on /var/log/home type xfs (rw,realtime,seclabel,attr2,inode64)

Fix: F-78064r1120191_fix

Configure Amazon Linux 2023 to have a separate file system/partition for the system audit data path. Migrate the system audit data path onto a separate partition.

b
Amazon Linux 2023 must label all off-loaded audit logs before sending them to the central log server.
AU-4 - Medium - CCI-001851 - V-274069 - SV-274069r1120195_rule
RMF Control
AU-4
Severity
Medium
CCI
CCI-001851
Version
AZLX-23-002025
Vuln IDs
  • V-274069
Rule IDs
  • SV-274069r1120195_rule
Enriched logging is needed to determine who, what, and when events occur on a system. Without this, determining root cause of an event will be much more difficult.
Checks: C-78160r1120193_chk

Verify Amazon Linux 2023 is configured so that the Audit Daemon labels all off-loaded audit logs with the following command: $ sudo grep name_format /etc/audit/auditd.conf name_format = hostname If the "name_format" option is not "hostname", "fqd", or "numeric", or the line is commented out, this is a finding.

Fix: F-78065r1120194_fix

Configure Amazon Linux 2023 to be configured so that the Audit Daemon labels all off-loaded audit logs. Edit the /etc/audit/auditd.conf file and add or update the "name_format" option: name_format = hostname The audit daemon must be restarted for changes to take effect.

b
Amazon Linux 2023 must take appropriate action when the internal event queue is full.
AU-4 - Medium - CCI-001851 - V-274070 - SV-274070r1120198_rule
RMF Control
AU-4
Severity
Medium
CCI
CCI-001851
Version
AZLX-23-002030
Vuln IDs
  • V-274070
Rule IDs
  • SV-274070r1120198_rule
The audit system should have an action setup in the event the internal event queue becomes full so that no data is lost. Information stored in one location is vulnerable to accidental or incidental deletion or alteration.
Checks: C-78161r1120196_chk

Verify Amazon Linux 2023 audit system is configured to take an appropriate action when the internal event queue is full: $ sudo grep -i overflow_action /etc/audit/auditd.conf overflow_action = syslog If the value of the "overflow_action" option is not set to "syslog", "single", "halt" or the line is commented out, ask the system administrator (SA) to indicate how the audit logs are off-loaded to a different system or media. If there is no evidence that the transfer of the audit logs being off-loaded to another system or media takes appropriate action if the internal event queue becomes full, this is a finding.

Fix: F-78066r1120197_fix

Configure Amazon Linux 2023 so that the audit system takes an appropriate action when the internal event queue is full. Edit the /etc/audit/auditd.conf file and add or update the "overflow_action" option: overflow_action = syslog The audit daemon must be restarted for changes to take effect.

b
Amazon Linux 2023 must take action when allocated audit record storage volume reaches 75 percent of the repository maximum audit record storage capacity.
AU-5 - Medium - CCI-001855 - V-274071 - SV-274071r1120201_rule
RMF Control
AU-5
Severity
Medium
CCI
CCI-001855
Version
AZLX-23-002035
Vuln IDs
  • V-274071
Rule IDs
  • SV-274071r1120201_rule
If security personnel are not notified immediately when storage volume reaches 75 percent utilization, they are unable to plan for audit record storage capacity expansion.
Checks: C-78162r1120199_chk

Verify Amazon Linux 2023 takes action when allocated audit record storage volume reaches 75 percent of the repository maximum audit record storage capacity with the following command: $ sudo grep -w space_left /etc/audit/auditd.conf space_left = 25% If the value of the "space_left" keyword is not set to 25 percent of the storage volume allocated to audit logs, or if the line is commented out, ask the system administrator (SA) to indicate how the system is providing real-time alerts to the SA and information system security officer (ISSO). If the "space_left" value is not configured to the correct value, this is a finding.

Fix: F-78067r1120200_fix

Configure Amazon Linux 2023 to take action when the audit log storage volume reaches 75 percent of the maximum storage capacity. Edit /etc/audit/auditd.conf and ensure the parameter "space_left = 25" is configured.

b
Amazon Linux 2023 must notify the system administrator (SA) and information system security officer (ISSO) (at a minimum) when allocated audit record storage volume 75 percent utilization.
AU-5 - Medium - CCI-001855 - V-274072 - SV-274072r1120204_rule
RMF Control
AU-5
Severity
Medium
CCI
CCI-001855
Version
AZLX-23-002040
Vuln IDs
  • V-274072
Rule IDs
  • SV-274072r1120204_rule
If security personnel are not notified immediately when storage volume reaches 75 percent utilization, they are unable to plan for audit record storage capacity expansion.
Checks: C-78163r1120202_chk

Verify Amazon Linux 2023 notifies the SA and ISSO (at a minimum) when allocated audit record storage volume reaches 75 percent of the repository maximum audit record storage capacity with the following command: $ sudo grep -w space_left_action /etc/audit/auditd.conf space_left_action = email If the value of the "space_left_action" is not set to "email", or if the line is commented out, ask the SA to indicate how the system is providing real-time alerts to the SA and ISSO. If there is no evidence that real-time alerts are configured on the system, this is a finding.

Fix: F-78068r1120203_fix

Configure Amazon Linux 2023 to initiate an action to notify the SA and ISSO (at a minimum) when allocated audit record storage volume reaches 75 percent of the repository maximum audit record storage capacity by adding/modifying the following line in the /etc/audit/auditd.conf file. space_left_action = email

b
Amazon Linux 2023 must take action when allocated audit record storage volume reaches 95 percent of the audit record storage capacity.
AU-5 - Medium - CCI-001855 - V-274073 - SV-274073r1120207_rule
RMF Control
AU-5
Severity
Medium
CCI
CCI-001855
Version
AZLX-23-002045
Vuln IDs
  • V-274073
Rule IDs
  • SV-274073r1120207_rule
If action is not taken when storage volume reaches 95 percent utilization, the auditing system may fail when the storage volume reaches capacity.
Checks: C-78164r1120205_chk

Verify Amazon Linux 2023 takes action when allocated audit record storage volume reaches 95 percent of the repository maximum audit record storage capacity with the following command: $ sudo grep -w admin_space_left /etc/audit/auditd.conf admin_space_left = 5% If the value of the "admin_space_left" keyword is not set to 5 percent of the storage volume allocated to audit logs, or if the line is commented out, ask the system administrator (SA) to indicate how the system is taking action if the allocated storage is about to reach capacity. If the "space_left" value is not configured to the correct value, this is a finding.

Fix: F-78069r1120206_fix

Configure Amazon Linux 2023 to initiate an action when allocated audit record storage volume reaches 95 percent of the repository maximum audit record storage capacity by adding/modifying the following line in the /etc/audit/auditd.conf file. admin_space_left = 5%

b
Amazon Linux 2023 must take action when allocated audit record storage volume reaches 95 percent of the repository maximum audit record storage capacity.
AU-5 - Medium - CCI-001855 - V-274074 - SV-274074r1120210_rule
RMF Control
AU-5
Severity
Medium
CCI
CCI-001855
Version
AZLX-23-002050
Vuln IDs
  • V-274074
Rule IDs
  • SV-274074r1120210_rule
If action is not taken when storage volume reaches 95 percent utilization, the auditing system may fail when the storage volume reaches capacity.
Checks: C-78165r1120208_chk

Verify Amazon Linux 2023 is configured to take action in the event of allocated audit record storage volume reaches 95 percent of the repository maximum audit record storage capacity with the following command: $ sudo grep admin_space_left_action /etc/audit/auditd.conf admin_space_left_action = single If the value of the "admin_space_left_action" is not set to "single", or if the line is commented out, ask the system administrator (SA) to indicate how the system is providing real-time alerts to the SA and information system security officer (ISSO). If there is no evidence that real-time alerts are configured on the system, this is a finding.

Fix: F-78070r1120209_fix

Configure Amazon Linux 2023 so that the auditd service takes action in the event of allocated audit record storage volume reaching 95 percent of the repository maximum audit record storage capacity. Edit the following line in "/etc/audit/auditd.conf" to ensure that the system is forced into single user mode in the event the audit record storage volume is about to reach maximum capacity: admin_space_left_action = single The audit daemon must be restarted for changes to take effect.

b
Amazon Linux 2023 must immediately notify the system administrator (SA) and information system security officer (ISSO), at a minimum, of an audit processing failure event.
AU-5 - Medium - CCI-001855 - V-274075 - SV-274075r1120700_rule
RMF Control
AU-5
Severity
Medium
CCI
CCI-001855
Version
AZLX-23-002055
Vuln IDs
  • V-274075
Rule IDs
  • SV-274075r1120700_rule
It is critical for the appropriate personnel to be aware if a system is at risk of failing to process audit logs as required. Without this notification, the security personnel may be unaware of an impending failure of the audit capability, and system operation may be adversely affected. Audit processing failures include software/hardware errors, failures in the audit capturing mechanisms, and audit storage capacity being reached or exceeded. This requirement applies to each audit data storage repository (i.e., distinct information system component where audit records are stored), the centralized audit storage capacity of organizations (i.e., all audit data storage repositories combined), or both.
Checks: C-78166r1120211_chk

Verify Amazon Linux 2023 is configured to notify the SA and/or ISSO (at a minimum) in the event of an audit processing failure with the following command: $ sudo grep action_mail_acct /etc/audit/auditd.conf action_mail_acct = root If the value of the "action_mail_acct" keyword is not set to "root" and/or other accounts for security personnel, the "action_mail_acct" keyword is missing, or the retuned line is commented out, ask the SA to indicate how they and the ISSO are notified of an audit process failure. If there is no evidence of the proper personnel being notified of an audit processing failure, this is a finding.

Fix: F-78071r1120212_fix

Configure Amazon Linux 2023 to that the auditd service notifies the SA and ISSO in the event of an audit processing failure. Edit the following line in "/etc/audit/auditd.conf" to ensure that administrators are notified via email for those situations: action_mail_acct = root The audit daemon must be restarted for changes to take effect.

b
Amazon Linux 2023 must be configured to off-load audit records onto a different system from the system being audited via syslog.
AU-4 - Medium - CCI-001851 - V-274076 - SV-274076r1120216_rule
RMF Control
AU-4
Severity
Medium
CCI
CCI-001851
Version
AZLX-23-002060
Vuln IDs
  • V-274076
Rule IDs
  • SV-274076r1120216_rule
The auditd service does not include the ability to send audit records to a centralized server for management directly. However, it can use a plug-in for audit event multiplexor (audispd) to pass audit records to the local syslog server.
Checks: C-78167r1120214_chk

Verify Amazon Linux 2023 is configured use the audisp-remote syslog service with the following command: $ sudo grep active /etc/audit/plugins.d/syslog.conf active = yes If the "active" keyword does not have a value of "yes", the line is commented out, or the line is missing, this is a finding.

Fix: F-78072r1120215_fix

Configure Amazon Linux 2023 to use the audisp-remote syslog service. Edit the /etc/audit/plugins.d/syslog.conf file and add or update the "active" option: active = yes The audit daemon must be restarted for changes to take effect.

b
Amazon Linux 2023 must authenticate the remote logging server for off-loading audit logs via rsyslog.
AU-4 - Medium - CCI-001851 - V-274077 - SV-274077r1120219_rule
RMF Control
AU-4
Severity
Medium
CCI
CCI-001851
Version
AZLX-23-002065
Vuln IDs
  • V-274077
Rule IDs
  • SV-274077r1120219_rule
Information stored in one location is vulnerable to accidental or incidental deletion or alteration.
Checks: C-78168r1120217_chk

Verify Amazon Linux 2023 authenticates the remote logging server for off-loading audit logs with the following command: $ sudo grep -i '$ActionSendStreamDriverAuthMode' /etc/rsyslog.conf /etc/rsyslog.d/*.conf /etc/rsyslog.conf:$ActionSendStreamDriverAuthMode x509/name If the value of the "$ActionSendStreamDriverAuthMode" option is not set to "x509/name" or the line is commented out, ask the system administrator (SA) to indicate how the audit logs are off-loaded to a different system or media. If there is no evidence that the transfer of the audit logs being off-loaded to another system or media is encrypted, this is a finding.

Fix: F-78073r1120218_fix

Configure Amazon Linux 2023 to authenticate the remote logging server for off-loading audit logs by setting the following option in "/etc/rsyslog.conf" or "/etc/rsyslog.d/[customfile].conf": $ActionSendStreamDriverAuthMode x509/name

b
Amazon Linux 2023 must encrypt the transfer of audit records off-loaded onto a different system or media from the system being audited via rsyslog.
AU-4 - Medium - CCI-001851 - V-274078 - SV-274078r1120222_rule
RMF Control
AU-4
Severity
Medium
CCI
CCI-001851
Version
AZLX-23-002070
Vuln IDs
  • V-274078
Rule IDs
  • SV-274078r1120222_rule
Information stored in one location is vulnerable to accidental or incidental deletion or alteration.
Checks: C-78169r1120220_chk

Verify Amazon Linux 2023 encrypts audit records off-loaded onto a different system or media from the system being audited via rsyslog with the following command: $ sudo grep -i '$ActionSendStreamDriverMode' /etc/rsyslog.conf /etc/rsyslog.d/*.conf /etc/rsyslog.conf:$ActionSendStreamDriverMode 1 If the value of the "$ActionSendStreamDriverMode" option is not set to "1" or the line is commented out, this is a finding.

Fix: F-78074r1120221_fix

Configure Amazon Linux 2023 to encrypt off-loaded audit records via rsyslog by setting the following options in "/etc/rsyslog.conf" or "/etc/rsyslog.d/[customfile].conf": $ActionSendStreamDriverMode 1

b
Amazon Linux 2023 must encrypt via the gtls driver the transfer of audit records off-loaded onto a different system or media from the system being audited via rsyslog.
AU-4 - Medium - CCI-001851 - V-274079 - SV-274079r1120724_rule
RMF Control
AU-4
Severity
Medium
CCI
CCI-001851
Version
AZLX-23-002075
Vuln IDs
  • V-274079
Rule IDs
  • SV-274079r1120724_rule
Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Off-loading is a common process in information systems with limited audit storage capacity. Support for both internet and Unix domain sockets enables this utility to support both local and remote logging. Coupling this utility with "gnutls" (a secure communications library implementing the SSL, TLS, and DTLS protocols) creates a method to securely encrypt and off-load auditing.
Checks: C-78170r1120223_chk

Verify Amazon Linux 2023 uses the gtls driver to encrypt audit records off-loaded onto a different system or media from the system being audited with the following command: $ sudo grep -i '$DefaultNetstreamDriver' /etc/rsyslog.conf /etc/rsyslog.d/*.conf /etc/rsyslog.conf:$DefaultNetstreamDriver ossl If the value of the "$DefaultNetstreamDriver" option is not set to "ossl" or the line is commented out, this is a finding.

Fix: F-78075r1120224_fix

Configure Amazon Linux 2023 to use the ossl driver to encrypt offloaded audit records by setting the following options in "/etc/rsyslog.conf" or "/etc/rsyslog.d/[customfile].conf": $DefaultNetstreamDriver ossl

a
Amazon Linux 2023 must be configured to off-load audit records onto a different system from the system being audited via syslog.
AU-4 - Low - CCI-001851 - V-274080 - SV-274080r1120228_rule
RMF Control
AU-4
Severity
Low
CCI
CCI-001851
Version
AZLX-23-002080
Vuln IDs
  • V-274080
Rule IDs
  • SV-274080r1120228_rule
The auditd service does not include the ability to send audit records to a centralized server for management directly. However, it can use a plug-in for audit event multiplexor (audispd) to pass audit records to the local syslog server. Satisfies: SRG-OS-000342-GPOS-00133, SRG-OS-000479-GPOS-00224
Checks: C-78171r1120226_chk

Verify Amazon Linux 2023 off-loads audit records onto a different system with the following command: $ more /etc/systemd/journal-upload.conf [Upload] URL=192.168.21.2 ServerKeyFile=/etc/ssl/private/journal-upload.pem ServerCertificateFile=/etc/ssl/certs/journal-upload.pem TrustedCertificateFile=/etc/ssl/ca/trusted.pem If all of the entries do not have values, are commented out, or are missing, this is a finding.

Fix: F-78076r1120227_fix

Configure Amazon Linux 2023 to off-load audit records onto a different system or media from the system being audited. If using systemd-journal-upload: Edit "/etc/systemd/journal-upload.conf" with the appropriate configuration: [Upload] URL=https://[server.domain]:[port]

b
Amazon Linux 2023 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/sudoers.
AC-2 - Medium - CCI-000018 - V-274081 - SV-274081r1120231_rule
RMF Control
AC-2
Severity
Medium
CCI
CCI-000018
Version
AZLX-23-002085
Vuln IDs
  • V-274081
Rule IDs
  • SV-274081r1120231_rule
The actions taken by system administrators must be audited to keep a record of what was executed on the system, as well as for accountability purposes. Editing the sudoers file may be sign of an attacker trying to establish persistent methods to a system, auditing the editing of the sudoers files mitigates this risk. Satisfies: SRG-OS-000004-GPOS-00004, SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000304-GPOS-00121, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000470-GPOS-00214, SRG-OS-000471-GPOS-00215, SRG-OS-000239-GPOS-00089, SRG-OS-000240-GPOS-00090, SRG-OS-000241-GPOS-00091, SRG-OS-000303-GPOS-00120, SRG-OS-000466-GPOS-00210, SRG-OS-000476-GPOS-00221
Checks: C-78172r1120229_chk

Verify Amazon Linux 2023 generates audit records for all account creations, modifications, disabling, and termination events that affect "/etc/sudoers" with the following command: $ sudo auditctl -l | grep '/etc/sudoers[^.]' -w /etc/sudoers -p wa -k identity If the command does not return a line, or the line is commented out, this is a finding.

Fix: F-78077r1120230_fix

Configure Amazon Linux 2023 to generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/sudoers". Add or update the following file system rule to "/etc/audit/rules.d/audit.rules": -w /etc/sudoers -p wa -k identity To load the rules to the kernel immediately, use the following command: $ sudo augenrules --load

b
Amazon Linux 2023 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/sudoers.d/ directory.
AC-2 - Medium - CCI-000018 - V-274082 - SV-274082r1120234_rule
RMF Control
AC-2
Severity
Medium
CCI
CCI-000018
Version
AZLX-23-002090
Vuln IDs
  • V-274082
Rule IDs
  • SV-274082r1120234_rule
The actions taken by system administrators must be audited to keep a record of what was executed on the system, as well as for accountability purposes. Editing the sudoers file may be sign of an attacker trying to establish persistent methods to a system, auditing the editing of the sudoers files mitigates this risk. Satisfies: SRG-OS-000004-GPOS-00004, SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000304-GPOS-00121, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000470-GPOS-00214, SRG-OS-000471-GPOS-00215, SRG-OS-000239-GPOS-00089, SRG-OS-000240-GPOS-00090, SRG-OS-000241-GPOS-00091, SRG-OS-000303-GPOS-00120, SRG-OS-000466-GPOS-00210, SRG-OS-000476-GPOS-00221
Checks: C-78173r1120232_chk

Verify Amazon Linux 2023 generates audit records for all account creations, modifications, disabling, and termination events that affect "/etc/sudoers.d/" with the following command: $ sudo auditctl -l | grep /etc/sudoers.d -w /etc/sudoers.d/ -p wa -k identity If the command does not return a line, or the line is commented out, this is a finding.

Fix: F-78078r1120233_fix

Configure Amazon Linux 2023 to generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/sudoers.d/". Add or update the following file system rule to "/etc/audit/rules.d/audit.rules": -w /etc/sudoers.d/ -p wa -k identity To load the rules to the kernel immediately, use the following command: $ sudo augenrules --load

b
Amazon Linux 2023 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/group.
AC-2 - Medium - CCI-000018 - V-274083 - SV-274083r1120237_rule
RMF Control
AC-2
Severity
Medium
CCI
CCI-000018
Version
AZLX-23-002095
Vuln IDs
  • V-274083
Rule IDs
  • SV-274083r1120237_rule
In addition to auditing new user and group accounts, these watches will alert the system administrator(s) to any modifications. Any unexpected users, groups, or modifications must be investigated for legitimacy. Satisfies: SRG-OS-000004-GPOS-00004, SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000304-GPOS-00121, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000470-GPOS-00214, SRG-OS-000471-GPOS-00215, SRG-OS-000239-GPOS-00089, SRG-OS-000240-GPOS-00090, SRG-OS-000241-GPOS-00091, SRG-OS-000303-GPOS-00120, SRG-OS-000466-GPOS-00210, SRG-OS-000476-GPOS-00221
Checks: C-78174r1120235_chk

Verify Amazon Linux 2023 generates audit records for all account creations, modifications, disabling, and termination events that affect "/etc/group" with the following command: $ sudo auditctl -l | egrep '(/etc/group)' -w /etc/group -p wa -k identity If the command does not return a line, or the line is commented out, this is a finding.

Fix: F-78079r1120236_fix

Configure Amazon Linux 2023 to generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/group". Add or update the following file system rule to "/etc/audit/rules.d/audit.rules": -w /etc/group -p wa -k identity To load the rules to the kernel immediately, use the following command: $ sudo augenrules --load

b
Amazon Linux 2023 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/gshadow.
AC-2 - Medium - CCI-000018 - V-274084 - SV-274084r1120240_rule
RMF Control
AC-2
Severity
Medium
CCI
CCI-000018
Version
AZLX-23-002100
Vuln IDs
  • V-274084
Rule IDs
  • SV-274084r1120240_rule
In addition to auditing new user and group accounts, these watches will alert the system administrator(s) to any modifications. Any unexpected users, groups, or modifications must be investigated for legitimacy. Satisfies: SRG-OS-000004-GPOS-00004, SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000304-GPOS-00121, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000470-GPOS-00214, SRG-OS-000471-GPOS-00215, SRG-OS-000239-GPOS-00089, SRG-OS-000240-GPOS-00090, SRG-OS-000241-GPOS-00091, SRG-OS-000303-GPOS-00120, SRG-OS-000466-GPOS-00210, SRG-OS-000476-GPOS-00221
Checks: C-78175r1120238_chk

Verify Amazon Linux 2023 generates audit records for all account creations, modifications, disabling, and termination events that affect "/etc/gshadow" with the following command: $ sudo auditctl -l | egrep '(/etc/gshadow)' -w /etc/gshadow -p wa -k identity If the command does not return a line, or the line is commented out, this is a finding.

Fix: F-78080r1120239_fix

Configure Amazon Linux 2023 to generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/gshadow". Add or update the following file system rule to "/etc/audit/rules.d/audit.rules": -w /etc/gshadow -p wa -k identity To load the rules to the kernel immediately, use the following command: $ sudo augenrules --load

b
Amazon Linux 2023 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/opasswd.
AC-2 - Medium - CCI-000018 - V-274085 - SV-274085r1120243_rule
RMF Control
AC-2
Severity
Medium
CCI
CCI-000018
Version
AZLX-23-002105
Vuln IDs
  • V-274085
Rule IDs
  • SV-274085r1120243_rule
In addition to auditing new user and group accounts, these watches will alert the system administrator(s) to any modifications. Any unexpected users, groups, or modifications must be investigated for legitimacy. Satisfies: SRG-OS-000004-GPOS-00004, SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000304-GPOS-00121, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000470-GPOS-00214, SRG-OS-000471-GPOS-00215, SRG-OS-000239-GPOS-00089, SRG-OS-000240-GPOS-00090, SRG-OS-000241-GPOS-00091, SRG-OS-000303-GPOS-00120, SRG-OS-000466-GPOS-00210, SRG-OS-000476-GPOS-00221
Checks: C-78176r1120241_chk

Verify Amazon Linux 2023 generates audit records for all account creations, modifications, disabling, and termination events that affect "/etc/security/opasswd" with the following command: $ sudo auditctl -l | egrep '(/etc/security/opasswd)' -w /etc/security/opasswd -p wa -k identity If the command does not return a line, or the line is commented out, this is a finding.

Fix: F-78081r1120242_fix

Configure Amazon Linux 2023 to generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/security/opasswd". Add or update the following file system rule to "/etc/audit/rules.d/audit.rules": -w /etc/security/opasswd -p wa -k identity To load the rules to the kernel immediately, use the following command: $ sudo augenrules --load

b
Amazon Linux 2023 must audit uses of the "execve" system call.
AC-6 - Medium - CCI-002233 - V-274086 - SV-274086r1120246_rule
RMF Control
AC-6
Severity
Medium
CCI
CCI-002233
Version
AZLX-23-002110
Vuln IDs
  • V-274086
Rule IDs
  • SV-274086r1120246_rule
Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised information system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider threats and the advanced persistent threat. Satisfies: SRG-OS-000326-GPOS-00126, SRG-OS-000327-GPOS-00127
Checks: C-78177r1120244_chk

Verify Amazon Linux 2023 is configured to audit the execution of the "execve" system call with the following command: $ sudo auditctl -l | grep execve -a always,exit -F arch=b64 -S execve -C uid!=euid -F euid=0 -k execpriv -a always,exit -F arch=b64 -S execve -C gid!=egid -F egid=0 -k execpriv If the command does not return all lines, or the lines are commented out, this is a finding.

Fix: F-78082r1120245_fix

Configure Amazon Linux 2023 to audit the execution of the "execve" system call. Add or update the following file system rules to "/etc/audit/rules.d/audit.rules": -a always,exit -F arch=b64 -S execve -C uid!=euid -F euid=0 -k execpriv -a always,exit -F arch=b64 -S execve -C gid!=egid -F egid=0 -k execpriv To load the rules to the kernel immediately, use the following command: $ sudo augenrules --load

b
Amazon Linux 2023 must audit all uses of the chmod, fchmod, and fchmodat system calls.
AU-3 - Medium - CCI-000130 - V-274087 - SV-274087r1120249_rule
RMF Control
AU-3
Severity
Medium
CCI
CCI-000130
Version
AZLX-23-002115
Vuln IDs
  • V-274087
Rule IDs
  • SV-274087r1120249_rule
Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary since these affect performance. The more rules, the bigger the performance hit. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215, SRG-OS-000064-GPOS-00033, SRG-OS-000466-GPOS-00210, SRG-OS-000458-GPOS-00203
Checks: C-78178r1120247_chk

Verify Amazon Linux 2023 is configured to audit the execution of the "chmod", "fchmod", and "fchmodat" system calls with the following command: $ sudo auditctl -l | grep chmod -a always,exit -F arch=b64 -S chmod,fchmod,fchmodat -F auid&gt;=1000 -F auid!=unset -k perm_mod If the command does not return the expected line, or the line is commented out, this is a finding.

Fix: F-78083r1120248_fix

Configure Amazon Linux 2023 to generate audit records upon successful/unsuccessful attempts to use the "chmod", "fchmod", and "fchmodat" syscalls. Add or update the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F arch=b64 -S chmod,fchmod,fchmodat -F auid>=1000 -F auid!=unset -k perm_mod To load the rule to the kernel immediately, use the following command: $ sudo augenrules --load

b
Amazon Linux 2023 must audit all uses of the chown, fchown, fchownat, and lchown system calls.
AU-3 - Medium - CCI-000130 - V-274088 - SV-274088r1120252_rule
RMF Control
AU-3
Severity
Medium
CCI
CCI-000130
Version
AZLX-23-002120
Vuln IDs
  • V-274088
Rule IDs
  • SV-274088r1120252_rule
Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary since these affect performance. The more rules, the bigger the performance hit. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215, SRG-OS-000064-GPOS-00033, SRG-OS-000466-GPOS-00210, SRG-OS-000458-GPOS-00203
Checks: C-78179r1120250_chk

Verify Amazon Linux 2023 is configured to audit the execution of the "chown", "fchown", "fchownat", and "lchown" system calls with the following command: $ sudo auditctl -l | grep chown -a always,exit -F arch=b64 -S chown,fchown,fchownat,lchown -F auid&gt;=1000 -F auid!=unset -k perm_mod If the command does not return the expected line, or the line is commented out, this is a finding.

Fix: F-78084r1120251_fix

Configure Amazon Linux 2023 to generate audit records upon successful/unsuccessful attempts to use the "chown", "fchown", "fchownat", and "lchown" system calls. Add or update the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F arch=b64 -S chown,fchown,fchownat,lchown -F auid>=1000 -F auid!=unset -k perm_mod To load the rule to the kernel immediately, use the following command: $ sudo augenrules --load

b
Amazon Linux 2023 must audit all uses of the setxattr, fsetxattr, lsetxattr, removexattr, fremovexattr, and lremovexattr system calls.
AU-3 - Medium - CCI-000130 - V-274089 - SV-274089r1120255_rule
RMF Control
AU-3
Severity
Medium
CCI
CCI-000130
Version
AZLX-23-002125
Vuln IDs
  • V-274089
Rule IDs
  • SV-274089r1120255_rule
Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary since these affect performance. The more rules, the bigger the performance hit. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215, SRG-OS-000064-GPOS-00033, SRG-OS-000466-GPOS-00210, SRG-OS-000471-GPOS-00216, SRG-OS-000458-GPOS-00203, SRG-OS-000474-GPOS-00219
Checks: C-78180r1120253_chk

Verify Amazon Linux 2023 is configured to audit the execution of the "setxattr", "fsetxattr", "lsetxattr", "removexattr", "fremovexattr", and "lremovexattr" system calls with the following command: $ sudo auditctl -l | grep xattr -a always,exit -F arch=b64 -S setxattr,fsetxattr,lsetxattr,removexattr,fremovexattr,lremovexattr -F auid&gt;=1000 -F auid!=unset -k perm_mod -a always,exit -F arch=b64 -S setxattr,fsetxattr,lsetxattr,removexattr,fremovexattr,lremovexattr -F auid=0 -k perm_mod If the audit rules are not defined for the "setxattr", "fsetxattr", "lsetxattr", "removexattr", "fremovexattr", and "lremovexattr" system calls, or any of the lines returned are commented out, this is a finding.

Fix: F-78085r1120254_fix

Configure Amazon Linux 2023 to audit the execution of the "setxattr", "fsetxattr", "lsetxattr", "removexattr", "fremovexattr", and "lremovexattr" system calls by adding or updating the following lines to "/etc/audit/rules.d/audit.rules": -a always,exit -F arch=b64 -S setxattr,fsetxattr,lsetxattr,removexattr,fremovexattr,lremovexattr -F auid>=1000 -F auid!=unset -k perm_mod -a always,exit -F arch=b64 -S setxattr,fsetxattr,lsetxattr,removexattr,fremovexattr,lremovexattr -F auid=0 -k perm_mod To load the rules to the kernel immediately, use the following command: $ sudo augenrules --load

b
Amazon Linux 2023 must audit all uses of the truncate, ftruncate, creat, open, openat, and open_by_handle_at system calls.
AU-3 - Medium - CCI-000130 - V-274090 - SV-274090r1120258_rule
RMF Control
AU-3
Severity
Medium
CCI
CCI-000130
Version
AZLX-23-002130
Vuln IDs
  • V-274090
Rule IDs
  • SV-274090r1120258_rule
Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary since these affect performance. The more rules, the bigger the performance hit. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215, SRG-OS-000064-GPOS-00033, SRG-OS-000466-GPOS-00210, SRG-OS-000458-GPOS-00203
Checks: C-78181r1120256_chk

Verify Amazon Linux 2023 is configured to audit successful/unsuccessful attempts to use the "truncate", "ftruncate", "creat", "open", "openat", and "open_by_handle_at" system calls with the following command: $ sudo auditctl -l | grep 'open\|truncate\|creat' -a always,exit -F arch=b64 -S truncate,ftruncate,creat,open,openat,open_by_handle_at -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -k perm_access -a always,exit -F arch=b64 -S truncate,ftruncate,creat,open,openat,open_by_handle_at -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -k perm_access If the output does not produce rules containing "-F exit=-EPERM", this is a finding. If the output does not produce rules containing "-F exit=-EACCES", this is a finding. If the command does not return an audit rule for "truncate", "ftruncate", "creat", "open", "openat", and "open_by_handle_at" or any of the lines returned are commented out, this is a finding.

Fix: F-78086r1120257_fix

Configure Amazon Linux 2023 to generate an audit event for any successful/unsuccessful use of the "truncate", "ftruncate", "creat", "open", "openat", and "open_by_handle_at" system calls by adding or updating the following rules in the "/etc/audit/rules.d/audit.rules" file: -a always,exit -F arch=b64 -S truncate,ftruncate,creat,open,openat,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -k perm_access -a always,exit -F arch=b64 -S truncate,ftruncate,creat,open,openat,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -k perm_access To load the rules to the kernel immediately, use the following command: $ sudo augenrules --load

b
Amazon Linux 2023 must audit all uses of the init_module and finit_module system calls.
AU-3 - Medium - CCI-000130 - V-274091 - SV-274091r1120261_rule
RMF Control
AU-3
Severity
Medium
CCI
CCI-000130
Version
AZLX-23-002135
Vuln IDs
  • V-274091
Rule IDs
  • SV-274091r1120261_rule
Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary since these affect performance. The more rules, the bigger the performance hit. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215, SRG-OS-000064-GPOS-00033, SRG-OS-000466-GPOS-00210, SRG-OS-000458-GPOS-00203
Checks: C-78182r1120259_chk

Verify Amazon Linux 2023 is configured to audit the execution of the "init_module" and "finit_module" system calls with the following command: $ sudo auditctl -l | grep init_module -a always,exit -F arch=b64 -S init_module,finit_module -F auid&gt;=1000 -F auid!=unset -k module_chng If audit rule is not defined for the "delete_module" system call, or the line returned is commented out, this is a finding.

Fix: F-78087r1120260_fix

Configure Amazon Linux 2023 to generate an audit event for any successful/unsuccessful use of the "init_module" and "finit_module" system calls by adding or updating the following rule in the "/etc/audit/rules.d/audit.rules" file: -a always,exit -F arch=b64 -S init_module,finit_module -F auid>=1000 -F auid!=unset -k module_chng To load the rule to the kernel immediately, use the following command: $ sudo augenrules --load

b
Amazon Linux 2023 must audit all uses of the create_module system call.
AU-3 - Medium - CCI-000130 - V-274092 - SV-274092r1120264_rule
RMF Control
AU-3
Severity
Medium
CCI
CCI-000130
Version
AZLX-23-002140
Vuln IDs
  • V-274092
Rule IDs
  • SV-274092r1120264_rule
Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary since these affect performance. The more rules, the bigger the performance hit. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215, SRG-OS-000064-GPOS-00033, SRG-OS-000466-GPOS-00210, SRG-OS-000458-GPOS-00203
Checks: C-78183r1120262_chk

Verify Amazon Linux 2023 generates audit records when successful/unsuccessful attempts to use the "create_module" syscall occur with the following command: $ sudo auditctl -l | grep "create_module" -a always,exit -F arch=b64 -S create_module -F auid&gt;=1000 -F auid!=-1 -F key=module-change If audit rule is not defined for the "create_module" syscall, this is a finding.

Fix: F-78088r1120263_fix

Configure Amazon Linux 2023 to generate audit records when successful/unsuccessful attempts to use the "create_module" syscall occur. Add or update the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F arch=b64 -S create_module -F auid>=1000 -F auid!=unset -k module-change To load the rule to the kernel immediately, use the following command: $ sudo augenrules --load

b
Amazon Linux 2023 must audit all uses of the kmod command.
AU-3 - Medium - CCI-000130 - V-274093 - SV-274093r1120267_rule
RMF Control
AU-3
Severity
Medium
CCI
CCI-000130
Version
AZLX-23-002145
Vuln IDs
  • V-274093
Rule IDs
  • SV-274093r1120267_rule
Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary since these affect performance. The more rules, the bigger the performance hit. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215, SRG-OS-000064-GPOS-00033, SRG-OS-000466-GPOS-00210, SRG-OS-000458-GPOS-00203
Checks: C-78184r1120265_chk

Verify Amazon Linux 2023 generates audit records when successful/unsuccessful attempts to use the "kmod" command occur. Check the auditing rules in "/etc/audit/audit.rules" with the following command: $ sudo auditctl -l | grep kmod -a always,exit -F path=/usr/bin/kmod -F perm=x -F auid&gt;=1000 -F auid!=unset -k modules If the command does not return a line, or the line is commented out, this is a finding.

Fix: F-78089r1120266_fix

Configure Amazon Linux 2023 to generate audit records upon successful/unsuccessful attempts to use the "kmod" command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/bin/kmod -F perm=x -F auid>=1000 -F auid!=unset -k modules To load the rules to the kernel immediately, use the following command: $ sudo augenrules --load

b
Amazon Linux 2023 must audit all uses of the rename, unlink, rmdir, renameat, and unlinkat system calls.
AU-3 - Medium - CCI-000130 - V-274094 - SV-274094r1120270_rule
RMF Control
AU-3
Severity
Medium
CCI
CCI-000130
Version
AZLX-23-002150
Vuln IDs
  • V-274094
Rule IDs
  • SV-274094r1120270_rule
Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary since these affect performance. The more rules, the bigger the performance hit. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215, SRG-OS-000466-GPOS-00210, SRG-OS-000467-GPOS-00211, SRG-OS-000468-GPOS-00212
Checks: C-78185r1120268_chk

Verify Amazon Linux 2023 is configured to audit successful/unsuccessful attempts to use the "rename", "unlink", "rmdir", "renameat", and "unlinkat" system calls with the following command: $ sudo auditctl -l | grep 'rename\|unlink\|rmdir' -a always,exit -F arch=b64 -S rename,unlink,rmdir,renameat,unlinkat -F auid&gt;=1000 -F auid!=unset -k delete If the command does not return an audit rule for "rename", "unlink", "rmdir", "renameat", and "unlinkat" or any of the lines returned are commented out, this is a finding.

Fix: F-78090r1120269_fix

Configure Amazon Linux 2023 to generate an audit event for any successful/unsuccessful use of the "rename", "unlink", "rmdir", "renameat", and "unlinkat" system calls by adding or updating the following rule in the "/etc/audit/rules.d/audit.rules" file: -a always,exit -F arch=b64 -S rename,unlink,rmdir,renameat,unlinkat -F auid>=1000 -F auid!=unset -k delete To load the rule to the kernel immediately, use the following command: $ sudo augenrules --load

b
Amazon Linux 2023 must audit all uses of the chcon command.
AU-3 - Medium - CCI-000130 - V-274095 - SV-274095r1120273_rule
RMF Control
AU-3
Severity
Medium
CCI
CCI-000130
Version
AZLX-23-002155
Vuln IDs
  • V-274095
Rule IDs
  • SV-274095r1120273_rule
Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary since these affect performance. The more rules, the bigger the performance hit. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000468-GPOS-00212, SRG-OS-000471-GPOS-00215, SRG-OS-000463-GPOS-00207, SRG-OS-000465-GPOS-00209
Checks: C-78186r1120271_chk

Verify Amazon Linux 2023 is configured to audit the execution of the "chcon" command with the following command: $ sudo auditctl -l | grep chcon -a always,exit -F path=/usr/bin/chcon -F perm=x -F auid&gt;=1000 -F auid!=unset -k perm_mod If the command does not return a line, or the line is commented out, this is a finding.

Fix: F-78091r1120272_fix

Configure Amazon Linux 2023 to generate audit records upon successful/unsuccessful attempts to use the "chcon" command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/bin/chcon -F perm=x -F auid>=1000 -F auid!=unset -k perm_mod To load the rules to the kernel immediately, use the following command: $ sudo augenrules --load

b
Amazon Linux 2023 must generate audit records for all account creations, modifications, disabling, and termination events that affect /var/log/faillock.
MA-4 - Medium - CCI-002884 - V-274096 - SV-274096r1120276_rule
RMF Control
MA-4
Severity
Medium
CCI
CCI-002884
Version
AZLX-23-002160
Vuln IDs
  • V-274096
Rule IDs
  • SV-274096r1120276_rule
Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Satisfies: SRG-OS-000392-GPOS-00172, SRG-OS-000470-GPOS-00214, SRG-OS-000473-GPOS-00218
Checks: C-78187r1120274_chk

Verify Amazon Linux 2023 generates audit records for all account creations, modifications, disabling, and termination events that affect "/var/log/faillock" with the following command: $ sudo auditctl -l | grep /var/log/faillock -w /var/log/faillock -p wa -k logins If the command does not return a line, or the line is commented out, this is a finding.

Fix: F-78092r1120275_fix

Configure Amazon Linux 2023 to generate audit records for all account creations, modifications, disabling, and termination events that affect "/var/log/faillock". Add or update the following file system rule to "/etc/audit/rules.d/audit.rules": -w /var/log/faillock -p wa -k logins To load the rules to the kernel immediately, use the following command: $ sudo augenrules --load

b
Amazon Linux 2023 must generate audit records for all account creations, modifications, disabling, and termination events that affect /var/log/lastlog.
AU-3 - Medium - CCI-000130 - V-274097 - SV-274097r1120279_rule
RMF Control
AU-3
Severity
Medium
CCI
CCI-000130
Version
AZLX-23-002165
Vuln IDs
  • V-274097
Rule IDs
  • SV-274097r1120279_rule
Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215, SRG-OS-000473-GPOS-00218, SRG-OS-000470-GPOS-00214
Checks: C-78188r1120277_chk

Verify Amazon Linux 2023 generates audit records for all account creations, modifications, disabling, and termination events that affect "/var/log/lastlog" with the following command: $ sudo auditctl -l | grep /var/log/lastlog -w /var/log/lastlog -p wa -k logins If the command does not return a line, or the line is commented out, this is a finding.

Fix: F-78093r1120278_fix

Configure Amazon Linux 2023 to generate audit records for all account creations, modifications, disabling, and termination events that affect "/var/log/lastlog". Add or update the following file system rule to "/etc/audit/rules.d/audit.rules": -w /var/log/lastlog -p wa -k logins To load the rules to the kernel immediately, use the following command: $ sudo augenrules --load

b
Amazon Linux 2023 must audit all uses of the init command.
AU-12 - Medium - CCI-000172 - V-274098 - SV-274098r1120282_rule
RMF Control
AU-12
Severity
Medium
CCI
CCI-000172
Version
AZLX-23-002175
Vuln IDs
  • V-274098
Rule IDs
  • SV-274098r1120282_rule
Misuse of the init command may cause availability issues for the system.
Checks: C-78189r1120280_chk

Verify Amazon Linux 2023 is configured to audit the execution of the "init" command with the following command: $ sudo auditctl -l | grep init -a always,exit -F path=/usr/sbin/init -F perm=x -F auid&gt;=1000 -F auid!=unset -k privileged-init If the command does not return a line, or the line is commented out, this is a finding.

Fix: F-78094r1120281_fix

Configure Amazon Linux 2023 so that the audit system generates an audit event for any successful/unsuccessful uses of the "init" command by adding or updating the following rule in the "/etc/audit/rules.d/audit.rules" file: -a always,exit -F path=/usr/sbin/init -F perm=x -F auid>=1000 -F auid!=unset -k privileged-init To load the rules to the kernel immediately, use the following command: $ sudo augenrules --load

b
Amazon Linux 2023 must audit all uses of the reboot command.
AU-12 - Medium - CCI-000172 - V-274099 - SV-274099r1120285_rule
RMF Control
AU-12
Severity
Medium
CCI
CCI-000172
Version
AZLX-23-002180
Vuln IDs
  • V-274099
Rule IDs
  • SV-274099r1120285_rule
Misuse of the reboot command may cause availability issues for the system.
Checks: C-78190r1120283_chk

Verify Amazon Linux 2023 is configured to audit the execution of the "reboot" command with the following command: $ sudo auditctl -l | grep reboot -a always,exit -F path=/usr/sbin/reboot -F perm=x -F auid&gt;=1000 -F auid!=unset -k privileged-reboot If the command does not return a line, or the line is commented out, this is a finding.

Fix: F-78095r1120284_fix

Configure Amazon Linux 2023 so that the audit system generates an audit event for any successful/unsuccessful uses of the "reboot" command by adding or updating the following rule in the "/etc/audit/rules.d/audit.rules" file: -a always,exit -F path=/usr/sbin/reboot -F perm=x -F auid>=1000 -F auid!=unset -k privileged-reboot To load the rules to the kernel immediately, use the following command: $ sudo augenrules --load

b
Amazon Linux 2023 must audit all uses of the shutdown command.
AU-12 - Medium - CCI-000172 - V-274100 - SV-274100r1120288_rule
RMF Control
AU-12
Severity
Medium
CCI
CCI-000172
Version
AZLX-23-002185
Vuln IDs
  • V-274100
Rule IDs
  • SV-274100r1120288_rule
Misuse of the shutdown command may cause availability issues for the system.
Checks: C-78191r1120286_chk

Verify Amazon Linux 2023 is configured to audit the execution of the "shutdown" command with the following command: $ sudo auditctl -l | grep shutdown -a always,exit -F path=/usr/sbin/shutdown -F perm=x -F auid&gt;=1000 -F auid!=unset -k privileged-shutdown If the command does not return a line, or the line is commented out, this is a finding.

Fix: F-78096r1120287_fix

Configure Amazon Linux 2023 so that the audit system generates an audit event for any successful/unsuccessful uses of the "shutdown" command by adding or updating the following rule in the "/etc/audit/rules.d/audit.rules" file: -a always,exit -F path=/usr/sbin/shutdown -F perm=x -F auid>=1000 -F auid!=unset -k privileged-shutdown To load the rules to the kernel immediately, use the following command: $ sudo augenrules --load

b
Amazon Linux 2023 audit tools must have a mode of "0755" or less permissive.
AU-9 - Medium - CCI-001493 - V-274101 - SV-274101r1120291_rule
RMF Control
AU-9
Severity
Medium
CCI
CCI-001493
Version
AZLX-23-002190
Vuln IDs
  • V-274101
Rule IDs
  • SV-274101r1120291_rule
Protecting audit information also includes identifying and protecting the tools used to view and manipulate log data. Therefore, protecting audit tools is necessary to prevent unauthorized operation on audit information. Operating systems providing tools to interface with audit information will leverage user permissions and roles identifying the user accessing the tools and the corresponding rights the user enjoys to make access decisions regarding the access to audit tools. Audit tools include, but are not limited to, vendor-provided and open source audit tools needed to successfully view and manipulate audit information system activity and records. Audit tools include custom queries and report generators.
Checks: C-78192r1120289_chk

Verify Amazon Linux 2023 audit tools have a mode of "0755" or less with the following command: $ stat -c "%a %n" /sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/autrace /sbin/auditd /sbin/rsyslogd /sbin/augenrules 755 /sbin/auditctl 755 /sbin/aureport 755 /sbin/ausearch 750 /sbin/autrace 755 /sbin/auditd 755 /sbin/rsyslogd 755 /sbin/augenrules If any of the audit tool files have a mode more permissive than "0755", this is a finding.

Fix: F-78097r1120290_fix

Configure Amazon Linux 2023 audit tools to have a mode of "0755" by running the following command: $ sudo chmod 0755 [audit_tool] Replace "[audit_tool]" with each audit tool that has a more permissive mode than "0755".

b
Amazon Linux 2023 audit tools must be owned by root.
AU-9 - Medium - CCI-001493 - V-274102 - SV-274102r1120294_rule
RMF Control
AU-9
Severity
Medium
CCI
CCI-001493
Version
AZLX-23-002195
Vuln IDs
  • V-274102
Rule IDs
  • SV-274102r1120294_rule
Protecting audit information also includes identifying and protecting the tools used to view and manipulate log data. Therefore, protecting audit tools is necessary to prevent unauthorized operation on audit information. Operating systems providing tools to interface with audit information will leverage user permissions and roles identifying the user accessing the tools and the corresponding rights the user enjoys to make access decisions regarding the access to audit tools. Audit tools include, but are not limited to, vendor-provided and open source audit tools needed to successfully view and manipulate audit information system activity and records. Audit tools include custom queries and report generators.
Checks: C-78193r1120292_chk

Verify Amazon Linux 2023 audit tools are owned by "root" with the following command: $ sudo stat -c "%U %n" /sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/autrace /sbin/auditd /sbin/rsyslogd /sbin/augenrules root /sbin/auditctl root /sbin/aureport root /sbin/ausearch root /sbin/autrace root /sbin/auditd root /sbin/rsyslogd root /sbin/augenrules If any audit tools do not have an owner of "root", this is a finding.

Fix: F-78098r1120293_fix

Configure Amazon Linux 2023 audit tools to be owned by "root" by running the following command: $ sudo chown root [audit_tool] Replace "[audit_tool]" with each audit tool not owned by "root".

b
Amazon Linux 2023 audit tools must be group-owned by root.
AU-9 - Medium - CCI-001493 - V-274103 - SV-274103r1120297_rule
RMF Control
AU-9
Severity
Medium
CCI
CCI-001493
Version
AZLX-23-002200
Vuln IDs
  • V-274103
Rule IDs
  • SV-274103r1120297_rule
Protecting audit information also includes identifying and protecting the tools used to view and manipulate log data. Therefore, protecting audit tools is necessary to prevent unauthorized operation on audit information. Operating systems providing tools to interface with audit information will leverage user permissions and roles identifying the user accessing the tools and the corresponding rights the user enjoys to make access decisions regarding the access to audit tools. Audit tools include, but are not limited to, vendor-provided and open source audit tools needed to successfully view and manipulate audit information system activity and records. Audit tools include custom queries and report generators.
Checks: C-78194r1120295_chk

Verify Amazon Linux 2023 audit tools are group owned by "root" with the following command: $ sudo stat -c "%G %n" /sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/autrace /sbin/auditd /sbin/rsyslogd /sbin/augenrules root /sbin/auditctl root /sbin/aureport root /sbin/ausearch root /sbin/autrace root /sbin/auditd root /sbin/rsyslogd root /sbin/augenrules If any audit tools do not have a group owner of "root", this is a finding.

Fix: F-78099r1120296_fix

Configure Amazon Linux 2023 audit tools to be group-owned by "root" by running the following command: $ sudo chgrp root [audit_tool] Replace "[audit_tool]" with each audit tool not group-owned by "root".

b
Amazon Linux 2023 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/passwd.
AC-2 - Medium - CCI-000018 - V-274104 - SV-274104r1120300_rule
RMF Control
AC-2
Severity
Medium
CCI
CCI-000018
Version
AZLX-23-002205
Vuln IDs
  • V-274104
Rule IDs
  • SV-274104r1120300_rule
Once an attacker establishes access to a system, the attacker often attempts to create a persistent method of reestablishing access. One way to accomplish this is for the attacker to create an account. Auditing account creation actions provides logging that can be used for forensic purposes. Satisfies: SRG-OS-000004-GPOS-00004, SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000304-GPOS-00121, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000470-GPOS-00214, SRG-OS-000471-GPOS-00215, SRG-OS-000239-GPOS-00089, SRG-OS-000240-GPOS-00090, SRG-OS-000241-GPOS-00091, SRG-OS-000303-GPOS-00120, SRG-OS-000466-GPOS-00210, SRG-OS-000476-GPOS-00221, SRG-OS-000274-GPOS-00104, SRG-OS-000275-GPOS-00105, SRG-OS-000276-GPOS-00106, SRG-OS-000277-GPOS-00107
Checks: C-78195r1120298_chk

Verify Amazon Linux 2023 generates audit records for all account creations, modifications, disabling, and termination events that affect "/etc/passwd" with the following command: $ sudo auditctl -l | egrep '(/etc/passwd)' -w /etc/passwd -p wa -k identity If the command does not return a line, or the line is commented out, this is a finding.

Fix: F-78100r1120299_fix

Configure Amazon Linux 2023 to generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/passwd". Enable the auditd daemon so that it can start at boot time: $ sudo systemctl enable auditd Add or update the following file system rule to "/etc/audit/rules.d/audit.rules": -w /etc/passwd -p wa -k identity Then, restart the auditd service for the changes to take effect: $ sudo service auditd restart

b
Amazon Linux 2023 must audit all successful/unsuccessful uses of the chage command.
AU-3 - Medium - CCI-000130 - V-274105 - SV-274105r1120661_rule
RMF Control
AU-3
Severity
Medium
CCI
CCI-000130
Version
AZLX-23-002210
Vuln IDs
  • V-274105
Rule IDs
  • SV-274105r1120661_rule
Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information. At a minimum, the organization must audit the full-text recording of privileged commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215, SRG-OS-000064-GPOS-00033, SRG-OS-000466-GPOS-00210, SRG-OS-000458-GPOS-00203
Checks: C-78196r1120301_chk

Verify Amazon Linux 2023 is configured so that an audit event is generated for any successful/unsuccessful use of the "chage" command by performing the following command to check the file system rules in "/etc/audit/audit.rules": $ sudo grep -w chage /etc/audit/audit.rules -a always,exit -F path=/usr/bin/chage -F perm=x -F auid&gt;=1000 -F auid!=unset -k privileged-chage If the command does not return a line, or the line is commented out, this is a finding.

Fix: F-78101r1120302_fix

Configure Amazon Linux 2023 so that the audit service generates an audit event for any successful/unsuccessful uses of the "chage" command by adding or updating the following rule in the "/etc/audit/rules.d/audit.rules" file: -a always,exit -F path=/usr/bin/chage -F perm=x -F auid>=1000 -F auid!=unset -k privileged-chage To load the rules to the kernel immediately, use the following command: $ sudo augenrules --load

b
Amazon Linux 2023 must alert the information system security officer (ISSO) and system administrator (SA), at a minimum, in the event of an audit processing failure.
AU-5 - Medium - CCI-000139 - V-274106 - SV-274106r1120657_rule
RMF Control
AU-5
Severity
Medium
CCI
CCI-000139
Version
AZLX-23-002215
Vuln IDs
  • V-274106
Rule IDs
  • SV-274106r1120657_rule
It is critical for the appropriate personnel to be aware if a system is at risk of failing to process audit logs as required. Without this notification, the security personnel may be unaware of an impending failure of the audit capability, and system operation may be adversely affected. Audit processing failures include software/hardware errors, failures in the audit capturing mechanisms, and audit storage capacity being reached or exceeded. This requirement applies to each audit data storage repository (i.e., distinct information system component where audit records are stored), the centralized audit storage capacity of organizations (i.e., all audit data storage repositories combined), or both.
Checks: C-78197r1120656_chk

Verify Amazon Linux 2023 is configured to notify the SA and ISSO, at a minimum, in the event of an audit processing failure with the following command: $ sudo grep action_mail_acct /etc/audit/auditd.conf action_mail_acct = root If the value of the "action_mail_acct" keyword is not set to "root" and/or other accounts for security personnel, the "action_mail_acct" keyword is missing, or the retuned line is commented out, ask the SA to indicate how they and the ISSO are notified of an audit process failure. If there is no evidence of the proper personnel being notified of an audit processing failure, this is a finding.

Fix: F-78102r1120305_fix

Configure Amazon Linux 2023 so that the "auditd" service notifies the SA and ISSO in the event of an audit processing failure. Edit the following line in "/etc/audit/auditd.conf" to ensure administrators are notified via email for those situations: action_mail_acct = root

b
Amazon Linux 2023 must off-load audit records onto a different system in the event the audit storage volume is full.
AU-4 - Medium - CCI-001851 - V-274107 - SV-274107r1120309_rule
RMF Control
AU-4
Severity
Medium
CCI
CCI-001851
Version
AZLX-23-002220
Vuln IDs
  • V-274107
Rule IDs
  • SV-274107r1120309_rule
Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Off-loading is a common process in information systems with limited audit storage capacity.
Checks: C-78198r1120307_chk

Verify Amazon Linux 2023 takes the appropriate action when the audit storage volume is full using the following command: $ sudo grep disk_full_action /etc/audit/auditd.conf disk_full_action = SYSLOG If the value of the "disk_full_action" option is not "SYSLOG", "SINGLE", or "HALT", or the line is commented out, ask the system administrator to indicate how the system takes appropriate action when an audit storage volume is full. If there is no evidence of appropriate action, this is a finding.

Fix: F-78103r1120308_fix

Configure Amazon Linux 2023 to off-load audit logs in the event the audit storage volume becomes full. Add or update the following line (depending on configuration "disk_full_action" can be set to "SYSLOG" or "SINGLE" depending on configuration) in "/etc/audit/auditd.conf" file: disk_full_action = SYSLOG

b
Amazon Linux 2023 audit logs must be group-owned by root or by a restricted logging group to prevent unauthorized read access.
AU-9 - Medium - CCI-000162 - V-274108 - SV-274108r1120312_rule
RMF Control
AU-9
Severity
Medium
CCI
CCI-000162
Version
AZLX-23-002225
Vuln IDs
  • V-274108
Rule IDs
  • SV-274108r1120312_rule
Unauthorized disclosure of audit records can reveal system and configuration data to attackers, thus compromising its confidentiality. Audit information includes all information (e.g., audit records, audit settings, audit reports) needed to successfully audit operating system activity. Satisfies: SRG-OS-000057-GPOS-00027, SRG-OS-000058-GPOS-00028, SRG-OS-000059-GPOS-00029, SRG-OS-000206-GPOS-00084
Checks: C-78199r1120310_chk

Verify Amazon Linux 2023 audit logs are group-owned by "root" or a restricted logging group. First determine if a group other than "root" has been assigned to the audit logs with the following command: $ sudo grep log_group /etc/audit/auditd.conf log_group = root Then determine where the audit logs are stored with the following command: $ sudo grep -iw log_file /etc/audit/auditd.conf log_file = /var/log/audit/audit.log Then using the location of the audit log file, determine if the audit log is group-owned by "root" using the following command: $ sudo stat -c "%G %n" /var/log/audit/audit.log root /var/log/audit/audit.log If the audit log is not group-owned by "root" or the configured alternative logging group, this is a finding.

Fix: F-78104r1120311_fix

Configure Amazon Linux 2023 so that audit logs are group-owned by "root" or a restricted logging group. Change the group of the directory of "/var/log/audit" to be owned by a correct group. Identify the group that is configured to own audit log: $ sudo grep -P '^[ ]*log_group[ ]+=.*$' /etc/audit/auditd.conf Change the ownership to that group: $ sudo chgrp ${GROUP} /var/log/audit

b
Amazon Linux 2023 audit log directory must be owned by root to prevent unauthorized read access.
AU-9 - Medium - CCI-000162 - V-274109 - SV-274109r1120315_rule
RMF Control
AU-9
Severity
Medium
CCI
CCI-000162
Version
AZLX-23-002230
Vuln IDs
  • V-274109
Rule IDs
  • SV-274109r1120315_rule
Unauthorized disclosure of audit records can reveal system and configuration data to attackers, thus compromising its confidentiality. Audit information includes all information (e.g., audit records, audit settings, audit reports) needed to successfully audit operating system activity. Satisfies: SRG-OS-000057-GPOS-00027, SRG-OS-000058-GPOS-00028, SRG-OS-000059-GPOS-00029, SRG-OS-000206-GPOS-00084
Checks: C-78200r1120313_chk

Verify Amazon Linux 2023 audit logs directory is owned by "root". First determine where the audit logs are stored with the following command: $ sudo grep -iw log_file /etc/audit/auditd.conf log_file = /var/log/audit/audit.log Then using the location of the audit log file, determine if the audit log directory is owned by "root" using the following command: $ sudo ls -ld /var/log/audit drwx------ 2 root root 23 Jun 11 11:56 /var/log/audit If the audit log directory is not owned by "root", this is a finding.

Fix: F-78105r1120314_fix

Configure Amazon Linux 2023 so that the audit logs directory is protected from unauthorized read access by setting the correct owner as "root" with the following command: $ sudo chown root /var/log/audit

b
Amazon Linux 2023 audit logs file must have mode "0600" or less permissive to prevent unauthorized access to the audit log.
AU-9 - Medium - CCI-000162 - V-274110 - SV-274110r1120318_rule
RMF Control
AU-9
Severity
Medium
CCI
CCI-000162
Version
AZLX-23-002235
Vuln IDs
  • V-274110
Rule IDs
  • SV-274110r1120318_rule
Unauthorized disclosure of audit records can reveal system and configuration data to attackers, thus compromising its confidentiality. Audit information includes all information (e.g., audit records, audit settings, audit reports) needed to successfully audit operating system activity. Satisfies: SRG-OS-000057-GPOS-00027, SRG-OS-000058-GPOS-00028, SRG-OS-000059-GPOS-00029, SRG-OS-000206-GPOS-00084
Checks: C-78201r1120316_chk

Verify Amazon Linux 2023 audit logs have a mode of "0600". First determine where the audit logs are stored with the following command: $ sudo grep -iw log_file /etc/audit/auditd.conf log_file = /var/log/audit/audit.log Then using the location of the audit log file, determine if the audit log files as a mode of "0640" with the following command: $ sudo find /var/log/audit/ -type f -exec stat -c '%a %n' {} \; 600 /var/log/audit/audit.log If the audit logs have a mode more permissive than "0600", this is a finding.

Fix: F-78106r1120317_fix

Configure Amazon Linux 2023 so that the audit logs have a mode of "0600". Replace "[audit_log_file]" to the correct audit log path, by default this location is "/var/log/audit/audit.log". $ sudo chmod 0600 /var/log/audit/[audit_log_file] Check the group that owns the system audit logs: $ sudo grep -iw log_group /etc/audit/auditd.conf If the log_group is not defined or it is set to root, configure the permissions as follows: $ sudo chmod 0640 $log_file $ sudo chmod 0440 $log_file.* Otherwise, configure the permissions as follows: $ sudo chmod 0600 $log_file $ sudo chmod 0400 $log_file.*

b
Amazon Linux 2023 must allow only the information system security manager (ISSM) (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited.
AU-12 - Medium - CCI-000171 - V-274111 - SV-274111r1120321_rule
RMF Control
AU-12
Severity
Medium
CCI
CCI-000171
Version
AZLX-23-002240
Vuln IDs
  • V-274111
Rule IDs
  • SV-274111r1120321_rule
Without the capability to restrict which roles and individuals can select which events are audited, unauthorized personnel may be able to prevent the auditing of critical events. Misconfigured audits may degrade the system's performance by overwhelming the audit log. Misconfigured audits may also make it more difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.
Checks: C-78202r1120319_chk

Verify Amazon Linux 2023 is configured so that files in "/etc/audit/rules.d/" and the "/etc/audit/auditd.conf" file have a mode of "0640" or less permissive by using the following commands: $ sudo find /etc/audit/rules.d/ /etc/audit/audit.rules /etc/audit/auditd.conf -type f -exec stat -c "%a %n" {} \; 600 /etc/audit/rules.d/audit.rules 640 /etc/audit/audit.rules 640 /etc/audit/auditd.conf If the files in the "/etc/audit/rules.d/" directory or the "/etc/audit/auditd.conf" file have a mode more permissive than "0640", this is a finding.

Fix: F-78107r1120320_fix

Configure Amazon Linux 2023 so that files in "/etc/audit/rules.d/" and the "/etc/audit/auditd.conf" file have a mode of "0640" or less permissive with the following commands: $ sudo chmod 0640 /etc/audit/rules.d/audit.rules $ sudo chmod 0640 /etc/audit/rules.d/[customrulesfile].rules $ sudo chmod 0640 /etc/audit/auditd.conf

b
Amazon Linux 2023 must audit all uses of the sudo command.
AU-3 - Medium - CCI-000130 - V-274112 - SV-274112r1120324_rule
RMF Control
AU-3
Severity
Medium
CCI
CCI-000130
Version
AZLX-23-002245
Vuln IDs
  • V-274112
Rule IDs
  • SV-274112r1120324_rule
Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000064-GPOS-00033, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000466-GPOS-00210, SRG-OS-000471-GPOS-00215
Checks: C-78203r1120322_chk

Verify Amazon Linux 2023 is configured to audit the execution of the "sudo" command with the following command: $ sudo auditctl -l | grep '/usr/bin/sudo\b' -a always,exit -S all -F path=/usr/bin/sudo -F perm=x -F auid&gt;=1000 -F auid!=-1 -F key=priv_cmd If the command does not return a line, or the line is commented out, this is a finding.

Fix: F-78108r1120323_fix

Configure Amazon Linux 2023 so that the audit system generates an audit event for any successful/unsuccessful use of the "sudo" command by adding or updating the following rule in the "/etc/audit/rules.d/audit.rules" file: -a always,exit -F path=/usr/bin/sudo -F perm=x -F auid>=1000 -F auid!=unset -k priv_cmd To load the rules to the kernel immediately, use the following command: $ sudo augenrules --load

b
Amazon Linux 2023 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/passwd.
AC-2 - Medium - CCI-000018 - V-274113 - SV-274113r1120327_rule
RMF Control
AC-2
Severity
Medium
CCI
CCI-000018
Version
AZLX-23-002250
Vuln IDs
  • V-274113
Rule IDs
  • SV-274113r1120327_rule
In addition to auditing new user and group accounts, these watches will alert the system administrator(s) (SAs) to any modifications. Any unexpected users, groups, or modifications should be investigated for legitimacy. Satisfies: SRG-OS-000004-GPOS-00004, SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000304-GPOS-00121, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000470-GPOS-00214, SRG-OS-000471-GPOS-00215, SRG-OS-000239-GPOS-00089, SRG-OS-000240-GPOS-00090, SRG-OS-000241-GPOS-00091, SRG-OS-000303-GPOS-00120, SRG-OS-000466-GPOS-00210, SRG-OS-000476-GPOS-00221, SRG-OS-000274-GPOS-00104, SRG-OS-000275-GPOS-00105, SRG-OS-000276-GPOS-00106, SRG-OS-000277-GPOS-00107
Checks: C-78204r1120325_chk

Verify Amazon Linux 2023 generates audit records for all account creations, modifications, disabling, and termination events that affect "/etc/passwd" with the following command: $ sudo auditctl -l | egrep '(/etc/passwd)' -w /etc/passwd -p wa -k identity If the command does not return a line, or the line is commented out, this is a finding.

Fix: F-78109r1120326_fix

Configure Amazon Linux 2023 to generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/passwd". Add or update the following file system rule to "/etc/audit/rules.d/audit.rules": -w /etc/passwd -p wa -k identity To load the rules to the kernel immediately, use the following command: $ sudo augenrules --load

b
Amazon Linux 2023 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/shadow.
AC-2 - Medium - CCI-000018 - V-274114 - SV-274114r1120330_rule
RMF Control
AC-2
Severity
Medium
CCI
CCI-000018
Version
AZLX-23-002255
Vuln IDs
  • V-274114
Rule IDs
  • SV-274114r1120330_rule
In addition to auditing new user and group accounts, these watches will alert the system administrator(s) (SAs) to any modifications. Any unexpected users, groups, or modifications should be investigated for legitimacy. Satisfies: SRG-OS-000004-GPOS-00004, SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000304-GPOS-00121, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000470-GPOS-00214, SRG-OS-000471-GPOS-00215, SRG-OS-000239-GPOS-00089, SRG-OS-000240-GPOS-00090, SRG-OS-000241-GPOS-00091, SRG-OS-000303-GPOS-00120, SRG-OS-000466-GPOS-00210, SRG-OS-000476-GPOS-00221, SRG-OS-000275-GPOS-00105
Checks: C-78205r1120328_chk

Verify Amazon Linux 2023 generates audit records for all account creations, modifications, disabling, and termination events that affect "/etc/shadow with the following command: $ sudo auditctl -l | egrep '(/etc/shadow)' -w /etc/shadow -p wa -k identity If the command does not return a line, or the line is commented out, this is a finding.

Fix: F-78110r1120329_fix

Configure Amazon Linux 2023 to generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/shadow". Add or update the following file system rule to "/etc/audit/rules.d/audit.rules": -w /etc/shadow -p wa -k identity To load the rules to the kernel immediately, use the following command: $ sudo augenrules --load

b
Amazon Linux 2023 must produce audit records containing information to establish the identity of any individual or process associated with the event.
AU-3 - Medium - CCI-001487 - V-274115 - SV-274115r1120333_rule
RMF Control
AU-3
Severity
Medium
CCI
CCI-001487
Version
AZLX-23-002260
Vuln IDs
  • V-274115
Rule IDs
  • SV-274115r1120333_rule
Without information that establishes the identity of the subjects (i.e., users or processes acting on behalf of users) associated with the events, security personnel cannot determine responsibility for the potentially harmful event.
Checks: C-78206r1120331_chk

Verify Amazon Linux 2023 is configured so that the audit system resolves audit information before writing to disk, with the following command: $ sudo grep log_format /etc/audit/auditd.conf log_format = ENRICHED If the "log_format" option is not "ENRICHED", or the line is commented out, this is a finding.

Fix: F-78111r1120332_fix

Configure Amazon Linux 2023 so that the audit system resolves audit information before writing to disk. Edit the /etc/audit/auditd.conf file and add or update the "log_format" option: log_format = ENRICHED The audit daemon must be restarted for changes to take effect.

b
Amazon Linux 2023 audit logs must be group-owned by root or by a restricted logging group to prevent unauthorized read access.
SI-11 - Medium - CCI-001314 - V-274116 - SV-274116r1120336_rule
RMF Control
SI-11
Severity
Medium
CCI
CCI-001314
Version
AZLX-23-002265
Vuln IDs
  • V-274116
Rule IDs
  • SV-274116r1120336_rule
Only authorized personnel should be aware of errors and the details of the errors. Error messages are an indicator of an organization's operational state or can identify Amazon Linux 2023 or platform. Additionally, Personally Identifiable Information (PII) and operational information must not be revealed through error messages to unauthorized personnel or their designated representatives. The structure and content of error messages must be carefully considered by the organization and development team. The extent to which the information system is able to identify and handle error conditions is guided by organizational policy and operational requirements.
Checks: C-78207r1120334_chk

Verify Amazon Linux 2023 is configured so that the audit logs are group-owned by "root" or a restricted logging group. First determine if a group other than "root" has been assigned to the audit logs with the following command: $ sudo grep log_group /etc/audit/auditd.conf Then determine where the audit logs are stored with the following command: $ sudo grep -iw log_file /etc/audit/auditd.conf log_file = /var/log/audit/audit.log Then using the location of the audit log file, determine if the audit log is group-owned by "root" using the following command: $ sudo stat -c "%G %n" /var/log/audit/audit.log root /var/log/audit/audit.log If the audit log is not group-owned by "root" or the configured alternative logging group, this is a finding.

Fix: F-78112r1120335_fix

Configure Amazon Linux 2023 to change the group of the directory of "/var/log/audit" to be owned by a correct group. Identify the group that is configured to own audit log: $ sudo grep -P '^[ ]*log_group[ ]+=.*$' /etc/audit/auditd.conf Change the ownership to that group: $ sudo chgrp ${GROUP} /var/log/audit

b
Amazon Linux 2023 must ensure the audit log directory be owned by root to prevent unauthorized read access.
SI-11 - Medium - CCI-001314 - V-274117 - SV-274117r1120339_rule
RMF Control
SI-11
Severity
Medium
CCI
CCI-001314
Version
AZLX-23-002270
Vuln IDs
  • V-274117
Rule IDs
  • SV-274117r1120339_rule
Only authorized personnel should be aware of errors and the details of the errors. Error messages are an indicator of an organization's operational state or can identify Amazon Linux 2023 or platform. Additionally, Personally Identifiable Information (PII) and operational information must not be revealed through error messages to unauthorized personnel or their designated representatives. The structure and content of error messages must be carefully considered by the organization and development team. The extent to which the information system is able to identify and handle error conditions is guided by organizational policy and operational requirements.
Checks: C-78208r1120337_chk

Verify Amazon Linux 2023 is configured so that the audit logs directory is owned by "root". First determine where the audit logs are stored with the following command: $ sudo grep -iw log_file /etc/audit/auditd.conf log_file = /var/log/audit/audit.log Then using the location of the audit log file, determine if the audit log directory is owned by "root" using the following command: sudo stat -c '%U %n' /var/log/audit root /var/log/audit If the audit log directory is not owned by "root", this is a finding.

Fix: F-78113r1120338_fix

Configure Amazon Linux 2023 audit logs to be protected from unauthorized read access by setting the correct owner as "root" with the following command: $ sudo chown root /var/log/audit

b
Amazon Linux 2023 audit logs file must have mode "0600" or less permissive to prevent unauthorized access to the audit log.
SI-11 - Medium - CCI-001314 - V-274118 - SV-274118r1120342_rule
RMF Control
SI-11
Severity
Medium
CCI
CCI-001314
Version
AZLX-23-002275
Vuln IDs
  • V-274118
Rule IDs
  • SV-274118r1120342_rule
Only authorized personnel should be aware of errors and the details of the errors. Error messages are an indicator of an organization's operational state or can identify Amazon Linux 2023 or platform. Additionally, Personally Identifiable Information (PII) and operational information must not be revealed through error messages to unauthorized personnel or their designated representatives. The structure and content of error messages must be carefully considered by the organization and development team. The extent to which the information system is able to identify and handle error conditions is guided by organizational policy and operational requirements.
Checks: C-78209r1120340_chk

Verify Amazon Linux 2023 is configured so that the audit logs have a mode of "0600". First determine where the audit logs are stored with the following command: $ sudo grep -iw log_file /etc/audit/auditd.conf log_file = /var/log/audit/audit.log Then using the location of the audit log file, determine if the audit log files as a mode of "0640" with the following command: $ sudo find /var/log/audit/ -type f -exec stat -c '%a %n' {} \; 600 /var/log/audit/audit.log If the audit logs have a mode more permissive than "0600", this is a finding.

Fix: F-78114r1120341_fix

Configure Amazon Linux 2023 audit logs to have a mode of "0600" with the following command: Replace "[audit_log_file]" to the correct audit log path, by default this location is "/var/log/audit/audit.log". $ sudo chmod 0600 /var/log/audit/[audit_log_file] Check the group that owns the system audit logs: $ sudo grep -m 1 -q ^log_group /etc/audit/auditd.conf If the log_group is not defined or it is set to root, configure the permissions as follows: $ sudo chmod 0640 $log_file $ sudo chmod 0440 $log_file.* Otherwise, configure the permissions as follows: $ sudo chmod 0600 $log_file $ sudo chmod 0400 $log_file.*

b
Amazon Linux 2023 library directories must be group-owned by root or a system account.
CM-5 - Medium - CCI-001499 - V-274119 - SV-274119r1120345_rule
RMF Control
CM-5
Severity
Medium
CCI
CCI-001499
Version
AZLX-23-002280
Vuln IDs
  • V-274119
Rule IDs
  • SV-274119r1120345_rule
If Amazon Linux 2023 were to allow any user to make changes to software libraries, then those changes might be implemented without undergoing the appropriate testing and approvals that are part of a robust change management process. This requirement applies to operating systems with software libraries that are accessible and configurable, as in the case of interpreted languages. Software libraries also include privileged programs which execute with escalated privileges. Only qualified and authorized individuals shall be allowed to obtain access to information system components for purposes of initiating changes, including upgrades and modifications.
Checks: C-78210r1120343_chk

Verify Amazon Linux 2023 systemwide shared library directories are group-owned by "root" with the following command: $ sudo find /lib /lib64 /usr/lib /usr/lib64 ! -group root -type d -exec stat -c "%n %G" '{}' \; If any systemwide shared library directory is returned and is not group-owned by a required system account, this is a finding.

Fix: F-78115r1120344_fix

Configure Amazon Linux 2023 systemwide shared library directories (/lib, /lib64, /usr/lib and /usr/lib64) to be protected from unauthorized access. Run the following command, replacing "[DIRECTORY]" with any library directory not group-owned by "root". $ sudo chgrp root [DIRECTORY]

b
Amazon Linux 2023 library directories must have mode "755" or less permissive.
CM-5 - Medium - CCI-001499 - V-274120 - SV-274120r1120348_rule
RMF Control
CM-5
Severity
Medium
CCI
CCI-001499
Version
AZLX-23-002285
Vuln IDs
  • V-274120
Rule IDs
  • SV-274120r1120348_rule
If Amazon Linux 2023 were to allow any user to make changes to software libraries, then those changes might be implemented without undergoing the appropriate testing and approvals that are part of a robust change management process. This requirement applies to operating systems with software libraries that are accessible and configurable, as in the case of interpreted languages. Software libraries also include privileged programs which execute with escalated privileges. Only qualified and authorized individuals shall be allowed to obtain access to information system components for purposes of initiating changes, including upgrades and modifications.
Checks: C-78211r1120346_chk

Verify Amazon Linux 2023 systemwide shared library directories have mode "755" or less permissive with the following command: $ sudo find -L /lib /lib64 /usr/lib /usr/lib64 -perm /022 -type d -exec ls -l {} \; If any systemwide shared library file is found to be group-writable or world-writable, this is a finding.

Fix: F-78116r1120347_fix

Configure Amazon Linux 2023 systemwide shared library directories (/lib, /lib64, /usr/lib and /usr/lib64) to be protected from unauthorized access. Run the following command, replacing "[DIRECTORY]" with any library directory with a mode more permissive than "755". $ sudo chmod 755 [DIRECTORY]

b
Amazon Linux 2023 library files must have mode "755" or less permissive.
CM-5 - Medium - CCI-001499 - V-274121 - SV-274121r1155161_rule
RMF Control
CM-5
Severity
Medium
CCI
CCI-001499
Version
AZLX-23-002290
Vuln IDs
  • V-274121
Rule IDs
  • SV-274121r1155161_rule
If Amazon Linux 2023 were to allow any user to make changes to software libraries, then those changes might be implemented without undergoing the appropriate testing and approvals that are part of a robust change management process. This requirement applies to operating systems with software libraries that are accessible and configurable, as in the case of interpreted languages. Software libraries also include privileged programs that execute with escalated privileges. Only qualified and authorized individuals will be allowed to obtain access to information system components for purposes of initiating changes, including upgrades and modifications.
Checks: C-78212r1155159_chk

Verify Amazon Linux 2023 systemwide shared library files contained in the directories "/lib", "/lib64", "/usr/lib", and "/usr/lib64" have mode 0755 or less permissive. Check that the systemwide shared library files have mode 0755 or less permissive with the following command: $ sudo find /lib /lib64 /usr/lib /usr/lib64 -type f -name '*.so*' -perm /022 -exec stat -c "%n %a" {} + If any output is returned, this is a finding.

Fix: F-78117r1155160_fix

Configure Amazon Linux 2023 systemwide shared library files contained in the directories "/lib", "/lib64", "/usr/lib", and "/usr/lib64" have mode 0755 or less permissive with the following command. $ sudo find /lib /lib64 /usr/lib /usr/lib64 -type f -name '*.so*' -perm /022 -exec chmod go-w {} +

b
Amazon Linux 2023 library files must be owned by root.
CM-5 - Medium - CCI-001499 - V-274122 - SV-274122r1155164_rule
RMF Control
CM-5
Severity
Medium
CCI
CCI-001499
Version
AZLX-23-002295
Vuln IDs
  • V-274122
Rule IDs
  • SV-274122r1155164_rule
If Amazon Linux 2023 were to allow any user to make changes to software libraries, then those changes might be implemented without undergoing the appropriate testing and approvals that are part of a robust change management process. This requirement applies to operating systems with software libraries that are accessible and configurable, as in the case of interpreted languages. Software libraries also include privileged programs that execute with escalated privileges. Only qualified and authorized individuals shall be allowed to obtain access to information system components for purposes of initiating changes, including upgrades and modifications.
Checks: C-78213r1155162_chk

Verify Amazon Linux 2023 systemwide shared library files contained in the directories "/lib", "/lib64", "/usr/lib", and "/usr/lib64" are owned by root with the following command: $ sudo find /lib /lib64 /usr/lib /usr/lib64 -type f -name '*.so*' ! -user root -exec stat -c "%n %U" {} + If any output is returned, this is a finding.

Fix: F-78118r1155163_fix

Configure Amazon Linux 2023 systemwide shared library files contained in the directories "/lib", "/lib64", "/usr/lib", and "/usr/lib64" to be owned by root with the following command: $ sudo find /lib /lib64 /usr/lib /usr/lib64 -type f -name '*.so*' ! -user root -exec chown root {} +

b
Amazon Linux 2023 library files must be group-owned by root or a system account.
CM-5 - Medium - CCI-001499 - V-274123 - SV-274123r1155167_rule
RMF Control
CM-5
Severity
Medium
CCI
CCI-001499
Version
AZLX-23-002300
Vuln IDs
  • V-274123
Rule IDs
  • SV-274123r1155167_rule
If Amazon Linux 2023 were to allow any user to make changes to software libraries, then those changes might be implemented without undergoing the appropriate testing and approvals that are part of a robust change management process. This requirement applies to operating systems with software libraries that are accessible and configurable, as in the case of interpreted languages. Software libraries also include privileged programs which execute with escalated privileges. Only qualified and authorized individuals shall be allowed to obtain access to information system components for purposes of initiating changes, including upgrades and modifications.
Checks: C-78214r1155165_chk

Verify Amazon Linux 2023 systemwide shared library files contained in the directories "/lib", "/lib64", "/usr/lib", and "/usr/lib64" are group owned by root with the following command: $ sudo find /lib /lib64 /usr/lib /usr/lib64 -type f -name '*.so*' ! -group root -exec stat -c "%n %G" {} + If any output is returned, this is a finding.

Fix: F-78119r1155166_fix

Configure Amazon Linux 2023 systemwide shared library files contained in the directories "/lib", "/lib64", "/usr/lib", and "/usr/lib64" to be group owned by root with the following command: $ sudo find /lib /lib64 /usr/lib /usr/lib64 -type f -name '*.so*' ! -group root -exec chown :root {} +

b
Amazon Linux 2023 library directories must be owned by root.
CM-5 - Medium - CCI-001499 - V-274124 - SV-274124r1120360_rule
RMF Control
CM-5
Severity
Medium
CCI
CCI-001499
Version
AZLX-23-002305
Vuln IDs
  • V-274124
Rule IDs
  • SV-274124r1120360_rule
If Amazon Linux 2023 were to allow any user to make changes to software libraries, then those changes might be implemented without undergoing the appropriate testing and approvals that are part of a robust change management process. This requirement applies to operating systems with software libraries that are accessible and configurable, as in the case of interpreted languages. Software libraries also include privileged programs which execute with escalated privileges. Only qualified and authorized individuals shall be allowed to obtain access to information system components for purposes of initiating changes, including upgrades and modifications.
Checks: C-78215r1120358_chk

Verify Amazon Linux 2023 systemwide shared library directories are owned by "root" with the following command: $ sudo find /lib /lib64 /usr/lib /usr/lib64 ! -user root -type d -exec stat -c "%n %U" '{}' \; If any systemwide shared library directory is not owned by root, this is a finding.

Fix: F-78120r1120359_fix

Configure Amazon Linux 2023 systemwide shared library directories within (/lib, /lib64, /usr/lib and /usr/lib64) to be protected from unauthorized access. Run the following command, replacing "[DIRECTORY]" with any library directory not owned by "root". $ sudo chown root [DIRECTORY]

b
Amazon Linux 2023 must ensure the /var/log directory have mode "0755" or less permissive.
SI-11 - Medium - CCI-001314 - V-274125 - SV-274125r1120363_rule
RMF Control
SI-11
Severity
Medium
CCI
CCI-001314
Version
AZLX-23-002315
Vuln IDs
  • V-274125
Rule IDs
  • SV-274125r1120363_rule
Only authorized personnel should be aware of errors and the details of the errors. Error messages are an indicator of an organization's operational state or can identify Amazon Linux 2023 or platform. Additionally, Personally Identifiable Information (PII) and operational information must not be revealed through error messages to unauthorized personnel or their designated representatives. The structure and content of error messages must be carefully considered by the organization and development team. The extent to which the information system is able to identify and handle error conditions is guided by organizational policy and operational requirements.
Checks: C-78216r1120361_chk

Verify Amazon Linux 2023 is configured so that the "/var/log" directory has a mode of "0755" or less permissive with the following command: $ stat -c '%a %n' /var/log 755 /var/log If "/var/log" does not have a mode of "0755" or less permissive, this is a finding.

Fix: F-78121r1120362_fix

Configure Amazon Linux 2023 so that the "/var/log" directory has a mode of "0755" by running the following command: $ sudo chmod 0755 /var/log

b
Amazon Linux 2023 must ensure the /var/log directory be owned by root.
SI-11 - Medium - CCI-001314 - V-274126 - SV-274126r1120366_rule
RMF Control
SI-11
Severity
Medium
CCI
CCI-001314
Version
AZLX-23-002320
Vuln IDs
  • V-274126
Rule IDs
  • SV-274126r1120366_rule
Only authorized personnel should be aware of errors and the details of the errors. Error messages are an indicator of an organization's operational state or can identify Amazon Linux 2023 or platform. Additionally, Personally Identifiable Information (PII) and operational information must not be revealed through error messages to unauthorized personnel or their designated representatives. The structure and content of error messages must be carefully considered by the organization and development team. The extent to which the information system is able to identify and handle error conditions is guided by organizational policy and operational requirements.
Checks: C-78217r1120364_chk

Verify Amazon Linux 2023 is configured so that the "/var/log" directory is owned by root with the following command: $ stat -c "%U %n" /var/log root /var/log If "/var/log" does not have an owner of "root", this is a finding.

Fix: F-78122r1120365_fix

Configure Amazon Linux 2023 so that the directory "/var/log" is owned by "root" with the following command: $ sudo chown root /var/log

b
Amazon Linux 2023 must ensure the /var/log directory be group-owned by root.
SI-11 - Medium - CCI-001314 - V-274127 - SV-274127r1120369_rule
RMF Control
SI-11
Severity
Medium
CCI
CCI-001314
Version
AZLX-23-002325
Vuln IDs
  • V-274127
Rule IDs
  • SV-274127r1120369_rule
Only authorized personnel should be aware of errors and the details of the errors. Error messages are an indicator of an organization's operational state or can identify Amazon Linux 2023 or platform. Additionally, Personally Identifiable Information (PII) and operational information must not be revealed through error messages to unauthorized personnel or their designated representatives. The structure and content of error messages must be carefully considered by the organization and development team. The extent to which the information system is able to identify and handle error conditions is guided by organizational policy and operational requirements.
Checks: C-78218r1120367_chk

Verify Amazon Linux 2023 is configured so the "/var/log" directory is group-owned by root with the following command: $ stat -c "%G %n" /var/log root /var/log If "/var/log" does not have a group owner of "root", this is a finding.

Fix: F-78123r1120368_fix

Configure Amazon Linux 2023 so that the "/var/log" is group-owned "root" with the following command: $ sudo chgrp root /var/log

b
Amazon Linux 2023 must ensure the /var/log/messages file have mode "0640" or less permissive.
SI-11 - Medium - CCI-001314 - V-274128 - SV-274128r1120372_rule
RMF Control
SI-11
Severity
Medium
CCI
CCI-001314
Version
AZLX-23-002330
Vuln IDs
  • V-274128
Rule IDs
  • SV-274128r1120372_rule
Only authorized personnel should be aware of errors and the details of the errors. Error messages are an indicator of an organization's operational state or can identify Amazon Linux 2023 or platform. Additionally, Personally Identifiable Information (PII) and operational information must not be revealed through error messages to unauthorized personnel or their designated representatives. The structure and content of error messages must be carefully considered by the organization and development team. The extent to which the information system is able to identify and handle error conditions is guided by organizational policy and operational requirements.
Checks: C-78219r1120370_chk

Verify Amazon Linux 2023 is configured so that the "/var/log/messages" file has a mode of "0640" or less permissive with the following command: $ stat -c '%a %n' /var/log/messages 600 /var/log/messages If "/var/log/messages" does not have a mode of "0640" or less permissive, this is a finding.

Fix: F-78124r1120371_fix

Configure Amazon Linux 2023 so that the "/var/log/messages" file has a mode of "0640" with the following command: $ sudo chmod 0640 /var/log/messages

b
Amazon Linux 2023 must ensure the /var/log/messages file be group-owned by root.
SI-11 - Medium - CCI-001314 - V-274129 - SV-274129r1120375_rule
RMF Control
SI-11
Severity
Medium
CCI
CCI-001314
Version
AZLX-23-002335
Vuln IDs
  • V-274129
Rule IDs
  • SV-274129r1120375_rule
Only authorized personnel should be aware of errors and the details of the errors. Error messages are an indicator of an organization's operational state or can identify Amazon Linux 2023 or platform. Additionally, Personally Identifiable Information (PII) and operational information must not be revealed through error messages to unauthorized personnel or their designated representatives. The structure and content of error messages must be carefully considered by the organization and development team. The extent to which the information system is able to identify and handle error conditions is guided by organizational policy and operational requirements.
Checks: C-78220r1120373_chk

Verify Amazon Linux 2023 is configured so that the "/var/log/messages" file is group-owned by root with the following command: $ stat -c "%G %n" /var/log/messages root /var/log/messages If "/var/log/messages" does not have a group owner of "root", this is a finding.

Fix: F-78125r1120374_fix

Configure Amazon Linux 2023 so that the "/var/log/messages" file is group-owned "root" with the following command: $ sudo chgrp root /var/log/messages

b
Amazon Linux 2023 must ensure the /var/log/messages file be owned by root.
SI-11 - Medium - CCI-001314 - V-274130 - SV-274130r1120378_rule
RMF Control
SI-11
Severity
Medium
CCI
CCI-001314
Version
AZLX-23-002340
Vuln IDs
  • V-274130
Rule IDs
  • SV-274130r1120378_rule
Only authorized personnel should be aware of errors and the details of the errors. Error messages are an indicator of an organization's operational state or can identify Amazon Linux 2023 or platform. Additionally, Personally Identifiable Information (PII) and operational information must not be revealed through error messages to unauthorized personnel or their designated representatives. The structure and content of error messages must be carefully considered by the organization and development team. The extent to which the information system is able to identify and handle error conditions is guided by organizational policy and operational requirements.
Checks: C-78221r1120376_chk

Verify Amazon Linux 2023 is configured so that the "/var/log/messages" file is owned by root with the following command: $ stat -c "%U %n" /var/log/messages root /var/log/messages If "/var/log/messages" does not have an owner of "root", this is a finding.

Fix: F-78126r1120377_fix

Configure Amazon Linux 2023 so that the "/var/log/messages" file is owned by "root" with the following command: $ sudo chown root /var/log/messages

b
Amazon Linux 2023 system commands must be owned by root.
CM-5 - Medium - CCI-001499 - V-274131 - SV-274131r1120381_rule
RMF Control
CM-5
Severity
Medium
CCI
CCI-001499
Version
AZLX-23-002345
Vuln IDs
  • V-274131
Rule IDs
  • SV-274131r1120381_rule
If Amazon Linux 2023 were to allow any user to make changes to software libraries, then those changes might be implemented without undergoing the appropriate testing and approvals that are part of a robust change management process. This requirement applies to operating systems with software libraries that are accessible and configurable, as in the case of interpreted languages. Software libraries also include privileged programs which execute with escalated privileges. Only qualified and authorized individuals shall be allowed to obtain access to information system components for purposes of initiating changes, including upgrades and modifications.
Checks: C-78222r1120379_chk

Verify Amazon Linux 2023 system commands contained in the following directories are owned by "root" with the following command: $ sudo find -L /bin /sbin /usr/bin /usr/sbin /usr/libexec /usr/local/bin /usr/local/sbin ! -user root -exec ls -l {} \; If any system commands are found to not be owned by root, this is a finding.

Fix: F-78127r1120380_fix

Configure Amazon Linux 2023 so that system commands are protected from unauthorized access. Run the following command, replacing "[FILE]" with any system command file not owned by "root". $ sudo chown root [FILE]

b
Amazon Linux 2023 system commands must be group-owned by root or a system account.
CM-5 - Medium - CCI-001499 - V-274132 - SV-274132r1120384_rule
RMF Control
CM-5
Severity
Medium
CCI
CCI-001499
Version
AZLX-23-002350
Vuln IDs
  • V-274132
Rule IDs
  • SV-274132r1120384_rule
If Amazon Linux 2023 were to allow any user to make changes to software libraries, then those changes might be implemented without undergoing the appropriate testing and approvals that are part of a robust change management process. This requirement applies to operating systems with software libraries that are accessible and configurable, as in the case of interpreted languages. Software libraries also include privileged programs which execute with escalated privileges. Only qualified and authorized individuals shall be allowed to obtain access to information system components for purposes of initiating changes, including upgrades and modifications.
Checks: C-78223r1120382_chk

Verify Amazon Linux 2023 system commands contained in the following directories are group-owned by "root", or a required system account, with the following command: $ sudo find -L /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin ! -group root -exec ls -l {} \; If any system commands are returned and is not group-owned by a required system account, this is a finding.

Fix: F-78128r1120383_fix

Configure Amazon Linux 2023 so that system commands are protected from unauthorized access. Run the following command, replacing "[FILE]" with any system command file not group-owned by "root" or a required system account. $ sudo chgrp root [FILE]

b
Amazon Linux 2023 must enforce password complexity by requiring that at least one uppercase character be used.
- Medium - CCI-004066 - V-274133 - SV-274133r1120387_rule
RMF Control
Severity
Medium
CCI
CCI-004066
Version
AZLX-23-002355
Vuln IDs
  • V-274133
Rule IDs
  • SV-274133r1120387_rule
Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised. Satisfies: SRG-OS-000069-GPOS-00037, SRG-OS-000725-GPOS-00180
Checks: C-78224r1120385_chk

Verify Amazon Linux 2023 enforces password complexity by requiring that at least one uppercase character with the following command: $ sudo grep ucredit /etc/security/pwquality.conf /etc/security/pwquality.conf.d/*.conf ucredit = -1 If the value of "ucredit" is a positive number or is commented out, this is a finding.

Fix: F-78129r1120386_fix

Configure Amazon Linux 2023 to enforce password complexity by requiring that at least one uppercase character be used by setting the "ucredit" option. Add or update the following line in the "/etc/security/pwquality.conf" file or a configuration file in the "/etc/security/pwquality.conf.d/" directory to contain the "ucredit" parameter: ucredit = -1 Remove any configurations that conflict with the above value.

b
Amazon Linux 2023 must enforce password complexity by requiring that at least one lowercase character be used.
- Medium - CCI-004066 - V-274134 - SV-274134r1120390_rule
RMF Control
Severity
Medium
CCI
CCI-004066
Version
AZLX-23-002360
Vuln IDs
  • V-274134
Rule IDs
  • SV-274134r1120390_rule
Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised. Satisfies: SRG-OS-000070-GPOS-00038, SRG-OS-000725-GPOS-00180
Checks: C-78225r1120388_chk

Verify Amazon Linux 2023 enforces password complexity by requiring that at least one lowercase character with the following command: $ sudo grep lcredit /etc/security/pwquality.conf /etc/security/pwquality.conf.d/*.conf lcredit = -1 If the value of "lcredit" is a positive number or is commented out, this is a finding.

Fix: F-78130r1120389_fix

Configure Amazon Linux 2023 to enforce password complexity by requiring that at least one lowercase character be used by setting the "lcredit" option. Add or update the following line in the "/etc/security/pwquality.conf" file or a configuration file in the "/etc/security/pwquality.conf.d/" directory to contain the "lcredit" parameter: lcredit = -1 Remove any configurations that conflict with the above value.

b
Amazon Linux 2023 must enforce password complexity by requiring that at least one numeric character be used.
- Medium - CCI-004066 - V-274135 - SV-274135r1120393_rule
RMF Control
Severity
Medium
CCI
CCI-004066
Version
AZLX-23-002365
Vuln IDs
  • V-274135
Rule IDs
  • SV-274135r1120393_rule
Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised. Satisfies: SRG-OS-000071-GPOS-00039, SRG-OS-000725-GPOS-00180
Checks: C-78226r1120391_chk

Verify Amazon Linux 2023 enforces password complexity by requiring that at least one numeric character with the following command: $ sudo grep dcredit /etc/security/pwquality.conf /etc/security/pwquality.conf.d/*.conf dcredit = -1 If the value of "dcredit" is a positive number or is commented out, this is a finding.

Fix: F-78131r1120392_fix

Configure Amazon Linux 2023 to enforce password complexity by requiring that at least one numeric character be used by setting the "dcredit" option. Add or update the following line in the "/etc/security/pwquality.conf" file or a configuration file in the "/etc/security/pwquality.conf.d/" directory to contain the "dcredit" parameter: dcredit = -1 Remove any configurations that conflict with the above value.

b
Amazon Linux 2023 must require the change of at least 50 percent of the total number of characters when passwords are changed.
- Medium - CCI-004066 - V-274136 - SV-274136r1120697_rule
RMF Control
Severity
Medium
CCI
CCI-004066
Version
AZLX-23-002370
Vuln IDs
  • V-274136
Rule IDs
  • SV-274136r1120697_rule
If Amazon Linux 2023 allows the user to consecutively reuse extensive portions of passwords, this increases the chances of password compromise by increasing the window of opportunity for attempts at guessing and brute-force attacks. The number of changed characters refers to the number of changes required with respect to the total number of positions in the current password. In other words, characters may be the same within the two passwords; however, the positions of the like characters must be different. If the password length is an odd number then number of changed characters must be rounded up. For example, a password length of 15 characters must require the change of at least 8 characters. Satisfies: SRG-OS-000072-GPOS-00040, SRG-OS-000725-GPOS-00180
Checks: C-78227r1120394_chk

Verify Amazon Linux 2023 enforces password complexity by requiring that at least a change of at least eight characters when passwords are changed with the following command: $ sudo grep difok /etc/security/pwquality.conf /etc/security/pwquality.conf.d/*.conf difok = 8 If the value of "difok" is set to less than "8", or is commented out, this is a finding.

Fix: F-78132r1120696_fix

Configure Amazon Linux 2023 to require the change of at least eight (with a 15 character password) of the total number of characters when passwords are changed by setting the "difok" option. Add or update the following line in the "/etc/security/pwquality.conf" file or a configuration file in the "/etc/security/pwquality.conf.d/" directory to contain the "difok" parameter: difok = 8 Remove any configurations that conflict with the above value. This value can be customized based on desired password length.

b
Amazon Linux 2023 must enforce a minimum 15-character password length.
- Medium - CCI-004066 - V-274137 - SV-274137r1120725_rule
RMF Control
Severity
Medium
CCI
CCI-004066
Version
AZLX-23-002375
Vuln IDs
  • V-274137
Rule IDs
  • SV-274137r1120725_rule
The shorter the password, the lower the number of possible combinations that need to be tested before the password is compromised. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password length is one factor of several that helps to determine strength and how long it takes to crack a password. Use of more characters in a password helps to exponentially increase the time and/or resources required to compromise the password. Satisfies: SRG-OS-000078-GPOS-00046, SRG-OS-000725-GPOS-00180
Checks: C-78228r1120397_chk

Verify Amazon Linux 2023 enforces a minimum 15-character password length with the following command: $ sudo grep -rs minlen /etc/security/pwquality.conf /etc/security/pwquality.conf.d/*.conf /etc/security/pwquality.conf: minlen = 15 If the command does not return a "minlen" value of 15 or greater, or the line is commented out, this is a finding. If conflicting results are returned, this is a finding.

Fix: F-78133r1120398_fix

Configure Amazon Linux 2023 to enforce a minimum 15-character password length. Add or update the following line in the "/etc/security/pwquality.conf" file or a configuration file in the "/etc/security/pwquality.conf.d/" directory to contain the "minlen" parameter: minlen = 15 Remove any configurations that conflict with the above value.

b
Amazon Linux 2023 must enforce password complexity by requiring that at least one special character be used.
- Medium - CCI-004066 - V-274138 - SV-274138r1120402_rule
RMF Control
Severity
Medium
CCI
CCI-004066
Version
AZLX-23-002380
Vuln IDs
  • V-274138
Rule IDs
  • SV-274138r1120402_rule
Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity or strength is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password complexity is one factor in determining how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised. Special characters are those characters that are not alphanumeric. Examples include: ~ ! @ # $ % ^ *. Satisfies: SRG-OS-000266-GPOS-00101, SRG-OS-000725-GPOS-00180
Checks: C-78229r1120400_chk

Verify Amazon Linux 2023 enforces password complexity by requiring at least one special character with the following command: $ sudo grep -rs ocredit /etc/security/pwquality.conf /etc/security/pwquality.conf.d/*.conf /etc/security/pwquality.conf: ocredit = -1 If the value of "ocredit" is a positive number or is commented out, this is a finding.

Fix: F-78134r1120401_fix

Configure Amazon Linux 2023 to enforce password complexity by requiring at least one special character be used by setting the "ocredit" option. Add or update the following line in the "/etc/security/pwquality.conf" file or a configuration file in the "/etc/security/pwquality.conf.d/" directory to contain the "ocredit" parameter: ocredit = -1

b
Amazon Linux 2023 must enforce password complexity rules for the root account.
- Medium - CCI-004066 - V-274139 - SV-274139r1120405_rule
RMF Control
Severity
Medium
CCI
CCI-004066
Version
AZLX-23-002385
Vuln IDs
  • V-274139
Rule IDs
  • SV-274139r1120405_rule
Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised. Satisfies: SRG-OS-000072-GPOS-00040, SRG-OS-000071-GPOS-00039, SRG-OS-000070-GPOS-00038, SRG-OS-000266-GPOS-00101, SRG-OS-000078-GPOS-00046, SRG-OS-000069-GPOS-00037
Checks: C-78230r1120403_chk

Verify Amazon Linux 2023 enforces password complexity rules for the root account with the following command: $ sudo grep -rs enforce_for_root /etc/security/pwquality.conf /etc/security/pwquality.conf.d/*.conf /etc/security/pwquality.conf:enforce_for_root If "enforce_for_root" is commented or missing, this is a finding.

Fix: F-78135r1120404_fix

Configure Amazon Linux 2023 to enforce password complexity on the root account. Add or update the following line in the "/etc/security/pwquality.conf" file or a configuration file in the "/etc/security/pwquality.conf.d/" directory to contain the "enforce_for_root" parameter: enforce_for_root

b
Amazon Linux 2023 must prevent the use of dictionary words for passwords.
CM-6 - Medium - CCI-000366 - V-274140 - SV-274140r1120408_rule
RMF Control
CM-6
Severity
Medium
CCI
CCI-000366
Version
AZLX-23-002390
Vuln IDs
  • V-274140
Rule IDs
  • SV-274140r1120408_rule
Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. If Amazon Linux 2023 allows the user to select passwords based on dictionary words, this increases the chances of password compromise by increasing the opportunity for successful guesses, and brute-force attacks. Satisfies: SRG-OS-000480-GPOS-00225, SRG-OS-000710-GPOS-00160
Checks: C-78231r1120406_chk

Verify Amazon Linux 2023 prevents the use of dictionary words for passwords with the following command: $ sudo grep -rs dictcheck /etc/security/pwquality.conf /etc/pwquality.conf.d/*.conf /etc/security/pwquality.conf:dictcheck=1 If the "dictcheck" parameter is not set to "1", is commented out, or is missing, this is a finding.

Fix: F-78136r1120407_fix

Configure Amazon Linux 2023 to prevent the use of dictionary words for passwords. Add or update the following line in the "/etc/security/pwquality.conf" file or a configuration file in the /etc/pwquality.conf.d/ directory to contain the "dictcheck" parameter: dictcheck=1

a
Amazon Linux 2023 must limit the number of concurrent sessions to ten for all accounts and/or account types.
AC-10 - Low - CCI-000054 - V-274141 - SV-274141r1120411_rule
RMF Control
AC-10
Severity
Low
CCI
CCI-000054
Version
AZLX-23-002395
Vuln IDs
  • V-274141
Rule IDs
  • SV-274141r1120411_rule
Operating system management includes the ability to control the number of users and user sessions that utilize an operating system. Limiting the number of allowed users and sessions per user is helpful in reducing the risks related to denial-of-service (DoS) attacks. This requirement addresses concurrent sessions for information system accounts and does not address concurrent sessions by single users via multiple system accounts. The maximum number of concurrent sessions should be defined based on mission needs and the operational environment for each system.
Checks: C-78232r1120409_chk

Verify Amazon Linux 2023 limits the number of concurrent sessions to "10" for all accounts and/or account types with the following command: $ sudo grep -r -s '^[^#].*maxlogins' /etc/security/limits.conf /etc/security/limits.d/*.conf * hard maxlogins 10 This can be set as a global domain (with the * wildcard) but may be set differently for multiple domains. If the "maxlogins" item is missing, commented out, or the value is set greater than "10" and is not documented with the information system security officer (ISSO) as an operational requirement for all domains that have the "maxlogins" item assigned, this is a finding.

Fix: F-78137r1120410_fix

Configure Amazon Linux 2023 to limit the number of concurrent sessions to "10" for all accounts and/or account types. Add the following line to the top of the /etc/security/limits.conf or in a ".conf" file defined in /etc/security/limits.d/: * hard maxlogins 10

b
Amazon Linux 2023 must automatically exit interactive command shell user sessions after 15 minutes of inactivity.
AC-11 - Medium - CCI-000057 - V-274142 - SV-274142r1120414_rule
RMF Control
AC-11
Severity
Medium
CCI
CCI-000057
Version
AZLX-23-002396
Vuln IDs
  • V-274142
Rule IDs
  • SV-274142r1120414_rule
Terminating an idle interactive command shell user session within a short time period reduces the window of opportunity for unauthorized personnel to take control of it when left unattended in a virtual terminal or physical console.
Checks: C-78233r1120412_chk

Verify Amazon Linux 2023 is configured to exit interactive command shell user sessions after 10 minutes of inactivity or less with the following command: $ sudo grep -i tmout /etc/profile /etc/profile.d/*.sh /etc/profile.d/tmout.sh:declare -xr TMOUT=600 If "TMOUT" is not set to "600" or less in a script located in the "/etc/'profile.d/ directory, is missing or is commented out, this is a finding.

Fix: F-78138r1120413_fix

Configure Amazon Linux 2023 to exit interactive command shell user sessions after 10 minutes of inactivity. Add or edit the following line in "/etc/profile.d/tmout.sh": #!/bin/bash declare -xr TMOUT=600

b
Amazon Linux 2023 must enforce 24 hours/1 day as the minimum password lifetime.
- Medium - CCI-004066 - V-274143 - SV-274143r1120417_rule
RMF Control
Severity
Medium
CCI
CCI-004066
Version
AZLX-23-002400
Vuln IDs
  • V-274143
Rule IDs
  • SV-274143r1120417_rule
Enforcing a minimum password lifetime helps to prevent repeated password changes to defeat the password reuse or history enforcement requirement. If users are allowed to immediately and continually change their password, then the password could be repeatedly changed in a short period of time to defeat the organization's policy regarding password reuse.
Checks: C-78234r1120415_chk

Verify Amazon Linux 2023 enforces 24 hours as the minimum password lifetime for new user accounts with the following command: $ sudo grep -i pass_min_days /etc/login.defs PASS_MIN_DAYS 1 If the "PASS_MIN_DAYS" parameter value is not "1" or greater, or is commented out, this is a finding.

Fix: F-78139r1120416_fix

Configure Amazon Linux 2023 to enforce 24 hours as the minimum password lifetime for new user accounts. Add the following line in "/etc/login.defs" (or modify the line to have the required value): PASS_MIN_DAYS 1

b
Amazon Linux 2023 must enforce a delay of at least four seconds between logon prompts following a failed logon attempt.
CM-6 - Medium - CCI-000366 - V-274144 - SV-274144r1120420_rule
RMF Control
CM-6
Severity
Medium
CCI
CCI-000366
Version
AZLX-23-002405
Vuln IDs
  • V-274144
Rule IDs
  • SV-274144r1120420_rule
Increasing the time between a failed authentication attempt and re-prompting to enter credentials helps to slow a single-threaded brute force attack.
Checks: C-78235r1120418_chk

Verify Amazon Linux 2023 enforces a delay of at least four seconds between console logon prompts following a failed logon attempt with the following command: $ sudo grep -i fail_delay /etc/login.defs FAIL_DELAY 4 If the value of "FAIL_DELAY" is not set to "4" or greater, the line is commented out, or the line is missing, this is a finding.

Fix: F-78140r1120419_fix

Configure Amazon Linux 2023 to enforce a delay of at least four seconds between logon prompts following a failed console logon attempt. Modify the "/etc/login.defs" file to set the "FAIL_DELAY" parameter to "4" or greater: FAIL_DELAY 4

b
Amazon Linux 2023 must define default permissions for all authenticated users in such a way that the user can only read and modify their own files.
CM-6 - Medium - CCI-000366 - V-274145 - SV-274145r1120423_rule
RMF Control
CM-6
Severity
Medium
CCI
CCI-000366
Version
AZLX-23-002410
Vuln IDs
  • V-274145
Rule IDs
  • SV-274145r1120423_rule
Setting the most restrictive default permissions ensures that when new accounts are created, they do not have unnecessary access. Satisfies: SRG-OS-000480-GPOS-00228, SRG-OS-000480-GPOS-00230
Checks: C-78236r1120421_chk

Verify Amazon Linux 2023 defines default permissions for all authenticated users in such a way that the user can only read and modify their own files with the following command: Note: If the value of the "UMASK" parameter is set to "000" in "/etc/login.defs" file, the Severity is raised to a CAT I. # grep -i umask /etc/login.defs UMASK 077 If the value for the "UMASK" parameter is not "077", or the "UMASK" parameter is missing or is commented out, this is a finding.

Fix: F-78141r1120422_fix

Configure Amazon Linux 2023 to define default permissions for all authenticated users in such a way that the user can only read and modify their own files. Add or edit the lines for the "UMASK" parameter in the "/etc/login.defs" file to "077": UMASK 077

b
Amazon Linux 2023 must automatically remove or disable temporary user accounts after 72 hours.
AC-2 - Medium - CCI-000016 - V-274146 - SV-274146r1120426_rule
RMF Control
AC-2
Severity
Medium
CCI
CCI-000016
Version
AZLX-23-002415
Vuln IDs
  • V-274146
Rule IDs
  • SV-274146r1120426_rule
If temporary user accounts remain active when no longer needed or for an excessive period, these accounts may be used to gain unauthorized access. To mitigate this risk, automated termination of all temporary accounts must be set upon account creation.
Checks: C-78237r1120424_chk

Verify Amazon Linux 2023 temporary accounts have been provisioned with an expiration date of 72 hours. For every existing temporary account, run the following command to obtain its account expiration information. $ sudo chage -l system_account_name Verify each of these accounts has an expiration date set within 72 hours. If any temporary accounts have no expiration date set or do not expire within 72 hours, this is a finding.

Fix: F-78142r1120425_fix

Configure Amazon Linux 2023 temporary accounts to have an expiration date of 72 hours. If a temporary account must be created configure the system to terminate the account after a 72 hour time period with the following command to set an expiration date on it. Substitute "system_account_name" with the account to be created. $ sudo chage -E $(date -d +3days +%Y-%m-%d) system_account_name

b
Amazon Linux 2023 must automatically lock an account when three unsuccessful logon attempts occur.
AC-7 - Medium - CCI-000044 - V-274147 - SV-274147r1120429_rule
RMF Control
AC-7
Severity
Medium
CCI
CCI-000044
Version
AZLX-23-002420
Vuln IDs
  • V-274147
Rule IDs
  • SV-274147r1120429_rule
By limiting the number of failed logon attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute-force attacks, is reduced. Limits are imposed by locking the account. Amazon Linux 2023 can utilize the "pam_faillock.so" for this purpose. Note that manual changes to the listed files may be overwritten by the "authselect" program. From "Pam_Faillock" man pages: Note that the default directory that "pam_faillock" uses is usually cleared on system boot so the access will be re-enabled after system reboot. If that is undesirable, a different tally directory must be set with the "dir" option.
Checks: C-78238r1120427_chk

Verify Amazon Linux 2023 locks an account after three unsuccessful logon attempts with the following commands: Note: If the system administrator demonstrates the use of an approved centralized account management method that locks an account after three unsuccessful logon attempts within a period of 15 minutes, this requirement is met by that method. $ sudo grep pam_faillock.so /etc/pam.d/password-auth auth required pam_faillock.so preauth dir=/var/log/faillock silent audit deny=3 even_deny_root fail_interval=900 unlock_time=0 auth required pam_faillock.so authfail dir=/var/log/faillock unlock_time=0 account required pam_faillock.so If the "deny" option is not set to "3" or less (but not "0") on the "preauth" line with the "pam_faillock.so" module, or is missing from this line, if any of the lines are commented out, or are missing, this is a finding.

Fix: F-78143r1120428_fix

Configure Amazon Linux 2023 to lock an account when three unsuccessful logon attempts occur. Add/Modify the appropriate sections of the "/etc/pam.d/system-auth" and "/etc/pam.d/password-auth" files to match the following lines: auth required pam_faillock.so preauth dir=/var/log/faillock silent audit deny=3 even_deny_root fail_interval=900 unlock_time=0 auth required pam_faillock.so authfail dir=/var/log/faillock unlock_time=0 account required pam_faillock.so The "sssd" service must be restarted for the changes to take effect. To restart the "sssd" service, run the following command: $ sudo systemctl restart sssd.service

b
Amazon Linux 2023 must be able to enforce a 60-day maximum password lifetime restriction.
- Medium - CCI-004066 - V-274148 - SV-274148r1120432_rule
RMF Control
Severity
Medium
CCI
CCI-004066
Version
AZLX-23-002425
Vuln IDs
  • V-274148
Rule IDs
  • SV-274148r1120432_rule
Any password, no matter how complex, can eventually be cracked. Therefore, passwords need to be changed periodically. If Amazon Linux 2023 does not limit the lifetime of passwords and force users to change their passwords, there is the risk that Amazon Linux 2023 passwords could be compromised.
Checks: C-78239r1120430_chk

Verify Amazon Linux 2023 enforces the maximum time period for existing passwords is restricted to 60 days with the following commands: $ sudo awk -F: '$5 &gt; 60 {print $1 " " $5}' /etc/shadow $ sudo awk -F: '$5 &lt;= 0 {print $1 " " $5}' /etc/shadow If any results are returned that are not associated with a system account, this is a finding.

Fix: F-78144r1120431_fix

Configure Amazon Linux 2023 to set noncompliant accounts to enforce a 60-day maximum password lifetime restriction. $ sudo chage -M 60 [user]

b
Amazon Linux 2023 must disable account identifiers (individuals, groups, roles, and devices) after 35 days of inactivity.
- Medium - CCI-003627 - V-274149 - SV-274149r1120435_rule
RMF Control
Severity
Medium
CCI
CCI-003627
Version
AZLX-23-002430
Vuln IDs
  • V-274149
Rule IDs
  • SV-274149r1120435_rule
Inactive identifiers pose a risk to systems and applications because attackers may exploit an inactive identifier and potentially obtain undetected access to the system. Owners of inactive accounts will not notice if unauthorized access to their user account has been obtained. Operating systems need to track periods of inactivity and disable application identifiers after 35 days of inactivity. Satisfies: SRG-OS-000118-GPOS-00060, SRG-OS-000590-GPOS-00110
Checks: C-78240r1120433_chk

Verify Amazon Linux 2023 account identifiers (individuals, groups, roles, and devices) are disabled after 35 days of inactivity with the following command: Check the account inactivity value by performing the following command: $ sudo grep -i inactive /etc/default/useradd INACTIVE=35 If "INACTIVE" is set to "-1", a value greater than "35", or is commented out, this is a finding.

Fix: F-78145r1120434_fix

Configure Amazon Linux 2023 to disable account identifiers after 35 days of inactivity after the password expiration. Run the following command to change the configuration for useradd: $ sudo useradd -D -f 35 The recommendation is 35 days, but a lower value is acceptable.

b
Amazon Linux 2023 must automatically expire temporary accounts within 72 hours.
AC-2 - Medium - CCI-001682 - V-274150 - SV-274150r1120438_rule
RMF Control
AC-2
Severity
Medium
CCI
CCI-001682
Version
AZLX-23-002435
Vuln IDs
  • V-274150
Rule IDs
  • SV-274150r1120438_rule
Temporary accounts are privileged or nonprivileged accounts that are established during pressing circumstances, such as new software or hardware configuration or an incident response, where the need for prompt account activation requires bypassing normal account authorization procedures. If any inactive temporary accounts are left enabled on the system and are not either manually removed or automatically expired within 72 hours, the security posture of the system will be degraded and exposed to exploitation by unauthorized users or insider threat actors. Temporary accounts are different from emergency accounts. Emergency accounts, also known as "last resort" or "break glass" accounts, are local logon accounts enabled on the system for emergency use by authorized system administrators to manage a system when standard logon methods are failing or not available. Emergency accounts are not subject to manual removal or scheduled expiration requirements. The automatic expiration of temporary accounts may be extended as needed by the circumstances but it must not be extended indefinitely. A documented permanent account must be established for privileged users who need long-term maintenance accounts.
Checks: C-78241r1120436_chk

Verify Amazon Linux 2023 temporary accounts have been provisioned with an expiration date of 72 hours. For every existing temporary account, run the following command to obtain its account expiration information: $ sudo chage -l &lt;temporary_account_name&gt; | grep -i "account expires" Verify each of these accounts has an expiration date set within 72 hours. If any temporary accounts have no expiration date set or do not expire within 72 hours, this is a finding.

Fix: F-78146r1120437_fix

Configure Amazon Linux 2023 to expire temporary accounts after 72 hours with the following command: $ sudo chage -E $(date -d +3days +%Y-%m-%d) <temporary_account_name>

b
Amazon Linux 2023 must restrict the use of the "su" command.
AC-3 - Medium - CCI-002165 - V-274151 - SV-274151r1120441_rule
RMF Control
AC-3
Severity
Medium
CCI
CCI-002165
Version
AZLX-23-002440
Vuln IDs
  • V-274151
Rule IDs
  • SV-274151r1120441_rule
The "su" program allows to run commands with a substitute user and group ID. It is commonly used to run commands as the root user. Limiting access to such commands is considered a good security practice.
Checks: C-78242r1120439_chk

Verify Amazon Linux 2023 requires uses to be members of the "wheel" group with the following command: $ grep pam_wheel /etc/pam.d/su auth required pam_wheel.so use_uid If a line for "pam_wheel.so" does not exist, or is commented out, this is a finding.

Fix: F-78147r1120440_fix

Configure Amazon Linux 2023 to require users to be in the "wheel" group to run "su" command. In file "/etc/pam.d/su", uncomment the following line: "#auth required pam_wheel.so use_uid" $ sudo sed '/^[[:space:]]*#[[:space:]]*auth[[:space:]]\+required[[:space:]]\+pam_wheel\.so[[:space:]]\+use_uid$/s/^[[:space:]]*#//' -i /etc/pam.d/su If necessary, create a "wheel" group and add administrative users to the group.

b
Amazon Linux 2023 must enable the SELinux targeted policy.
SI-6 - Medium - CCI-002696 - V-274152 - SV-274152r1120738_rule
RMF Control
SI-6
Severity
Medium
CCI
CCI-002696
Version
AZLX-23-002445
Vuln IDs
  • V-274152
Rule IDs
  • SV-274152r1120738_rule
Setting the SELinux policy to "targeted" or a more specialized policy ensures the system will confine processes that are likely to be targeted for exploitation, such as network or system services. Note: During the development or debugging of SELinux modules, it is common to temporarily place nonproduction systems in "permissive" mode. In such temporary cases, SELinux policies should be developed, and once work is completed, the system should be reconfigured to "targeted".
Checks: C-78243r1120442_chk

Verify Amazon Linux 2023 SELINUX is using the targeted policy with the following command: $ sestatus | grep policy Loaded policy name: targeted If the loaded policy name is not "targeted", this is a finding.

Fix: F-78148r1120737_fix

Configure Amazon Linux 2023 to use the targeted SELINUX policy. Edit the file "/etc/selinux/config" and add or modify the following line: SELINUXTYPE=targeted A reboot is required for the changes to take effect.

c
Amazon Linux 2023 must use a Linux Security Module configured to enforce limits on system services.
SC-3 - High - CCI-001084 - V-274153 - SV-274153r1120713_rule
RMF Control
SC-3
Severity
High
CCI
CCI-001084
Version
AZLX-23-002450
Vuln IDs
  • V-274153
Rule IDs
  • SV-274153r1120713_rule
An isolation boundary provides access control and protects the integrity of the hardware, software, and firmware that perform security functions. Security functions are the hardware, software, and/or firmware of the information system responsible for enforcing the system security policy and supporting the isolation of code and data on which the protection is based. Operating systems implement code separation (i.e., separation of security functions from nonsecurity functions) in a number of ways, including through the provision of security kernels via processor rings or processor modes. For nonkernel code, security function isolation is often achieved through file system protections that serve to protect the code on disk and address space protections that protect executing code. Developers and implementers can increase the assurance in security functions by employing well-defined security policy models; structured, disciplined, and rigorous hardware and software development techniques; and sound system/security engineering principles. Implementation may include isolation of memory space and libraries. Operating systems restrict access to security functions through the use of access control mechanisms and by implementing least privilege capabilities. Satisfies: SRG-OS-000134-GPOS-00068, SRG-OS-000445-GPOS-00199
Checks: C-78244r1120445_chk

Verify Amazon Linux 2023 verifies the correct operation of security functions through the use of SELinux with the following command: $ getenforce Enforcing If SELINUX is not set to "Enforcing", this is a finding.

Fix: F-78149r1120446_fix

Configure Amazon Linux 2023 to verify correct operation of security functions. Edit the file "/etc/selinux/config" and add or modify the following line: SELINUX=enforcing A reboot is required for the changes to take effect.

b
Amazon Linux 2023 must automatically lock an account when three unsuccessful logon attempts occur.
AC-7 - Medium - CCI-002238 - V-274154 - SV-274154r1120450_rule
RMF Control
AC-7
Severity
Medium
CCI
CCI-002238
Version
AZLX-23-002455
Vuln IDs
  • V-274154
Rule IDs
  • SV-274154r1120450_rule
By limiting the number of failed logon attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute-forcing, is reduced. Limits are imposed by locking the account.
Checks: C-78245r1120448_chk

Verify Amazon Linux 2023 is configured to lock an account after three unsuccessful logon attempts with the command: $ grep 'deny =' /etc/security/faillock.conf deny = 3 If the "deny" option is not set to "3" or less (but not "0"), is missing or commented out, this is a finding.

Fix: F-78150r1120449_fix

Configure Amazon Linux 2023 to lock an account when three unsuccessful logon attempts occur. Add/modify the "/etc/security/faillock.conf" file to match the following line: deny = 3

b
Amazon Linux 2023 must automatically lock the root account until the root account is released by an administrator when three unsuccessful logon attempts occur during a 15-minute time period.
AC-7 - Medium - CCI-002238 - V-274155 - SV-274155r1120453_rule
RMF Control
AC-7
Severity
Medium
CCI
CCI-002238
Version
AZLX-23-002460
Vuln IDs
  • V-274155
Rule IDs
  • SV-274155r1120453_rule
By limiting the number of failed logon attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute-forcing, is reduced. Limits are imposed by locking the account.
Checks: C-78246r1120451_chk

Verify Amazon Linux 2023 is configured to lock the root account after three unsuccessful logon attempts with the command: $ grep even_deny_root /etc/security/faillock.conf even_deny_root If the "even_deny_root" option is not set, is missing or commented out, this is a finding.

Fix: F-78151r1120452_fix

Configure Amazon Linux 2023 to lock out the "root" account after a number of incorrect login attempts using "pam_faillock.so", first enable the feature using the following command: $ sudo authselect enable-feature with-faillock Then edit the "/etc/security/faillock.conf" file as follows: add or uncomment the following line: even_deny_root

b
Amazon Linux 2023 must automatically lock an account until the locked account is released by an administrator when three unsuccessful logon attempts in 15 minutes occur.
AC-7 - Medium - CCI-002238 - V-274156 - SV-274156r1120456_rule
RMF Control
AC-7
Severity
Medium
CCI
CCI-002238
Version
AZLX-23-002465
Vuln IDs
  • V-274156
Rule IDs
  • SV-274156r1120456_rule
By limiting the number of failed logon attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute-forcing, is reduced. Limits are imposed by locking the account.
Checks: C-78247r1120454_chk

Note: If the system administrator demonstrates the use of an approved centralized account management method that locks an account after three unsuccessful logon attempts within a period of 15 minutes, this requirement is not applicable. Verify Amazon Linux 2023 locks an account after three unsuccessful logon attempts within a period of 15 minutes with the following command: $ grep fail_interval /etc/security/faillock.conf fail_interval = 900 If the "fail_interval" option is not set to "900" or less (but not "0"), the line is commented out, or the line is missing, this is a finding.

Fix: F-78152r1120455_fix

Configure Amazon Linux 2023 to automatically lock an account after three unsuccessful logon attempts in 15-minutes. First, ensure that the system is configured with authselect, i.e., using sssd profiles: $ sudo authselect select sssd [--force] Then, enable the faillock feature: $ sudo authselect enable-feature with-faillock Then edit the "/etc/security/faillock.conf" file as follows: fail_interval = 900

b
Amazon Linux 2023 must maintain an account lock until the locked account is released by an administrator.
AC-7 - Medium - CCI-002238 - V-274157 - SV-274157r1120459_rule
RMF Control
AC-7
Severity
Medium
CCI
CCI-002238
Version
AZLX-23-002470
Vuln IDs
  • V-274157
Rule IDs
  • SV-274157r1120459_rule
By limiting the number of failed logon attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute-forcing, is reduced. Limits are imposed by locking the account.
Checks: C-78248r1120457_chk

Verify Amazon Linux 2023 is configured to lock an account until released by an administrator after three unsuccessful logon attempts with the command: $ grep 'unlock_time =' /etc/security/faillock.conf unlock_time = 0 If the "unlock_time" option is not set to "0", the line is missing, or commented out, this is a finding.

Fix: F-78153r1120458_fix

Configure Amazon Linux 2023 to lock an account until released by an administrator after three unsuccessful logon attempts with the command: $ authselect enable-feature with-faillock Then edit the "/etc/security/faillock.conf" file as follows: unlock_time = 0

b
Amazon Linux 2023 must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services, as defined in the Ports, Protocols, and Services Management Category Assurance List (PPSM CAL) and vulnerability assessments.
CM-7 - Medium - CCI-000382 - V-274158 - SV-274158r1120727_rule
RMF Control
CM-7
Severity
Medium
CCI
CCI-000382
Version
AZLX-23-002475
Vuln IDs
  • V-274158
Rule IDs
  • SV-274158r1120727_rule
To prevent unauthorized connection of devices, unauthorized transfer of information, or unauthorized tunneling (i.e., embedding of data types within data types), organizations must disable or restrict unused or unnecessary physical and logical ports/protocols on information systems. Operating systems are capable of providing a variety of functions and services. Some of the functions and services provided by default may not be necessary to support essential organizational operations. Additionally, it is sometimes convenient to provide multiple services from a single component (e.g., VPN and IPS); however, doing so increases risk over limiting the services provided by any one component. To support the requirements and principles of least functionality, Amazon Linux 2023 must support the organizational requirements, providing only essential capabilities and limiting the use of ports, protocols, and/or services to only those required, authorized, and approved to conduct official business or to address authorized quality of life issues. Satisfies: SRG-OS-000096-GPOS-00050, SRG-OS-000297-GPOS-00115
Checks: C-78249r1120726_chk

Verify Amazon Linux 2023 firewall is configured to block unregistered ports, protocols, and services. Inspect the list of enabled firewall ports and verify they are configured correctly by running the following command: $ sudo firewall-cmd --list-all Ask the system administrator for the site or program PPSM Component Local Service Assessment (CLSA). Verify the services allowed by the firewall match the PPSM CLSA. If there are additional ports, protocols, or services that are not in the PPSM CLSA, or there are ports, protocols, or services that are prohibited by the PPSM CAL, or there are no firewall rules configured, this is a finding.

Fix: F-78154r1120461_fix

Configure Amazon Linux 2023 to Prohibit/Restrict Functions, Ports, Protocols, Services. Use firewall-cmd to manage firewalld. For example, to block a specific port (8080), use: sudo firewall-cmd --permanent --remove-port=8080/tcp

b
Amazon Linux 2023 must insure all interactive users have a primary group that exists.
IA-2 - Medium - CCI-000764 - V-274159 - SV-274159r1120465_rule
RMF Control
IA-2
Severity
Medium
CCI
CCI-000764
Version
AZLX-23-002480
Vuln IDs
  • V-274159
Rule IDs
  • SV-274159r1120465_rule
If a user is assigned the group identifier (GID) of a group that does not exist on the system, and a group with the GID is subsequently created, the user may have unintended rights to any files associated with the group. Satisfies: SRG-OS-000104-GPOS-00051, SRG-OS-000121-GPOS-00062, SRG-OS-000042-GPOS-00020
Checks: C-78250r1120463_chk

Verify Amazon Linux 2023 interactive users have a valid GID with the following command: $ sudo pwck -qr If the system has any interactive users with duplicate GIDs, this is a finding.

Fix: F-78155r1120464_fix

Configure Amazon Linux 2023 so that all GIDs are referenced in "/etc/passwd" are defined in "/etc/group". Edit the file "/etc/passwd" and ensure that every user's GID is a valid GID.

b
Amazon Linux 2023 must ensure all interactive users have unique User IDs (UIDs).
IA-2 - Medium - CCI-000764 - V-274160 - SV-274160r1120663_rule
RMF Control
IA-2
Severity
Medium
CCI
CCI-000764
Version
AZLX-23-002485
Vuln IDs
  • V-274160
Rule IDs
  • SV-274160r1120663_rule
To ensure accountability and prevent unauthenticated access, interactive users must be identified and authenticated to prevent potential misuse and compromise of the system. Satisfies: SRG-OS-000104-GPOS-00051, SRG-OS-000121-GPOS-00062, SRG-OS-000042-GPOS-00020
Checks: C-78251r1120466_chk

Verify Amazon Linux 2023 contains no duplicate UIDs for interactive users with the following command: $ sudo awk -F ":" 'list[$3]++{print $1, $3}' /etc/passwd If output is produced and the accounts listed are interactive user accounts, this is a finding.

Fix: F-78156r1120467_fix

Configure Amazon Linux 2023 to contain no duplicate UIDs for interactive users. Edit the file "/etc/passwd" and provide each interactive user account that has a duplicate UID with a unique UID.

b
Amazon Linux 2023 must ensure the password complexity module is enabled in the password-auth file.
- Medium - CCI-004066 - V-274161 - SV-274161r1120471_rule
RMF Control
Severity
Medium
CCI
CCI-004066
Version
AZLX-23-002489
Vuln IDs
  • V-274161
Rule IDs
  • SV-274161r1120471_rule
Enabling PAM password complexity permits enforcement of strong passwords and consequently makes the system less prone to dictionary attacks.
Checks: C-78252r1120469_chk

Verify Amazon Linux 2023 uses "pwquality" to enforce the password complexity rules in the password-auth file with the following command: $ grep pam_pwquality /etc/pam.d/password-auth password required pam_pwquality.so If the command does not return a line containing the value "pam_pwquality.so", or the line is commented out, this is a finding. If the system administrator can demonstrate that the required configuration is contained in a PAM configuration file included or substacked from the system-auth file, this is not a finding.

Fix: F-78157r1120470_fix

Configure Amazon Linux 2023 to use "pwquality" to enforce password complexity rules. Add the following line to the "/etc/pam.d/password-auth" file (or modify the line to have the required value): password required pam_pwquality.so

b
Amazon Linux 2023 password-auth must be configured to use a sufficient number of hashing rounds.
- Medium - CCI-004062 - V-274162 - SV-274162r1120474_rule
RMF Control
Severity
Medium
CCI
CCI-004062
Version
AZLX-23-002490
Vuln IDs
  • V-274162
Rule IDs
  • SV-274162r1120474_rule
Unapproved mechanisms, used for authentication to the cryptographic module are not verified and therefore, cannot be relied upon to provide confidentiality or integrity, and DOD data may be compromised. Operating systems utilizing encryption are required to use FIPS-compliant mechanisms for authenticating to cryptographic modules. FIPS 140-2/140-3 is the current standard for validating that mechanisms used to access cryptographic modules utilize authentication that meets DOD requirements. This allows for Security Levels 1, 2, 3, or 4 for use on a general purpose computing system. Satisfies: SRG-OS-000073-GPOS-00041, SRG-OS-000120-GPOS-00061
Checks: C-78253r1120472_chk

Verify Amazon Linux 2023 has the required number of rounds for the password hashing algorithm is configured in password-auth with the following command: $ sudo grep rounds /etc/pam.d/password-auth password sufficient pam_unix.so sha512 rounds=100000 If a matching line is not returned or "rounds" is less than "100000", this a finding.

Fix: F-78158r1120473_fix

Configure Amazon Linux 2023 to use 100000 hashing rounds for hashing passwords. Add or modify the following line in "/etc/pam.d/password-auth" and set "rounds" to "100000". password sufficient pam_unix.so sha512 rounds=100000

b
Amazon Linux 2023 system-auth must be configured to use a sufficient number of hashing rounds.
- Medium - CCI-004062 - V-274163 - SV-274163r1120477_rule
RMF Control
Severity
Medium
CCI
CCI-004062
Version
AZLX-23-002495
Vuln IDs
  • V-274163
Rule IDs
  • SV-274163r1120477_rule
Unapproved mechanisms used for authentication to the cryptographic module are not verified and therefore, cannot be relied upon to provide confidentiality or integrity, and DOD data may be compromised. Operating systems utilizing encryption are required to use FIPS-compliant mechanisms for authenticating to cryptographic modules. FIPS 140-2/140-3 is the current standard for validating that mechanisms used to access cryptographic modules utilize authentication that meets DOD requirements. This allows for Security Levels 1, 2, 3, or 4 for use on a general purpose computing system. Satisfies: SRG-OS-000073-GPOS-00041, SRG-OS-000120-GPOS-00061
Checks: C-78254r1120475_chk

Verify Amazon Linux 2023 has the required number of rounds for the password hashing algorithm is configured in system-auth with the following command: $ sudo grep rounds /etc/pam.d/system-auth password sufficient pam_unix.so sha512 rounds=100000 If a matching line is not returned or "rounds" is less than "100000", this a finding.

Fix: F-78159r1120476_fix

Configure Amazon Linux 2023 to use 100000 hashing rounds for hashing passwords. Add or modify the following line in "/etc/pam.d/system-auth" and set "rounds" to "100000". password sufficient pam_unix.so sha512 rounds=100000

b
Amazon Linux 2023 must ensure a sticky bit be set on all public directories.
SC-4 - Medium - CCI-001090 - V-274164 - SV-274164r1137695_rule
RMF Control
SC-4
Severity
Medium
CCI
CCI-001090
Version
AZLX-23-002500
Vuln IDs
  • V-274164
Rule IDs
  • SV-274164r1137695_rule
Preventing unauthorized information transfers mitigates the risk of information, including encrypted representations of information, produced by the actions of prior users/roles (or the actions of processes acting on behalf of prior users/roles) from being available to any current users/roles (or current processes) that obtain access to shared system resources (e.g., registers, main memory, hard disks) after those resources have been released back to information systems. The control of information in shared resources is also commonly referred to as object reuse and residual information protection. This requirement generally applies to the design of an information technology product, but it can also apply to the configuration of particular information system components that are, or use, such products. This can be verified by acceptance/validation processes in DOD or other government agencies. There may be shared resources with configurable protections (e.g., files in storage) that may be assessed on specific information system components.
Checks: C-78255r1120478_chk

Verify Amazon Linux 2023 world-writable directories have the sticky bit set. Determine if all world-writable directories have the sticky bit set by running the following command: $ sudo find / -type d -perm -0002 ! -perm -1000 -exec ls -ld {} + If any output is returned, these directories are world-writable and do not have the sticky bit set, and this is a finding.

Fix: F-78160r1120479_fix

Configure Amazon Linux 2023 world-writable directories to have the sticky bit set to prevent unauthorized and unintended information transferred via shared system resources. Set the sticky bit on all world-writable directories using the following command: $ sudo find / -type d -perm -0002 ! -perm -1000 -exec chmod +t {} +

b
Amazon Linux 2023 must ensure all world-writable directories be owned by root, sys, bin, or an application user.
SC-4 - Medium - CCI-001090 - V-274165 - SV-274165r1137695_rule
RMF Control
SC-4
Severity
Medium
CCI
CCI-001090
Version
AZLX-23-002505
Vuln IDs
  • V-274165
Rule IDs
  • SV-274165r1137695_rule
Preventing unauthorized information transfers mitigates the risk of information, including encrypted representations of information, produced by the actions of prior users/roles (or the actions of processes acting on behalf of prior users/roles) from being available to any current users/roles (or current processes) that obtain access to shared system resources (e.g., registers, main memory, hard disks) after those resources have been released back to information systems. The control of information in shared resources is also commonly referred to as object reuse and residual information protection. This requirement generally applies to the design of an information technology product, but it can also apply to the configuration of particular information system components that are, or use, such products. This can be verified by acceptance/validation processes in DOD or other government agencies. There may be shared resources with configurable protections (e.g., files in storage) that may be assessed on specific information system components.
Checks: C-78256r1120481_chk

Verify Amazon Linux 2023 world writable directories are owned by root, a system account, or an application account with the following command: $ sudo find / -xdev -type d -perm -0002 ! -user root ! -uid +999 -exec ls -ld {} + If there is output, this is a finding.

Fix: F-78161r1120482_fix

Configure Amazon Linux 2023 public directories to be owned by root or a system account to prevent unauthorized and unintended information transferred via shared system resources. Set the owner of all public directories as root or a system account using the following command: $ sudo find / -xdev -type d -perm -0002 ! -user root ! -uid +999 -exec chown root:root {} +

b
Amazon Linux 2023 must terminate idle user sessions.
SC-10 - Medium - CCI-001133 - V-274166 - SV-274166r1155170_rule
RMF Control
SC-10
Severity
Medium
CCI
CCI-001133
Version
AZLX-23-002510
Vuln IDs
  • V-274166
Rule IDs
  • SV-274166r1155170_rule
Terminating an idle session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled on the console or console port that has been left unattended. In addition, quickly terminating an idle session will also free up resources committed by the managed network element. Terminating network connections associated with communications sessions includes, for example, de-allocating associated TCP/IP address/port pairs at Amazon Linux 2023 level, and de-allocating networking assignments at the application level if multiple application sessions are using a single operating system-level network connection. This does not mean that Amazon Linux 2023 terminates all sessions or network access; it only ends the inactive session and releases the resources associated with that session.
Checks: C-78257r1155168_chk

Verify Amazon Linux 2023 logs out sessions that are idle for 10 minutes with the following command: $ sudo grep -i ^StopIdleSessionSec /etc/systemd/logind.conf StopIdleSessionSec=600 If "StopIdleSessionSec" is not configured to "600" seconds, this is a finding.

Fix: F-78162r1155169_fix

Configure Amazon Linux 2023 to log out idle sessions by editing the /etc/systemd/logind.conf file with the following line: StopIdleSessionSec=600 The "logind" service must be restarted for the changes to take effect. To restart the "logind" service, run the following command: $ sudo systemctl restart systemd-logind

b
Amazon Linux 2023 must enable auditing of processes that start prior to the audit daemon.
AU-3 - Medium - CCI-000130 - V-274167 - SV-274167r1120489_rule
RMF Control
AU-3
Severity
Medium
CCI
CCI-000130
Version
AZLX-23-002515
Vuln IDs
  • V-274167
Rule IDs
  • SV-274167r1120489_rule
Without the capability to generate audit records, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. If auditing is enabled late in the startup process, the actions of some startup processes may not be audited. Some audit systems also maintain state information only available if auditing is enabled before a given process is created. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215, SRG-OS-000473-GPOS-00218, SRG-OS-000254-GPOS-00095
Checks: C-78258r1120487_chk

Verify Amazon Linux 2023 is configured so that GRUB 2 enables auditing of processes that start prior to the audit daemon with the following commands: Check that the current GRUB 2 configuration enables auditing: $ sudo grubby --info=ALL | grep args | grep -v 'audit=1' If any output is returned, this is a finding. Check that auditing is enabled by default to persist in kernel updates: $ grep audit /etc/default/grub GRUB_CMDLINE_LINUX="audit=1" If "audit" is not set to "1", is missing, or is commented out, this is a finding.

Fix: F-78163r1120488_fix

Configure Amazon Linux 2023 so that GRUB 2 enables auditing of processes that start prior to the audit daemon with the following command: $ sudo grubby --update-kernel=ALL --args="audit=1" Add or modify the following line in "/etc/default/grub" to ensure the configuration survives kernel updates: GRUB_CMDLINE_LINUX="audit=1"

b
Amazon Linux 2023 must allocate an audit_backlog_limit of sufficient size to capture processes that start prior to the audit daemon.
AU-14 - Medium - CCI-001464 - V-274168 - SV-274168r1120492_rule
RMF Control
AU-14
Severity
Medium
CCI
CCI-001464
Version
AZLX-23-002520
Vuln IDs
  • V-274168
Rule IDs
  • SV-274168r1120492_rule
Without the capability to generate audit records, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. If auditing is enabled late in the startup process, the actions of some startup processes may not be audited. Some audit systems also maintain state information only available if auditing is enabled before a given process is created. Audit records can be generated from various components within the information system (e.g., module or policy filter). Allocating an audit_backlog_limit of sufficient size is critical in maintaining a stable boot process. With an insufficient limit allocated, the system is susceptible to boot failures and crashes. Satisfies: SRG-OS-000254-GPOS-00095, SRG-OS-000341-GPOS-00132
Checks: C-78259r1120490_chk

Verify Amazon Linux 2023 allocates a sufficient audit_backlog_limit to capture processes that start prior to the audit daemon with the following command: $ sudo grubby --info=ALL | grep args | grep -v 'audit_backlog_limit=8192' If the command returns any outputs, and audit_backlog_limit is less than "8192", this is a finding.

Fix: F-78164r1120491_fix

Configure Amazon Linux 2023 to allocate sufficient audit_backlog_limit to capture processes that start prior to the audit daemon with the following command: $ sudo grubby --update-kernel=ALL --args=audit_backlog_limit=8192

b
Amazon Linux 2023 must enable discretionary access control on hardlinks.
AC-3 - Medium - CCI-002165 - V-274169 - SV-274169r1120495_rule
RMF Control
AC-3
Severity
Medium
CCI
CCI-002165
Version
AZLX-23-002535
Vuln IDs
  • V-274169
Rule IDs
  • SV-274169r1120495_rule
By enabling the fs.protected_hardlinks kernel parameter, users can no longer create soft or hard links to files they do not own. Disallowing such hardlinks mitigates vulnerabilities based on insecure file system accessed by privileged programs, avoiding an exploitation vector exploiting unsafe use of open() or creat(). Satisfies: SRG-OS-000312-GPOS-00123, SRG-OS-000324-GPOS-00125
Checks: C-78260r1120493_chk

Verify Amazon Linux 2023 is configured to enable DAC on hardlinks. Check the status of the fs.protected_hardlinks kernel parameter with the following command: $ sudo sysctl fs.protected_hardlinks fs.protected_hardlinks = 1 If "fs.protected_hardlinks" is not set to "1" or is missing, this is a finding.

Fix: F-78165r1120494_fix

Configure Amazon Linux 2023 to enable DAC on hardlinks with the following: Add or edit the following line in a system configuration file in the "/etc/sysctl.d/" directory: fs.protected_hardlinks = 1 Load settings from all system configuration files with the following command: $ sudo sysctl --system

b
Amazon Linux 2023 must enable kernel parameters to enforce discretionary access control on symlinks.
AC-3 - Medium - CCI-002165 - V-274170 - SV-274170r1120498_rule
RMF Control
AC-3
Severity
Medium
CCI
CCI-002165
Version
AZLX-23-002540
Vuln IDs
  • V-274170
Rule IDs
  • SV-274170r1120498_rule
By enabling the fs.protected_symlinks kernel parameter, symbolic links are permitted to be followed only when outside a sticky world-writable directory, or when the user identifier (UID) of the link and follower match, or when the directory owner matches the symlink's owner. Disallowing such symlinks helps mitigate vulnerabilities based on insecure file system accessed by privileged programs, avoiding an exploitation vector exploiting unsafe use of open() or creat(). Satisfies: SRG-OS-000312-GPOS-00123, SRG-OS-000324-GPOS-00125
Checks: C-78261r1120496_chk

Verify Amazon Linux 2023 is configured to enable DAC on symlinks. Check the status of the fs.protected_symlinks kernel parameter with the following command: $ sudo sysctl fs.protected_symlinks fs.protected_symlinks = 1 If "fs.protected_symlinks " is not set to "1" or is missing, this is a finding.

Fix: F-78166r1120497_fix

Configure Amazon Linux 2023 to enable DAC on symlinks with the following: Add or edit the following line in a system configuration file in the "/etc/sysctl.d/" directory: fs.protected_symlinks = 1 Load settings from all system configuration files with the following command: $ sudo sysctl --system

b
Amazon Linux 2023 debug-shell systemd service must be disabled.
AC-6 - Medium - CCI-002235 - V-274173 - SV-274173r1120507_rule
RMF Control
AC-6
Severity
Medium
CCI
CCI-002235
Version
AZLX-23-002555
Vuln IDs
  • V-274173
Rule IDs
  • SV-274173r1120507_rule
The debug-shell requires no authentication and provides root privileges to anyone who has physical access to the machine. While this feature is disabled by default, masking it adds an additional layer of assurance that it will not be enabled via a dependency in systemd. This also prevents attackers with physical access from trivially bypassing security on the machine through valid troubleshooting configurations and gaining root access when the system is rebooted.
Checks: C-78264r1120505_chk

Verify Amazon Linux 2023 is configured to mask the debug-shell systemd service with the following command: $ sudo systemctl status debug-shell.service O debug-shell.service Loaded: masked (Reason: Unit debug-shell.service is masked.) Active: inactive (dead) If the "debug-shell.service" is loaded and not masked, this is a finding.

Fix: F-78169r1120506_fix

Configure Amazon Linux 2023 to mask the debug-shell systemd service with the following command: $ sudo systemctl disable --now debug-shell.service $ sudo systemctl mask --now debug-shell.service

b
Amazon Linux 2023 chrony must be configured with a maximum interval of 24 hours between requests sent to a USNO server or a time server designated for the appropriate DOD network.
- Medium - CCI-004923 - V-274174 - SV-274174r1120510_rule
RMF Control
Severity
Medium
CCI
CCI-004923
Version
AZLX-23-002560
Vuln IDs
  • V-274174
Rule IDs
  • SV-274174r1120510_rule
Inaccurate time stamps make it more difficult to correlate events and can lead to an inaccurate analysis. Determining the correct time a particular event occurred on a system is critical when conducting forensic analysis and investigating system events. Sources outside the configured acceptable allowance (drift) may be inaccurate.
Checks: C-78265r1120508_chk

Verify Amazon Linux 2023 chrony service specifies a maximum interval of 24 hours between requests sent to a USNO server with the following command: Note: &lt;USNO/DOD Server&gt; is used in place of a time source IP address. $ sudo grep maxpoll /etc/chrony.conf server &lt;USNO/DOD Server&gt; iburst maxpoll 16 If the "maxpoll" option is not configured, commented out, or set to a number greater than 16 or the line is commented out then this is a finding. Verify Amazon Linux 2023 chrony service is configured to use authoritative USNO or appropriate DOD time source with the following command: $ sudo grep -i server /etc/chrony.conf server &lt;USNO/DOD Server&gt; If the parameter "server" is not set, or is not set to an authoritative USNO/DOD time source, then this is a finding.

Fix: F-78170r1120509_fix

Configure Amazon Linux 2023 to compare internal information system clocks at least every 24 hours with an NTP server. Ensure the following line is added or updated in /etc/chrony.conf: server DOD.ntp.server iburst maxpoll 16

b
Amazon Linux 2023 must synchronize internal information system clocks to the authoritative time source at least every 24 hours.
- Medium - CCI-004926 - V-274175 - SV-274175r1120659_rule
RMF Control
Severity
Medium
CCI
CCI-004926
Version
AZLX-23-002565
Vuln IDs
  • V-274175
Rule IDs
  • SV-274175r1120659_rule
Inaccurate time stamps make it more difficult to correlate events and can lead to an inaccurate analysis. Determining the correct time a particular event occurred on a system is critical when conducting forensic analysis and investigating system events. Sources outside the configured acceptable allowance (drift) may be inaccurate. Synchronizing internal information system clocks provides uniformity of time stamps for information systems with multiple system clocks and systems connected over a network. Depending on the infrastructure being used the "pool" directive may not be supported. Satisfies: SRG-OS-000356-GPOS-00144, SRG-OS-000785-GPOS-00250, SRG-OS-000359-GPOS-00146
Checks: C-78266r1120658_chk

Verify Amazon Linux 2023 is securely comparing internal information system clocks at least every 24 hours with an NTP server with the following commands: $ sudo grep maxpoll /etc/chrony.conf server 0.us.pool.ntp.mil iburst maxpoll 16 If the "maxpoll" option is set to a number greater than 16 or the line is commented out, this is a finding. Verify the "chrony.conf" file is configured to an authoritative DOD time source by running the following command: $ sudo grep -i server /etc/chrony.conf server 0.us.pool.ntp.mil If the parameter "server" is not set, or is not set to an authoritative DOD time source, this is a finding.

Fix: F-78171r1120512_fix

Configure Amazon Linux 2023 chrony service to securely compare internal information system clocks at least every 24 hours with an NTP server by adding/modifying the following line in the /etc/chrony.conf file. server [ntp.server.name] iburst maxpoll 16

b
Amazon Linux 2023 must routinely check the baseline configuration for unauthorized changes and notify the system administrator when anomalies in the operation of any security functions are discovered.
CM-3 - Medium - CCI-001744 - V-274176 - SV-274176r1120655_rule
RMF Control
CM-3
Severity
Medium
CCI
CCI-001744
Version
AZLX-23-002570
Vuln IDs
  • V-274176
Rule IDs
  • SV-274176r1120655_rule
Unauthorized changes to the baseline configuration could make the system vulnerable to various attacks or allow unauthorized access to Amazon Linux 2023. Changes to operating system configurations can have unintended side effects, some of which may be relevant to security. Detecting such changes and providing an automated response can help avoid unintended, negative consequences that could ultimately affect the security state of Amazon Linux 2023. Amazon Linux 2023's information management officer (IMO)/information system security officer (ISSO) and system administrators (SAs) must be notified via email and/or monitoring system trap when there is an unauthorized modification of a configuration item. Notifications provided by information systems include messages to local computer consoles, and/or hardware indications, such as lights. This capability must take into account operational requirements for availability for selecting an appropriate response. The organization may choose to shut down or restart the information system upon security function anomaly detection.
Checks: C-78267r1120514_chk

Verify Amazon Linux 2023 routinely executes a file integrity scan for changes to the system baseline. The command used in the example will use a daily occurrence. Check the cron directories for scripts controlling the execution and notification of results of the file integrity application. For example, if AIDE is installed on the system, use the following commands: $ sudo ls -al /etc/cron.* | grep aide -rwxr-xr-x 1 root root 29 Nov 22 2015 aide $ grep aide /etc/crontab /var/spool/cron/root /etc/crontab: 30 04 * * * root usr/sbin/aide /var/spool/cron/root: 30 04 * * * root usr/sbin/aide $ sudo more /etc/cron.daily/aide #!/bin/bash /usr/sbin/aide --check | /bin/mail -s "$HOSTNAME - Daily aide integrity check run" root@sysname.mil If the file integrity application does not exist, or a script file controlling the execution of the file integrity application does not exist, or the file integrity application does not notify designated personnel of changes, this is a finding.

Fix: F-78172r1120654_fix

Configure Amazon Linux 2023 so that the file integrity tool runs automatically on the system at least weekly and notifies designated personnel if baseline configurations are changed in an unauthorized manner. The AIDE tool can be configured to email designated personnel with the use of the cron system. The following example output is generic. It will set cron to run AIDE daily and to send email at the completion of the analysis. $ sudo more /etc/cron.daily/aide #!/bin/bash /usr/sbin/aide --check | /bin/mail -s "$HOSTNAME - Daily aide integrity check run" root@sysname.mil

b
Amazon Linux 2023 must prevent the loading of a new kernel for later execution.
- Medium - CCI-003992 - V-274177 - SV-274177r1120519_rule
RMF Control
Severity
Medium
CCI
CCI-003992
Version
AZLX-23-002575
Vuln IDs
  • V-274177
Rule IDs
  • SV-274177r1120519_rule
Changes to any software components can have significant effects on the overall security of Amazon Linux 2023. This requirement ensures the software has not been tampered with and that it has been provided by a trusted vendor. All software packages must be signed with a cryptographic key recognized and approved by the organization. Verifying the authenticity of software prior to installation validates the integrity of the software package received from a vendor. This verifies the software has not been tampered with and that it has been provided by a trusted vendor.
Checks: C-78268r1120517_chk

Verify Amazon Linux 2023 is configured to disable kernel image loading. Check the status of the kernel.kexec_load_disabled kernel parameter with the following command: $ sudo sysctl kernel.kexec_load_disabled kernel.kexec_load_disabled = 1 If "kernel.kexec_load_disabled" is not set to "1" or is missing, this is a finding.

Fix: F-78173r1120518_fix

Configure Amazon Linux 2023 to disable kernel image loading. Add or edit the following line in a system configuration file in the "/etc/sysctl.d/" directory: kernel.kexec_load_disabled = 1 Load settings from all system configuration files with the following command: $ sudo sysctl --system

b
Amazon Linux 2023 must prevent files with the setuid and setgid bit set from being executed on the /boot/efi directory.
CM-7 - Medium - CCI-001764 - V-274178 - SV-274178r1120522_rule
RMF Control
CM-7
Severity
Medium
CCI
CCI-001764
Version
AZLX-23-002580
Vuln IDs
  • V-274178
Rule IDs
  • SV-274178r1120522_rule
The "nosuid" mount option causes the system not to execute "setuid" and "setgid" files with owner privileges. This option must be used for mounting any file system not containing approved "setuid" and "setguid" files. Executing files from untrusted file systems increases the opportunity for nonprivileged users to attain unauthorized administrative access.
Checks: C-78269r1120520_chk

Verify Amazon Linux 2023 is configured so that the /boot/efi directory is mounted with the "nosuid" option with the following command: $ mount | grep '\s/boot/efi\s' /dev/sda1 on /boot/efi type vfat (rw,nosuid,relatime,fmask=0077,dmask=0077,codepage=437,iocharset=ascii,shortname=winnt,errors=remount-ro) If the /boot/efi file system does not have the "nosuid" option set, this is a finding.

Fix: F-78174r1120521_fix

Configure Amazon Linux 2023 so that the /boot/efi directory is mounted with the "nosuid" option. Modify "/etc/fstab" to use the "nosuid" option on the "/boot/efi" directory.

b
Amazon Linux 2023 must mount /dev/shm with the nodev option.
CM-7 - Medium - CCI-001764 - V-274179 - SV-274179r1120525_rule
RMF Control
CM-7
Severity
Medium
CCI
CCI-001764
Version
AZLX-23-002585
Vuln IDs
  • V-274179
Rule IDs
  • SV-274179r1120525_rule
The "nodev" mount option causes the system to not interpret character or block special devices. Executing character or block special devices from untrusted file systems increases the opportunity for nonprivileged users to attain unauthorized administrative access.
Checks: C-78270r1120523_chk

Verify Amazon Linux 2023 is configured so that "/dev/shm" is mounted with the "nodev" option with the following command: $ mount | grep /dev/shm tmpfs on /dev/shm type tmpfs (rw,nodev,nosuid,noexec,seclabel) If the /dev/shm file system is mounted without the "nodev" option, this is a finding.

Fix: F-78175r1120524_fix

Configure Amazon Linux 2023 so that "/dev/shm" is mounted with the "nodev" option. Modify "/etc/fstab" to use the "nodev" option on the "/dev/shm" file system.

b
Amazon Linux 2023 must mount /dev/shm with the nosuid option.
CM-7 - Medium - CCI-001764 - V-274180 - SV-274180r1120528_rule
RMF Control
CM-7
Severity
Medium
CCI
CCI-001764
Version
AZLX-23-002590
Vuln IDs
  • V-274180
Rule IDs
  • SV-274180r1120528_rule
The "nosuid" mount option causes the system to not execute "setuid" and "setgid" files with owner privileges. This option must be used for mounting any file system not containing approved "setuid" and "setguid" files. Executing files from untrusted file systems increases the opportunity for nonprivileged users to attain unauthorized administrative access.
Checks: C-78271r1120526_chk

Verify Amazon Linux 2023 is configured so that "/dev/shm" is mounted with the "nosuid" option with the following command: $ mount | grep /dev/shm tmpfs on /dev/shm type tmpfs (rw,nodev,nosuid,noexec,seclabel) If the /dev/shm file system is mounted without the "noexec" option, this is a finding.

Fix: F-78176r1120527_fix

Configure Amazon Linux 2023 so that "/dev/shm" is mounted with the "nosuid" option. Modify "/etc/fstab" to use the "nosuid" option on the "/dev/shm" file system.

b
Amazon Linux 2023 must ensure the pcscd service is active.
- Medium - CCI-004046 - V-274181 - SV-274181r1120531_rule
RMF Control
Severity
Medium
CCI
CCI-004046
Version
AZLX-23-002595
Vuln IDs
  • V-274181
Rule IDs
  • SV-274181r1120531_rule
The information system ensures that even if the information system is compromised, that compromise will not affect credentials stored on the authentication device. The daemon program for pcsc-lite and the MuscleCard framework is pcscd. It is a resource manager that coordinates communications with smart card readers and smart cards and cryptographic tokens connected to the system.
Checks: C-78272r1120529_chk

Verify Amazon Linux 2023 is configured so that the "pcscd" service is active with the following command: $ systemctl is-active pcscd active If the pcscdservice is not active, this is a finding.

Fix: F-78177r1120530_fix

Configure Amazon Linux 2023 so that the "pcscd" service is active with the following command: $ sudo systemctl enable --now pcscd

b
Amazon Linux 2023 file system automount function must be disabled unless required.
IA-3 - Medium - CCI-001958 - V-274182 - SV-274182r1120729_rule
RMF Control
IA-3
Severity
Medium
CCI
CCI-001958
Version
AZLX-23-002600
Vuln IDs
  • V-274182
Rule IDs
  • SV-274182r1120729_rule
Without authenticating devices, unidentified or unknown devices may be introduced, thereby facilitating malicious activity. Peripherals include, but are not limited to, such devices as flash drives, external storage, and printers.
Checks: C-78273r1120728_chk

Verify Amazon Linux 2023 disables the file system automount function with the following command: $ sudo systemctl is-enabled autofs masked If the returned value is not "masked", "disabled", "Failed to get unit file state for autofs.service for autofs", or "enabled", and is not documented as operational requirement with the information system security officer (ISSO), this is a finding.

Fix: F-78178r1120533_fix

Configure Amazon Linux 2023 to disable the ability to automount devices. The autofs service can be disabled with the following command: $ sudo systemctl mask --now autofs.service

b
Amazon Linux 2023 must protect against or limit the effects of denial-of-service (DoS) attacks by ensuring rate-limiting measures are configured on impacted network interfaces.
SC-5 - Medium - CCI-002385 - V-274183 - SV-274183r1120714_rule
RMF Control
SC-5
Severity
Medium
CCI
CCI-002385
Version
AZLX-23-002605
Vuln IDs
  • V-274183
Rule IDs
  • SV-274183r1120714_rule
DoS is a condition when a resource is not available for legitimate users. When this occurs, the organization either cannot accomplish its mission or must operate at degraded capacity. This requirement addresses the configuration of Amazon Linux 2023 to mitigate the impact of DoS attacks that have occurred or are ongoing on system availability. For each system, known and potential DoS attacks must be identified and solutions for each type implemented. A variety of technologies exist to limit or, in some cases, eliminate the effects of DoS attacks (e.g., limiting processes or establishing memory partitions). Employing increased capacity and bandwidth, combined with service redundancy, may reduce the susceptibility to some DoS attacks.
Checks: C-78274r1120535_chk

Verify Amazon Linux 2023 is implementing rate-limiting measures on network interfaces to protect against DoS attacks. Access the AWS Management Console: Sign in to the AWS Management Console and navigate to the EC2 service. To locate the Application Load Balancer (ALB) in the EC2 dashboard, go to the "Load Balancers" section and find the ALB. Check the ALB configuration: Click on the ALB to view its details. The listener configuration for the ALB is located in the "Listener" tab. Look for the rate limiting settings: Scroll down to the "Rules" section. If rate limiting is enabled, a rule with the "Rate Limit" action will be displayed.

Fix: F-78179r1120536_fix

Configure Amazon Linux 2023 to use the AWS ALB rate limiting feature using its built-in rate limiting capabilities. This allows the user to set rate limits at the ALB level, which will apply to all traffic passing through the load balancer.

b
Amazon Linux 2023 must implement nonexecutable data to protect its memory from unauthorized code execution.
SI-16 - Medium - CCI-002824 - V-274184 - SV-274184r1120540_rule
RMF Control
SI-16
Severity
Medium
CCI
CCI-002824
Version
AZLX-23-002610
Vuln IDs
  • V-274184
Rule IDs
  • SV-274184r1120540_rule
The no-execute (NX) feature uses the segmentation feature on all x86 systems to prevent execution in memory higher than a certain address. It writes an address as a limit in the code segment descriptor, to control where code can be executed, on a per-process basis. When the kernel places a process's memory regions such as the stack and heap higher than this address, the hardware prevents execution in that address range. This is enabled by default on the latest Red Hat and Fedora systems if supported by the hardware.
Checks: C-78275r1120538_chk

Verify Amazon Linux 2023 NX support is enabled with the following command: $ sudo dmesg | grep '[NX|DX]*protection' [ 0.000000] NX (Execute Disable) protection: active If "dmesg" does not show "NX (Execute Disable) protection" active, this is a finding.

Fix: F-78180r1120539_fix

Configure Amazon Linux 2023 NX support to be enabled by opening a support case via the AWS Console to investigate why NX support is not detected.

b
Amazon Linux 2023 must remove all software components after updated versions have been installed.
SI-2 - Medium - CCI-002617 - V-274185 - SV-274185r1120543_rule
RMF Control
SI-2
Severity
Medium
CCI
CCI-002617
Version
AZLX-23-002615
Vuln IDs
  • V-274185
Rule IDs
  • SV-274185r1120543_rule
Previous versions of software components that are not removed from the information system after updates have been installed may be exploited by some adversaries.
Checks: C-78276r1120541_chk

Verify Amazon Linux 2023 removes all software components after updated versions have been installed with the following command: $ grep clean /etc/dnf/dnf.conf clean_requirements_on_remove=1 If "clean_requirements_on_remove" is not set to "1", "True", or "yes", this is a finding.

Fix: F-78181r1120542_fix

Configure Amazon Linux 2023 to remove all software components after updated versions have been installed. Set the "clean_requirements_on_remove" option to "1" in the "/etc/dnf/dnf.conf" file: clean_requirements_on_remove=1

b
Amazon Linux 2023 must configure the use of the pam_faillock.so module in the /etc/pam.d/system-auth file.
AC-7 - Medium - CCI-000044 - V-274186 - SV-274186r1120546_rule
RMF Control
AC-7
Severity
Medium
CCI
CCI-000044
Version
AZLX-23-002620
Vuln IDs
  • V-274186
Rule IDs
  • SV-274186r1120546_rule
If the pam_faillock.so module is not loaded, the system will not correctly lockout accounts to prevent password guessing attacks.
Checks: C-78277r1120544_chk

Verify Amazon Linux 2023 is configured so that the pam_faillock.so module is present in the "/etc/pam.d/system-auth" file: $ grep pam_faillock.so /etc/pam.d/system-auth auth required pam_faillock.so preauth auth required pam_faillock.so authfail account required pam_faillock.so If the pam_faillock.so module is not present in the "/etc/pam.d/system-auth" file with the "preauth" line listed before pam_unix.so, this is a finding.

Fix: F-78182r1120545_fix

Configure Amazon Linux 2023 to include the use of the pam_faillock.so module in the /etc/pam.d/system-auth file. Add/modify the appropriate sections of the "/etc/pam.d/system-auth" file to match the following lines: Note: The "preauth" line must be listed before pam_unix.so. auth required pam_faillock.so preauth auth required pam_faillock.so authfail account required pam_faillock.so

b
Amazon Linux 2023 audit system must protect logon user identifiers (UIDs) from unauthorized change.
AU-12 - Medium - CCI-000172 - V-274187 - SV-274187r1120715_rule
RMF Control
AU-12
Severity
Medium
CCI
CCI-000172
Version
AZLX-23-005000
Vuln IDs
  • V-274187
Rule IDs
  • SV-274187r1120715_rule
If modification of login UIDs is not prevented, they can be changed by nonprivileged users and make auditing complicated or impossible. Satisfies: SRG-OS-000462-GPOS-00206, SRG-OS-000475-GPOS-00220, SRG-OS-000057-GPOS-00027, SRG-OS-000058-GPOS-00028, SRG-OS-000059-GPOS-00029
Checks: C-78278r1120547_chk

Verify Amazon Linux 2023 is configured so that the audit system prevents unauthorized changes to login UIDs with the following command: $ sudo grep -i immutable /etc/audit/audit.rules --loginuid-immutable If the "--loginuid-immutable" option is not returned in the "/etc/audit/audit.rules", or the line is commented out, this is a finding.

Fix: F-78183r1120548_fix

Configure Amazon Linux 2023 auditing to prevent modification of login UIDs once they are set by adding the following line to /etc/audit/rules.d/audit.rules: --loginuid-immutable To load the rules to the kernel immediately, use the following command: $ sudo augenrules --load