Canonical Ubuntu 18.04 LTS Security Technical Implementation Guide
Pick two releases to diff their requirements.
Open a previous version of this STIG.
Digest of Updates +194 −200
Comparison against the immediately-prior release (V1R2). Rule matching uses the Group Vuln ID. Content-change detection compares the rule’s description, check, and fix text after stripping inline markup — cosmetic-only edits aren’t flagged.
Added rules 194
- V-219147 High Ubuntu operating systems booted with a BIOS must require authentication upon booting into single-user and maintenance modes.
- V-219148 High Ubuntu operating systems booted with United Extensible Firmware Interface (UEFI) implemented must require authentication upon booting into single-user mode and maintenance.
- V-219149 Medium The Ubuntu operating system must initiate session audits at system startup.
- V-219150 Medium Ubuntu operating systems handling data requiring data at rest protections must employ cryptographic mechanisms to prevent unauthorized disclosure and modification of the information at rest.
- V-219151 High The Ubuntu operating system must implement NIST FIPS-validated cryptography to protect classified information and for the following: to provision digital signatures, to generate cryptographic hashes, and to protect unclassified information requiring confidentiality and cryptographic protection in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.
- V-219152 Low The Ubuntu operating system must immediately notify the SA and ISSO (at a minimum) when allocated audit record storage volume reaches 75% of the repository maximum audit record storage capacity.
- V-219153 Low The Ubuntu operating system audit event multiplexor must be configured to off-load audit logs onto a different system in real time, if the system is interconnected.
- V-219154 Low The Ubuntu operating system must have a crontab script running weekly to off-load audit events of standalone systems.
- V-219155 Medium Advance package Tool (APT) must be configured to prevent the installation of patches, service packs, device drivers, or Ubuntu operating system components without verification they have been digitally signed using a certificate that is recognized and approved by the organization.
- V-219156 Medium The Ubuntu operating system must be configured so that Advance package Tool (APT) removes all software components after updated versions have been installed.
- V-219157 High The Ubuntu operating system must not have the Network Information Service (NIS) package installed.
- V-219158 High The Ubuntu operating system must not have the rsh-server package installed.
- V-219159 Medium The Ubuntu operating system must deploy Endpoint Security for Linux Threat Prevention (ENSLTP).
- V-219160 Medium The Ubuntu operating system must be configured to preserve log records from failure events.
- V-219161 Medium The Ubuntu operating system must have an application firewall installed in order to control remote access methods.
- V-219162 Low The Ubuntu operating system audit event multiplexor must be configured to off-load audit logs onto a different system or storage media from the system being audited.
- V-219163 Low The Ubuntu operating system must be configured such that Pluggable Authentication Module (PAM) prohibits the use of cached authentications after one day.
- V-219164 Low The Ubuntu operating system must enforce a delay of at least 4 seconds between logon prompts following a failed logon attempt.
- V-219165 Low The Ubuntu operating system must display the date and time of the last successful account logon upon logon.
- V-219166 Medium The Ubuntu operating system must be configured so that three consecutive invalid logon attempts by a user automatically locks the account until released by an administrator.
- V-219167 Medium The Ubuntu operating system must display the Standard Mandatory DoD Notice and Consent Banner before granting local access to the system via a graphical user logon.
- V-219168 Medium The Ubuntu operating system must prevent direct login into the root account.
- V-219169 High The Ubuntu operating system must be configured so that only users who need access to security functions are part of the sudo group.
- V-219170 Medium The Ubuntu operating system must display the Standard Mandatory DoD Notice and Consent Banner before granting any publically accessible connection to the system.
- V-219172 Low The Ubuntu operating system must enforce password complexity by requiring that at least one upper-case character be used.
- V-219173 Low The Ubuntu operating system must enforce password complexity by requiring that at least one lower-case character be used.
- V-219174 Low The Ubuntu operating system must enforce password complexity by requiring that at least one numeric character be used.
- V-219175 Low The Ubuntu operating system must require the change of at least 8 characters when passwords are changed.
- V-219176 Medium The Ubuntu operating system must encrypt all stored passwords with a FIPS 140-2 approved cryptographic hashing algorithm.
- V-219177 High The Ubuntu operating system must not have the telnet package installed.
- V-219178 Low The Ubuntu operating system must enforce 24 hours/1 day as the minimum password lifetime. Passwords for new users must have a 24 hours/1 day minimum password lifetime restriction.
- V-219179 Low The Ubuntu operating system must enforce a 60-day maximum password lifetime restriction. Passwords for new users must have a 60-day maximum password lifetime restriction.
- V-219180 Low The Ubuntu operating system must prohibit password reuse for a minimum of five generations.
- V-219181 Medium The Ubuntu operating system must enforce a minimum 15-character password length.
- V-219182 Medium The Ubuntu operating system must employ a FIPS 140-2 approved cryptographic hashing algorithms for all created and stored passwords.
- V-219183 Medium The Ubuntu operating system must allow the use of a temporary password for system logons with an immediate change to a permanent password.
- V-219184 Medium The Ubuntu operating system must prevent the use of dictionary words for passwords.
- V-219185 Medium The Ubuntu operating system must require users to re-authenticate for privilege escalation and changing roles.
- V-219186 Medium The Ubuntu Operating system must be configured so that when passwords are changed or new passwords are established, pwquality must be used.
- V-219187 Medium The Ubuntu operating system must set a sticky bit on all public directories to prevent unauthorized and unintended information transferred via shared system resources.
- V-219188 Medium The Ubuntu operating system must generate error messages that provide information necessary for corrective actions without revealing information that could be exploited by adversaries.
- V-219189 Medium The Ubuntu operating system must configure the /var/log directory to be group-owned by syslog.
- V-219190 Medium The Ubuntu operating system must configure the /var/log directory to be owned by root.
- V-219191 Medium The Ubuntu operating system must configure the /var/log directory to have mode 0750 or less permissive.
- V-219192 Medium The Ubuntu operating system must configure the /var/log/syslog file to be group-owned by adm.
- V-219193 Medium The Ubuntu operating system must configure /var/log/syslog file to be owned by syslog.
- V-219194 Medium The Ubuntu operating system must configure /var/log/syslog file with mode 0640 or less permissive.
- V-219195 Medium The Ubuntu operating system must configure audit tools with a mode of 0755 or less permissive.
- V-219196 Medium The Ubuntu operating system must configure audit tools to be owned by root.
- V-219197 Medium The Ubuntu operating system must configure the audit tools to be group-owned by root.
- V-219198 Medium The Ubuntu operating system library files must have mode 0755 or less permissive.
- V-219199 Medium The Ubuntu operating system library directories must have mode 0755 or less permissive.
- V-219200 Medium The Ubuntu operating system library files must be owned by root.
- V-219201 Medium The Ubuntu operating system library directories must be owned by root.
- V-219202 Medium The Ubuntu operating system library files must be group-owned by root.
- V-219203 Medium The Ubuntu operating system library directories must be group-owned by root.
- V-219204 Medium The Ubuntu operating system must have system commands set to a mode of 0755 or less permissive.
- V-219205 Medium The Ubuntu operating system must have directories that contain system commands set to a mode of 0755 or less permissive.
- V-219206 Medium The Ubuntu operating system must have system commands owned by root.
- V-219207 Medium The Ubuntu operating system must have directories that contain system commands owned by root.
- V-219208 Medium The Ubuntu operating system must have system commands group-owned by root.
- V-219209 Medium The Ubuntu operating system must have directories that contain system commands group-owned by root.
- V-219210 Low The Ubuntu operating system must enforce password complexity by requiring that at least one special character be used.
- V-219211 High The Ubuntu Operating system must disable the x86 Ctrl-Alt-Delete key sequence if a graphical user interface is installed.
- V-219212 High The Ubuntu Operating system must disable the x86 Ctrl-Alt-Delete key sequence.
- V-219213 Medium The Ubuntu operating system must generate audit records for the use and modification of the tallylog file.
- V-219214 Medium The Ubuntu operating system must generate audit records for the use and modification of faillog file.
- V-219215 Medium The Ubuntu operating system must generate audit records for the use and modification of the lastlog file.
- V-219216 Medium The Ubuntu operating system must generate audit records for privileged activities or other system-level access.
- V-219217 Medium The Ubuntu operating system must generate audit records for the /var/log/wtmp file.
- V-219218 Medium The Ubuntu operating system must generate audit records for the /var/run/wtmp file.
- V-219219 Medium The Ubuntu operating system must generate audit records for the /var/log/btmp file.
- V-219220 Medium The Ubuntu operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/passwd.
- V-219221 Medium The Ubuntu operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/group.
- V-219222 Medium The Ubuntu operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/gshadow.
- V-219223 Medium The Ubuntu operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/shadow.
- V-219224 Medium The Ubuntu operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/security/opasswd.
- V-219225 Medium The Ubuntu operating system must produce audit records and reports containing information to establish when, where, what type, the source, and the outcome for all DoD-defined auditable events and actions in near real time.
- V-219226 Medium The Ubuntu operating system must alert the ISSO and SA (at a minimum) in the event of an audit processing failure.
- V-219227 Medium The Ubuntu operating system must shut down by default upon audit failure (unless availability is an overriding concern).
- V-219228 Medium The Ubuntu operating system must be configured so that audit log files cannot be read or write-accessible by unauthorized users.
- V-219229 Medium The Ubuntu operating system must permit only authorized accounts ownership of the audit log files.
- V-219230 Medium The Ubuntu operating system must permit only authorized groups to own the audit log files.
- V-219231 Medium The Ubuntu operating system must be configured so that the audit log directory is not write-accessible by unauthorized users.
- V-219232 Medium The Ubuntu operating system must allow only authorized accounts to own the audit log directory.
- V-219233 Medium The Ubuntu operating system must ensure only authorized groups can own the audit log directory and its underlying files.
- V-219234 Medium The Ubuntu operating system must be configured so that audit configuration files are not write-accessible by unauthorized users.
- V-219235 Medium The Ubuntu operating system must permit only authorized accounts to own the audit configuration files.
- V-219236 Medium The Ubuntu operating system must permit only authorized groups to own the audit configuration files.
- V-219237 Low The Ubuntu operating system must allocate audit record storage capacity to store at least one weeks worth of audit records, when audit records are not immediately sent to a central audit record storage facility.
- V-219238 Medium The Ubuntu operating system must generate audit records for successful/unsuccessful uses of the su command.
- V-219239 Medium The Ubuntu operating system must generate audit records for successful/unsuccessful uses of the chfn command.
- V-219240 Medium The Ubuntu operating system must generate audit records for successful/unsuccessful uses of the mount command.
- V-219241 Medium The Ubuntu operating system must generate audit records for successful/unsuccessful uses of the umount command.
- V-219242 Medium The Ubuntu operating system must generate audit records for successful/unsuccessful uses of the ssh-agent command.
- V-219243 Medium The Ubuntu operating system must generate audit records for successful/unsuccessful uses of the ssh-keysign command.
- V-219244 Medium The Ubuntu operating system must generate audit records for any usage of the setxattr system call.
- V-219245 Medium The Ubuntu operating system must generate audit records for any usage of the lsetxattr system call.
- V-219246 Medium The Ubuntu operating system must generate audit records for any usage of the fsetxattr system call.
- V-219247 Medium The Ubuntu operating system must generate audit records for any usage of the removexattr system call.
- V-219248 Medium The Ubuntu operating system must generate audit records for any usage of the lremovexattr system call.
- V-219249 Medium The Ubuntu operating system must generate audit records for any usage of the fremovexattr system call.
- V-219250 Medium The Ubuntu operating system must generate audit records for successful/unsuccessful uses of the chown system call.
- V-219251 Medium The Ubuntu operating system must generate audit records for successful/unsuccessful uses of the fchown system call.
- V-219252 Medium The Ubuntu operating system must generate audit records for successful/unsuccessful uses of the fchownat system call.
- V-219253 Medium The Ubuntu operating system must generate audit records for successful/unsuccessful uses of the lchown system call.
- V-219254 Medium The Ubuntu operating system must generate audit records for successful/unsuccessful uses of the chmod system call.
- V-219255 Medium The Ubuntu operating system must generate audit records for successful/unsuccessful uses of the fchmod system call.
- V-219256 Medium The Ubuntu operating system must generate audit records for successful/unsuccessful uses of the fchmodat system call.
- V-219257 Medium The Ubuntu operating system must generate audit records for successful/unsuccessful uses of the open system call.
- V-219261 Medium The Ubuntu operating system must generate audit records for successful/unsuccessful uses of the openat system call.
- V-219262 Medium The Ubuntu operating system must generate audit records for successful/unsuccessful uses of the open_by_handle_at system call.
- V-219263 Medium The Ubuntu operating system must generate audit records for successful/unsuccessful uses of the sudo command.
- V-219264 Medium The Ubuntu operating system must generate audit records for successful/unsuccessful uses of the sudoedit command.
- V-219265 Medium The Ubuntu operating system must generate audit records for successful/unsuccessful uses of the chsh command.
- V-219266 Medium The Ubuntu operating system must generate audit records for successful/unsuccessful uses of the newgrp command.
- V-219267 Medium The Ubuntu operating system must generate audit records for successful/unsuccessful uses of the chcon command.
- V-219268 Medium The Ubuntu operating system must generate audit records for successful/unsuccessful uses of the apparmor_parser command.
- V-219269 Medium The Ubuntu operating system must generate audit records for successful/unsuccessful uses of the setfacl command.
- V-219270 Medium The Ubuntu operating system must generate audit records for successful/unsuccessful uses of the chacl command.
- V-219271 Medium The Ubuntu operating system must generate audit records for successful/unsuccessful uses of the passwd command.
- V-219272 Medium The Ubuntu operating system must generate audit records for successful/unsuccessful uses of the unix_update command.
- V-219273 Medium The Ubuntu operating system must generate audit records for successful/unsuccessful uses of the gpasswd command.
- V-219274 Medium The Ubuntu operating system must generate audit records for successful/unsuccessful uses of the chage command.
- V-219275 Medium The Ubuntu operating system must generate audit records for successful/unsuccessful uses of the usermod command.
- V-219276 Medium The Ubuntu operating system must generate audit records for successful/unsuccessful uses of the crontab command.
- V-219277 Medium The Ubuntu operating system must generate audit records for successful/unsuccessful uses of the pam_timestamp_check command.
- V-219278 Medium The Ubuntu operating system must generate audit records for successful/unsuccessful uses of the init_module syscall.
- V-219279 Medium The Ubuntu operating system must generate audit records for successful/unsuccessful uses of the finit_module syscall.
- V-219280 Medium The Ubuntu operating system must generate audit records for successful/unsuccessful uses of the delete_module syscall.
- V-219281 Medium The Ubuntu operating system must prevent all software from executing at higher privilege levels than users executing the software and the audit system must be configured to audit the execution of privileged functions.
- V-219282 Medium The Ubuntu operating system must generate audit records when successful/unsuccessful attempts to use setxattr system call.
- V-219283 Medium The Ubuntu operating system must generate audit records when successful/unsuccessful attempts to use lsetxattr system call.
- V-219284 Medium The Ubuntu operating system must generate audit records when successful/unsuccessful attempts to use fsetxattr system call.
- V-219285 Medium The Ubuntu operating system must generate audit records when successful/unsuccessful attempts to use the removexattr system call.
- V-219286 Medium The Ubuntu operating system must generate audit records when successful/unsuccessful attempts to use the lremovexattr system call.
- V-219287 Medium The Ubuntu operating system must generate audit records when successful/unsuccessful use of unlink system call.
- V-219288 Medium The Ubuntu operating system must generate audit records when successful/unsuccessful use of unlinkat system call.
- V-219289 Medium The Ubuntu operating system must generate audit records when successful/unsuccessful use of rename system call.
- V-219290 Medium The Ubuntu operating system must generate audit records when successful/unsuccessful use of renameat system call.
- V-219291 Medium The Ubuntu operating system must generate audit records when loading dynamic kernel modules.
- V-219292 Medium The Ubuntu operating system must generate audit records when unloading dynamic kernel modules.
- V-219293 Medium The Ubuntu operating system must generate audit records when successful/unsuccessful uses of the truncate system call.
- V-219294 Medium The Ubuntu operating system must generate audit records when successful/unsuccessful uses of the ftruncate system call.
- V-219295 Medium The Ubuntu operating system must generate audit records when successful/unsuccessful uses of the creat system call.
- V-219296 Medium The Ubuntu operating system must generate records for successful/unsuccessful uses of init_module or finit_module syscalls.
- V-219297 Medium The Ubuntu operating system must generate records for successful/unsuccessful uses of delete_module syscall.
- V-219298 Medium The Ubuntu operating system must generate audit records when successful/unsuccessful attempts to use modprobe command.
- V-219299 Medium The Ubuntu operating system must generate audit records when successful/unsuccessful attempts to use the kmod command.
- V-219300 Medium The Ubuntu operating system must generate audit records when successful/unsuccessful attempts to use the fdisk command.
- V-219301 Low The Ubuntu operating system must limit the number of concurrent sessions to ten for all accounts and/or account types.
- V-219302 Medium The Ubuntu operating system must retain a users session lock until that user reestablishes access using established identification and authentication procedures.
- V-219303 Medium The Ubuntu operating system must initiate a session lock after a 15-minute period of inactivity for all connection types.
- V-219304 Medium The Ubuntu operating system must be configured for users to directly initiate a session lock for all connection types.
- V-219306 Medium The Ubuntu operating system must monitor remote access methods.
- V-219307 Medium The Ubuntu operating system must implement DoD-approved encryption to protect the confidentiality of remote access sessions.
- V-219308 High The Ubuntu operating system must enforce SSHv2 for network access to all accounts.
- V-219309 Medium The Ubuntu operating system must use strong authenticators in establishing nonlocal maintenance and diagnostic sessions.
- V-219310 Medium The Ubuntu operating system must immediately terminate all network connections associated with SSH traffic after a period of inactivity.
- V-219311 Medium The Ubuntu operating system must automatically terminate all network connections associated with SSH traffic at the end of the session or after 10 minutes of inactivity.
- V-219312 High The Ubuntu operating system must configure the SSH daemon to only use Message Authentication Codes (MACs) employing FIPS 140-2 approved cryptographic hash algorithms to protect the integrity of nonlocal maintenance and diagnostic communications.
- V-219313 High The Ubuntu operating system must use SSH to protect the confidentiality and integrity of transmitted information unless otherwise protected by alternative physical safeguards, such as, at a minimum, a Protected Distribution System (PDS).
- V-219314 High The Ubuntu operating system must not allow unattended or automatic login via ssh.
- V-219315 Medium The Ubuntu operating system, for PKI-based authentication, must validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor.
- V-219316 High The Ubuntu operating system must map the authenticated identity to the user or group account for PKI-based authentication.
- V-219317 Medium The Ubuntu operating system must implement smart card logins for multifactor authentication for access to accounts.
- V-219318 Medium The Ubuntu operating system must implement multifactor authentication for remote access to privileged accounts in such a way that one of the factors is provided by a device separate from the system gaining access.
- V-219319 Medium The Ubuntu operating system must accept Personal Identity Verification (PIV) credentials.
- V-219320 Medium The Ubuntu operating system must implement certificate status checking for multifactor authentication.
- V-219321 Medium The Ubuntu operating system must only allow the use of DoD PKI-established certificate authorities for verification of the establishment of protected sessions.
- V-219322 Low Pam_Apparmor must be configured to allow system administrators to pass information to any other Ubuntu operating system administrator or user, change security attributes, and to confine all non-privileged users from executing functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures.
- V-219323 Medium The Ubuntu operating system must be configured to use AppArmor.
- V-219324 Medium The Apparmor module must be configured to employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs and limit the ability of non-privileged users to grant other users direct access to the contents of their home directories/folders.
- V-219325 Medium The Ubuntu operating system must uniquely identify interactive users.
- V-219326 Medium The Ubuntu operating system must disable account identifiers (individuals, groups, roles, and devices) after 35 days of inactivity.
- V-219327 Low The Ubuntu operating system must automatically remove or disable emergency accounts after 72 hours.
- V-219328 Medium The Ubuntu operating system default filesystem permissions must be defined in such a way that all authenticated users can only read and modify their own files.
- V-219329 Medium The Ubuntu operating system must provision temporary user accounts with an expiration time of 72 hours or less.
- V-219330 Medium The Ubuntu operating system must be configured to use TCP syncookies.
- V-219331 Medium The Ubuntu operating system must, for networked systems, compare internal information system clocks at least every 24 hours with a server which is synchronized to one of the redundant United States Naval Observatory (USNO) time servers, or a time server designated for the appropriate DoD network (NIPRNet/SIPRNet), and/or the Global Positioning System (GPS).
- V-219332 Low The Ubuntu operating system must synchronize internal information system clocks to the authoritative time source when the time difference is greater than one second.
- V-219333 Low The Ubuntu operating system must record time stamps for audit records that can be mapped to Coordinated Universal Time (UTC) or Greenwich Mean Time (GMT).
- V-219334 Medium The Ubuntu operating system must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments.
- V-219335 Medium Kernel core dumps must be disabled unless needed.
- V-219336 Medium The Ubuntu operating system must use cryptographic mechanisms to protect the integrity of audit tools.
- V-219337 Medium The Ubuntu operating system must enable and run the uncomplicated firewall(ufw).
- V-219338 Medium The Ubuntu operating system must notify designated personnel if baseline configurations are changed in an unauthorized manner. The file integrity tool must notify the system administrator when changes to the baseline configuration or anomalies in the operation of any security functions are discovered.
- V-219339 Medium The Ubuntu operating system must disable automatic mounting of Universal Serial Bus (USB) mass storage driver.
- V-219340 Medium The Ubuntu operating system must configure the uncomplicated firewall to rate-limit impacted network interfaces.
- V-219341 Medium The Ubuntu operating system must implement non-executable data to protect its memory from unauthorized code execution.
- V-219342 Medium The Ubuntu operating system must implement address space layout randomization to protect its memory from unauthorized code execution.
- V-219343 Medium The Ubuntu operating system must use a file integrity tool to verify correct operation of all security functions.
- V-219344 Medium The Ubuntu operating system must be configured so that a file integrity tool verifies the correct operation of security functions every 30 days.
- V-219346 Medium The Ubuntu operating system must disable all wireless network adapters.
Removed rules 200
- V-100519 High Ubuntu operating systems booted with a BIOS must require authentication upon booting into single-user and maintenance modes.
- V-100521 High Ubuntu operating systems booted with United Extensible Firmware Interface (UEFI) implemented must require authentication upon booting into single-user mode and maintenance.
- V-100523 Medium The Ubuntu operating system must initiate session audits at system startup.
- V-100525 Medium Ubuntu operating systems handling data requiring data at rest protections must employ cryptographic mechanisms to prevent unauthorized disclosure and modification of the information at rest.
- V-100527 High The Ubuntu operating system must implement NIST FIPS-validated cryptography to protect classified information and for the following: to provision digital signatures, to generate cryptographic hashes, and to protect unclassified information requiring confidentiality and cryptographic protection in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.
- V-100529 Low The Ubuntu operating system must immediately notify the SA and ISSO (at a minimum) when allocated audit record storage volume reaches 75% of the repository maximum audit record storage capacity.
- V-100531 Low The Ubuntu operating system audit event multiplexor must be configured to off-load audit logs onto a different system in real time, if the system is interconnected.
- V-100533 Low The Ubuntu operating system must have a crontab script running weekly to off-load audit events of standalone systems.
- V-100535 Medium Advance package Tool (APT) must be configured to prevent the installation of patches, service packs, device drivers, or Ubuntu operating system components without verification they have been digitally signed using a certificate that is recognized and approved by the organization.
- V-100537 Medium The Ubuntu operating system must be configured so that Advance package Tool (APT) removes all software components after updated versions have been installed.
- V-100539 High The Ubuntu operating system must not have the Network Information Service (NIS) package installed.
- V-100541 High The Ubuntu operating system must not have the rsh-server package installed.
- V-100545 Medium The Ubuntu operating system must deploy Endpoint Security for Linux Threat Prevention (ENSLTP).
- V-100547 Medium The Ubuntu operating system must be configured to preserve log records from failure events.
- V-100549 Medium The Ubuntu operating system must have an application firewall installed in order to control remote access methods.
- V-100551 Low The Ubuntu operating system audit event multiplexor must be configured to off-load audit logs onto a different system or storage media from the system being audited.
- V-100553 Low The Ubuntu operating system must be configured such that Pluggable Authentication Module (PAM) prohibits the use of cached authentications after one day.
- V-100555 Low The Ubuntu operating system must enforce a delay of at least 4 seconds between logon prompts following a failed logon attempt.
- V-100557 Low The Ubuntu operating system must display the date and time of the last successful account logon upon logon.
- V-100559 Medium The Ubuntu operating system must be configured so that three consecutive invalid logon attempts by a user locks the account.
- V-100561 Medium The Ubuntu operating system must display the Standard Mandatory DoD Notice and Consent Banner before granting local access to the system via a graphical user logon.
- V-100563 Medium The Ubuntu operating system must prevent direct login into the root account.
- V-100565 High The Ubuntu operating system must be configured so that only users who need access to security functions are part of the sudo group.
- V-100567 Medium The Ubuntu operating system must display the Standard Mandatory DoD Notice and Consent Banner before granting any publically accessible connection to the system.
- V-100569 Low The Ubuntu operating system must automatically lock an account until the locked account is released by an administrator when three unsuccessful logon attempts.
- V-100571 Low The Ubuntu operating system must enforce password complexity by requiring that at least one upper-case character be used.
- V-100573 Low The Ubuntu operating system must enforce password complexity by requiring that at least one lower-case character be used.
- V-100575 Low The Ubuntu operating system must enforce password complexity by requiring that at least one numeric character be used.
- V-100577 Low The Ubuntu operating system must require the change of at least 8 characters when passwords are changed.
- V-100579 Medium The Ubuntu operating system must encrypt all stored passwords with a FIPS 140-2 approved cryptographic hashing algorithm.
- V-100581 High The Ubuntu operating system must not have the telnet package installed.
- V-100583 Low The Ubuntu operating system must enforce 24 hours/1 day as the minimum password lifetime. Passwords for new users must have a 24 hours/1 day minimum password lifetime restriction.
- V-100585 Low The Ubuntu operating system must enforce a 60-day maximum password lifetime restriction. Passwords for new users must have a 60-day maximum password lifetime restriction.
- V-100587 Low The Ubuntu operating system must prohibit password reuse for a minimum of five generations.
- V-100589 Medium The Ubuntu operating system must enforce a minimum 15-character password length.
- V-100591 Medium The Ubuntu operating system must employ a FIPS 140-2 approved cryptographic hashing algorithms for all created and stored passwords.
- V-100593 Medium The Ubuntu operating system must allow the use of a temporary password for system logons with an immediate change to a permanent password.
- V-100595 Medium The Ubuntu operating system must prevent the use of dictionary words for passwords.
- V-100597 Medium The Ubuntu operating system must require users to re-authenticate for privilege escalation and changing roles.
- V-100599 Medium The Ubuntu Operating system must be configured so that when passwords are changed or new passwords are established, pwquality must be used.
- V-100601 Medium The Ubuntu operating system must set a sticky bit on all public directories to prevent unauthorized and unintended information transferred via shared system resources.
- V-100603 Medium The Ubuntu operating system must generate error messages that provide information necessary for corrective actions without revealing information that could be exploited by adversaries.
- V-100605 Medium The Ubuntu operating system must configure the /var/log directory to be group-owned by syslog.
- V-100607 Medium The Ubuntu operating system must configure the /var/log directory to be owned by root.
- V-100609 Medium The Ubuntu operating system must configure the /var/log directory to have mode 0750 or less permissive.
- V-100611 Medium The Ubuntu operating system must configure the /var/log/syslog file to be group-owned by adm.
- V-100613 Medium The Ubuntu operating system must configure /var/log/syslog file to be owned by syslog.
- V-100615 Medium The Ubuntu operating system must configure /var/log/syslog file with mode 0640 or less permissive.
- V-100617 Medium The Ubuntu operating system must configure audit tools with a mode of 0755 or less permissive.
- V-100619 Medium The Ubuntu operating system must configure audit tools to be owned by root.
- V-100621 Medium The Ubuntu operating system must configure the audit tools to be group-owned by root.
- V-100623 Medium The Ubuntu operating system library files must have mode 0755 or less permissive.
- V-100625 Medium The Ubuntu operating system library directories must have mode 0755 or less permissive.
- V-100627 Medium The Ubuntu operating system library files must be owned by root.
- V-100629 Medium The Ubuntu operating system library directories must be owned by root.
- V-100631 Medium The Ubuntu operating system library files must be group-owned by root.
- V-100633 Medium The Ubuntu operating system library directories must be group-owned by root.
- V-100635 Medium The Ubuntu operating system must have system commands set to a mode of 0755 or less permissive.
- V-100637 Medium The Ubuntu operating system must have directories that contain system commands set to a mode of 0755 or less permissive.
- V-100639 Medium The Ubuntu operating system must have system commands owned by root.
- V-100641 Medium The Ubuntu operating system must have directories that contain system commands owned by root.
- V-100643 Medium The Ubuntu operating system must have system commands group-owned by root.
- V-100645 Medium The Ubuntu operating system must have directories that contain system commands group-owned by root.
- V-100647 Low The Ubuntu operating system must enforce password complexity by requiring that at least one special character be used.
- V-100649 High The Ubuntu Operating system must disable the x86 Ctrl-Alt-Delete key sequence if a graphical user interface is installed.
- V-100651 High The Ubuntu Operating system must disable the x86 Ctrl-Alt-Delete key sequence.
- V-100653 Medium The Ubuntu operating system must generate audit records for the use and modification of the tallylog file.
- V-100655 Medium The Ubuntu operating system must generate audit records for the use and modification of faillog file.
- V-100657 Medium The Ubuntu operating system must generate audit records for the use and modification of the lastlog file.
- V-100659 Medium The Ubuntu operating system must generate audit records for privileged activities or other system-level access.
- V-100661 Medium The Ubuntu operating system must generate audit records for the /var/log/wtmp file.
- V-100663 Medium The Ubuntu operating system must generate audit records for the /var/run/wtmp file.
- V-100665 Medium The Ubuntu operating system must generate audit records for the /var/log/btmp file.
- V-100667 Medium The Ubuntu operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/passwd.
- V-100669 Medium The Ubuntu operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/group.
- V-100671 Medium The Ubuntu operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/gshadow.
- V-100673 Medium The Ubuntu operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/shadow.
- V-100675 Medium The Ubuntu operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/security/opasswd.
- V-100677 Medium The Ubuntu operating system must produce audit records and reports containing information to establish when, where, what type, the source, and the outcome for all DoD-defined auditable events and actions in near real time.
- V-100679 Medium The Ubuntu operating system must alert the ISSO and SA (at a minimum) in the event of an audit processing failure.
- V-100681 Medium The Ubuntu operating system must shut down by default upon audit failure (unless availability is an overriding concern).
- V-100683 Medium The Ubuntu operating system must be configured so that audit log files cannot be read or write-accessible by unauthorized users.
- V-100685 Medium The Ubuntu operating system must permit only authorized accounts ownership of the audit log files.
- V-100687 Medium The Ubuntu operating system must permit only authorized groups to own the audit log files.
- V-100689 Medium The Ubuntu operating system must be configured so that the audit log directory is not write-accessible by unauthorized users.
- V-100691 Medium The Ubuntu operating system must allow only authorized accounts to own the audit log directory.
- V-100693 Medium The Ubuntu operating system must ensure only authorized groups can own the audit log directory and its underlying files.
- V-100695 Medium The Ubuntu operating system must be configured so that audit configuration files are not write-accessible by unauthorized users.
- V-100697 Medium The Ubuntu operating system must permit only authorized accounts to own the audit configuration files.
- V-100699 Medium The Ubuntu operating system must permit only authorized groups to own the audit configuration files.
- V-100701 Low The Ubuntu operating system must allocate audit record storage capacity to store at least one weeks worth of audit records, when audit records are not immediately sent to a central audit record storage facility.
- V-100703 Medium The Ubuntu operating system must generate audit records for successful/unsuccessful uses of the su command.
- V-100705 Medium The Ubuntu operating system must generate audit records for successful/unsuccessful uses of the chfn command.
- V-100707 Medium The Ubuntu operating system must generate audit records for successful/unsuccessful uses of the mount command.
- V-100709 Medium The Ubuntu operating system must generate audit records for successful/unsuccessful uses of the umount command.
- V-100711 Medium The Ubuntu operating system must generate audit records for successful/unsuccessful uses of the ssh-agent command.
- V-100713 Medium The Ubuntu operating system must generate audit records for successful/unsuccessful uses of the ssh-keysign command.
- V-100715 Medium The Ubuntu operating system must generate audit records for any usage of the setxattr system call.
- V-100717 Medium The Ubuntu operating system must generate audit records for any usage of the lsetxattr system call.
- V-100719 Medium The Ubuntu operating system must generate audit records for any usage of the fsetxattr system call.
- V-100721 Medium The Ubuntu operating system must generate audit records for any usage of the lremovexattr system call.
- V-100723 Medium The Ubuntu operating system must generate audit records for any usage of the fremovexattr system call.
- V-100725 Medium The Ubuntu operating system must generate audit records for successful/unsuccessful uses of the chown system call.
- V-100727 Medium The Ubuntu operating system must generate audit records for successful/unsuccessful uses of the fchown system call.
- V-100729 Medium The Ubuntu operating system must generate audit records for successful/unsuccessful uses of the fchownat system call.
- V-100731 Medium The Ubuntu operating system must generate audit records for successful/unsuccessful uses of the lchown system call.
- V-100733 Medium The Ubuntu operating system must generate audit records for successful/unsuccessful uses of the chmod system call.
- V-100735 Medium The Ubuntu operating system must generate audit records for successful/unsuccessful uses of the fchmod system call.
- V-100737 Medium The Ubuntu operating system must generate audit records for successful/unsuccessful uses of the fchmodat system call.
- V-100739 Medium The Ubuntu operating system must generate audit records for successful/unsuccessful uses of the open system call.
- V-100741 Medium The Ubuntu operating system must generate audit records for successful/unsuccessful uses of the truncate system call.
- V-100743 Medium The Ubuntu operating system must generate audit records for successful/unsuccessful uses of the ftruncate system call.
- V-100745 Medium The Ubuntu operating system must generate audit records for successful/unsuccessful uses of the creat system call.
- V-100747 Medium The Ubuntu operating system must generate audit records for successful/unsuccessful uses of the openat system call.
- V-100749 Medium The Ubuntu operating system must generate audit records for successful/unsuccessful uses of the open_by_handle_at system call.
- V-100751 Medium The Ubuntu operating system must generate audit records for successful/unsuccessful uses of the sudo command.
- V-100753 Medium The Ubuntu operating system must generate audit records for successful/unsuccessful uses of the sudoedit command.
- V-100755 Medium The Ubuntu operating system must generate audit records for successful/unsuccessful uses of the chsh command.
- V-100757 Medium The Ubuntu operating system must generate audit records for successful/unsuccessful uses of the newgrp command.
- V-100759 Medium The Ubuntu operating system must generate audit records for successful/unsuccessful uses of the chcon command.
- V-100761 Medium The Ubuntu operating system must generate audit records for successful/unsuccessful uses of the apparmor_parser command.
- V-100763 Medium The Ubuntu operating system must generate audit records for successful/unsuccessful uses of the setfacl command.
- V-100765 Medium The Ubuntu operating system must generate audit records for successful/unsuccessful uses of the chacl command.
- V-100767 Medium The Ubuntu operating system must generate audit records for successful/unsuccessful uses of the passwd command.
- V-100769 Medium The Ubuntu operating system must generate audit records for successful/unsuccessful uses of the unix_update command.
- V-100771 Medium The Ubuntu operating system must generate audit records for successful/unsuccessful uses of the gpasswd command.
- V-100773 Medium The Ubuntu operating system must generate audit records for successful/unsuccessful uses of the chage command.
- V-100775 Medium The Ubuntu operating system must generate audit records for successful/unsuccessful uses of the usermod command.
- V-100777 Medium The Ubuntu operating system must generate audit records for successful/unsuccessful uses of the pam_timestamp_check command.
- V-100779 Medium The Ubuntu operating system must generate audit records for successful/unsuccessful uses of the init_module syscall.
- V-100781 Medium The Ubuntu operating system must generate audit records for successful/unsuccessful uses of the finit_module syscall.
- V-100783 Medium The Ubuntu operating system must generate audit records for successful/unsuccessful uses of the delete_module syscall.
- V-100785 Medium The Ubuntu operating system must prevent all software from executing at higher privilege levels than users executing the software and the audit system must be configured to audit the execution of privileged functions.
- V-100787 Medium The Ubuntu operating system must generate audit records when successful/unsuccessful attempts to use setxattr system call.
- V-100789 Medium The Ubuntu operating system must generate audit records when successful/unsuccessful attempts to use lsetxattr system call.
- V-100791 Medium The Ubuntu operating system must generate audit records when successful/unsuccessful attempts to use fsetxattr system call.
- V-100793 Medium The Ubuntu operating system must generate audit records when successful/unsuccessful attempts to use the removexattr system call.
- V-100795 Medium The Ubuntu operating system must generate audit records when successful/unsuccessful attempts to use the lremovexattr system call.
- V-100797 Medium The Ubuntu operating system must generate audit records when successful/unsuccessful use of unlink system call.
- V-100799 Medium The Ubuntu operating system must generate audit records when successful/unsuccessful use of unlinkat system call.
- V-100801 Medium The Ubuntu operating system must generate audit records when successful/unsuccessful use of rename system call.
- V-100803 Medium The Ubuntu operating system must generate audit records when successful/unsuccessful use of renameat system call.
- V-100805 Medium The Ubuntu operating system must generate audit records when loading dynamic kernel modules.
- V-100807 Medium The Ubuntu operating system must generate audit records when unloading dynamic kernel modules.
- V-100809 Medium The Ubuntu operating system must generate audit records when successful/unsuccessful uses of the truncate system call.
- V-100811 Medium The Ubuntu operating system must generate audit records when successful/unsuccessful uses of the ftruncate system call.
- V-100813 Medium The Ubuntu operating system must generate audit records when successful/unsuccessful uses of the creat system call.
- V-100815 Medium The Ubuntu operating system must generate records for successful/unsuccessful uses of init_module or finit_module syscalls.
- V-100817 Medium The Ubuntu operating system must generate records for successful/unsuccessful uses of delete_module syscall.
- V-100819 Medium The Ubuntu operating system must generate audit records when successful/unsuccessful attempts to use modprobe command.
- V-100821 Medium The Ubuntu operating system must generate audit records when successful/unsuccessful attempts to use the kmod command.
- V-100823 Medium The Ubuntu operating system must generate audit records when successful/unsuccessful attempts to use the fdisk command.
- V-100825 Low The Ubuntu operating system must limit the number of concurrent sessions to ten for all accounts and/or account types.
- V-100827 Medium The Ubuntu operating system must retain a users session lock until that user reestablishes access using established identification and authentication procedures.
- V-100829 Medium The Ubuntu operating system must initiate a session lock after a 15-minute period of inactivity for all connection types.
- V-100831 Medium The Ubuntu operating system must be configured for users to directly initiate a session lock for all connection types.
- V-100833 Medium The Ubuntu operating system must automatically terminate a user session after inactivity time-outs have expired.
- V-100835 Medium The Ubuntu operating system must monitor remote access methods.
- V-100837 Medium The Ubuntu operating system must implement DoD-approved encryption to protect the confidentiality of remote access sessions.
- V-100839 High The Ubuntu operating system must enforce SSHv2 for network access to all accounts.
- V-100841 Medium The Ubuntu operating system must use strong authenticators in establishing nonlocal maintenance and diagnostic sessions.
- V-100843 Medium The Ubuntu operating system must immediately terminate all network connections associated with SSH traffic after a period of inactivity.
- V-100845 Medium The Ubuntu operating system must immediately terminate all network connections associated with SSH traffic at the end of the session or after 10 minutes of inactivity.
- V-100847 High The Ubuntu operating system must configure the SSH daemon to only use Message Authentication Codes (MACs) employing FIPS 140-2 approved cryptographic hash algorithms to protect the integrity of nonlocal maintenance and diagnostic communications.
- V-100849 High The Ubuntu operating system must use SSH to protect the confidentiality and integrity of transmitted information unless otherwise protected by alternative physical safeguards, such as, at a minimum, a Protected Distribution System (PDS).
- V-100851 High The Ubuntu operating system must not allow unattended or automatic login via ssh.
- V-100853 Medium The Ubuntu operating system, for PKI-based authentication, must validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor.
- V-100855 High The Ubuntu operating system must map the authenticated identity to the user or group account for PKI-based authentication.
- V-100857 Medium The Ubuntu operating system must implement smart card logins for multifactor authentication for access to accounts.
- V-100859 Medium The Ubuntu operating system must implement multifactor authentication for remote access to privileged accounts in such a way that one of the factors is provided by a device separate from the system gaining access.
- V-100861 Medium The Ubuntu operating system must accept Personal Identity Verification (PIV) credentials.
- V-100863 Medium The Ubuntu operating system must implement certificate status checking for multifactor authentication.
- V-100865 Medium The Ubuntu operating system must only allow the use of DoD PKI-established certificate authorities for verification of the establishment of protected sessions.
- V-100867 Low Pam_Apparmor must be configured to allow system administrators to pass information to any other Ubuntu operating system administrator or user, change security attributes, and to confine all non-privileged users from executing functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures.
- V-100869 Medium The Ubuntu operating system must be configured to use AppArmor.
- V-100871 Medium The Apparmor module must be configured to employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs and limit the ability of non-privileged users to grant other users direct access to the contents of their home directories/folders.
- V-100873 Medium The Ubuntu operating system must uniquely identify interactive users.
- V-100875 Medium The Ubuntu operating system must disable account identifiers (individuals, groups, roles, and devices) after 35 days of inactivity.
- V-100877 Low The Ubuntu operating system must automatically remove or disable emergency accounts after 72 hours.
- V-100879 Medium The Ubuntu operating system default filesystem permissions must be defined in such a way that all authenticated users can only read and modify their own files.
- V-100881 Medium The Ubuntu operating system must provision temporary user accounts with an expiration time of 72 hours or less.
- V-100883 Medium The Ubuntu operating system must be configured to use TCP syncookies.
- V-100885 Medium The Ubuntu operating system must, for networked systems, compare internal information system clocks at least every 24 hours with a server which is synchronized to one of the redundant United States Naval Observatory (USNO) time servers, or a time server designated for the appropriate DoD network (NIPRNet/SIPRNet), and/or the Global Positioning System (GPS).
- V-100887 Low The Ubuntu operating system must synchronize internal information system clocks to the authoritative time source when the time difference is greater than one second.
- V-100889 Low The Ubuntu operating system must record time stamps for audit records that can be mapped to Coordinated Universal Time (UTC) or Greenwich Mean Time (GMT).
- V-100891 Medium The Ubuntu operating system must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments.
- V-100893 Medium Kernel core dumps must be disabled unless needed.
- V-100895 Medium The Ubuntu operating system must use cryptographic mechanisms to protect the integrity of audit tools.
- V-100897 Medium The Ubuntu operating system must enable and run the uncomplicated firewall(ufw).
- V-100899 Medium The Ubuntu operating system must notify designated personnel if baseline configurations are changed in an unauthorized manner. The file integrity tool must notify the system administrator when changes to the baseline configuration or anomalies in the operation of any security functions are discovered.
- V-100901 Medium The Ubuntu operating system must configure the uncomplicated firewall to rate-limit impacted network interfaces.
- V-100903 Medium The Ubuntu operating system must implement non-executable data to protect its memory from unauthorized code execution.
- V-100905 Medium The Ubuntu operating system must implement address space layout randomization to protect its memory from unauthorized code execution.
- V-100907 Medium The Ubuntu operating system must use a file integrity tool to verify correct operation of all security functions.
- V-100909 Medium The Ubuntu operating system must be configured so that a file integrity tool verifies the correct operation of security functions every 30 days.
- V-100911 Medium The Ubuntu operating system must have an application firewall enabled.
- V-100913 Medium The Ubuntu operating system must disable all wireless network adapters.
- V-100915 Medium The Ubuntu operating system must generate audit records for any usage of the removexattr system call.
- V-100917 Medium The Ubuntu operating system must generate audit records for successful/unsuccessful uses of the crontab command.
- V-100919 Medium The Ubuntu operating system must disable automatic mounting of Universal Serial Bus (USB) mass storage driver.
- RMF Control
- AC-3
- Severity
- H
- CCI
- CCI-000213
- Version
- UBTU-18-010000
- Vuln IDs
-
- V-219147
- V-100519
- Rule IDs
-
- SV-219147r508662_rule
- SV-109623
Checks: C-20872r304769_chk
Verify that an encrypted root password is set. This is only applicable on systems that use a basic Input/Output System BIOS. Run the following command to verify the encrypted password is set: # grep –i password /boot/grub/grub.cfg password_pbkdf2 root grub.pbkdf2.sha512.10000.MFU48934NJA87HF8NSD34493GDHF84NG If the root password entry does not begin with “password_pbkdf2”, this is a finding.
Fix: F-20871r304770_fix
Configure the system to require a password for authentication upon booting into single-user and maintenance modes. Generate an encrypted (grub) password for root with the following command: # grub-mkpasswd-pbkdf2 Enter Password: Reenter Password: PBKDF2 hash of your password is grub.pbkdf2.sha512.10000.MFU48934NJD84NF8NSD39993JDHF84NG Using the hash from the output, modify the "/etc/grub.d/40_custom" file with the following command to add a boot password: # sudo sed -i '$i set superusers=\"root\"\npassword_pbkdf2 root <hash>' /etc/grub.d/40_custom where <hash> is the hash generated by grub-mkpasswd-pbdkf2 command. Generate an updated "grub.conf" file with the new password by using the following command: # update-grub
- RMF Control
- AC-3
- Severity
- H
- CCI
- CCI-000213
- Version
- UBTU-18-010001
- Vuln IDs
-
- V-219148
- V-100521
- Rule IDs
-
- SV-219148r508662_rule
- SV-109625
Checks: C-20873r304772_chk
Verify that an encrypted root password is set. This is only applicable on Ubuntu operating systems that use UEFI. Run the following command to verify the encrypted password is set: # grep –i password /boot/efi/EFI/grub.cfg password_pbkdf2 root grub.pbkdf2.sha512.10000.VeryLongString If the root password entry does not begin with “password_pbkdf2”, this is a finding.
Fix: F-20872r304773_fix
Configure the system to require a password for authentication upon booting into single-user and maintenance modes. Generate an encrypted (grub) password for root with the following command: # grub-mkpasswd-pbkdf2 Enter Password: Reenter Password: PBKDF2 hash of your password is grub.pbkdf2.sha512.10000.MFU48934NJD84NF8NSD39993JDHF84NG Using the hash from the output, modify the "/etc/grub.d/40_custom" file with the following command to add a boot password: # sudo sed -i '$i set superusers=\"root\"\npassword_pbkdf2 root <hash>' /etc/grub.d/40_custom where <hash> is the hash generated by grub-mkpasswd-pbdkf2 command. Generate an updated "grub.conf" file with the new password by using the following command: # update-grub
- RMF Control
- AU-14
- Severity
- M
- CCI
- CCI-001464
- Version
- UBTU-18-010002
- Vuln IDs
-
- V-219149
- V-100523
- Rule IDs
-
- SV-219149r508662_rule
- SV-109627
Checks: C-20874r304775_chk
Verify the Ubuntu operating system enables auditing at system startup. Check that the auditing is enabled in grub with the following command: grep "^\s*linux" /boot/grub/grub.cfg linux /vmlinuz-4.15.0-55-generic root=/dev/mapper/ubuntu--vg-root ro quiet splash $vt_handoff audit=1 linux /vmlinuz-4.15.0-55-generic root=/dev/mapper/ubuntu--vg-root ro recovery nomodeset audit=1 If any linux lines do not contain "audit=1", this is a finding.
Fix: F-20873r304776_fix
Configure the Ubuntu operating system to produce audit records at system startup. Edit /etc/default/grub file and add "audit=1" to the GRUB_CMDLINE_LINUX option. To update the grub config file run, sudo update-grub
- RMF Control
- SC-28
- Severity
- M
- CCI
- CCI-001199
- Version
- UBTU-18-010003
- Vuln IDs
-
- V-219150
- V-100525
- Rule IDs
-
- SV-219150r508662_rule
- SV-109629
Checks: C-20875r304778_chk
If there is a documented and approved reason for not having data-at-rest encryption, this requirement is Not Applicable. Verify the Ubuntu operating system prevents unauthorized disclosure or modification of all information requiring at rest protection by using disk encryption. Determine the partition layout for the system with the following command: #sudo fdisk -l (..) Disk /dev/vda: 15 GiB, 16106127360 bytes, 31457280 sectors Units: sectors of 1 * 512 = 512 bytes Sector size (logical/physical): 512 bytes / 512 bytes I/O size (minimum/optimal): 512 bytes / 512 bytes Disklabel type: gpt Disk identifier: 83298450-B4E3-4B19-A9E4-7DF147A5FEFB Device Start End Sectors Size Type /dev/vda1 2048 4095 2048 1M BIOS boot /dev/vda2 4096 2101247 2097152 1G Linux filesystem /dev/vda3 2101248 31455231 29353984 14G Linux filesystem (...) Verify that the system partitions are all encrypted with the following command: # more /etc/crypttab Every persistent disk partition present must have an entry in the file. If any partitions other than the boot partition or pseudo file systems (such as /proc or /sys) are not listed, this is a finding.
Fix: F-20874r304779_fix
To encrypt an entire partition, dedicate a partition for encryption in the partition layout. Note: Encrypting a partition in an already-installed system is more difficult because the existing partitions must be resized and changed.
- RMF Control
- SC-13
- Severity
- H
- CCI
- CCI-002450
- Version
- UBTU-18-010005
- Vuln IDs
-
- V-219151
- V-100527
- Rule IDs
-
- SV-219151r508662_rule
- SV-109631
Checks: C-20876r304781_chk
Verify the system is configured to run in FIPS mode. Check that the system is configured to run in FIPS mode with the following command: # grep -i 1 /proc/sys/crypto/fips_enabled 1 If a value of "1" is not returned, this is a finding.
Fix: F-20875r304782_fix
Configure the system to run in FIPS mode. Add "fips=1" to the kernel parameter during the Ubuntu operating systems install. Enabling a FIPS mode on a pre-existing system involves a number of modifications to the Ubuntu operating system. Refer to the Ubuntu Server 18.04 FIPS 140-2 security policy document for instructions. A subscription to the "Ubuntu Advantage" plan is required in order to obtain the FIPS Kernel cryptographic modules and enable FIPS.
- RMF Control
- AU-5
- Severity
- L
- CCI
- CCI-001855
- Version
- UBTU-18-010006
- Vuln IDs
-
- V-219152
- V-100529
- Rule IDs
-
- SV-219152r508662_rule
- SV-109633
Checks: C-20877r304784_chk
Verify the Ubuntu operating system notifies the System Administrator (SA) and Information System Security Officer (ISSO) (at a minimum) when allocated audit record storage volume reaches 75% of the repository maximum audit record storage capacity. Check that the Ubuntu operating system notifies the SA and ISSO (at a minimum) when allocated audit record storage volume reaches 75% of the repository maximum audit record storage capacity with the following command: # sudo grep ^space_left_action /etc/audit/auditd.conf space_left_action email # sudo grep ^space_left /etc/audit/auditd.conf space_left 250000 If the "space_left" parameter is missing, set to blanks or set to a value less than 25% of the space free in the allocated audit record storage, this is a finding. If the "space_left_action" parameter is missing or set to blanks, this is a finding. If the "space_left_action" is set to "syslog", the system logs the event, but does not generate a notification, so this is a finding. If the "space_left_action" is set to "exec", the system executes a designated script. If this script informs the SA of the event, this is not a finding. If the "space_left_action" is set to "email" check the value of the "action_mail_acct" parameter with the following command: # sudo grep action_mail_acct /etc/audit/auditd.conf action_mail_acct root@localhost The "action_mail_acct" parameter, if missing, defaults to "root". If the "action_mail_acct parameter" is not set to the e-mail address of the system administrator(s) and/or ISSO, this is a finding. Note: If the email address of the system administrator is on a remote system a mail package must be available.
Fix: F-20876r304785_fix
Edit /etc/audit/auditd.conf and set the space_left_action parameter to "exec" or "email". If the space_left_action parameter is set to "email" set the action_mail_acct parameter to an e-mail address for the System Administrator (SA) and Information System Security Officer (ISSO). If the space_left_action parameter is set to "exec", make sure the command being execute notifies the System Administrator (SA) and Information System Security Officer (ISSO). Edit /etc/audit/auditd.conf and set the space_left parameter to be, at least, 25% of the repository maximum audit record storage capacity.
- RMF Control
- AU-4
- Severity
- L
- CCI
- CCI-001851
- Version
- UBTU-18-010007
- Vuln IDs
-
- V-219153
- V-100531
- Rule IDs
-
- SV-219153r508662_rule
- SV-109635
Checks: C-20878r304787_chk
Verify the audit event multiplexor is configured to off-load audit records to a different system or storage media from the system being audited. Check that audisp-remote plugin is installed: # sudo dpkg -s audispd-plugins If status is "not installed", this is a finding. Check that the records are being off-loaded to a remote server with the following command: # sudo grep -i active /etc/audisp/plugins.d/au-remote.conf active = yes If "active" is not set to "yes", or the line is commented out, this is a finding. Check that audisp-remote plugin is configured to send audit logs to a different system: # sudo grep -i ^remote_server /etc/audisp/audisp-remote.conf remote_server = 192.168.122.126 If the remote_server parameter is not set or is set with a local address, or is set with invalid address, this is a finding.
Fix: F-20877r304788_fix
Configure the audit event multiplexor to off-load audit records to a different system or storage media from the system being audited. Install the audisp-remote plugin: # sudo apt-get install audispd-plugins -y Set the audisp-remote plugin as active, by editing the /etc/audisp/plugins.d/au-remote.conf file: # sudo sed -i -E 's/active\s*=\s*no/active = yes/' /etc/audisp/plugins.d/au-remote.conf Set the address of the remote machine, by editing the /etc/audisp/audisp-remote.conf file: # sudo sed -i -E 's/(remote_server\s*=).*/\1 <remote addr>/' audisp-remote.conf where <remote addr> must be substituted by the address of the remote server receiving the audit log. Make the audit service reload its configuration files: # sudo systemctl restart auditd.service
- RMF Control
- AU-4
- Severity
- L
- CCI
- CCI-001851
- Version
- UBTU-18-010008
- Vuln IDs
-
- V-219154
- V-100533
- Rule IDs
-
- SV-219154r508662_rule
- SV-109637
Checks: C-20879r304790_chk
Verify there is a script which off-loads audit data and if that script runs weekly. Check if there is a script in the /etc/cron.weekly directory which off-loads audit data: # sudo ls /etc/cron.weekly audit-offload Check if the script inside the file does offloading of audit logs to an external media. If the script file does not exist or if the script file doesn't offload audit logs, this is a finding.
Fix: F-20878r304791_fix
Create a script which off-loads audit logs to external media and runs weekly. Script must be located into the /etc/cron.weekly directory.
- RMF Control
- CM-5
- Severity
- M
- CCI
- CCI-001749
- Version
- UBTU-18-010016
- Vuln IDs
-
- V-219155
- V-100535
- Rule IDs
-
- SV-219155r508662_rule
- SV-109639
Checks: C-20880r304793_chk
Verify that Advance package Tool (APT) is configured to prevent the installation of patches, service packs, device drivers, or Ubuntu operating system components without verification they have been digitally signed using a certificate that is recognized and approved by the organization. Check that the "AllowUnauthenticated" variable is not set at all or set to "false" with the following command: # grep AllowUnauthenticated /etc/apt/apt.conf.d/* /etc/apt/apt.conf.d/01-vendor-Ubuntu:APT::Get::AllowUnauthenticated "false"; If any of the files returned from the command with "AllowUnauthenticated" set to "true", this is a finding.
Fix: F-20879r304794_fix
Configure Advance package Tool (APT) to prevent the installation of patches, service packs, device drivers, or Ubuntu operating system components without verification they have been digitally signed using a certificate that is recognized and approved by the organization. Remove/Update any APT configuration file that contain the variable "AllowUnauthenticated" to "false", or remove "AllowUnauthenticated" entirely from each file. Below is an example of setting the "AllowUnauthenticated" variable to "false": APT::Get::AllowUnauthenticated "false";
- RMF Control
- SI-2
- Severity
- M
- CCI
- CCI-002617
- Version
- UBTU-18-010017
- Vuln IDs
-
- V-219156
- V-100537
- Rule IDs
-
- SV-219156r508662_rule
- SV-109641
Checks: C-20881r304796_chk
Verify Advance package Tool (APT) is configured to remove all software components after updated versions have been installed. Check that APT is configured to remove all software components after updating with the following command: # grep -i remove-unused /etc/apt/apt.conf.d/50unattended-upgrades Unattended-Upgrade::Remove-Unused-Dependencies "true"; Unattended-Upgrade::Remove-Unused-Kernel-Packages "true"; If the "::Remove-Unused-Dependencies" and "::Remove-Unused-Kernel-Packages" parameters are not set to "true", or are missing, or are commented out, this is a finding.
Fix: F-20880r304797_fix
Configure APT to remove all software components after updated versions have been installed. Add or updated the following options to the "/etc/apt/apt.conf.d/50unattended-upgrades" file: Unattended-Upgrade::Remove-Unused-Dependencies "true"; Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";
- RMF Control
- CM-7
- Severity
- H
- CCI
- CCI-000381
- Version
- UBTU-18-010018
- Vuln IDs
-
- V-219157
- V-100539
- Rule IDs
-
- SV-219157r508662_rule
- SV-109643
Checks: C-20882r304799_chk
Verify that the Network Information Service (NIS) package is not installed on the Ubuntu operating system. Check to see if the NIS package is installed with the following command: # dpkg -l | grep nis If the NIS package is installed, this is a finding.
Fix: F-20881r304800_fix
Configure the Ubuntu operating system to disable non-essential capabilities by removing the Network Information Service (NIS) package from the system with the following command: # sudo apt-get remove nis
- RMF Control
- CM-7
- Severity
- H
- CCI
- CCI-000381
- Version
- UBTU-18-010019
- Vuln IDs
-
- V-219158
- V-100541
- Rule IDs
-
- SV-219158r508662_rule
- SV-109645
Checks: C-20883r304802_chk
Check to see if the rsh-server package is installed with the following command: # dpkg -l | grep rsh-server If the rsh-server package is installed, this is a finding.
Fix: F-20882r304803_fix
Configure the Ubuntu operating system to disable non-essential capabilities by removing the rsh-server package from the system with the following command: # sudo apt-get remove rsh-server
- RMF Control
- SI-2
- Severity
- M
- CCI
- CCI-001233
- Version
- UBTU-18-010021
- Vuln IDs
-
- V-219159
- V-100545
- Rule IDs
-
- SV-219159r508662_rule
- SV-109649
Checks: C-20884r304805_chk
Verify the Ubuntu operating system deploys ENSLTP. Check that the following package has been installed: # dpkg -l | grep isectp If the "isectp" package is not installed, this is a finding. Check that the daemon is running: # ps -ef | grep isectpd root 7614 1 2 08:20 ? 00:00:02 /opt/isec/ens/threatprevention/bin/isectpd If the daemon is not running, then this is a finding.
Fix: F-20883r304806_fix
Configure the Ubuntu operating system to use ENSLTP. Install the isectp package, # sudo apt-get install isectp
- RMF Control
- SC-24
- Severity
- M
- CCI
- CCI-001665
- Version
- UBTU-18-010022
- Vuln IDs
-
- V-219160
- V-100547
- Rule IDs
-
- SV-219160r508662_rule
- SV-109651
Checks: C-20885r304808_chk
Verify the log service is configured to collect system failure events. Check that the log service is installed properly with the following command: # dpkg -l | grep rsyslog ii rsyslog 8.32.0-1ubuntu4 amd64 reliable system and kernel logging daemon If the "rsyslog" package is not installed, this is a finding. Check that the log service is enabled with the following command: # sudo systemctl is-enabled rsyslog enabled If the command above returns "disabled", this is a finding. Check that the log service is properly running and active on the system with the following command: # systemctl is-active rsyslog active If the command above returns "inactive", this is a finding.
Fix: F-20884r304809_fix
Configure the log service to collect failure events. Install the log service (if the log service is not already installed) with the following command: # sudo apt-get install rsyslog Enable the log service with the following command: # sudo systemctl enable rsyslog Restart the log service with the following command: # sudo systemctl restart rsyslog
- RMF Control
- AC-17
- Severity
- M
- CCI
- CCI-002314
- Version
- UBTU-18-010023
- Vuln IDs
-
- V-219161
- V-100549
- Rule IDs
-
- SV-219161r508662_rule
- SV-109653
Checks: C-20886r304811_chk
Verify that the Uncomplicated Firewall is installed. Check that the Uncomplicated Firewall is installed with the following command: # dpkg -l | grep ufw ii ufw 0.35-0Ubuntu2 If the "ufw" package is not installed, ask the System Administrator is another application firewall is installed. If no application firewall is installed this is a finding.
Fix: F-20885r304812_fix
Install the Uncomplicated Firewall by using the following command: # sudo apt-get install ufw
- RMF Control
- AU-4
- Severity
- L
- CCI
- CCI-001851
- Version
- UBTU-18-010025
- Vuln IDs
-
- V-219162
- V-100551
- Rule IDs
-
- SV-219162r508662_rule
- SV-109655
Checks: C-20887r466198_chk
Verify the audit event multiplexor is configured to off-load audit records to a different system or storage media from the system being audited. Check that audisp-remote plugin is installed: # sudo dpkg -s audispd-plugins If status is "not installed", verify that another method to off-load audit logs has been implemented. Check that the records are being off-loaded to a remote server with the following command: # sudo grep -i active /etc/audisp/plugins.d/au-remote.conf active = yes If "active" is not set to "yes", or the line is commented out, ask the System Administrator to indicate how the audit logs are off-loaded to a different system or storage media. If there is no evidence that the system is configured to off-load audit logs to a different system or storage media, this is a finding.
Fix: F-20886r304815_fix
Configure the audit event multiplexor to off-load audit records to a different system or storage media from the system being audited. Install the audisp-remote plugin: # sudo apt-get install audispd-plugins -y Set the audisp-remote plugin as active, by editing the /etc/audisp/plugins.d/au-remote.conf file: # sudo sed -i -E 's/active\s*=\s*no/active = yes/' /etc/audisp/plugins.d/au-remote.conf Set the address of the remote machine, by editing the /etc/audisp/audisp-remote.conf file: # sudo sed -i -E 's/(remote_server\s*=).*/\1 <remote addr>/' audisp-remote.conf where <remote addr> must be substituted by the address of the remote server receiving the audit log. Make the audit service reload its configuration files: # sudo systemctl restart auditd.service
- RMF Control
- IA-5
- Severity
- L
- CCI
- CCI-002007
- Version
- UBTU-18-010030
- Vuln IDs
-
- V-219163
- V-100553
- Rule IDs
-
- SV-219163r508662_rule
- SV-109657
Checks: C-20888r304817_chk
If smart card authentication is not being used on the system this item is Not Applicable. Verify that Pluggable Authentication Module (PAM) prohibits the use of cached authentications after one day. Check that PAM prohibits the use of cached authentications after one day with the following command: # sudo grep offline_credentials_expiration /etc/sssd/sssd.conf /etc/sssd/conf.d/*.conf offline_credentials_expiration = 1 If "offline_credentials_expiration" is not set to a value of "1", in /etc/sssd/sssd.conf or in a file with a name ending in .conf in the /etc/sssd/conf.d/ directory, this is a finding.
Fix: F-20887r304818_fix
Configure Pluggable Authentication Module (PAM) to prohibit the use of cached authentications after one day. Add or change the following line in "/etc/sssd/sssd.conf" just below the line "[pam]". offline_credentials_expiration = 1 Note: It is valid for this configuration to be in a file with a name that ends with ".conf" and does not begin with a "." in the /etc/sssd/conf.d/ directory instead of the /etc/sssd/sssd.conf file.
- RMF Control
- CM-6
- Severity
- L
- CCI
- CCI-000366
- Version
- UBTU-18-010031
- Vuln IDs
-
- V-219164
- V-100555
- Rule IDs
-
- SV-219164r508662_rule
- SV-109659
Checks: C-20889r304820_chk
Verify the Ubuntu operating system enforces a delay of at least 4 seconds between logon prompts following a failed logon attempt. Check that the Ubuntu operating system enforces a delay of at least 4 seconds between logon prompts with the following command: # grep pam_faildelay /etc/pam.d/common-auth auth required pam_faildelay.so delay=4000000 If the line is not present, or is commented out, this is a finding.
Fix: F-20888r304821_fix
Configure the Ubuntu operating system to enforce a delay of at least 4 seconds between logon prompts following a failed logon attempt. Edit the file "/etc/pam.d/common-auth" and set the parameter "pam_faildelay" to a value of 4000000 or greater: auth required pam_faildelay.so delay=4000000
- RMF Control
- CM-6
- Severity
- L
- CCI
- CCI-000366
- Version
- UBTU-18-010032
- Vuln IDs
-
- V-219165
- V-100557
- Rule IDs
-
- SV-219165r508662_rule
- SV-109661
Checks: C-20890r304823_chk
Verify users are provided with feedback on when account accesses last occurred. Check that "pam_lastlog" is used and not silent with the following command: # grep pam_lastlog /etc/pam.d/login session required pam_lastlog.so showfailed If "pam_lastlog" is missing from "/etc/pam.d/login" file, is not "required", or the "silent" option is present, this is a finding.
Fix: F-20889r304824_fix
Configure the Ubuntu operating system to provide users with feedback on when account accesses last occurred by setting the required configuration options in "/etc/pam.d/postlogin-ac". Add the following line to the top of "/etc/pam.d/login": session required pam_lastlog.so showfailed
- RMF Control
- AC-7
- Severity
- M
- CCI
- CCI-000044
- Version
- UBTU-18-010033
- Vuln IDs
-
- V-219166
- V-100559
- Rule IDs
-
- SV-219166r508662_rule
- SV-109663
Checks: C-20891r485690_chk
Check that Ubuntu operating system locks an account after three unsuccessful login attempts with following command: # grep pam_tally2 /etc/pam.d/common-auth auth required pam_tally2.so onerr=fail deny=3 If no line is returned or the line is commented out, this is a finding. If the line is missing "onerr=fail", this is a finding. If the line has "deny" set to a value more than 3, this is a finding.
Fix: F-20890r485691_fix
Configure the Ubuntu operating system to lock an account after three unsuccessful login attempts. Edit the /etc/pam.d/common-auth file. The pam_tally2.so entry must be placed at the top of the "auth" stack. So add the following line before the first "auth" entry in the file. auth required pam_tally2.so onerr=fail deny=3
- RMF Control
- AC-8
- Severity
- M
- CCI
- CCI-000050
- Version
- UBTU-18-010035
- Vuln IDs
-
- V-219167
- V-100561
- Rule IDs
-
- SV-219167r508662_rule
- SV-109665
Checks: C-20892r304829_chk
Verify the Ubuntu operating system displays the Standard Mandatory DoD Notice and Consent Banner before granting access to the operating system via a graphical user logon. Note: If the system does not have Graphical User Interface installed, this requirement is Not Applicable. Check that the operating system displays the exact approved Standard Mandatory DoD Notice and Consent Banner text with the command: # grep banner-message-enable /etc/gdm3/greeter.dconf-defaults banner-message-enable=true If the line is commented out or set to "false", this is a finding. # grep banner-message-text /etc/gdm3/greeter.dconf-defaults banner-message-text="You are accessing a U.S. Government \(USG\) Information System \(IS\) that is provided for USG-authorized use only.\s+By using this IS \(which includes any device attached to this IS\), you consent to the following conditions:\s+-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct \(PM\), law enforcement \(LE\), and counterintelligence \(CI\) investigations.\s+-At any time, the USG may inspect and seize data stored on this IS.\s+-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\s+-This IS includes security measures \(e.g., authentication and access controls\) to protect USG interests--not for your personal benefit or privacy.\s+-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." If the banner-message-text is missing, commented out, or the text does not match the Standard Mandatory DoD Notice and Consent Banner exactly, this is a finding.
Fix: F-20891r304830_fix
Edit the /etc/gdm3/greeter.dconf-defaults file. Uncomment (remove the leading '#' characters) the following 3 configuration lines: [org/gnome/login-screen] banner-message-enable=true banner-message-text='Welcome' Note: the lines are all near the bottom of the file but they are not adjacent to each other. Edit the banner-message-text='Welcome' line to contain the appropriate banner message text as shown below: banner-message-text='You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\n\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\n\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\n\n-At any time, the USG may inspect and seize data stored on this IS.\n\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\n\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\n\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.' Note that it is similar to the text in /etc/issue but it is all on a single line and the newline characters have been replaced with \n. # sudo dconf update # sudo systemctl restart gdm3
- RMF Control
- IA-2
- Severity
- M
- CCI
- CCI-000770
- Version
- UBTU-18-010036
- Vuln IDs
-
- V-219168
- V-100563
- Rule IDs
-
- SV-219168r508662_rule
- SV-109667
Checks: C-20893r304832_chk
Verify the Ubuntu operating system prevents direct logins to the root account. Check that the Ubuntu operating system prevents direct logins to the root account with the following command: # sudo passwd -S root root L 11/11/2017 0 99999 7 -1 If the output does not contain "L" in the second field to indicate the account is locked, this is a finding.
Fix: F-20892r304833_fix
Configure the Ubuntu operating system to prevent direct logins to the root account by performing the following operations: sudo passwd -l root
- RMF Control
- SC-3
- Severity
- H
- CCI
- CCI-001084
- Version
- UBTU-18-010037
- Vuln IDs
-
- V-219169
- V-100565
- Rule IDs
-
- SV-219169r508662_rule
- SV-109669
Checks: C-20894r304835_chk
Verify that the sudo group has only members who should have access to security functions. # grep sudo /etc/group sudo:x:27:foo If the sudo group contains users not needing access to security functions, this is a finding.
Fix: F-20893r304836_fix
Configure the sudo group with only members requiring access to security functions. To remove a user from the sudo group run: sudo gpasswd -d <username> sudo
- RMF Control
- AC-8
- Severity
- M
- CCI
- CCI-001384
- Version
- UBTU-18-010038
- Vuln IDs
-
- V-219170
- V-100567
- Rule IDs
-
- SV-219170r508662_rule
- SV-109671
Checks: C-20895r304838_chk
Verify the Ubuntu operating system displays the Standard Mandatory DoD Notice and Consent Banner before granting access to the Ubuntu operating system via a ssh logon. Check that the Ubuntu operating system displays the Standard Mandatory DoD Notice and Consent Banner before granting access to the Ubuntu operating system via a ssh logon with the following command: # grep -i banner /etc/ssh/sshd_config Banner /etc/issue The command will return the banner option along with the name of the file that contains the ssh banner. If the line is commented out, this is a finding. Check the specified banner file to check that it matches the Standard Mandatory DoD Notice and Consent Banner exactly: # cat /etc/issue “You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.” If the banner text does not match the Standard Mandatory DoD Notice and Consent Banner exactly, this is a finding.
Fix: F-20894r304839_fix
Configure the Ubuntu operating system to display the Standard Mandatory DoD Notice and Consent Banner before granting access to the system via SSH logon. Edit the SSH daemon configuration "/etc/ssh/sshd_config" file. Uncomment the banner keyword and configure it to point to the file that contains the correct banner. An example of this configure is below: Banner /etc/issue Either create the file containing the banner, or replace the text in the file with the Standard Mandatory DoD Notice and Consent Banner. The DoD required text is: "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." In order for the changes to take effect, the SSH daemon must be restarted. # sudo systemctl restart sshd.service
- RMF Control
- IA-5
- Severity
- L
- CCI
- CCI-000192
- Version
- UBTU-18-010100
- Vuln IDs
-
- V-219172
- V-100571
- Rule IDs
-
- SV-219172r508662_rule
- SV-109675
Checks: C-20897r304844_chk
Verify the Ubuntu operating system enforces password complexity by requiring that at least one upper-case character be used. Determine if the field "ucredit" is set in the "/etc/security/pwquality.conf" file with the following command: # grep -i "ucredit" /etc/security/pwquality.conf ucredit=-1 If the "ucredit" parameter is greater than "-1", or is commented out, this is a finding.
Fix: F-20896r304845_fix
Add or update the "/etc/security/pwquality.conf" file to contain the "ucredit" parameter: ucredit=-1
- RMF Control
- IA-5
- Severity
- L
- CCI
- CCI-000193
- Version
- UBTU-18-010101
- Vuln IDs
-
- V-219173
- V-100573
- Rule IDs
-
- SV-219173r508662_rule
- SV-109677
Checks: C-20898r304847_chk
Verify the Ubuntu operating system enforces password complexity by requiring that at least one lower-case character be used. Determine if the field "lcredit" is set in the "/etc/security/pwquality.conf" file with the following command: # grep -i "lcredit" /etc/security/pwquality.conf lcredit=-1 If the "lcredit" parameter is greater than "-1", or is commented out, this is a finding.
Fix: F-20897r304848_fix
Add or update the "/etc/security/pwquality.conf" file to contain the "lcredit" parameter: lcredit=-1
- RMF Control
- IA-5
- Severity
- L
- CCI
- CCI-000194
- Version
- UBTU-18-010102
- Vuln IDs
-
- V-219174
- V-100575
- Rule IDs
-
- SV-219174r508662_rule
- SV-109679
Checks: C-20899r304850_chk
Verify the Ubuntu operating system enforces password complexity by requiring that at least one numeric character be used. Determine if the field "dcredit" is set in the "/etc/security/pwquality.conf" file with the following command: # grep -i "dcredit" /etc/security/pwquality.conf dcredit=-1 If the "dcredit" parameter is greater than "-1", or is commented out, this is a finding.
Fix: F-20898r304851_fix
Configure the Ubuntu operating system to enforce password complexity by requiring that at least one numeric character be used. Add or update the "/etc/security/pwquality.conf" file to contain the "dcredit" parameter: dcredit=-1
- RMF Control
- IA-5
- Severity
- L
- CCI
- CCI-000195
- Version
- UBTU-18-010103
- Vuln IDs
-
- V-219175
- V-100577
- Rule IDs
-
- SV-219175r508662_rule
- SV-109681
Checks: C-20900r304853_chk
Verify the Ubuntu operating system requires the change of at least 8 characters when passwords are changed. Determine if the field "difok" is set in the "/etc/security/pwquality.conf" file with the following command: # grep -i "difok" /etc/security/pwquality.conf difok=8 If the "difok" parameter is less than "8", or is commented out, this is a finding.
Fix: F-20899r304854_fix
Configure the Ubuntu operating system to require the change of at least 8 characters when passwords are changed. Add or update the "/etc/security/pwquality.conf" file to include the "difok=8" parameter: difok=8
- RMF Control
- IA-5
- Severity
- M
- CCI
- CCI-000196
- Version
- UBTU-18-010104
- Vuln IDs
-
- V-219176
- V-100579
- Rule IDs
-
- SV-219176r508662_rule
- SV-109683
Checks: C-20901r304856_chk
Verify that the shadow password suite configuration is set to encrypt password with a FIPS 140-2 approved cryptographic hashing algorithm. Check the hashing algorithm that is being used to hash passwords with the following command: # cat /etc/login.defs | grep -i crypt ENCRYPT_METHOD SHA512 If "ENCRYPT_METHOD" does not equal SHA512 or greater, this is a finding.
Fix: F-20900r304857_fix
Configure the Ubuntu operating system to encrypt all stored passwords. Edit/Modify the following line in the "/etc/login.defs" file and set "ENCRYPT_METHOD" to SHA512. ENCRYPT_METHOD SHA512
- RMF Control
- IA-5
- Severity
- H
- CCI
- CCI-000197
- Version
- UBTU-18-010105
- Vuln IDs
-
- V-219177
- V-100581
- Rule IDs
-
- SV-219177r508662_rule
- SV-109685
Checks: C-20902r304859_chk
Verify that the telnet package is not installed on the Ubuntu operating system. Check that the telnet daemon is not installed on the Ubuntu operating system by running the following command: # dpkg -l | grep telnetd If the package is installed, this is a finding.
Fix: F-20901r304860_fix
Remove the telnet package from the Ubuntu operating system by running the following command: # sudo apt-get remove telnetd
- RMF Control
- IA-5
- Severity
- L
- CCI
- CCI-000198
- Version
- UBTU-18-010106
- Vuln IDs
-
- V-219178
- V-100583
- Rule IDs
-
- SV-219178r508662_rule
- SV-109687
Checks: C-20903r304862_chk
Verify that the Ubuntu operating system enforces a 24 hours/1 day minimum password lifetime for new user accounts by running the following command: # grep -i pass_min_days /etc/login.defs PASS_MIN_DAYS 1 If the "PASS_MIN_DAYS" parameter value is less than 1, or commented out, this is a finding.
Fix: F-20902r304863_fix
Configure the Ubuntu operating system to enforce a 24 hours/1 day minimum password lifetime. Add, or modify the following line in the "/etc/login.defs" file: PASS_MIN_DAYS 1
- RMF Control
- IA-5
- Severity
- L
- CCI
- CCI-000199
- Version
- UBTU-18-010107
- Vuln IDs
-
- V-219179
- V-100585
- Rule IDs
-
- SV-219179r508662_rule
- SV-109689
Checks: C-20904r304865_chk
Verify that the Ubuntu operating system enforces a 60-day maximum password lifetime for new user accounts by running the following command: # grep -i pass_max_days /etc/login.defs PASS_MAX_DAYS 60 If the "PASS_MAX_DAYS" parameter value is less than 60, or commented out, this is a finding.
Fix: F-20903r304866_fix
Configure the Ubuntu operating system to enforce a 60-day maximum password lifetime. Add, or modify the following line in the "/etc/login.defs" file: PASS_MAX_DAYS 60
- RMF Control
- IA-5
- Severity
- L
- CCI
- CCI-000200
- Version
- UBTU-18-010108
- Vuln IDs
-
- V-219180
- V-100587
- Rule IDs
-
- SV-219180r508662_rule
- SV-109691
Checks: C-20905r304868_chk
Verify that the Ubuntu operating system prevents passwords from being reused for a minimum of five generations by running the following command: # grep -i remember /etc/pam.d/common-password password [success=1 default=ignore] pam_unix.so sha512 shadow remember=5 rounds=5000 If the "remember" parameter value is not greater than or equal to 5, commented out, or not set at all this is a finding.
Fix: F-20904r304869_fix
Configure the Ubuntu operating system prevents passwords from being reused for a minimum of five generations. Add, or modify the "remember" parameter value to the following line in "/etc/pam.d/common-password" file: password [success=1 default=ignore] pam_unix.so sha512 shadow remember=5 rounds=5000
- RMF Control
- IA-5
- Severity
- M
- CCI
- CCI-000205
- Version
- UBTU-18-010109
- Vuln IDs
-
- V-219181
- V-100589
- Rule IDs
-
- SV-219181r508662_rule
- SV-109693
Checks: C-20906r304871_chk
Verify if the pwquality configuration file enforces a minimum 15-character password length, by running the following command: # grep -i minlen /etc/security/pwquality.conf minlen=15 If "minlen" parameter value is not 15 or higher, or is commented out, this is a finding.
Fix: F-20905r304872_fix
Configure the Ubuntu operating system to enforce a minimum 15-character password length. Add, or modify the "minlen" parameter value to the "/etc/security/pwquality.conf" file: minlen=15
- RMF Control
- IA-7
- Severity
- M
- CCI
- CCI-000803
- Version
- UBTU-18-010110
- Vuln IDs
-
- V-219182
- V-100591
- Rule IDs
-
- SV-219182r508662_rule
- SV-109695
Checks: C-20907r304874_chk
Verify that encrypted passwords stored in /etc/shadow use a strong cryptographic hash. Check that pam_unix.so auth is configured to use sha512 with the following command: # grep password /etc/pam.d/common-password | grep pam_unix password [success=1 default=ignore] pam_unix.so obscure sha512 If "sha512" is not an option of the output, or is commented out, this is a finding. Check that ENCRYPT_METHOD is set to sha512 in /etc/login.defs: # grep -i ENCRYPT_METHOD /etc/login.defs ENCRYPT_METHOD SHA512 If the output does not contain "sha512", or it is commented out, this is a finding.
Fix: F-20906r304875_fix
Configure the Ubuntu operating system to encrypt all stored passwords with a strong cryptographic hash. Edit/modify the following line in the file "/etc/pam.d/common-password" file to include the sha512 option for pam_unix.so: password [success=1 default=ignore] pam_unix.so obscure sha512 Edit/modify /etc/login.defs and set "ENCRYPT_METHOD sha512".
- RMF Control
- IA-5
- Severity
- M
- CCI
- CCI-002041
- Version
- UBTU-18-010112
- Vuln IDs
-
- V-219183
- V-100593
- Rule IDs
-
- SV-219183r508662_rule
- SV-109697
Checks: C-20908r304877_chk
Verify a policy exists that ensures when a user account is created, it is created using a method that forces a user to change their password upon their next login. If a policy does not exist, this is a finding.
Fix: F-20907r304878_fix
Create a policy that ensures when a user is created, it is created using a method that forces a user to change their password upon their next login. Below are two examples of how to create a user account that requires the user to change their password upon their next login. # chage -d 0 [UserName] or # passwd -e [UserName]
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- UBTU-18-010113
- Vuln IDs
-
- V-219184
- V-100595
- Rule IDs
-
- SV-219184r508662_rule
- SV-109699
Checks: C-20909r304880_chk
Verify that the Ubuntu operating system uses the cracklib library to prevent the use of dictionary words with the following command: # grep dictcheck /etc/security/pwquality.conf dictcheck=1 If the "dictcheck" parameter is not set to "1", or is commented out, this is a finding.
Fix: F-20908r304881_fix
Configure the Ubuntu operating system to prevent the use of dictionary words for passwords. Add or update the following line in the "/etc/security/pwquality.conf" file to include the "dictcheck=1" parameter: dictcheck=1
- RMF Control
- IA-11
- Severity
- M
- CCI
- CCI-002038
- Version
- UBTU-18-010114
- Vuln IDs
-
- V-219185
- V-100597
- Rule IDs
-
- SV-219185r508662_rule
- SV-109701
Checks: C-20910r304883_chk
Verify that "/etc/sudoers" has no occurrences of "NOPASSWD" or "!authenticate". Check that the "/etc/sudoers" file has no occurrences of "NOPASSWD" or "!authenticate" by running the following command: # sudo egrep -i '(nopasswd|!authenticate)' /etc/sudoers /etc/sudoers.d/* If any occurrences of "NOPASSWD" or "!authenticate" return from the command, this is a finding.
Fix: F-20909r304884_fix
Remove any occurrence of "NOPASSWD" or "!authenticate" found in "/etc/sudoers" file or files in the /etc/sudoers.d directory.
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- UBTU-18-010116
- Vuln IDs
-
- V-219186
- V-100599
- Rule IDs
-
- SV-219186r508662_rule
- SV-109703
Checks: C-20911r485728_chk
Verify the Ubuntu operating system has the libpam-pwquality package installed, by running the following command: # dpkg -l libpam-pwquality ii libpam-pwquality:amd64 1.4.0-2 amd64 PAM module to check password strength If "libpam-pwquality" is not installed, this is a finding. Verify the operating system uses "pwquality" to enforce the password complexity rules. Verify the pwquality module is being enforced by the Ubuntu Operating System, by running the following command: # grep -i enforcing /etc/security/pwquality.conf enforcing = 1 If the value of "enforcing" is not 1 or the line is commented out, this is a finding. Check for the use of "pwquality" with the following command: # sudo cat /etc/pam.d/common-password | grep requisite | grep pam_pwquality password requisite pam_pwquality.so retry=3 enforce_for_root If no output is returned or the line is commented out, this is a finding. If the value of "retry" is set to "0" or greater than "3", this is a finding. If "enforce_for_root" is missing from the configuration line, this is a finding.
Fix: F-20910r485729_fix
Configure the operating system to use "pwquality" to enforce password complexity rules. Install the pam_pwquality package by using the following command: # apt-get install libpam-pwquality -y Add the following line to "/etc/security/pwquality.conf" (or modify the line to have the required value): enforcing = 1 Add the following line to "/etc/pam.d/common-password" (or modify the line to have the required value): password requisite pam_pwquality.so retry=3 enforce_for_root Note: The value of "retry" should be between "1" and "3".
- RMF Control
- SC-4
- Severity
- M
- CCI
- CCI-001090
- Version
- UBTU-18-010120
- Vuln IDs
-
- V-219187
- V-100601
- Rule IDs
-
- SV-219187r508662_rule
- SV-109705
Checks: C-20912r304889_chk
Verify that all public (world writeable) directories have the public sticky bit set. Find world-writable directories that lack the sticky bit by running the following command: # sudo find / -type d -perm -002 ! -perm -1000 If any world-writable directories are found missing the sticky bit, this is a finding.
Fix: F-20911r304890_fix
Configure all public directories to have the sticky bit set to prevent unauthorized and unintended information transferred via shared system resources. Set the sticky bit on all public directories using the command, replace "[Public Directory]" with any directory path missing the sticky bit: # sudo chmod +t [Public Directory]
- RMF Control
- SI-11
- Severity
- M
- CCI
- CCI-001312
- Version
- UBTU-18-010121
- Vuln IDs
-
- V-219188
- V-100603
- Rule IDs
-
- SV-219188r508662_rule
- SV-109707
Checks: C-20913r304892_chk
Verify the Ubuntu operating system has all system log files under the /var/log directory with a permission set to 640, by using the following command: # sudo find /var/log -perm /137 -type f -exec stat -c "%n %a" {} \; If command displays any output, this is a finding.
Fix: F-20912r304893_fix
Configured the Ubuntu operating system to set permissions of all log files under /var/log directory to 640 or more restricted, by using the following command: # sudo find /var/log -perm /137 -type f -exec chmod 640 '{}' \;
- RMF Control
- SI-11
- Severity
- M
- CCI
- CCI-001314
- Version
- UBTU-18-010122
- Vuln IDs
-
- V-219189
- V-100605
- Rule IDs
-
- SV-219189r508662_rule
- SV-109709
Checks: C-20914r304895_chk
Verify the Ubuntu operating system configures the /var/log directory to be group-owned by syslog. Check that the /var/log directory is group owned by syslog with the following command: # sudo stat -c "%n %G" /var/log /var/log syslog If the /var/log directory is not group-owned by syslog, this is a finding.
Fix: F-20913r304896_fix
Configure the Ubuntu operating system to have syslog group-own the /var/log directory by running the following command: # sudo chgrp syslog /var/log
- RMF Control
- SI-11
- Severity
- M
- CCI
- CCI-001314
- Version
- UBTU-18-010123
- Vuln IDs
-
- V-219190
- V-100607
- Rule IDs
-
- SV-219190r508662_rule
- SV-109711
Checks: C-20915r304898_chk
Verify the Ubuntu operating system configures the /var/log directory to be owned by root. Check that the /var/log directory is owned by root with the following command: # sudo stat -c "%n %U" /var/log /var/log root If the /var/log directory is not owned by root, this is a finding.
Fix: F-20914r304899_fix
Configure the Ubuntu operating system to have root own the /var/log directory by running the following command: # sudo chown root /var/log
- RMF Control
- SI-11
- Severity
- M
- CCI
- CCI-001314
- Version
- UBTU-18-010124
- Vuln IDs
-
- V-219191
- V-100609
- Rule IDs
-
- SV-219191r508662_rule
- SV-109713
Checks: C-20916r304901_chk
Verify that the Ubuntu operating system configures the /var/log directory with a mode of 750 or less permissive. Check the mode of the /var/log directory with the following command: # stat -c "%n %a" /var/log /var/log 750 If a value of "750" or less permissive is not returned, this is a finding.
Fix: F-20915r304902_fix
Configure the Ubuntu operating system to have permissions of 0750 for the /var/log directory by running the following command: # sudo chmod 0750 /var/log
- RMF Control
- SI-11
- Severity
- M
- CCI
- CCI-001314
- Version
- UBTU-18-010125
- Vuln IDs
-
- V-219192
- V-100611
- Rule IDs
-
- SV-219192r508662_rule
- SV-109715
Checks: C-20917r304904_chk
Verify that the Ubuntu operating system configures the /var/log/syslog file to be group-owned by adm. Check that the /var/log/syslog file is group-owned by adm with the following command: # sudo stat -c "%n %G" /var/log/syslog /var/log/syslog adm If the /var/log/syslog file is not group-owned by adm, this is a finding.
Fix: F-20916r304905_fix
Configure the Ubuntu operating system to have adm group-own the /var/log/syslog file by running the following command: # sudo chgrp adm /var/log/syslog
- RMF Control
- SI-11
- Severity
- M
- CCI
- CCI-001314
- Version
- UBTU-18-010126
- Vuln IDs
-
- V-219193
- V-100613
- Rule IDs
-
- SV-219193r508662_rule
- SV-109717
Checks: C-20918r304907_chk
Verify that the Ubuntu operating system configures the /var/log/syslog file to be owned by syslog. Check that the /var/log/syslog file is owned by syslog with the following command: # sudo stat -c "%n %U" /var/log/syslog /var/log/syslog syslog If the /var/log/syslog file is not owned by syslog, this is a finding.
Fix: F-20917r304908_fix
Configure the Ubuntu operating system to have syslog own the /var/log/syslog file by running the following command: # sudo chown syslog /var/log/syslog
- RMF Control
- SI-11
- Severity
- M
- CCI
- CCI-001314
- Version
- UBTU-18-010127
- Vuln IDs
-
- V-219194
- V-100615
- Rule IDs
-
- SV-219194r508662_rule
- SV-109719
Checks: C-20919r304910_chk
Verify that the Ubuntu operating system configures the /var/log/syslog file with mode 0640 or less permissive. Check the /var/log/syslog permissions by running the following command: # stat -c "%n %a" /var/log/syslog /var/log/syslog 640 If a value of "640" or less permissive is not returned, this is a finding.
Fix: F-20918r304911_fix
Configure the Ubuntu operating system to have permissions of 0640 o for the /var/log/syslog file by running the following command: # sudo chmod 0640 /var/log/syslog
- RMF Control
- AU-9
- Severity
- M
- CCI
- CCI-001494
- Version
- UBTU-18-010128
- Vuln IDs
-
- V-219195
- V-100617
- Rule IDs
-
- SV-219195r508662_rule
- SV-109721
Checks: C-20920r304913_chk
Verify the audit tools are protected from unauthorized access, deletion, or modification by checking the permissive mode. For each audit tool, /sbin/auditctl, /sbin/aureport, /sbin/ausearch, /sbin/autrace, /sbin/auditd, /sbin/audispd, /sbin/augenrules Check the permissions by running the following command: # stat -c "%n %a" /sbin/auditctl 755 /sbin/auditctl If any of the audit tools have a mode more permissive than 0755, this is a finding.
Fix: F-20919r304914_fix
Configure the audit tools on the Ubuntu operating system to be protected from unauthorized access by setting the correct permissive mode using the following command: # sudo chmod 0755 [audit_tool] Replace "[audit_tool]" with the audit tool that does not have the correct permissive mode.
- RMF Control
- AU-9
- Severity
- M
- CCI
- CCI-001493
- Version
- UBTU-18-010129
- Vuln IDs
-
- V-219196
- V-100619
- Rule IDs
-
- SV-219196r508662_rule
- SV-109723
Checks: C-20921r304916_chk
Verify the Ubuntu operating system configures the audit tools to be owned by root to prevent any unauthorized access, deletion, or modification. For each audit tool, /sbin/auditctl, /sbin/aureport, /sbin/ausearch, /sbin/autrace, /sbin/auditd, /sbin/audispd, /sbin/augenrules Check the ownership by running the following command: # stat -c "%n %U" /sbin/auditctl /sbin/auditctl root If any of the audit tools are not owned by root, this is a finding.
Fix: F-20920r304917_fix
Configure the audit tools on the Ubuntu operating system to be owned by root, by running the following command: # sudo chown root [audit_tool] Replace "[audit_tool]" with each audit tool not owned by root.
- RMF Control
- AU-9
- Severity
- M
- CCI
- CCI-001493
- Version
- UBTU-18-010130
- Vuln IDs
-
- V-219197
- V-100621
- Rule IDs
-
- SV-219197r508662_rule
- SV-109725
Checks: C-20922r304919_chk
Verify the Ubuntu operating system configures the audit tools to be group-owned by root to prevent any unauthorized access, deletion, or modification. For each audit tools, /sbin/auditctl, /sbin/aureport, /sbin/ausearch, /sbin/autrace, /sbin/auditd, /sbin/audispd, /sbin/augenrules Check the group-owner of each audit tool by running the following commands: stat -c "%n %G" /sbin/auditctl /sbin/auditctl root If any of the audit tools are not group-owned by root, this is a finding.
Fix: F-20921r304920_fix
Configure the audit tools on the Ubuntu operating system to be group-owned by root, by running the following command: # sudo chgrp root [audit_tool] Replace "[audit_tool]" with each audit tool not group-owned by root.
- RMF Control
- CM-5
- Severity
- M
- CCI
- CCI-001499
- Version
- UBTU-18-010133
- Vuln IDs
-
- V-219198
- V-100623
- Rule IDs
-
- SV-219198r508662_rule
- SV-109727
Checks: C-20923r304922_chk
Verify the system-wide shared library files contained in the directories "/lib", "/lib64" and "/usr/lib" have mode 0755 or less permissive. Check that the system-wide shared library files have mode 0755 or less permissive with the following command: # sudo find /lib /lib64 /usr/lib -perm /022 -type f -exec stat -c "%n %a" '{}' \; /usr/lib64/pkcs11-spy.so If any files are found to be group-writable or world-writable, this is a finding.
Fix: F-20922r304923_fix
Configure the library files to be protected from unauthorized access. Run the following command: # sudo find /lib /lib64 /usr/lib -perm /022 -type f -exec chmod 755 '{}' \;
- RMF Control
- CM-5
- Severity
- M
- CCI
- CCI-001499
- Version
- UBTU-18-010134
- Vuln IDs
-
- V-219199
- V-100625
- Rule IDs
-
- SV-219199r508662_rule
- SV-109729
Checks: C-20924r485703_chk
Verify the system-wide shared library directories "/lib", "/lib64" and "/usr/lib have mode 0755 or less permissive. Check that the system-wide shared library directories have mode 0755 or less permissive with the following command: # sudo find /lib /lib64 /usr/lib -perm /022 -type d -exec stat -c "%n %a" '{}' \; If any of the aforementioned directories are found to be group-writable or world-writable, this is a finding.
Fix: F-20923r485739_fix
Configure the shared library directories to be protected from unauthorized access. Run the following command: # sudo find /lib /lib64 /usr/lib -perm /022 -type d -exec chmod 755 '{}' \;
- RMF Control
- CM-5
- Severity
- M
- CCI
- CCI-001499
- Version
- UBTU-18-010135
- Vuln IDs
-
- V-219200
- V-100627
- Rule IDs
-
- SV-219200r508662_rule
- SV-109731
Checks: C-20925r304928_chk
Verify the system-wide shared library files contained in the directories "/lib", "/lib64" and "/usr/lib" are owned by root. Check that the system-wide shared library files are owned by root with the following command: # sudo find /lib /usr/lib /lib64 ! -user root -type f -exec stat -c "%n %U" '{}' \; If any system wide library file is returned, this is a finding.
Fix: F-20924r304929_fix
Configure the system library files to be protected from unauthorized access. Run the following command: # sudo find /lib /usr/lib /lib64 ! -user root -type f -exec chown root '{}' \;
- RMF Control
- CM-5
- Severity
- M
- CCI
- CCI-001499
- Version
- UBTU-18-010136
- Vuln IDs
-
- V-219201
- V-100629
- Rule IDs
-
- SV-219201r508662_rule
- SV-109733
Checks: C-20926r304931_chk
Verify the system-wide shared library directories "/lib", "/lib64" and "/usr/lib" are owned by root. Check that the system-wide shared library directories are owned by root with the following command: # sudo find /lib /usr/lib /lib64 ! -user root -type d -exec stat -c "%n %U" '{}' \; If any system wide library directory is returned, this is a finding.
Fix: F-20925r304932_fix
Configure the library files and their respective parent directories to be protected from unauthorized access. Run the following command: # sudo find /lib /usr/lib /lib64 ! -user root -type d -exec chown root '{}' \;
- RMF Control
- CM-5
- Severity
- M
- CCI
- CCI-001499
- Version
- UBTU-18-010137
- Vuln IDs
-
- V-219202
- V-100631
- Rule IDs
-
- SV-219202r508662_rule
- SV-109735
Checks: C-20927r304934_chk
Verify the system-wide library files contained in the directories "/lib", "/lib64" and "/usr/lib" are group-owned by root. Check that the system-wide library files are group-owned by root with the following command: # sudo find /lib /usr/lib /lib64 ! -group root -type f -exec stat -c "%n %G" '{}' \; If any system wide shared library file is returned, this is a finding.
Fix: F-20926r304935_fix
Configure the system library files to be protected from unauthorized access. Run the following command: # sudo find /lib /usr/lib /lib64 ! -group root -type f -exec chgrp root '{}' \;
- RMF Control
- CM-5
- Severity
- M
- CCI
- CCI-001499
- Version
- UBTU-18-010138
- Vuln IDs
-
- V-219203
- V-100633
- Rule IDs
-
- SV-219203r508662_rule
- SV-109737
Checks: C-20928r304937_chk
Verify the system-wide library directories "/lib", "/lib64" and "/usr/lib" are group-owned by root. Check that the system-wide library directories are group-owned by root with the following command: # sudo find /lib /usr/lib /lib64 ! -group root -type d -exec stat -c "%n %G" '{}' \; If any system wide shared library directory is returned, this is a finding.
Fix: F-20927r304938_fix
Configure the system library directories to be protected from unauthorized access. Run the following command: # sudo find /lib /usr/lib /lib64 ! -group root -type d -exec chgrp root '{}' \;
- RMF Control
- CM-5
- Severity
- M
- CCI
- CCI-001499
- Version
- UBTU-18-010139
- Vuln IDs
-
- V-219204
- V-100635
- Rule IDs
-
- SV-219204r508662_rule
- SV-109739
Checks: C-20929r304940_chk
Verify the system commands contained in the following directories have mode 0755 or less permissive: /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin Check that the system command files have mode 0755 or less permissive with the following command: # find -L /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin -perm /022 -type f -exec stat -c "%n %a" '{}' \; If any files are found to be group-writable or world-writable, this is a finding.
Fix: F-20928r304941_fix
Configure the system commands to be protected from unauthorized access. Run the following command: # sudo find -L /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin -perm /022 -type f -exec chmod 755 '{}' \;
- RMF Control
- CM-5
- Severity
- M
- CCI
- CCI-001499
- Version
- UBTU-18-010140
- Vuln IDs
-
- V-219205
- V-100637
- Rule IDs
-
- SV-219205r508662_rule
- SV-109741
Checks: C-20930r304943_chk
Verify the system commands directories have mode 0755 or less permissive: /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin Check that the system command directories have mode 0755 or less permissive with the following command: # find -L /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin -perm /022 -type d -exec stat -c "%n %a" '{}' \; If any directories are found to be group-writable or world-writable, this is a finding.
Fix: F-20929r304944_fix
Configure the system commands directories to be protected from unauthorized access. Run the following command: # sudo find -L /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin -perm /022 -type d -exec chmod -R 755 '{}' \;
- RMF Control
- CM-5
- Severity
- M
- CCI
- CCI-001499
- Version
- UBTU-18-010141
- Vuln IDs
-
- V-219206
- V-100639
- Rule IDs
-
- SV-219206r508662_rule
- SV-109743
Checks: C-20931r304946_chk
Verify the system commands contained in the following directories are owned by root: /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin Use the following command for the check: # sudo find -L /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin ! -user root -type f -exec stat -c "%n %U" '{}' \; If any system commands are returned, this is a finding.
Fix: F-20930r304947_fix
Configure the system commands - and their respective parent directories - to be protected from unauthorized access. Run the following command: # sudo find -L /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin ! -user root -type f -exec chown root '{}' \;
- RMF Control
- CM-5
- Severity
- M
- CCI
- CCI-001499
- Version
- UBTU-18-010142
- Vuln IDs
-
- V-219207
- V-100641
- Rule IDs
-
- SV-219207r508662_rule
- SV-109745
Checks: C-20932r304949_chk
Verify the system commands directories are owned by root: /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin Use the following command for the check: # sudo find -L /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin ! -user root -type d -exec stat -c "%n %U" '{}' \; If any system commands directories are returned, this is a finding.
Fix: F-20931r304950_fix
Configure the system commands directories to be protected from unauthorized access. Run the following command: # sudo find -L /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin ! -user root -type d -exec chown root '{}' \;
- RMF Control
- CM-5
- Severity
- M
- CCI
- CCI-001499
- Version
- UBTU-18-010143
- Vuln IDs
-
- V-219208
- V-100643
- Rule IDs
-
- SV-219208r508662_rule
- SV-109747
Checks: C-20933r304952_chk
Verify the system commands contained in the following directories are group-owned by root: /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin Run the check with the following command: # sudo find -L /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin ! -group root -type f -exec stat -c "%n %G" '{}' \; If any system commands are returned that are not Set Group ID up on execution (SGID) files and owned by a privileged account, this is a finding.
Fix: F-20932r304953_fix
Configure the system commands to be protected from unauthorized access. Run the following command: # sudo find -L /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin ! -group root -type f -exec chgrp root '{}' \;
- RMF Control
- CM-5
- Severity
- M
- CCI
- CCI-001499
- Version
- UBTU-18-010144
- Vuln IDs
-
- V-219209
- V-100645
- Rule IDs
-
- SV-219209r508662_rule
- SV-109749
Checks: C-20934r304955_chk
Verify the system commands directories are group-owned by root: /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin Run the check with the following command: # sudo find -L /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin ! -group root -type d -exec stat -c "%n %G" '{}' \; If any system commands directories are returned that are not Set Group ID up on execution (SGID) files and owned by a privileged account, this is a finding.
Fix: F-20933r304956_fix
Configure the system commands directories to be protected from unauthorized access. Run the following command: # sudo find -L /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin ! -group root -type d -exec chgrp root '{}' \;
- RMF Control
- IA-5
- Severity
- L
- CCI
- CCI-001619
- Version
- UBTU-18-010145
- Vuln IDs
-
- V-219210
- V-100647
- Rule IDs
-
- SV-219210r508662_rule
- SV-109751
Checks: C-20935r304958_chk
Determine if the field "ocredit" is set in the "/etc/security/pwquality.conf" file with the following command: # grep -i "ocredit" /etc/security/pwquality.conf ocredit=-1 If the "ocredit" parameter is greater than "-1", or is commented out, this is a finding.
Fix: F-20934r304959_fix
Configure the Ubuntu operating system to enforce password complexity by requiring that at least one special character be used. Add or update the following line in the "/etc/security/pwquality.conf" file to include the "ocredit=-1" parameter: ocredit=-1
- RMF Control
- CM-6
- Severity
- H
- CCI
- CCI-000366
- Version
- UBTU-18-010150
- Vuln IDs
-
- V-219211
- V-100649
- Rule IDs
-
- SV-219211r508662_rule
- SV-109753
Checks: C-20936r304961_chk
Verify the Ubuntu operating system is not configured to reboot the system when Ctrl-Alt-Delete is pressed when using a graphical user interface. Check that the "logout" target is not bound to an action with the following command: # grep logout /etc/dconf/db/local.d/* logout='' If the "logout" key is bound to an action, is commented out, or is missing, this is a finding.
Fix: F-20935r304962_fix
Configure the system to disable the Ctrl-Alt-Delete sequence when using a graphical user interface by creating or editing the /etc/dconf/db/local.d/00-disable-CAD file. Add the setting to disable the Ctrl-Alt-Delete sequence for the graphical user interface: [org/gnome/settings-daemon/plugins/media-keys] logout='' Then update the dconf settings: # dconf update
- RMF Control
- CM-6
- Severity
- H
- CCI
- CCI-000366
- Version
- UBTU-18-010151
- Vuln IDs
-
- V-219212
- V-100651
- Rule IDs
-
- SV-219212r508662_rule
- SV-109755
Checks: C-20937r304964_chk
Verify the Ubuntu operating system is not configured to reboot the system when Ctrl-Alt-Delete is pressed. Check that the "ctrl-alt-del.target" (otherwise also known as reboot.target) is not active with the following command: # systemctl status ctrl-alt-del.target reboot.target - Reboot Loaded: loaded (/usr/lib/systemd/system/reboot.target; disabled) Active: inactive (dead) Docs: man:systemd.special(7) If the "ctrl-alt-del.target" is active, this is a finding.
Fix: F-20936r304965_fix
Configure the system to disable the Ctrl-Alt-Delete sequence for the command line with the following command: # sudo systemctl mask ctrl-alt-del.target And reload the daemon to take effect # sudo systemctl daemon-reload
- RMF Control
- AU-12
- Severity
- M
- CCI
- CCI-000172
- Version
- UBTU-18-010201
- Vuln IDs
-
- V-219213
- V-100653
- Rule IDs
-
- SV-219213r508662_rule
- SV-109757
Checks: C-20938r304967_chk
Verify the Ubuntu operating system generates an audit record when successful/unsuccessful modifications to the "tallylog" file occur. Check the currently configured audit rules with the following command: # sudo auditctl -l | grep tallylog -w /var/log/tallylog -p wa -k logins If the command does not return a line that matches the example or the line is commented out, this is a finding. Note: The '-k' allows for specifying an arbitrary identifier and the string after it does not need to match the example output above.
Fix: F-20937r304968_fix
Configure the audit system to generate an audit event for any successful/unsuccessful modifications to the "tallylog" file occur. Add or update the following rules in the "/etc/audit/rules.d/stig.rules" file: -w /var/log/tallylog -p wa -k logins Note: The "root" account must be used to view/edit any files in the /etc/audit/rules.d/ directory. In order to reload the rules file, issue the following command: # sudo augenrules --load
- RMF Control
- AU-12
- Severity
- M
- CCI
- CCI-000172
- Version
- UBTU-18-010202
- Vuln IDs
-
- V-219214
- V-100655
- Rule IDs
-
- SV-219214r508662_rule
- SV-109759
Checks: C-20939r304970_chk
Verify the Ubuntu operating system generates an audit record when successful/unsuccessful modifications to the "faillog" file occur. Check the currently configured audit rules with the following command: # sudo auditctl -l | grep faillog -w /var/log/faillog -p wa -k logins If the command does not return a line that matches the example or the line is commented out, this is a finding. Note: The '-k' allows for specifying an arbitrary identifier and the string after it does not need to match the example output above.
Fix: F-20938r304971_fix
Configure the audit system to generate an audit event for any successful/unsuccessful modifications to the "faillog" file occur. Add or update the following rules in the "/etc/audit/rules.d/stig.rules" file: -w /var/log/faillog -p wa -k logins Note: The "root" account must be used to view/edit any files in the /etc/audit/rules.d/ directory. In order to reload the rules file, issue the following command: # sudo augenrules --load
- RMF Control
- AU-12
- Severity
- M
- CCI
- CCI-000172
- Version
- UBTU-18-010203
- Vuln IDs
-
- V-219215
- V-100657
- Rule IDs
-
- SV-219215r508662_rule
- SV-109761
Checks: C-20940r304973_chk
Verify the Ubuntu operating system generates an audit record when successful/unsuccessful modifications to the "lastlog" file occur. Check the currently configured audit rules with the following command: # sudo auditctl -l | grep lastlog -w /var/log/lastlog -p wa -k logins If the command does not return a line that matches the example or the line is commented out, this is a finding. Note: The '-k' allows for specifying an arbitrary identifier and the string after it does not need to match the example output above.
Fix: F-20939r304974_fix
Configure the audit system to generate an audit event for any successful/unsuccessful modifications to the "lastlog" file occur. Add or update the following rules in the "/etc/audit/rules.d/stig.rules" file: -w /var/log/lastlog -p wa -k logins Note: The "root" account must be used to view/edit any files in the /etc/audit/rules.d/ directory. In order to reload the rules file, issue the following command: # sudo augenrules --load
- RMF Control
- AU-12
- Severity
- M
- CCI
- CCI-000172
- Version
- UBTU-18-010237
- Vuln IDs
-
- V-219216
- V-100659
- Rule IDs
-
- SV-219216r508662_rule
- SV-109763
Checks: C-20941r304976_chk
Verify the Ubuntu operating system audits privileged activities. Check the currently configured audit rules with the following command: # sudo auditctl -l | grep sudo.log -w /var/log/sudo.log -p wa -k priv_actions If the command does not return lines that match the example or the lines are commented out, this is a finding. Notes: The '-k' allows for specifying an arbitrary identifier and the string after it does not need to match the example output above.
Fix: F-20940r304977_fix
Configure the Ubuntu operating system to audit privileged activities. Add or update the following rules in the "/etc/audit/rules.d/stig.rules" file: -w /var/log/sudo.log -p wa -k actions Note: The "root" account must be used to view/edit any files in the /etc/audit/rules.d/ directory. In order to reload the rules file, issue the following command: # sudo augenrules --load
- RMF Control
- AU-12
- Severity
- M
- CCI
- CCI-000172
- Version
- UBTU-18-010238
- Vuln IDs
-
- V-219217
- V-100661
- Rule IDs
-
- SV-219217r508662_rule
- SV-109765
Checks: C-20942r304979_chk
Verify the Ubuntu operating system generates audit records showing start and stop times for user access to the system via /va/rlog/wtmp. Check the currently configured audit rules with the following command: # sudo auditctl -l | grep '/var/log/wtmp' -w /var/log/wtmp -p wa -k logins If the command does not return a line matching the example or the line is commented out, this is a finding. Note: The '-k' allows for specifying an arbitrary identifier and the string after it does not need to match the example output above.
Fix: F-20941r304980_fix
Configure the audit system to generate audit events showing start and stop times for user access via the /var/log/wtmp file. Add or update the following rules in the "/etc/audit/rules.d/stig.rules" file: -w /var/log/wtmp -p wa -k logins Note: The "root" account must be used to view/edit any files in the /etc/audit/rules.d/ directory. In order to reload the rules file, issue the following command: # sudo augenrules --load
- RMF Control
- AU-12
- Severity
- M
- CCI
- CCI-000172
- Version
- UBTU-18-010239
- Vuln IDs
-
- V-219218
- V-100663
- Rule IDs
-
- SV-219218r508662_rule
- SV-109767
Checks: C-20943r304982_chk
Verify the Ubuntu operating system generates audit records showing start and stop times for user access to the system via /var/run/wtmp file. Check the currently configured audit rules with the following command: # sudo auditctl -l | grep '/var/run/wtmp' -w /var/run/wtmp -p wa -k logins If the command does not return a line matching the example or the line is commented out, this is a finding. Note: The '-k' allows for specifying an arbitrary identifier and the string after it does not need to match the example output above.
Fix: F-20942r304983_fix
Configure the audit system to generate audit events showing start and stop times for user access via the /var/run/wtmp file. Add or update the following rules in the "/etc/audit/rules.d/stig.rules" file: -w /var/run/wtmp -p wa -k logins Note: The "root" account must be used to view/edit any files in the /etc/audit/rules.d/ directory. In order to reload the rules file, issue the following command: # sudo augenrules --load
- RMF Control
- AU-12
- Severity
- M
- CCI
- CCI-000172
- Version
- UBTU-18-010240
- Vuln IDs
-
- V-219219
- V-100665
- Rule IDs
-
- SV-219219r508662_rule
- SV-109769
Checks: C-20944r304985_chk
Verify the Ubuntu operating system generates audit records showing start and stop times for user access to the system via /var/log/btmp file. Check the currently configured audit rules with the following command: # sudo auditctl -l | grep '/var/log/btmp' -w /var/log/btmp -p wa -k logins If the command does not return a line matching the example or the line is commented out, this is a finding. Note: The '-k' allows for specifying an arbitrary identifier and the string after it does not need to match the example output above.
Fix: F-20943r304986_fix
Configure the audit system to generate audit events showing start and stop times for user access via the /var/log/btmp file. Add or update the following rules in the "/etc/audit/rules.d/stig.rules" file: -w /var/log/btmp -p wa -k logins Note: The "root" account must be used to view/edit any files in the /etc/audit/rules.d/ directory. In order to reload the rules file, issue the following command: # sudo augenrules --load
- RMF Control
- AU-12
- Severity
- M
- CCI
- CCI-000172
- Version
- UBTU-18-010244
- Vuln IDs
-
- V-219220
- V-100667
- Rule IDs
-
- SV-219220r508662_rule
- SV-109771
Checks: C-20945r304988_chk
Verify the Ubuntu operating system generates audit records for all account creations, modifications, disabling, and termination events that affect /etc/passwd. Check the currently configured audit rules with the following command: # sudo auditctl -l | grep passwd -w /etc/passwd -p wa -k usergroup_modification If the command does not return a line that matches the example or the line is commented out, this is a finding. Note: The '-k' allows for specifying an arbitrary identifier and the string after it does not need to match the example output above.
Fix: F-20944r304989_fix
Configure the Ubuntu operating system to generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/passwd. Add or update the following rule to "/etc/audit/rules.d/stig.rules": -w /etc/passwd -p wa -k usergroup_modification Note: The "root" account must be used to view/edit any files in the /etc/audit/rules.d/ directory. In order to reload the rules file, issue the following command: # sudo augenrules --load
- RMF Control
- AC-2
- Severity
- M
- CCI
- CCI-002130
- Version
- UBTU-18-010245
- Vuln IDs
-
- V-219221
- V-100669
- Rule IDs
-
- SV-219221r508662_rule
- SV-109773
Checks: C-20946r304991_chk
Verify the Ubuntu operating system generates audit records for all account creations, modifications, disabling, and termination events that affect /etc/group. Check the currently configured audit rules with the following command: # sudo auditctl -l | grep group -w /etc/group -p wa -k usergroup_modification If the command does not return a line that matches the example or the line is commented out, this is a finding. Note: The '-k' allows for specifying an arbitrary identifier and the string after it does not need to match the example output above.
Fix: F-20945r304992_fix
Configure the Ubuntu operating system to generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/group. Add or update the following rule to "/etc/audit/rules.d/stig.rules": -w /etc/group -p wa -k usergroup_modification Note: The "root" account must be used to view/edit any files in the /etc/audit/rules.d/ directory. In order to reload the rules file, issue the following command: # sudo augenrules --load
- RMF Control
- AU-12
- Severity
- M
- CCI
- CCI-000172
- Version
- UBTU-18-010246
- Vuln IDs
-
- V-219222
- V-100671
- Rule IDs
-
- SV-219222r508662_rule
- SV-109775
Checks: C-20947r304994_chk
Verify the Ubuntu operating system generates audit records for all account creations, modifications, disabling, and termination events that affect /etc/gshadow. Check the currently configured audit rules with the following command: # sudo auditctl -l | grep gshadow -w /etc/gshadow -p wa -k usergroup_modification If the command does not return a line that matches the example or the line is commented out, this is a finding. Note: The '-k' allows for specifying an arbitrary identifier and the string after it does not need to match the example output above.
Fix: F-20946r304995_fix
Configure the Ubuntu operating system to generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/gshadow. Add or update the following rule to "/etc/audit/rules.d/stig.rules": -w /etc/gshadow -p wa -k usergroup_modification Note: The "root" account must be used to view/edit any files in the /etc/audit/rules.d/ directory. In order to reload the rules file, issue the following command: # sudo augenrules --load
- RMF Control
- AC-2
- Severity
- M
- CCI
- CCI-002130
- Version
- UBTU-18-010247
- Vuln IDs
-
- V-219223
- V-100673
- Rule IDs
-
- SV-219223r508662_rule
- SV-109777
Checks: C-20948r304997_chk
Verify the Ubuntu operating system generates audit records for all account creations, modifications, disabling, and termination events that affect /etc/shadow. Check the currently configured audit rules with the following command: # sudo auditctl -l | grep shadow -w /etc/shadow -p wa -k usergroup_modification If the command does not return a line that matches the example or the line is commented out, this is a finding. Note: The '-k' allows for specifying an arbitrary identifier and the string after it does not need to match the example output above.
Fix: F-20947r304998_fix
Configure the Ubuntu operating system to generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/shadow. Add or update the following rule to "/etc/audit/rules.d/stig.rules": -w /etc/shadow -p wa -k usergroup_modification Note: The "root" account must be used to view/edit any files in the /etc/audit/rules.d/ directory. In order to reload the rules file, issue the following command: # sudo augenrules --load
- RMF Control
- AU-12
- Severity
- M
- CCI
- CCI-000172
- Version
- UBTU-18-010248
- Vuln IDs
-
- V-219224
- V-100675
- Rule IDs
-
- SV-219224r508662_rule
- SV-109779
Checks: C-20949r305000_chk
Verify the Ubuntu operating system generates audit records for all account creations, modifications, disabling, and termination events that affect /etc/security/opasswd. Check the currently configured audit rules with the following command: # sudo auditctl -l | grep opasswd -w /etc/security/opasswd -p wa -k usergroup_modification If the command does not return a line that matches the example or the line is commented out, this is a finding. Note: The '-k' allows for specifying an arbitrary identifier and the string after it does not need to match the example output above.
Fix: F-20948r305001_fix
Configure the Ubuntu operating system to generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/security/opasswd. Add or update the following rule to "/etc/audit/rules.d/stig.rules": -w /etc/security/opasswd -p wa -k usergroup_modification Note: The "root" account must be used to view/edit any files in the /etc/audit/rules.d/ directory. In order to reload the rules file, issue the following command: # sudo augenrules --load
- RMF Control
- CM-5
- Severity
- M
- CCI
- CCI-001814
- Version
- UBTU-18-010250
- Vuln IDs
-
- V-219225
- V-100677
- Rule IDs
-
- SV-219225r508662_rule
- SV-109781
Checks: C-20950r305003_chk
Verify the audit service is configured to produce audit records. Check that the audit service is installed properly with the following command: # dpkg -l | grep auditd If the "auditd" package is not installed, this is a finding. Check that the audit service is enabled with the following command: # systemctl is-enabled auditd.service If the command above returns "disabled", this is a finding. Check that the audit service is properly running and active on the system with the following command: # systemctl is-active auditd.service active If the command above returns "inactive", this is a finding.
Fix: F-20949r305004_fix
Configure the audit service to produce audit records containing the information needed to establish when (date and time) an event occurred. Install the audit service (if the audit service is not already installed) with the following command: # sudo apt-get install auditd Enable the audit service with the following command: # sudo systemctl enable auditd.service In order to reload the rules file, issue the following command: # sudo augenrules --load
- RMF Control
- AU-5
- Severity
- M
- CCI
- CCI-000139
- Version
- UBTU-18-010300
- Vuln IDs
-
- V-219226
- V-100679
- Rule IDs
-
- SV-219226r508662_rule
- SV-109783
Checks: C-20951r305006_chk
Verify that the System Administrator (SA) and Information System Security Officer (ISSO) (at a minimum) are notified in the event of an audit processing failure. Check that the Ubuntu operating system notifies the SA and ISSO (at a minimum) win the event of an audit processing failure with the following command: # sudo grep action_mail_acct = root /etc/audit/auditd.conf action_mail_acct = root If the value of the "action_mail_acct" keyword is not set to "root" and/or other accounts for security personnel, the "action_mail_acct" keyword is missing, or the returned line is commented out, this is a finding.
Fix: F-20950r305007_fix
Configure "auditd" service to notify the System Administrator (SA) and Information System Security Officer (ISSO) in the event of an audit processing failure. Edit the following line in "/etc/audit/auditd.conf" to ensure that administrators are notified via email for those situations: action_mail_acct = root Restart the auditd service so the changes take effect: # sudo systemctl restart auditd.service
- RMF Control
- AU-5
- Severity
- M
- CCI
- CCI-000140
- Version
- UBTU-18-010301
- Vuln IDs
-
- V-219227
- V-100681
- Rule IDs
-
- SV-219227r508662_rule
- SV-109785
Checks: C-20952r305009_chk
Verify the Ubuntu operating system takes the appropriate action when the audit storage volume is full. Check that the Ubuntu operating system takes the appropriate action when the audit storage volume is full with the following command: # sudo grep disk_full_action /etc/audit/auditd.conf disk_full_action = HALT If the value of the "disk_full_action" option is not "SYSLOG", "SINGLE", or "HALT", or the line is commented out, this is a finding.
Fix: F-20951r305010_fix
Configure the Ubuntu operating system to shut down by default upon audit failure (unless availability is an overriding concern). Add or update the following line (depending on configuration "disk_full_action" can be set to "SYSLOG", "HALT" or "SINGLE") in "/etc/audit/auditd.conf" file: disk_full_action = HALT Restart the auditd service so the changes take effect: # sudo systemctl restart auditd.service
- RMF Control
- AU-9
- Severity
- M
- CCI
- CCI-000162
- Version
- UBTU-18-010305
- Vuln IDs
-
- V-219228
- V-100683
- Rule IDs
-
- SV-219228r508662_rule
- SV-109787
Checks: C-20953r305012_chk
Verify that the audit log files have a mode of "0600" or less permissive. First determine where the audit logs are stored with the following command: # sudo grep -iw log_file /etc/audit/auditd.conf log_file = /var/log/audit/audit.log Using the path of the directory containing the audit logs, check if the audit log files have a mode of "0600" or less by using the following command: # sudo stat -c "%n %a" /var/log/audit/* /var/log/audit/audit.log 600 If the audit log files have a mode more permissive than "0600", this is a finding.
Fix: F-20952r305013_fix
Configure the audit log files to have a mode of "0600" or less permissive. First determine where the audit logs are stored with the following command: # sudo grep -iw log_file /etc/audit/auditd.conf log_file = /var/log/audit/audit.log Using the path of the directory containing the audit logs, configure the audit log files to have a mode of "0600" or less permissive by using the following command: # sudo chmod 0600 /var/log/audit/*
- RMF Control
- AU-9
- Severity
- M
- CCI
- CCI-000162
- Version
- UBTU-18-010306
- Vuln IDs
-
- V-219229
- V-100685
- Rule IDs
-
- SV-219229r508662_rule
- SV-109789
Checks: C-20954r305015_chk
Verify that the audit log files are owned by "root" account. First determine where the audit logs are stored with the following command: # sudo grep -iw log_file /etc/audit/auditd.conf log_file = /var/log/audit/audit.log Using the path of the directory containing the audit logs, check if the audit log files are owned by the "root" user by using the following command: # sudo stat -c "%n %U" /var/log/audit/* /var/log/audit/audit.log root If the audit log files are owned by an user other than "root", this is a finding.
Fix: F-20953r305016_fix
Configure the audit log files to be owned by "root" user. First determine where the audit logs are stored with the following command: # sudo grep -iw log_file /etc/audit/auditd.conf log_file = /var/log/audit/audit.log Using the path of the directory containing the audit logs, configure the audit log files to be owned by "root" user by using the following command: # sudo chown root /var/log/audit/*
- RMF Control
- AU-9
- Severity
- M
- CCI
- CCI-000162
- Version
- UBTU-18-010307
- Vuln IDs
-
- V-219230
- V-100687
- Rule IDs
-
- SV-219230r508662_rule
- SV-109791
Checks: C-20955r305018_chk
Verify that the audit log files are owned by "root" group. First determine where the audit logs are stored with the following command: # sudo grep -iw log_file /etc/audit/auditd.conf log_file = /var/log/audit/audit.log Using the path of the directory containing the audit logs, check if the audit log files are owned by the "root" group by using the following command: # sudo stat -c "%n %G" /var/log/audit/* /var/log/audit/audit.log root If the audit log files are owned by a group other than "root", this is a finding.
Fix: F-20954r305019_fix
Configure the audit log files to be owned by "root" group. First determine where the audit logs are stored with the following command: # sudo grep -iw log_file /etc/audit/auditd.conf log_file = /var/log/audit/audit.log Using the path of the directory containing the audit logs, configure the audit log files to be owned by "root" group by using the following command: # sudo chown :root /var/log/audit/*
- RMF Control
- AU-9
- Severity
- M
- CCI
- CCI-000164
- Version
- UBTU-18-010308
- Vuln IDs
-
- V-219231
- V-100689
- Rule IDs
-
- SV-219231r508662_rule
- SV-109793
Checks: C-20956r305021_chk
Verify that the audit log directory has a mode of "0750" or less permissive. First determine where the audit logs are stored with the following command: # sudo grep -iw log_file /etc/audit/auditd.conf log_file = /var/log/audit/audit.log Using the path of the directory containing the audit logs, check if the directory has a mode of "0750" or less by using the following command: # sudo stat -c "%n %a" /var/log/audit /var/log/audit 750 If the audit log directory has a mode more permissive than "0750", this is a finding.
Fix: F-20955r305022_fix
Configure the audit log directory to have a mode of "0750" or less permissive. First determine where the audit logs are stored with the following command: # sudo grep -iw log_file /etc/audit/auditd.conf log_file = /var/log/audit/audit.log Using the path of the directory containing the audit logs, configure the audit log directory to have a mode of "0750" or less permissive by using the following command: # chmod -R g-w,o-rwx /var/log/audit
- RMF Control
- AU-9
- Severity
- M
- CCI
- CCI-000164
- Version
- UBTU-18-010309
- Vuln IDs
-
- V-219232
- V-100691
- Rule IDs
-
- SV-219232r508662_rule
- SV-109795
Checks: C-20957r305024_chk
Verify that the audit log directory is owned by "root" account. First determine where the audit logs are stored with the following command: # sudo grep -iw log_file /etc/audit/auditd.conf log_file = /var/log/audit/audit.log Using the path of the directory containing the audit logs, check if the directory is owned by the "root" user by using the following command: # sudo stat -c "%n %U" /var/log/audit /var/log/audit root If the audit log directory is owned by an user other than "root", this is a finding.
Fix: F-20956r305025_fix
Configure the audit log directory to be owned by "root" user. First determine where the audit logs are stored with the following command: # sudo grep -iw log_file /etc/audit/auditd.conf log_file = /var/log/audit/audit.log Using the path of the directory containing the audit logs, configure the audit log directory to be owned by "root" user by using the following command: # chown -R root /var/log/audit
- RMF Control
- AU-9
- Severity
- M
- CCI
- CCI-000164
- Version
- UBTU-18-010310
- Vuln IDs
-
- V-219233
- V-100693
- Rule IDs
-
- SV-219233r508662_rule
- SV-109797
Checks: C-20958r305027_chk
Verify that the audit log directory is owned by "root" group. First determine where the audit logs are stored with the following command: # sudo grep -iw log_file /etc/audit/auditd.conf log_file = /var/log/audit/audit.log Using the path of the directory containing the audit logs, check if the directory is owned by the "root" group by using the following command: # sudo stat -c "%n %G" /var/log/audit /var/log/audit root If the audit log directory is owned by a group other than "root", this is a finding.
Fix: F-20957r305028_fix
Configure the audit log directory to be owned by "root" group. First determine where the audit logs are stored with the following command: # sudo grep -iw log_file /etc/audit/auditd.conf log_file = /var/log/audit/audit.log Using the path of the directory containing the audit logs, configure the audit log directory to be owned by "root" group by using the following command: # chown -R :root /var/log/audit
- RMF Control
- AU-12
- Severity
- M
- CCI
- CCI-000171
- Version
- UBTU-18-010311
- Vuln IDs
-
- V-219234
- V-100695
- Rule IDs
-
- SV-219234r508662_rule
- SV-109799
Checks: C-20959r305030_chk
Verify that "/etc/audit/audit.rules", "/etc/audit/rules.d/*" and "/etc/audit/auditd.conf" files have a mode of 0640 or less permissive by using the following command: # sudo ls -al /etc/audit/ /etc/audit/rules.d/ /etc/audit/: drwxr-x--- 3 root root 4096 Nov 25 11:02 . drwxr-xr-x 130 root root 12288 Dec 19 13:42 .. -rw-r----- 1 root root 804 Nov 25 11:01 auditd.conf -rw-r----- 1 root root 9128 Dec 27 09:56 audit.rules -rw-r----- 1 root root 9373 Dec 27 09:56 audit.rules.prev -rw-r----- 1 root root 127 Feb 7 2018 audit-stop.rules drwxr-x--- 2 root root 4096 Dec 27 09:56 rules.d /etc/audit/rules.d/: drwxr-x--- 2 root root 4096 Dec 27 09:56 . drwxr-x--- 3 root root 4096 Nov 25 11:02 .. -rw-r----- 1 root root 10357 Dec 27 09:56 stig.rules If "/etc/audit/audit.rule","/etc/audit/rules.d/*" or "/etc/audit/auditd.conf" file have a mode more permissive than "0640", this is a finding.
Fix: F-20958r305031_fix
Configure "/etc/audit/audit.rules", "/etc/audit/rules.d/*" and "/etc/audit/auditd.conf" files to have a mode of 0640 by using the following command: # chmod -R 0640 /etc/audit/audit*.{rules,conf} /etc/audit/rules.d/* Note: The "root" account must be used to edit any files in the /etc/audit and /etc/audit/rules.d/ directories.
- RMF Control
- AU-12
- Severity
- M
- CCI
- CCI-000171
- Version
- UBTU-18-010312
- Vuln IDs
-
- V-219235
- V-100697
- Rule IDs
-
- SV-219235r508662_rule
- SV-109801
Checks: C-20960r305033_chk
Verify that "/etc/audit/audit.rules", "/etc/audit/rules.d/*" and "/etc/audit/auditd.conf" files are owned by root account by using the following command: # sudo ls -al /etc/audit/ /etc/audit/rules.d/ /etc/audit/: drwxr-x--- 3 root root 4096 Nov 25 11:02 . drwxr-xr-x 130 root root 12288 Dec 19 13:42 .. -rw-r----- 1 root root 804 Nov 25 11:01 auditd.conf -rw-r----- 1 root root 9128 Dec 27 09:56 audit.rules -rw-r----- 1 root root 9373 Dec 27 09:56 audit.rules.prev -rw-r----- 1 root root 127 Feb 7 2018 audit-stop.rules drwxr-x--- 2 root root 4096 Dec 27 09:56 rules.d /etc/audit/rules.d/: drwxr-x--- 2 root root 4096 Dec 27 09:56 . drwxr-x--- 3 root root 4096 Nov 25 11:02 .. -rw-r----- 1 root root 10357 Dec 27 09:56 stig.rules If "/etc/audit/audit.rules" or "/etc/audit/rules.d/*" or "/etc/audit/auditd.conf" file is owned by a user other than "root", this is a finding.
Fix: F-20959r305034_fix
Configure "/etc/audit/audit.rules", "/etc/audit/rules.d/*" and "/etc/audit/auditd.conf" files to be owned by root user by using the following command: # chown root /etc/audit/audit*.{rules,conf} /etc/audit/rules.d/* Note: The "root" account must be used to edit any files in the /etc/audit and /etc/audit/rules.d/ directories.
- RMF Control
- AU-12
- Severity
- M
- CCI
- CCI-000171
- Version
- UBTU-18-010313
- Vuln IDs
-
- V-219236
- V-100699
- Rule IDs
-
- SV-219236r508662_rule
- SV-109803
Checks: C-20961r305036_chk
Verify that "/etc/audit/audit.rules", "/etc/audit/rules.d/*" and "/etc/audit/auditd.conf" files are owned by root group by using the following command: # sudo ls -al /etc/audit/ /etc/audit/rules.d/ /etc/audit/: drwxr-x--- 3 root root 4096 Nov 25 11:02 . drwxr-xr-x 130 root root 12288 Dec 19 13:42 .. -rw-r----- 1 root root 804 Nov 25 11:01 auditd.conf -rw-r----- 1 root root 9128 Dec 27 09:56 audit.rules -rw-r----- 1 root root 9373 Dec 27 09:56 audit.rules.prev -rw-r----- 1 root root 127 Feb 7 2018 audit-stop.rules drwxr-x--- 2 root root 4096 Dec 27 09:56 rules.d /etc/audit/rules.d/: drwxr-x--- 2 root root 4096 Dec 27 09:56 . drwxr-x--- 3 root root 4096 Nov 25 11:02 .. -rw-r----- 1 root root 10357 Dec 27 09:56 stig.rules If "/etc/audit/audit.rules" or "/etc/audit/rules.d/*" or "/etc/audit/auditd.conf" file is owned by a group other than "root", this is a finding.
Fix: F-20960r305037_fix
Configure "/etc/audit/audit.rules", "/etc/audit/rules.d/*" and "/etc/audit/auditd.conf" files to be owned by root group by using the following command: # chown :root /etc/audit/audit*.{rules,conf} /etc/audit/rules.d/* Note: The "root" account must be used to edit any files in the /etc/audit and /etc/audit/rules.d/ directories.
- RMF Control
- AU-4
- Severity
- L
- CCI
- CCI-001849
- Version
- UBTU-18-010314
- Vuln IDs
-
- V-219237
- V-100701
- Rule IDs
-
- SV-219237r508662_rule
- SV-109805
Checks: C-20962r305039_chk
Verify the Ubuntu operating system allocates audit record storage capacity to store at least one week's worth of audit records when audit records are not immediately sent to a central audit record storage facility. Determine which partition the audit records are being written to with the following command: # sudo grep log_file /etc/audit/auditd.conf log_file = /var/log/audit/audit.log Check the size of the partition that audit records are written to (with the example being /var/log/audit/) with the following command: # df –h /var/log/audit/ /dev/sda2 24G 10.4G 13.6G 43% /var/log/audit If the audit records are not written to a partition made specifically for audit records (/var/log/audit is a separate partition), determine the amount of space being used by other files in the partition with the following command: #du –sh [audit_partition] 1.8G /var/log/audit Note: The partition size needed to capture a week's worth of audit records is based on the activity level of the system and the total storage capacity available. In normal circumstances, 10.0 GB of storage space for audit records will be sufficient. If the audit record partition is not allocated for sufficient storage capacity, this is a finding.
Fix: F-20961r305040_fix
Allocate enough storage capacity for at least one week's worth of audit records when audit records are not immediately sent to a central audit record storage facility. If audit records are stored on a partition made specifically for audit records, use the "parted" program to resize the partition with sufficient space to contain one week's worth of audit records. If audit records are not stored on a partition made specifically for audit records, a new partition with sufficient amount of space will need be to be created. Set the auditd server to point to the mount point where the audit records must be located: # sudo sed -i -E 's@^(log_file\s*=\s*).*@\1 <log mountpoint>/audit.log@' /etc/audit/auditd.conf where <log mountpoint> is the aforementioned mount point.
- RMF Control
- AU-12
- Severity
- M
- CCI
- CCI-000172
- Version
- UBTU-18-010315
- Vuln IDs
-
- V-219238
- V-100703
- Rule IDs
-
- SV-219238r508662_rule
- SV-109807
Checks: C-20963r485693_chk
Verify if the Ubuntu operating system generates audit records when successful/unsuccessful attempts to use the "su" command occur. Check the configured audit rules with the following commands: # sudo auditctl -l | grep '/bin/su' -a always,exit -F path=/bin/su -F perm=x -F auid>=1000 -F auid!=-1 -k privileged-priv_change If the command does not return lines that match the example or the lines are commented out, this is a finding. Note: The '-k' allows for specifying an arbitrary identifier and the string after it does not need to match the example output above.
Fix: F-20962r485694_fix
Configure the Ubuntu operating system to generate audit records when successful/unsuccessful attempts to use the "su" command occur. Add or update the following rules in the "/etc/audit/rules.d/stig.rules" file: -a always,exit -F path=/bin/su -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged-priv_change In order to reload the rules file, issue the following command: # sudo augenrules --load Note: The "root" account must be used to view/edit any files in the /etc/audit/rules.d/ directory.
- RMF Control
- AU-12
- Severity
- M
- CCI
- CCI-000172
- Version
- UBTU-18-010316
- Vuln IDs
-
- V-219239
- V-100705
- Rule IDs
-
- SV-219239r508662_rule
- SV-109809
Checks: C-20964r305045_chk
Verify if the Ubuntu operating system generates audit records when successful/unsuccessful attempts to use of the "chfn" command occur. Check the configured audit rules with the following commands: # sudo auditctl -l | grep '/usr/bin/chfn' -a always,exit -F path=/usr/bin/chfn -F perm=x -F auid>=1000 -F auid!=-1 -k privileged-chfn If the command does not return lines that match the example or the lines are commented out, this is a finding. Note: The '-k' allows for specifying an arbitrary identifier and the string after it does not need to match the example output above.
Fix: F-20963r305046_fix
Configure the audit system to generate an audit event for any successful/unsuccessful uses of the "chfn" command. Add or update the following rules in the "/etc/audit/rules.d/stig.rules" file: -a always,exit -F path=/usr/bin/chfn -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged-chfn In order to reload the rules file, issue the following command: # sudo augenrules --load Note: The "root" account must be used to view/edit any files in the /etc/audit/rules.d/ directory.
- RMF Control
- AU-12
- Severity
- M
- CCI
- CCI-000172
- Version
- UBTU-18-010317
- Vuln IDs
-
- V-219240
- V-100707
- Rule IDs
-
- SV-219240r508662_rule
- SV-109811
Checks: C-20965r305048_chk
Verify if the Ubuntu operating system generates audit records when successful/unsuccessful attempts to use of the "mount" command occur. Check the configured audit rules with the following commands: # sudo auditctl -l | grep '/bin/mount' -a always,exit -F path=/bin/mount -F perm=x -F auid>=1000 -F auid!=-1 -k privileged-mount If the command does not return lines that match the example or the lines are commented out, this is a finding. Note: The '-k' allows for specifying an arbitrary identifier and the string after it does not need to match the example output above.
Fix: F-20964r305049_fix
Configure the audit system to generate an audit event for any successful/unsuccessful use of the "mount" command. Add or update the following rules in the "/etc/audit/rules.d/stig.rules" file: -a always,exit -F path=/bin/mount -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged-mount In order to reload the rules file, issue the following command: # sudo augenrules --load Note: The "root" account must be used to view/edit any files in the /etc/audit/rules.d/ directory.
- RMF Control
- AU-12
- Severity
- M
- CCI
- CCI-000172
- Version
- UBTU-18-010318
- Vuln IDs
-
- V-219241
- V-100709
- Rule IDs
-
- SV-219241r508662_rule
- SV-109813
Checks: C-20966r305051_chk
Verify if the Ubuntu operating system generates audit records when successful/unsuccessful attempts to use of the "umount" command occur. Check the configured audit rules with the following commands: # sudo auditctl -l | grep '/bin/umount' -a always,exit -F path=/bin/umount -F perm=x -F auid>=1000 -F auid!=-1 -k privileged-umount If the command does not return lines that match the example or the lines are commented out, this is a finding. Note: The '-k' allows for specifying an arbitrary identifier and the string after it does not need to match the example output above.
Fix: F-20965r305052_fix
Configure the audit system to generate an audit event for any successful/unsuccessful use of the "umount" command. Add or update the following rules in the "/etc/audit/rules.d/stig.rules" file: -a always,exit -F path=/bin/umount -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged-umount In order to reload the rules file, issue the following command: # sudo augenrules --load Note: The "root" account must be used to view/edit any files in the /etc/audit/rules.d/ directory.
- RMF Control
- AU-12
- Severity
- M
- CCI
- CCI-000172
- Version
- UBTU-18-010319
- Vuln IDs
-
- V-219242
- V-100711
- Rule IDs
-
- SV-219242r508662_rule
- SV-109815
Checks: C-20967r305054_chk
Verify the Ubuntu operating system generates an audit record when successful/unsuccessful attempts to use the "ssh-agent" command occur. Check the configured audit rules with the following commands: # sudo auditctl -l | grep '/usr/bin/ssh-agent' -a always,exit -F path=/usr/bin/ssh-agent -F perm=x -F auid>=1000 -F auid!=-1 -k privileged-ssh If the command does not return lines that match the example or the lines are commented out, this is a finding. Note: The '-k' allows for specifying an arbitrary identifier and the string after it does not need to match the example output above.
Fix: F-20966r305055_fix
Configure the audit system to generate an audit event for any successful/unsuccessful use of the "ssh-agent" command. Add or update the following rules in the "/etc/audit/rules.d/stig.rules" file: -a always,exit -F path=/usr/bin/ssh-agent -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged-ssh In order to reload the rules file, issue the following command: # sudo augenrules --load Note: The "root" account must be used to view/edit any files in the /etc/audit/rules.d/ directory.
- RMF Control
- AU-12
- Severity
- M
- CCI
- CCI-000172
- Version
- UBTU-18-010320
- Vuln IDs
-
- V-219243
- V-100713
- Rule IDs
-
- SV-219243r508662_rule
- SV-109817
Checks: C-20968r305057_chk
Verify the Ubuntu operating system generates an audit record when successful/unsuccessful attempts to use the "ssh-keysign" command occur. Check the configured audit rules with the following commands: #sudo auditctl -l | grep ssh-keysign -a always,exit -F path=/usr/lib/openssh/ssh-keysign -F perm=x -F auid>=1000 -F auid!=-1 -k privileged-ssh If the command does not return lines that match the example or the lines are commented out, this is a finding. Note: The '-k' allows for specifying an arbitrary identifier and the string after it does not need to match the example output above.
Fix: F-20967r305058_fix
Configure the audit system to generate an audit event for any successful/unsuccessful use of the "ssh-keysign" command. Add or update the following rules in the "/etc/audit/rules.d/stig.rules" file: -a always,exit -F path=/usr/lib/openssh/ssh-keysign -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged-ssh In order to reload the rules file, issue the following command: # sudo augenrules --load Note: The "root" account must be used to view/edit any files in the /etc/audit/rules.d/ directory.
- RMF Control
- AU-12
- Severity
- M
- CCI
- CCI-000172
- Version
- UBTU-18-010321
- Vuln IDs
-
- V-219244
- V-100715
- Rule IDs
-
- SV-219244r508662_rule
- SV-109819
Checks: C-20969r305060_chk
Verify the Ubuntu operating system generates an audit record when successful/unsuccessful attempts to use the "setxattr" system call. Check the currently configured audit rules with the following command: # sudo auditctl -l | grep setxattr -a always,exit -F arch=b32 -S setxattr -F auid>=1000 -F auid!=-1 -k perm_mod -a always,exit -F arch=b32 -S setxattr -F auid=0 -k perm_mod -a always,exit -F arch=b64 -S setxattr -F auid>=1000 -F auid!=-1 -k perm_mod -a always,exit -F arch=b64 -S setxattr -F auid=0 -k perm_mod If the command does not return lines that match the example or the lines are commented out, this is a finding. Notes: For 32-bit architectures, only the 32-bit specific output lines from the commands are required. The '-k' allows for specifying an arbitrary identifier and the string after it does not need to match the example output above.
Fix: F-20968r305061_fix
Configure the audit system to generate an audit event for any successful/unsuccessful use of the "setxattr" system call. Add or update the following rules in the "/etc/audit/rules.d/stig.rules" file: -a always,exit -F arch=b32 -S setxattr -F auid>=1000 -F auid!=4294967295 -k perm_mod -a always,exit -F arch=b32 -S setxattr -F auid=0 -k perm_mod -a always,exit -F arch=b64 -S setxattr -F auid>=1000 -F auid!=4294967295 -k perm_mod -a always,exit -F arch=b64 -S setxattr -F auid=0 -k perm_mod Notes: For 32-bit architectures, only the 32-bit specific entries are required. The "root" account must be used to view/edit any files in the /etc/audit/rules.d/ directory. In order to reload the rules file, issue the following command: # sudo augenrules --load
- RMF Control
- AU-12
- Severity
- M
- CCI
- CCI-000172
- Version
- UBTU-18-010322
- Vuln IDs
-
- V-219245
- V-100717
- Rule IDs
-
- SV-219245r508662_rule
- SV-109821
Checks: C-20970r305063_chk
Verify the Ubuntu operating system generates an audit record when successful/unsuccessful attempts to use the "lsetxattr" system call. Check the currently configured audit rules with the following command: # sudo auditctl -l | grep lsetxattr -a always,exit -F arch=b32 -S lsetxattr -F auid>=1000 -F auid!=-1 -k perm_mod -a always,exit -F arch=b32 -S lsetxattr -F auid=0 -k perm_mod -a always,exit -F arch=b64 -S lsetxattr -F auid>=1000 -F auid!=-1 -k perm_mod -a always,exit -F arch=b64 -S lsetxattr -F auid=0 -k perm_mod If the command does not return lines that match the example or the lines are commented out, this is a finding. Notes: For 32-bit architectures, only the 32-bit specific output lines from the commands are required. The '-k' allows for specifying an arbitrary identifier and the string after it does not need to match the example output above.
Fix: F-20969r305064_fix
Configure the audit system to generate an audit event for any successful/unsuccessful use of the "lsetxattr" system call. Add or update the following rules in the "/etc/audit/rules.d/stig.rules" file: -a always,exit -F arch=b32 -S lsetxattr -F auid>=1000 -F auid!=4294967295 -k perm_mod -a always,exit -F arch=b32 -S lsetxattr -F auid=0 -k perm_mod -a always,exit -F arch=b64 -S lsetxattr -F auid>=1000 -F auid!=4294967295 -k perm_mod -a always,exit -F arch=b64 -S lsetxattr -F auid=0 -k perm_mod Notes: For 32-bit architectures, only the 32-bit specific entries are required. The "root" account must be used to view/edit any files in the /etc/audit/rules.d/ directory. In order to reload the rules file, issue the following command: # sudo augenrules --load
- RMF Control
- AU-12
- Severity
- M
- CCI
- CCI-000172
- Version
- UBTU-18-010323
- Vuln IDs
-
- V-219246
- V-100719
- Rule IDs
-
- SV-219246r508662_rule
- SV-109823
Checks: C-20971r305066_chk
Verify the Ubuntu operating system generates an audit record when successful/unsuccessful attempts to use the "fsetxattr" system call. Check the currently configured audit rules with the following command: # sudo auditctl -l | grep fsetxattr -a always,exit -F arch=b32 -S fsetxattr -F auid>=1000 -F auid!=-1 -k perm_mod -a always,exit -F arch=b32 -S fsetxattr -F auid=0 -k perm_mod -a always,exit -F arch=b64 -S fsetxattr -F auid>=1000 -F auid!=-1 -k perm_mod -a always,exit -F arch=b64 -S fsetxattr -F auid=0 -k perm_mod If the command does not return lines that match the example or the lines are commented out, this is a finding. Notes: For 32-bit architectures, only the 32-bit specific output lines from the commands are required. The '-k' allows for specifying an arbitrary identifier and the string after it does not need to match the example output above.
Fix: F-20970r305067_fix
Configure the audit system to generate an audit event for any successful/unsuccessful use of the "fsetxattr" system call. Add or update the following rules in the "/etc/audit/rules.d/stig.rules" file: -a always,exit -F arch=b32 -S fsetxattr -F auid>=1000 -F auid!=4294967295 -k perm_mod -a always,exit -F arch=b32 -S fsetxattr -F auid=0 -k perm_mod -a always,exit -F arch=b64 -S fsetxattr -F auid>=1000 -F auid!=4294967295 -k perm_mod -a always,exit -F arch=b64 -S fsetxattr -F auid=0 -k perm_mod Notes: For 32-bit architectures, only the 32-bit specific entries are required. The "root" account must be used to view/edit any files in the /etc/audit/rules.d/ directory. In order to reload the rules file, issue the following command: # sudo augenrules --load
- RMF Control
- AU-12
- Severity
- M
- CCI
- CCI-000172
- Version
- UBTU-18-010324
- Vuln IDs
-
- V-219247
- V-100915
- Rule IDs
-
- SV-219247r508662_rule
- SV-110019
Checks: C-20972r305069_chk
Verify the Ubuntu operating system generates an audit record when successful/unsuccessful attempts to use the "removexattr" system call. Check the currently configured audit rules with the following command: # sudo auditctl -l | grep perm_mod -a always,exit -F arch=b32 -S removexattr -F auid>=1000 -F auid!=-1 -k perm_mod -a always,exit -F arch=b32 -S removexattr -F auid=0 -k perm_mod -a always,exit -F arch=b64 -S removexattr -F auid>=1000 -F auid!=-1 -k perm_mod -a always,exit -F arch=b64 -S removexattr -F auid=0 -k perm_mod If the command does not return lines that match the example or the lines are commented out, this is a finding. Notes: For 32-bit architectures, only the 32-bit specific output lines from the commands are required. The '-k' allows for specifying an arbitrary identifier and the string after it does not need to match the example output above.
Fix: F-20971r305070_fix
Configure the audit system to generate an audit event for any successful/unsuccessful use of the "removexattr" system call. Add or update the following rules in the "/etc/audit/rules.d/stig.rules" file: -a always,exit -F arch=b32 -S removexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod -a always,exit -F arch=b32 -S removexattr -F auid=0 -k perm_mod -a always,exit -F arch=b64 -S removexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod -a always,exit -F arch=b64 -S removexattr -F auid=0 -k perm_mod Notes: For 32-bit architectures, only the 32-bit specific entries are required. The "root" account must be used to view/edit any files in the /etc/audit/rules.d/ directory. In order to reload the rules file, issue the following command: # sudo augenrules --load
- RMF Control
- AU-12
- Severity
- M
- CCI
- CCI-000172
- Version
- UBTU-18-010325
- Vuln IDs
-
- V-219248
- V-100721
- Rule IDs
-
- SV-219248r508662_rule
- SV-109825
Checks: C-20973r305072_chk
Verify if the Ubuntu operating system is configured to audit the execution of the "lremovexattr" system call. Check the currently configured audit rules with the following command: # sudo auditctl -l | lremovexattr -a always,exit -F arch=b32 -S lremovexattr -F auid>=1000 -F auid!=-1 -k perm_mod -a always,exit -F arch=b32 -S lremovexattr -F auid=0 -k perm_mod -a always,exit -F arch=b64 -S lremovexattr -F auid>=1000 -F auid!=-1 -k perm_mod -a always,exit -F arch=b64 -S lremovexattr -F auid=0 -k perm_mod If the command does not return lines that match the example or the lines are commented out, this is a finding. Notes: For 32-bit architectures, only the 32-bit specific output lines from the commands are required. The '-k' allows for specifying an arbitrary identifier and the string after it does not need to match the example output above.
Fix: F-20972r305073_fix
Configure the audit system to generate an audit event for any successful/unsuccessful use of the "lremovexattr" system call. Add or update the following rules in the "/etc/audit/rules.d/stig.rules" file: -a always,exit -F arch=b32 -S lremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod -a always,exit -F arch=b32 -S lremovexattr -F auid=0 -k perm_mod -a always,exit -F arch=b64 -S lremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod -a always,exit -F arch=b64 -S lremovexattr -F auid=0 -k perm_mod Notes: For 32-bit architectures, only the 32-bit specific entries are required. The "root" account must be used to view/edit any files in the /etc/audit/rules.d/ directory. In order to reload the rules file, issue the following command: # sudo augenrules --load
- RMF Control
- AU-12
- Severity
- M
- CCI
- CCI-000172
- Version
- UBTU-18-010326
- Vuln IDs
-
- V-219249
- V-100723
- Rule IDs
-
- SV-219249r508662_rule
- SV-109827
Checks: C-20974r305075_chk
Verify the Ubuntu operating system generates an audit record when successful/unsuccessful attempts to use the "fremovexattr" system call. Check the currently configured audit rules with the following command: # sudo auditctl -l | grep fremovexattr -a always,exit -F arch=b32 -S fremovexattr -F auid>=1000 -F auid!=-1 -k perm_mod -a always,exit -F arch=b32 -S fremovexattr -F auid=0 -k perm_mod -a always,exit -F arch=b64 -S fremovexattr -F auid>=1000 -F auid!=-1 -k perm_mod -a always,exit -F arch=b64 -S fremovexattr -F auid=0 -k perm_mod If the command does not return lines that match the example or the lines are commented out, this is a finding. Notes: For 32-bit architectures, only the 32-bit specific output lines from the commands are required. The '-k' allows for specifying an arbitrary identifier and the string after it does not need to match the example output above.
Fix: F-20973r305076_fix
Configure the audit system to generate an audit event for any successful/unsuccessful use of the "fremovexattr" command. Add or update the following rules in the "/etc/audit/rules.d/stig.rules" file: -a always,exit -F arch=b32 -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod -a always,exit -F arch=b32 -S fremovexattr -F auid=0 -k perm_mod -a always,exit -F arch=b64 -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod -a always,exit -F arch=b64 -S fremovexattr -F auid=0 -k perm_mod Notes: For 32-bit architectures, only the 32-bit specific entries are required. The "root" account must be used to view/edit any files in the /etc/audit/rules.d/ directory. In order to reload the rules file, issue the following command: # sudo augenrules --load
- RMF Control
- AU-12
- Severity
- M
- CCI
- CCI-000172
- Version
- UBTU-18-010327
- Vuln IDs
-
- V-219250
- V-100725
- Rule IDs
-
- SV-219250r508662_rule
- SV-109829
Checks: C-20975r305078_chk
Verify the Ubuntu operating system generates an audit record when successful/unsuccessful attempts to use the "chown" system call. Check the configured audit rules with the following commands: # sudo auditctl -l | grep chown -a always,exit -F arch=b32 -S chown -F auid>=1000 -F auid!=-1 -k perm_chng -a always,exit -F arch=b64 -S chown -F auid>=1000 -F auid!=-1 -k perm_chng If the command does not return lines that match the example or the lines are commented out, this is a finding. Notes: For 32-bit architectures, only the 32-bit specific output lines from the commands are required. The '-k' allows for specifying an arbitrary identifier and the string after it does not need to match the example output above.
Fix: F-20974r305079_fix
Configure the audit system to generate an audit event for any successful/unsuccessful use of the "chown" system call. Add or update the following rules in the "/etc/audit/rules.d/stig.rules": -a always,exit -F arch=b32 -S chown -F auid>=1000 -F auid!=4294967295 -k perm_chng -a always,exit -F arch=b64 -S chown -F auid>=1000 -F auid!=4294967295 -k perm_chng Notes: For 32-bit architectures, only the 32-bit specific entries are required. The "root" account must be used to view/edit any files in the /etc/audit/rules.d/ directory. In order to reload the rules file, issue the following command: # sudo augenrules --load
- RMF Control
- AU-12
- Severity
- M
- CCI
- CCI-000172
- Version
- UBTU-18-010328
- Vuln IDs
-
- V-219251
- V-100727
- Rule IDs
-
- SV-219251r508662_rule
- SV-109831
Checks: C-20976r485696_chk
Verify the Ubuntu operating system generates an audit record when successful/unsuccessful attempts to use the "fchown" system call. Check the configured audit rules with the following commands: # sudo auditctl -l | grep fchown -a always,exit -F arch=b32 -S fchown -F auid>=1000 -F auid!=-1 -k perm_chng -a always,exit -F arch=b64 -S fchown -F auid>=1000 -F auid!=-1 -k perm_chng If the command does not return lines that match the example or the lines are commented out, this is a finding. Notes: For 32-bit architectures, only the 32-bit specific output lines from the commands are required. The '-k' allows for specifying an arbitrary identifier and the string after it does not need to match the example output above.
Fix: F-20975r485697_fix
Configure the audit system to generate an audit event for any successful/unsuccessful use of the "fchown" system call. Add or update the following rules in the "/etc/audit/rules.d/stig.rules": -a always,exit -F arch=b32 -S fchown -F auid>=1000 -F auid!=4294967295 -k perm_chng -a always,exit -F arch=b64 -S fchown -F auid>=1000 -F auid!=4294967295 -k perm_chng Notes: For 32-bit architectures, only the 32-bit specific entries are required. The "root" account must be used to view/edit any files in the /etc/audit/rules.d/ directory. In order to reload the rules file, issue the following command: # sudo augenrules --load
- RMF Control
- AU-12
- Severity
- M
- CCI
- CCI-000172
- Version
- UBTU-18-010329
- Vuln IDs
-
- V-219252
- V-100729
- Rule IDs
-
- SV-219252r508662_rule
- SV-109833
Checks: C-20977r305084_chk
Verify the Ubuntu operating system generates an audit record when successful/unsuccessful attempts to use the "fchownat" system call. Check the configured audit rules with the following commands: # sudo auditctl -l | grep fchownat -a always,exit -F arch=b32 -S fchownat -F auid>=1000 -F auid!=-1 -k perm_chng -a always,exit -F arch=b64 -S fchownat -F auid>=1000 -F auid!=-1 -k perm_chng If the command does not return lines that match the example or the lines are commented out, this is a finding. Notes: For 32-bit architectures, only the 32-bit specific output lines from the commands are required. The '-k' allows for specifying an arbitrary identifier and the string after it does not need to match the example output above.
Fix: F-20976r305085_fix
Configure the audit system to generate an audit event for any successful/unsuccessful use of the "fchownat" system call. Add or update the following rules in the "/etc/audit/rules.d/stig.rules": -a always,exit -F arch=b32 -S fchownat -F auid>=1000 -F auid!=4294967295 -k perm_chng -a always,exit -F arch=b64 -S fchownat -F auid>=1000 -F auid!=4294967295 -k perm_chng Notes: For 32-bit architectures, only the 32-bit specific entries are required. The "root" account must be used to view/edit any files in the /etc/audit/rules.d/ directory. In order to reload the rules file, issue the following command: # sudo augenrules --load
- RMF Control
- AU-12
- Severity
- M
- CCI
- CCI-000172
- Version
- UBTU-18-010330
- Vuln IDs
-
- V-219253
- V-100731
- Rule IDs
-
- SV-219253r508662_rule
- SV-109835
Checks: C-20978r305087_chk
Verify the Ubuntu operating system generates an audit record when successful/unsuccessful attempts to use the "lchown" system call. Check the configured audit rules with the following commands: # sudo auditctl -l | grep lchown -a always,exit -F arch=b32 -S lchown -F auid>=1000 -F auid!=-1 -k perm_chng -a always,exit -F arch=b64 -S lchown -F auid>=1000 -F auid!=-1 -k perm_chng If the command does not return lines that match the example or the lines are commented out, this is a finding. Notes: For 32-bit architectures, only the 32-bit specific output lines from the commands are required. The '-k' allows for specifying an arbitrary identifier and the string after it does not need to match the example output above.
Fix: F-20977r305088_fix
Configure the audit system to generate an audit event for any successful/unsuccessful use of the "lchown" system call. Add or update the following rules in the "/etc/audit/rules.d/stig.rules": -a always,exit -F arch=b32 -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_chng -a always,exit -F arch=b64 -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_chng Notes: For 32-bit architectures, only the 32-bit specific entries are required. The "root" account must be used to view/edit any files in the /etc/audit/rules.d/ directory. In order to reload the rules file, issue the following command: # sudo augenrules --load
- RMF Control
- AU-12
- Severity
- M
- CCI
- CCI-000172
- Version
- UBTU-18-010331
- Vuln IDs
-
- V-219254
- V-100733
- Rule IDs
-
- SV-219254r508662_rule
- SV-109837
Checks: C-20979r305090_chk
Verify the Ubuntu operating system generates an audit record when successful/unsuccessful attempts to use the "chmod" system call. Check the configured audit rules with the following commands: # sudo auditctl -l | grep chmod -a always,exit -F arch=b32 -S chmod -F auid>=1000 -F auid!=-1 -k perm_chng -a always,exit -F arch=b64 -S chmod -F auid>=1000 -F auid!=-1 -k perm_chng If the command does not return lines that match the example or the lines are commented out, this is a finding. Notes: For 32-bit architectures, only the 32-bit specific output lines from the commands are required. The '-k' allows for specifying an arbitrary identifier and the string after it does not need to match the example output above.
Fix: F-20978r305091_fix
Configure the audit system to generate an audit event for any successful/unsuccessful use of the "chmod" system call. Add or update the following rules in the "/etc/audit/rules.d/stig.rules": -a always,exit -F arch=b32 -S chmod -F auid>=1000 -F auid!=4294967295 -k perm_chng -a always,exit -F arch=b64 -S chmod -F auid>=1000 -F auid!=4294967295 -k perm_chng Notes: For 32-bit architectures, only the 32-bit specific entries are required. The "root" account must be used to view/edit any files in the /etc/audit/rules.d/ directory. In order to reload the rules file, issue the following command: # sudo augenrules --load
- RMF Control
- AU-12
- Severity
- M
- CCI
- CCI-000172
- Version
- UBTU-18-010332
- Vuln IDs
-
- V-219255
- V-100735
- Rule IDs
-
- SV-219255r508662_rule
- SV-109839
Checks: C-20980r305093_chk
Verify the Ubuntu operating system generates an audit record when successful/unsuccessful attempts to use the "fchmod" system call. Check the currently configured audit rules with the following command: # sudo auditctl -l | grep fchmod -a always,exit -F arch=b32 -S fchmod -F auid>=1000 -F auid!=-1 -k perm_chng -a always,exit -F arch=b64 -S fchmod -F auid>=1000 -F auid!=-1 -k perm_chng If the command does not return lines that match the example or the lines are commented out, this is a finding. Notes: For 32-bit architectures, only the 32-bit specific output lines from the commands are required. The '-k' allows for specifying an arbitrary identifier and the string after it does not need to match the example output above.
Fix: F-20979r305094_fix
Configure the audit system to generate an audit event for any successful/unsuccessful use of the "fchmod" system call. Add or update the following rules in the "/etc/audit/rules.d/stig.rules": -a always,exit -F arch=b32 -S fchmod -F auid>=1000 -F auid!=4294967295 -k perm_chng -a always,exit -F arch=b64 -S fchmod -F auid>=1000 -F auid!=4294967295 -k perm_chng Notes: For 32-bit architectures, only the 32-bit specific entries are required. The "root" account must be used to view/edit any files in the /etc/audit/rules.d/ directory. In order to reload the rules file, issue the following command: # sudo augenrules --load
- RMF Control
- AU-12
- Severity
- M
- CCI
- CCI-000172
- Version
- UBTU-18-010333
- Vuln IDs
-
- V-219256
- V-100737
- Rule IDs
-
- SV-219256r508662_rule
- SV-109841
Checks: C-20981r305096_chk
Verify the Ubuntu operating system generates an audit record when successful/unsuccessful attempts to use the "fchmodat" system call. Check the configured audit rules with the following commands: # sudo auditctl -l | grep fchmodat -a always,exit -F arch=b32 -S fchmodat -F auid>=1000 -F auid!=-1 -k perm_chng -a always,exit -F arch=b64 -S fchmodat -F auid>=1000 -F auid!=-1 -k perm_chng If the command does not return lines that match the example or the lines are commented out, this is a finding. Note: For 32-bit architectures, only the 32-bit specific output lines from the commands are required. The '-k' allows for specifying an arbitrary identifier and the string after it does not need to match the example output above.
Fix: F-20980r305097_fix
Configure the audit system to generate an audit event for any successful/unsuccessful use of the "fchmodat" system call. Add or update the following rules in the "/etc/audit/rules.d/stig.rules" file: -a always,exit -F arch=b32 -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_chng -a always,exit -F arch=b64 -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_chng Notes: For 32-bit architectures, only the 32-bit specific entries are required. The "root" account must be used to view/edit any files in the /etc/audit/rules.d/ directory. In order to reload the rules file, issue the following command: # sudo augenrules --load
- RMF Control
- AU-12
- Severity
- M
- CCI
- CCI-000172
- Version
- UBTU-18-010334
- Vuln IDs
-
- V-219257
- V-100739
- Rule IDs
-
- SV-219257r508662_rule
- SV-109843
Checks: C-20982r305099_chk
Verify the Ubuntu operating system generates an audit record when unsuccessful attempts to use the "open" system call occur. Check the configured audit rules with the following commands: # sudo auditctl -l | grep open -a always,exit -F arch=b32 -S open -F exit=-EPERM -F auid>=1000 -F auid!=-1 -k perm_access -a always,exit -F arch=b32 -S open -F exit=-EACCES -F auid>=1000 -F auid!=-1 -k perm_access -a always,exit -F arch=b64 -S open -F exit=-EPERM -F auid>=1000 -F auid!=-1 -k perm_access -a always,exit -F arch=b64 -S open -F exit=-EACCES -F auid>=1000 -F auid!=-1 -k perm_access If the command does not return lines that match the example or the lines are commented out, this is a finding. Notes: For 32-bit architectures, only the 32-bit specific output lines from the commands are required. The '-k' allows for specifying an arbitrary identifier and the string after it does not need to match the example output above.
Fix: F-20981r305100_fix
Configure the audit system to generate an audit event for any unsuccessful use of the "open" system call. Add or update the following rules in the "/etc/audit/rules.d/stig.rules" file: -a always,exit -F arch=b32 -S open -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k perm_access -a always,exit -F arch=b32 -S open -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k perm_access -a always,exit -F arch=b64 -S open -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k perm_access -a always,exit -F arch=b64 -S open -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k perm_access Notes: For 32-bit architectures, only the 32-bit specific entries are required. The "root" account must be used to view/edit any files in the /etc/audit/rules.d/ directory. In order to reload the rules file, issue the following command: # sudo augenrules --load
- RMF Control
- AU-12
- Severity
- M
- CCI
- CCI-000172
- Version
- UBTU-18-010338
- Vuln IDs
-
- V-219261
- V-100747
- Rule IDs
-
- SV-219261r508662_rule
- SV-109851
Checks: C-20986r305111_chk
Verify the Ubuntu operating system generates an audit record when unsuccessful attempts to use the "openat" system call. Check the configured audit rules with the following commands: # sudo auditctl -l | grep openat -a always,exit -F arch=b32 -S openat -F exit=-EPERM -F auid>=1000 -F auid!=-1 -k perm_access -a always,exit -F arch=b32 -S openat -F exit=-EACCES -F auid>=1000 -F auid!=-1 -k perm_access -a always,exit -F arch=b64 -S openat -F exit=-EPERM -F auid>=1000 -F auid!=-1 -k perm_access -a always,exit -F arch=b64 -S openat -F exit=-EACCES -F auid>=1000 -F auid!=-1 -k perm_access If the command does not return lines that match the example or the lines are commented out, this is a finding. Notes: For 32-bit architectures, only the 32-bit specific output lines from the commands are required. The '-k' allows for specifying an arbitrary identifier and the string after it does not need to match the example output above.
Fix: F-20985r305112_fix
Configure the audit system to generate an audit event for any unsuccessful use of the "openat" system call. Add or update the following rules in the "/etc/audit/rules.d/stig.rules" file: -a always,exit -F arch=b32 -S openat -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k perm_access -a always,exit -F arch=b32 -S openat -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k perm_access -a always,exit -F arch=b64 -S openat -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k perm_access -a always,exit -F arch=b64 -S openat -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k perm_access Notes: For 32-bit architectures, only the 32-bit specific entries are required. The "root" account must be used to view/edit any files in the /etc/audit/rules.d/ directory. In order to reload the rules file, issue the following command: # sudo augenrules --load
- RMF Control
- AU-12
- Severity
- M
- CCI
- CCI-000172
- Version
- UBTU-18-010339
- Vuln IDs
-
- V-219262
- V-100749
- Rule IDs
-
- SV-219262r508662_rule
- SV-109853
Checks: C-20987r305114_chk
Verify the Ubuntu operating system generates an audit record when unsuccessful attempts to use the "open_by_handle_at" system call. Check the configured audit rules with the following command: # sudo auditctl -l | grep open_by_handle_at -a always,exit -F arch=b32 -S open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=-1 -k perm_access -a always,exit -F arch=b32 -S open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=-1 -k perm_access -a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=-1 -k perm_access -a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=-1 -k perm_access If the command does not return lines that match the example or the lines are commented out, this is a finding. Notes: For 32-bit architectures, only the 32-bit specific output lines from the commands are required. The '-k' allows for specifying an arbitrary identifier and the string after it does not need to match the example output above.
Fix: F-20986r305115_fix
Configure the audit system to generate an audit event for any unsuccessful use of the "open_by_handle_at" system call. Add or update the following rules in the "/etc/audit/rules.d/stig.rules" file: -a always,exit -F arch=b32 -S open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k perm_access -a always,exit -F arch=b32 -S open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k perm_access -a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k perm_access -a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k perm_access Notes: For 32-bit architectures, only the 32-bit specific entries are required. The "root" account must be used to view/edit any files in the /etc/audit/rules.d/ directory. In order to reload the rules file, issue the following command: # sudo augenrules --load
- RMF Control
- AU-12
- Severity
- M
- CCI
- CCI-000172
- Version
- UBTU-18-010340
- Vuln IDs
-
- V-219263
- V-100751
- Rule IDs
-
- SV-219263r508662_rule
- SV-109855
Checks: C-20988r305117_chk
Verify that an audit event is generated for any successful/unsuccessful use of the "sudo" command. Check the configured audit rules with the following command: # sudo auditctl -l | grep /usr/bin/sudo -a always,exit -F path=/usr/bin/sudo -F perm=x -F auid>=1000 -F auid!=-1 -k priv_cmd If the command does not return a line that matches the example or the line is commented out, this is a finding. Note: The '-k' allows for specifying an arbitrary identifier and the string after it does not need to match the example output above.
Fix: F-20987r305118_fix
Configure the audit system to generate an audit event for any successful/unsuccessful use of the "sudo" command. Add or update the following rules in the "/etc/audit/rules.d/stig.rules" file: -a always,exit -F path=/usr/bin/sudo -F perm=x -F auid>=1000 -F auid!=4294967295 -k priv_cmd Note: The "root" account must be used to view/edit any files in the /etc/audit/rules.d/ directory. In order to reload the rules file, issue the following command: # sudo augenrules --load
- RMF Control
- AU-12
- Severity
- M
- CCI
- CCI-000172
- Version
- UBTU-18-010341
- Vuln IDs
-
- V-219264
- V-100753
- Rule IDs
-
- SV-219264r508662_rule
- SV-109857
Checks: C-20989r305120_chk
Verify the Ubuntu operating system generates an audit record when successful/unsuccessful attempts to use the "sudoedit" command occur. Check the configured audit rules with the following commands: # sudo auditctl -l | grep /usr/bin/sudoedit -a always,exit -F path=/usr/bin/sudoedit -F perm=x -F auid>=1000 -F auid!=-1 -k priv_cmd If the command does not return a line that matches the example or the line is commented out, this is a finding. Note: The '-k' allows for specifying an arbitrary identifier and the string after it does not need to match the example output above.
Fix: F-20988r305121_fix
Configure the audit system to generate an audit event for any successful/unsuccessful use of the "sudoedit" command. Add or update the following rules in the "/etc/audit/rules.d/stig.rules": -a always,exit -F path=/usr/bin/sudoedit -F perm=x -F auid>=1000 -F auid!=4294967295 -k priv_cmd Note: The "root" account must be used to view/edit any files in the /etc/audit/rules.d/ directory. In order to reload the rules file, issue the following command: # sudo augenrules --load
- RMF Control
- AU-12
- Severity
- M
- CCI
- CCI-000172
- Version
- UBTU-18-010342
- Vuln IDs
-
- V-219265
- V-100755
- Rule IDs
-
- SV-219265r508662_rule
- SV-109859
Checks: C-20990r305123_chk
Verify the Ubuntu operating system generates an audit record when successful/unsuccessful attempts to use the "chsh" command. Check the configured audit rules with the following commands: # sudo auditctl -l | grep chsh -a always,exit -F path=/usr/bin/chsh -F perm=x -F auid>=1000 -F auid!=-1 -k priv_cmd If the command does not return a line that matches the example or the line is commented out, this is a finding. Notes: The '-k' allows for specifying an arbitrary identifier and the string after it does not need to match the example output above.
Fix: F-20989r305124_fix
Configure the audit system to generate an audit event for any successful/unsuccessful use of the "chsh" command. Add or update the following rules in the "/etc/audit/rules.d/stig.rules" file: -a always,exit -F path=/usr/bin/chsh -F perm=x -F auid>=1000 -F auid!=4294967295 -k priv_cmd Note: The "root" account must be used to view/edit any files in the /etc/audit/rules.d/ directory. In order to reload the rules file, issue the following command: # sudo augenrules --load
- RMF Control
- AU-12
- Severity
- M
- CCI
- CCI-000172
- Version
- UBTU-18-010343
- Vuln IDs
-
- V-219266
- V-100757
- Rule IDs
-
- SV-219266r508662_rule
- SV-109861
Checks: C-20991r305126_chk
Verify the Ubuntu operating system generates an audit record when successful/unsuccessful attempts to use the "newgrp" command occur. Check the configured audit rules with the following commands: # sudo auditctl -l | grep newgrp -a always,exit -F path=/usr/bin/newgrp -F perm=x -F auid>=1000 -F auid!=-1 -k priv_cmd If the command does not return a line that matches the example or the line is commented out, this is a finding. Note: The '-k' allows for specifying an arbitrary identifier and the string after it does not need to match the example output above.
Fix: F-20990r305127_fix
Configure the audit system to generate an audit event for any successful/unsuccessful use of the "newgrp" command. Add or update the following rules in the "/etc/audit/rules.d/stig.rules" file: -a always,exit -F path=/usr/bin/newgrp -F perm=x -F auid>=1000 -F auid!=4294967295 -k priv_cmd Note: The "root" account must be used to view/edit any files in the /etc/audit/rules.d/ directory. In order to reload the rules file, issue the following command: # sudo augenrules --load
- RMF Control
- AU-12
- Severity
- M
- CCI
- CCI-000172
- Version
- UBTU-18-010344
- Vuln IDs
-
- V-219267
- V-100759
- Rule IDs
-
- SV-219267r508662_rule
- SV-109863
Checks: C-20992r305129_chk
Verify the Ubuntu operating system generates an audit record when successful/unsuccessful attempts to use the "chcon" command occur. Check the currently configured audit rules with the following command: # sudo auditctl -l | grep chcon -a always,exit -F path=/usr/bin/chcon -F perm=x -F auid>=1000 -F auid!=-1 -k perm_chng If the command does not return a line that matches the example or the line is commented out, this is a finding. Note: The '-k' allows for specifying an arbitrary identifier and the string after it does not need to match the example output above.
Fix: F-20991r305130_fix
Configure the audit system to generate an audit event for any successful/unsuccessful use of the "chcon" command. Add or update the following rules in the "/etc/audit/rules.d/stig.rules" file: -a always,exit -F path=/usr/bin/chcon -F perm=x -F auid>=1000 -F auid!=4294967295 -k perm_chng Note: The "root" account must be used to view/edit any files in the /etc/audit/rules.d/ directory. In order to reload the rules file, issue the following command: # sudo augenrules --load
- RMF Control
- AU-12
- Severity
- M
- CCI
- CCI-000172
- Version
- UBTU-18-010345
- Vuln IDs
-
- V-219268
- V-100761
- Rule IDs
-
- SV-219268r508662_rule
- SV-109865
Checks: C-20993r305132_chk
Verify the Ubuntu operating system generates an audit record when successful/unsuccessful attempts to use the "apparmor_parser" command occur. Check the currently configured audit rules with the following command: # sudo auditctl -l | grep apparmor_parser -a always,exit -F path=/sbin/apparmor_parser -F perm=x -F auid>=1000 -F auid!=-1 -k perm_chng If the command does not return a line that matches the example or the line is commented out, this is a finding. Note: The '-k' allows for specifying an arbitrary identifier and the string after it does not need to match the example output above.
Fix: F-20992r305133_fix
Configure the audit system to generate an audit event for any successful/unsuccessful use of the "apparmor_parser" command. Add or update the following rules in the "/etc/audit/rules.d/stig.rules" file: -a always,exit -F path=/sbin/apparmor_parser -F perm=x -F auid>=1000 -F auid!=4294967295 -k perm_chng Note: The "root" account must be used to view/edit any files in the /etc/audit/rules.d/ directory. In order to reload the rules file, issue the following command: # sudo augenrules --load
- RMF Control
- AU-12
- Severity
- M
- CCI
- CCI-000172
- Version
- UBTU-18-010346
- Vuln IDs
-
- V-219269
- V-100763
- Rule IDs
-
- SV-219269r508662_rule
- SV-109867
Checks: C-20994r305135_chk
Verify the Ubuntu operating system generates an audit record when successful/unsuccessful attempts to use the "setfacl" command occur. Check the currently configured audit rules with the following command: # sudo auditctl -l | grep setfacl -a always,exit -F path=/usr/bin/setfacl -F perm=x -F auid>=1000 -F auid!=-1 -k perm_chng If the command does not return a line that matches the example or the line is commented out, this is a finding. Note: The '-k' allows for specifying an arbitrary identifier and the string after it does not need to match the example output above.
Fix: F-20993r305136_fix
Configure the audit system to generate an audit event for any successful/unsuccessful use of the "setfacl" command. Add or update the following rules in the "/etc/audit/rules.d/stig.rules" file: -a always,exit -F path=/usr/bin/setfacl -F perm=x -F auid>=1000 -F auid!=4294967295 -k perm_chng Note: The "root" account must be used to view/edit any files in the /etc/audit/rules.d/ directory. In order to reload the rules file, issue the following command: # sudo augenrules --load
- RMF Control
- AU-12
- Severity
- M
- CCI
- CCI-000172
- Version
- UBTU-18-010347
- Vuln IDs
-
- V-219270
- V-100765
- Rule IDs
-
- SV-219270r508662_rule
- SV-109869
Checks: C-20995r305138_chk
Verify the Ubuntu operating system generates an audit record when successful/unsuccessful attempts to use the "chacl" command occur. Check the currently configured audit rules with the following command: # sudo audtctl -l | grep chacl -a always,exit -F path=/usr/bin/chacl -F perm=x -F auid>=1000 -F auid!=-1 -k perm_chng If the command does not return a line that matches the example or the line is commented out, this is a finding. Note: The '-k' allows for specifying an arbitrary identifier and the string after it does not need to match the example output above. If the command does not return a line that matches the example or the line is commented out, this is a finding.
Fix: F-20994r305139_fix
Configure the audit system to generate an audit event for any successful/unsuccessful use of the "chacl" command. Add or update the following rules in the "/etc/audit/rules.d/stig.rules" file: -a always,exit -F path=/usr/bin/chacl -F perm=x -F auid>=1000 -F auid!=4294967295 -k perm_chng Note: The "root" account must be used to view/edit any files in the /etc/audit/rules.d/ directory. In order to reload the rules file, issue the following command: # sudo augenrules --load
- RMF Control
- AU-12
- Severity
- M
- CCI
- CCI-000172
- Version
- UBTU-18-010348
- Vuln IDs
-
- V-219271
- V-100767
- Rule IDs
-
- SV-219271r508662_rule
- SV-109871
Checks: C-20996r305141_chk
Verify that an audit event is generated for any successful/unsuccessful use of the "passwd" command. Check the currently configured audit rules with the following command: # sudo auditctl -l | grep -w passwd -a always,exit -F path=/usr/bin/passwd -F perm=x -F auid>=1000 -F auid!=-1 -k privileged-passwd If the command does not return a line that matches the example or the line is commented out, this is a finding. Note: The '-k' allows for specifying an arbitrary identifier and the string after it does not need to match the example output above.
Fix: F-20995r305142_fix
Configure the audit system to generate an audit event for any successful/unsuccessful uses of the "passwd" command. Add or update the following rule in the "/etc/audit/rules.d/stig.rules" file: -a always,exit -F path=/usr/bin/passwd -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged-passwd Note: The "root" account must be used to view/edit any files in the /etc/audit/rules.d/ directory. In order to reload the rules file, issue the following command: # sudo augenrules --load
- RMF Control
- AU-12
- Severity
- M
- CCI
- CCI-000172
- Version
- UBTU-18-010349
- Vuln IDs
-
- V-219272
- V-100769
- Rule IDs
-
- SV-219272r508662_rule
- SV-109873
Checks: C-20997r305144_chk
Verify that an audit event is generated for any successful/unsuccessful use of the "unix_update" command. Check the currently configured audit rules with the following command: # sudo auditctl -l | grep -w unix_update -a always,exit -F path=/sbin/unix_update -F perm=x -F auid>=1000 -F auid!=-1 -k privileged-unix-update If the command does not return a line that matches the example or the line is commented out, this is a finding. Note: The '-k' allows for specifying an arbitrary identifier and the string after it does not need to match the example output above.
Fix: F-20996r305145_fix
Configure the audit system to generate an audit event for any successful/unsuccessful uses of the "unix_update" command. Add or update the following rules in the "/etc/audit/rules.d/stig.rules" file: -a always,exit -F path=/sbin/unix_update -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged-unix-update Note: The "root" account must be used to view/edit any files in the /etc/audit/rules.d/ directory. In order to reload the rules file, issue the following command: # sudo augenrules --load
- RMF Control
- AU-12
- Severity
- M
- CCI
- CCI-000172
- Version
- UBTU-18-010350
- Vuln IDs
-
- V-219273
- V-100771
- Rule IDs
-
- SV-219273r508662_rule
- SV-109875
Checks: C-20998r305147_chk
Verify that an audit event is generated for any successful/unsuccessful use of the "gpasswd" command. Check the currently configured audit rules with the following command: # sudo auditctl -l | grep -w gpasswd -a always,exit -F path=/usr/bin/gpasswd -F perm=x -F auid>=1000 -F auid!=-1 -k privileged-gpasswd If the command does not return a line that matches the example or the line is commented out, this is a finding. Note: The '-k' allows for specifying an arbitrary identifier and the string after it does not need to match the example output above.
Fix: F-20997r305148_fix
Configure the audit system to generate an audit event for any successful/unsuccessful uses of the gpasswd command. Add or update the following rules in the "/etc/audit/rules.d/stig.rules" file: -a always,exit -F path=/usr/bin/gpasswd -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged-gpasswd Note: The "root" account must be used to view/edit any files in the /etc/audit/rules.d/ directory. In order to reload the rules file, issue the following command: # sudo augenrules --load
- RMF Control
- AU-12
- Severity
- M
- CCI
- CCI-000172
- Version
- UBTU-18-010351
- Vuln IDs
-
- V-219274
- V-100773
- Rule IDs
-
- SV-219274r508662_rule
- SV-109877
Checks: C-20999r305150_chk
Verify that an audit event is generated for any successful/unsuccessful use of the "chage" command. Check the currently configured audit rules with the following command: # sudo auditctl -l | grep -w chage -a always,exit -F path=/usr/bin/chage -F perm=x -F auid>=1000 -F auid!=-1 -k privileged-chage If the command does not return a line that matches the example or the line is commented out, this is a finding. Note: The '-k' allows for specifying an arbitrary identifier and the string after it does not need to match the example output above.
Fix: F-20998r305151_fix
Configure the audit system to generate an audit event for any successful/unsuccessful uses of the "chage" command. Add or update the following rules in the "/etc/audit/rules.d/stig.rules" file: -a always,exit -F path=/usr/bin/chage -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged-chage Note: The "root" account must be used to view/edit any files in the /etc/audit/rules.d/ directory. In order to reload the rules file, issue the following command: # sudo augenrules --load
- RMF Control
- AU-12
- Severity
- M
- CCI
- CCI-000172
- Version
- UBTU-18-010352
- Vuln IDs
-
- V-219275
- V-100775
- Rule IDs
-
- SV-219275r508662_rule
- SV-109879
Checks: C-21000r305153_chk
Verify that an audit event is generated for any successful/unsuccessful use of the "usermod" command. Check the currently configured audit rules with the following command: # sudo auditctl -l | grep -w usermod -a always,exit -F path=/usr/sbin/usermod -F perm=x -F auid>=1000 -F auid!=-1 -k privileged-usermod If the command does not return a line that matches the example or the line is commented out, this is a finding. Note: The '-k' allows for specifying an arbitrary identifier and the string after it does not need to match the example output above.
Fix: F-20999r305154_fix
Configure the audit system to generate an audit event for any successful/unsuccessful uses of the "usermod" command. Add or update the following rules in the "/etc/audit/rules.d/stig.rules" file: -a always,exit -F path=/usr/sbin/usermod -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged-usermod Note: The "root" account must be used to view/edit any files in the /etc/audit/rules.d/ directory. In order to reload the rules file, issue the following command: # sudo augenrules --load
- RMF Control
- AU-12
- Severity
- M
- CCI
- CCI-000172
- Version
- UBTU-18-010353
- Vuln IDs
-
- V-219276
- V-100917
- Rule IDs
-
- SV-219276r508662_rule
- SV-110021
Checks: C-21001r305156_chk
Verify that an audit event is generated for any successful/unsuccessful use of the "crontab" command. Check the currently configured audit rules with the following command: # sudo auditctl -l | grep -w crontab -a always,exit -F path=/usr/bin/crontab -F perm=x -F auid>=1000 -F auid!=-1 -k privileged-crontab If the command does not return a line that matches the example or the line is commented out, this is a finding. Note: The '-k' allows for specifying an arbitrary identifier and the string after it does not need to match the example output above.
Fix: F-21000r305157_fix
Configure the audit system to generate an audit event for any successful/unsuccessful uses of the "crontab" command. Add or update the following rules in the "/etc/audit/rules.d/stig.rules" file: -a always,exit -F path=/usr/bin/crontab -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged-crontab Note: The "root" account must be used to view/edit any files in the /etc/audit/rules.d/ directory. In order to reload the rules file, issue the following command: # sudo augenrules --load
- RMF Control
- AU-12
- Severity
- M
- CCI
- CCI-000172
- Version
- UBTU-18-010354
- Vuln IDs
-
- V-219277
- V-100777
- Rule IDs
-
- SV-219277r508662_rule
- SV-109881
Checks: C-21002r305159_chk
Verify that an audit event is generated for any successful/unsuccessful use of the "pam_timestamp_check" command. Check the currently configured audit rules with the following command: # sudo auditctl -l | grep -w pam_timestamp_check -a always,exit -F path=/usr/sbin/pam_timestamp_check -F perm=x -F auid>=1000 -F auid!=-1 -k privileged-pam_timestamp_check If the command does not return a line that matches the example or the line is commented out, this is a finding. Note: The '-k' allows for specifying an arbitrary identifier and the string after it does not need to match the example output above.
Fix: F-21001r305160_fix
Configure the audit system to generate an audit event for any successful/unsuccessful uses of the "pam_timestamp_check" command. Add or update the following rules in the "/etc/audit/rules.d/stig.rules" file: -a always,exit -F path=/usr/sbin/pam_timestamp_check -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged-pam_timestamp_check Note: The "root" account must be used to view/edit any files in the /etc/audit/rules.d/ directory. In order to reload the rules file, issue the following command: # sudo augenrules --load
- RMF Control
- AU-12
- Severity
- M
- CCI
- CCI-000172
- Version
- UBTU-18-010355
- Vuln IDs
-
- V-219278
- V-100779
- Rule IDs
-
- SV-219278r508662_rule
- SV-109883
Checks: C-21003r305162_chk
Verify the Ubuntu operating system generates an audit record when successful/unsuccessful attempts to use the "init_module" syscall. Check the currently configured audit rules with the following command: # sudo auditctl -l | grep -w init_module -a always,exit -F arch=b32 -S init_module -F auid>=1000 -F auid!=-1 -k module_chng -a always,exit -F arch=b64 -S init_module -F auid>=1000 -F auid!=-1 -k module_chng If the command does not return a line that matches the example or the line is commented out, this is a finding. Notes: For 32-bit architectures, only the 32-bit specific output lines from the commands are required. The '-k' allows for specifying an arbitrary identifier and the string after it does not need to match the example output above.
Fix: F-21002r305163_fix
Configure the audit system to generate an audit event for any successful/unsuccessful use of the "init_module" syscall. Add or update the following rules in the "/etc/audit/rules.d/stig.rules" file: -a always,exit -F arch=b32 -S init_module -F auid>=1000 -F auid!=4294967295 -k module_chng -a always,exit -F arch=b64 -S init_module -F auid>=1000 -F auid!=4294967295 -k module_chng Notes: For 32-bit architectures, only the 32-bit specific entries are required. The "root" account must be used to view/edit any files in the /etc/audit/rules.d/ directory. In order to reload the rules file, issue the following command: # sudo augenrules --load
- RMF Control
- AU-12
- Severity
- M
- CCI
- CCI-000172
- Version
- UBTU-18-010356
- Vuln IDs
-
- V-219279
- V-100781
- Rule IDs
-
- SV-219279r508662_rule
- SV-109885
Checks: C-21004r305165_chk
Verify the Ubuntu operating system generates an audit record when successful/unsuccessful attempts to use the "finit_module" syscall. Check the currently configured audit rules with the following command: # sudo auditctl -l | grep -w finit_module -a always,exit -F arch=b32 -S finit_module -F auid>=1000 -F auid!=-1 -k module_chng -a always,exit -F arch=b64 -S finit_module -F auid>=1000 -F auid!=-1 -k module_chng If the command does not return a line that matches the example or the line is commented out, this is a finding. Notes: For 32-bit architectures, only the 32-bit specific output lines from the commands are required. The '-k' allows for specifying an arbitrary identifier and the string after it does not need to match the example output above.
Fix: F-21003r305166_fix
Configure the audit system to generate an audit event for any successful/unsuccessful use of the "finit_module" syscall. Add or update the following rules in the "/etc/audit/rules.d/stig.rules" file: -a always,exit -F arch=b32 -S finit_module -F auid>=1000 -F auid!=4294967295 -k module_chng -a always,exit -F arch=b64 -S finit_module -F auid>=1000 -F auid!=4294967295 -k module_chng Notes: For 32-bit architectures, only the 32-bit specific entries are required. The "root" account must be used to view/edit any files in the /etc/audit/rules.d/ directory. In order to reload the rules file, issue the following command: # sudo augenrules --load
- RMF Control
- AU-12
- Severity
- M
- CCI
- CCI-000172
- Version
- UBTU-18-010357
- Vuln IDs
-
- V-219280
- V-100783
- Rule IDs
-
- SV-219280r508662_rule
- SV-109887
Checks: C-21005r305168_chk
Verify the Ubuntu operating system generates an audit record when successful/unsuccessful attempts to use the "delete_module" syscall. Check the currently configured audit rules with the following command: # sudo auditctl -l | grep -w delete_module -a always,exit -F arch=b32 -S delete_module -F auid>=1000 -F auid!=-1 -k module_chng -a always,exit -F arch=b64 -S delete_module -F auid>=1000 -F auid!=-1 -k module_chng If the command does not return a line that matches the example or the line is commented out, this is a finding. Notes: For 32-bit architectures, only the 32-bit specific output lines from the commands are required. The '-k' allows for specifying an arbitrary identifier and the string after it does not need to match the example output above.
Fix: F-21004r305169_fix
Configure the audit system to generate an audit event for any successful/unsuccessful use of the "delete_module" syscall. Add or update the following rules in the "/etc/audit/rules.d/stig.rules" file: -a always,exit -F arch=b32 -S delete_module -F auid>=1000 -F auid!=4294967295 -k module_chng -a always,exit -F arch=b64 -S delete_module -F auid>=1000 -F auid!=4294967295 -k module_chng Notes: For 32-bit architectures, only the 32-bit specific entries are required. The "root" account must be used to view/edit any files in the /etc/audit/rules.d/ directory. In order to reload the rules file, issue the following command: # sudo augenrules --load
- RMF Control
- AC-6
- Severity
- M
- CCI
- CCI-002233
- Version
- UBTU-18-010358
- Vuln IDs
-
- V-219281
- V-100785
- Rule IDs
-
- SV-219281r508662_rule
- SV-109889
Checks: C-21006r305171_chk
Verify the Ubuntu operating system audits the execution of privilege functions by auditing the "execve" system call. Check the currently configured audit rules with the following command: # sudo auditctl -l | grep execve -a always,exit -F arch=b64 -S execve -C uid!=euid -F key=execpriv -a always,exit -F arch=b64 -S execve -C gid!=egid -F key=execpriv -a always,exit -F arch=b32 -S execve -C uid!=euid -F key=execpriv -a always,exit -F arch=b32 -S execve -C gid!=egid -F key=execpriv If the command does not return lines that match the example or the lines are commented out, this is a finding. Notes: For 32-bit architectures, only the 32-bit specific output lines from the commands are required. The '-k' allows for specifying an arbitrary identifier and the string after it does not need to match the example output above.
Fix: F-21005r305172_fix
Configure the Ubuntu operating system to audit the execution of all privileged functions. Add or update the following rules in the "/etc/audit/rules.d/stig.rules" file: -a always,exit -F arch=b64 -S execve -C uid!=euid -F key=execpriv -a always,exit -F arch=b64 -S execve -C gid!=egid -F key=execpriv -a always,exit -F arch=b32 -S execve -C uid!=euid -F key=execpriv -a always,exit -F arch=b32 -S execve -C gid!=egid -F key=execpriv Notes: For 32-bit architectures, only the 32-bit specific entries are required. The "root" account must be used to view/edit any files in the /etc/audit/rules.d/ directory. In order to reload the rules file, issue the following command: # sudo augenrules --load
- RMF Control
- AU-12
- Severity
- M
- CCI
- CCI-000172
- Version
- UBTU-18-010366
- Vuln IDs
-
- V-219282
- V-100787
- Rule IDs
-
- SV-219282r508662_rule
- SV-109891
Checks: C-21007r305174_chk
Verify the Ubuntu operating system generates audit records when successful/unsuccessful attempts to use setxattr system call. Check the configured audit rules with the following commands: # sudo auditctl -l | grep setxattr -a always,exit -F arch=b64 -S setxattr -F auid>=1000 -F auid!=-1 -k perm_chng -a always,exit -F arch=b32 -S setxattr -F auid>=1000 -F auid!=-1 -k perm_chng If the command does not return lines that match the example or the lines are commented out, this is a finding. Note: For 32-bit architectures, only the 32-bit specific output lines from the commands are required. The '-k' allows for specifying an arbitrary identifier and the string after it does not need to match the example output above.
Fix: F-21006r305175_fix
Configure the audit system to generate audit records for successful/unsuccessful attempts to use setxattr system call. Add or update the following rules in the "/etc/audit/rules.d/stig.rules" file: -a always,exit -F arch=b64 -S setxattr -F auid>=1000 -F auid!=4294967295 -k perm_chng -a always,exit -F arch=b32 -S setxattr -F auid>=1000 -F auid!=4294967295 -k perm_chng Notes: For 32-bit architectures, only the 32-bit specific entries are required. The "root" account must be used to view/edit any files in the /etc/audit/rules.d/ directory. In order to reload the rules file, issue the following command: # sudo augenrules --load
- RMF Control
- AU-12
- Severity
- M
- CCI
- CCI-000172
- Version
- UBTU-18-010367
- Vuln IDs
-
- V-219283
- V-100789
- Rule IDs
-
- SV-219283r508662_rule
- SV-109893
Checks: C-21008r305177_chk
Verify the Ubuntu operating system generates audit records when successful/unsuccessful attempts to use lsetxattr system call. Check the configured audit rules with the following commands: # sudo auditctl -l | grep lsetxattr -a always,exit -F arch=b64 -S lsetxattr -F auid>=1000 -F auid!=-1 -k perm_chng -a always,exit -F arch=b32 -S lsetxattr -F auid>=1000 -F auid!=-1 -k perm_chng If the command does not return lines that match the example or the lines are commented out, this is a finding. Note: For 32-bit architectures, only the 32-bit specific output lines from the commands are required. The '-k' allows for specifying an arbitrary identifier and the string after it does not need to match the example output above.
Fix: F-21007r305178_fix
Configure the audit system to generate audit records for successful/unsuccessful attempts to use lsetxattr system call. Add or update the following rules in the "/etc/audit/rules.d/stig.rules" file: -a always,exit -F arch=b64 -S lsetxattr -F auid>=1000 -F auid!=4294967295 -k perm_chng -a always,exit -F arch=b32 -S lsetxattr -F auid>=1000 -F auid!=4294967295 -k perm_chng Notes: For 32-bit architectures, only the 32-bit specific entries are required. The "root" account must be used to view/edit any files in the /etc/audit/rules.d/ directory. In order to reload the rules file, issue the following command: # sudo augenrules --load
- RMF Control
- AU-12
- Severity
- M
- CCI
- CCI-000172
- Version
- UBTU-18-010368
- Vuln IDs
-
- V-219284
- V-100791
- Rule IDs
-
- SV-219284r508662_rule
- SV-109895
Checks: C-21009r305180_chk
Verify the Ubuntu operating system generates audit records when successful/unsuccessful attempts to use fsetxattr system call. Check the configured audit rules with the following commands: # sudo auditctl -l | grep fsetxattr -a always,exit -F arch=b64 -S fsetxattr -F auid>=1000 -F auid!=-1 -k perm_chng -a always,exit -F arch=b32 -S fsetxattr -F auid>=1000 -F auid!=-1 -k perm_chng If the command does not return lines that match the example or the lines are commented out, this is a finding. Note: For 32-bit architectures, only the 32-bit specific output lines from the commands are required. The '-k' allows for specifying an arbitrary identifier and the string after it does not need to match the example output above.
Fix: F-21008r305181_fix
Configure the audit system to generate audit records for successful/unsuccessful attempts to use fsetxattr system call. Add or update the following rules in the "/etc/audit/rules.d/stig.rules" file: -a always,exit -F arch=b64 -S fsetxattr -F auid>=1000 -F auid!=4294967295 -k perm_chng -a always,exit -F arch=b32 -S fsetxattr -F auid>=1000 -F auid!=4294967295 -k perm_chng Notes: For 32-bit architectures, only the 32-bit specific entries are required. The "root" account must be used to view/edit any files in the /etc/audit/rules.d/ directory. In order to reload the rules file, issue the following command: # sudo augenrules --load
- RMF Control
- AU-12
- Severity
- M
- CCI
- CCI-000172
- Version
- UBTU-18-010369
- Vuln IDs
-
- V-219285
- V-100793
- Rule IDs
-
- SV-219285r508662_rule
- SV-109897
Checks: C-21010r305183_chk
Verify the Ubuntu operating system generates audit records when successful/unsuccessful attempts to use removexattr system call. Check the configured audit rules with the following commands: # sudo auditctl -l | grep removexattr -a always,exit -F arch=b64 -S removexattr -F auid>=1000 -F auid!=-1 -k perm_chng -a always,exit -F arch=b32 -S removexattr -F auid>=1000 -F auid!=-1 -k perm_chng If the command does not return lines that match the example or the lines are commented out, this is a finding. Note: For 32-bit architectures, only the 32-bit specific output lines from the commands are required. The '-k' allows for specifying an arbitrary identifier and the string after it does not need to match the example output above.
Fix: F-21009r305184_fix
Configure the audit system to generate audit records for successful/unsuccessful attempts to use removexattr system call. Add or update the following rules in the "/etc/audit/rules.d/stig.rules" file: -a always,exit -F arch=b64 -S removexattr -F auid>=1000 -F auid!=4294967295 -k perm_chng -a always,exit -F arch=b32 -S removexattr -F auid>=1000 -F auid!=4294967295 -k perm_chng Notes: For 32-bit architectures, only the 32-bit specific entries are required. The "root" account must be used to view/edit any files in the /etc/audit/rules.d/ directory. In order to reload the rules file, issue the following command: # sudo augenrules --load
- RMF Control
- AU-12
- Severity
- M
- CCI
- CCI-000172
- Version
- UBTU-18-010370
- Vuln IDs
-
- V-219286
- V-100795
- Rule IDs
-
- SV-219286r508662_rule
- SV-109899
Checks: C-21011r305186_chk
Verify the Ubuntu operating system generates audit records when successful/unsuccessful attempts to use lremovexattr system call. Check the configured audit rules with the following commands: # sudo auditctl -l | grep lremovexattr -a always,exit -F arch=b64 -S lremovexattr -F auid>=1000 -F auid!=-1 -k perm_chng -a always,exit -F arch=b32 -S lremovexattr -F auid>=1000 -F auid!=-1 -k perm_chng If the command does not return lines that match the example or the lines are commented out, this is a finding. Note: For 32-bit architectures, only the 32-bit specific output lines from the commands are required. The '-k' allows for specifying an arbitrary identifier and the string after it does not need to match the example output above.
Fix: F-21010r305187_fix
Configure the audit system to generate audit records for successful/unsuccessful attempts to use lremovexattr system call. Add or update the following rules in the "/etc/audit/rules.d/stig.rules" file: -a always,exit -F arch=b64 -S lremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_chng -a always,exit -F arch=b32 -S lremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_chng Notes: For 32-bit architectures, only the 32-bit specific entries are required. The "root" account must be used to view/edit any files in the /etc/audit/rules.d/ directory. In order to reload the rules file, issue the following command: # sudo augenrules --load
- RMF Control
- AU-12
- Severity
- M
- CCI
- CCI-000172
- Version
- UBTU-18-010375
- Vuln IDs
-
- V-219287
- V-100797
- Rule IDs
-
- SV-219287r508662_rule
- SV-109901
Checks: C-21012r305189_chk
Verify the Ubuntu operating system generates audit records when successful/unsuccessful use of unlink system call. Check the currently configured audit rules with the following command: # sudo auditctl -l | grep unlink -a always,exit -F arch=b64 -S unlink -F auid>=1000 -F auid!=-1 -k delete -a always,exit -F arch=b32 -S unlink -F auid>=1000 -F auid!=-1 -k delete If the command does not return lines that match the example or the lines are commented out, this is a finding. Notes: For 32-bit architectures, only the 32-bit specific output lines from the commands are required. The '-k' allows for specifying an arbitrary identifier and the string after it does not need to match the example output above.
Fix: F-21011r305190_fix
Configure the audit system to generate audit events when successful/unsuccessful use of unlink system call. Add or update the following rules in the "/etc/audit/rules.d/stig.rules" file: -a always,exit -F arch=b64 -S unlink -Fauid>=1000 -F auid!=4294967295 -k delete -a always,exit -F arch=b32 -S unlink -F auid>=1000 -F auid!=4294967295 -k delete Notes: For 32-bit architectures, only the 32-bit specific entries are required. The "root" account must be used to view/edit any files in the /etc/audit/rules.d/ directory. In order to reload the rules file, issue the following command: # sudo augenrules --load
- RMF Control
- AU-12
- Severity
- M
- CCI
- CCI-000172
- Version
- UBTU-18-010376
- Vuln IDs
-
- V-219288
- V-100799
- Rule IDs
-
- SV-219288r508662_rule
- SV-109903
Checks: C-21013r305192_chk
Verify the Ubuntu operating system generates audit records when successful/unsuccessful use of unlinkat system call. Check the currently configured audit rules with the following command: # sudo auditctl -l | grep unlinkat -a always,exit -F arch=b64 -S unlinkat -F auid>=1000 -F auid!=-1 -k delete -a always,exit -F arch=b32 -S unlinkat -F auid>=1000 -F auid!=-1 -k delete If the command does not return lines that match the example or the lines are commented out, this is a finding. Notes: For 32-bit architectures, only the 32-bit specific output lines from the commands are required. The '-k' allows for specifying an arbitrary identifier and the string after it does not need to match the example output above.
Fix: F-21012r305193_fix
Configure the audit system to generate audit events when successful/unsuccessful use of the unlinkat system call. Add or update the following rules in the "/etc/audit/rules.d/stig.rules" file: -a always,exit -F arch=b64 -S unlinkat -Fauid>=1000 -F auid!=4294967295 -k delete -a always,exit -F arch=b32 -S unlinkat -F auid>=1000 -F auid!=4294967295 -k delete Notes: For 32-bit architectures, only the 32-bit specific entries are required. The "root" account must be used to view/edit any files in the /etc/audit/rules.d/ directory. In order to reload the rules file, issue the following command: # sudo augenrules --load
- RMF Control
- AU-12
- Severity
- M
- CCI
- CCI-000172
- Version
- UBTU-18-010377
- Vuln IDs
-
- V-219289
- V-100801
- Rule IDs
-
- SV-219289r508662_rule
- SV-109905
Checks: C-21014r305195_chk
Verify the Ubuntu operating system generates audit records when successful/unsuccessful use of rename system call. Check the currently configured audit rules with the following command: # sudo auditctl -l | grep rename -a always,exit -F arch=b64 -S rename -F auid>=1000 -F auid!=-1 -k delete -a always,exit -F arch=b32 -S rename -F auid>=1000 -F auid!=-1 -k delete If the command does not return lines that match the example or the lines are commented out, this is a finding. Notes: For 32-bit architectures, only the 32-bit specific output lines from the commands are required. The '-k' allows for specifying an arbitrary identifier and the string after it does not need to match the example output above.
Fix: F-21013r305196_fix
Configure the audit system to generate audit events when successful/unsuccessful use of the rename system call. Add or update the following rules in the "/etc/audit/rules.d/stig.rules" file: -a always,exit -F arch=b64 -S rename -Fauid>=1000 -F auid!=4294967295 -k delete -a always,exit -F arch=b32 -S rename -F auid>=1000 -F auid!=4294967295 -k delete Notes: For 32-bit architectures, only the 32-bit specific entries are required. The "root" account must be used to view/edit any files in the /etc/audit/rules.d/ directory. In order to reload the rules file, issue the following command: # sudo augenrules --load
- RMF Control
- AU-12
- Severity
- M
- CCI
- CCI-000172
- Version
- UBTU-18-010378
- Vuln IDs
-
- V-219290
- V-100803
- Rule IDs
-
- SV-219290r508662_rule
- SV-109907
Checks: C-21015r305198_chk
Verify the Ubuntu operating system generates audit records when successful/unsuccessful use of renameat system call. Check the currently configured audit rules with the following command: # sudo auditctl -l | grep renameat -a always,exit -F arch=b64 -S renameat -F auid>=1000 -F auid!=-1 -k delete -a always,exit -F arch=b32 -S renameat -F auid>=1000 -F auid!=-1 -k delete If the command does not return lines that match the example or the lines are commented out, this is a finding. Notes: For 32-bit architectures, only the 32-bit specific output lines from the commands are required. The '-k' allows for specifying an arbitrary identifier and the string after it does not need to match the example output above.
Fix: F-21014r305199_fix
Configure the audit system to generate audit events when successful/unsuccessful use of the renameat system call. Add or update the following rules in the "/etc/audit/rules.d/stig.rules" file: -a always,exit -F arch=b64 -S renameat -Fauid>=1000 -F auid!=4294967295 -k delete -a always,exit -F arch=b32 -S renameat -F auid>=1000 -F auid!=4294967295 -k delete Notes: For 32-bit architectures, only the 32-bit specific entries are required. The "root" account must be used to view/edit any files in the /etc/audit/rules.d/ directory. In order to reload the rules file, issue the following command: # sudo augenrules --load
- RMF Control
- AU-12
- Severity
- M
- CCI
- CCI-000172
- Version
- UBTU-18-010379
- Vuln IDs
-
- V-219291
- V-100805
- Rule IDs
-
- SV-219291r508662_rule
- SV-109909
Checks: C-21016r485712_chk
Verify the Ubuntu operating system generates an audit record when adding and deleting kernel modules. Check the currently configured audit rules with the following command: # sudo auditctl -l | grep -E 'init_module|finit_module' -a always,exit -F arch=b32 -S init_module -S finit_module -k modules -a always,exit -F arch=b64 -S init_module -S finit_module -k modules If the command does not return lines that matches the example or the lines are commented out, this is a finding. Notes: For 32-bit architectures, only the 32-bit specific output lines from the commands are required. The '-k' allows for specifying an arbitrary identifier and the string after it does not need to match the example output above.
Fix: F-21015r485713_fix
Configure the audit system to generate audit events when adding and deleting kernel modules. Add or update the following rules in the "/etc/audit/rules.d/stig.rules" file: -a always,exit -F arch=b32 -S init_module -S finit_module -k modules -a always,exit -F arch=b64 -S init_module -S finit_module -k modules Notes: For 32-bit architectures, only the 32-bit specific entries are required. The "root" account must be used to view/edit any files in the /etc/audit/rules.d/ directory. In order to reload the rules file, issue the following command: # sudo augenrules --load
- RMF Control
- AU-12
- Severity
- M
- CCI
- CCI-000172
- Version
- UBTU-18-010380
- Vuln IDs
-
- V-219292
- V-100807
- Rule IDs
-
- SV-219292r508662_rule
- SV-109911
Checks: C-21017r485715_chk
Verify the Ubuntu operating system generates an audit record when adding and deleting kernel modules. Check the currently configured audit rules with the following command: # sudo auditctl -l | grep -delete_module -a always,exit -F arch=b32 -S delete_module -k modules -a always,exit -F arch=b64 -S delete_module -k modules If the command does not return lines that matches the example or the lines are commented out, this is a finding. Notes: For 32-bit architectures, only the 32-bit specific output lines from the commands are required. The '-k' allows for specifying an arbitrary identifier and the string after it does not need to match the example output above.
Fix: F-21016r485716_fix
Configure the audit system to generate audit events when adding and deleting kernel modules. Add or update the following rules in the "/etc/audit/rules.d/stig.rules" file: -a always,exit -F arch=b32 -S delete_module -k modules -a always,exit -F arch=b64 -S delete_module -k modules Notes: For 32-bit architectures, only the 32-bit specific entries are required. The "root" account must be used to view/edit any files in the /etc/audit/rules.d/ directory. In order to reload the rules file, issue the following command: # sudo augenrules --load
- RMF Control
- AU-12
- Severity
- M
- CCI
- CCI-000172
- Version
- UBTU-18-010382
- Vuln IDs
-
- V-219293
- V-100809
- Rule IDs
-
- SV-219293r508662_rule
- SV-109913
Checks: C-21018r485719_chk
Verify the Ubuntu operating system generates an audit record when unsuccessful attempts to use the "truncate" system call occur. Check the configured audit rules with the following commands: # sudo auditctl -l | grep truncate -a always,exit -F arch=b32 -S truncate -F exit=-EPERM -F auid>=1000 -F auid!=-1 -k perm_access -a always,exit -F arch=b32 -S truncate -F exit=-EACCES -F auid>=1000 -F auid!=-1 -k perm_access -a always,exit -F arch=b64 -S truncate -F exit=-EPERM -F auid>=1000 -F auid!=-1 -k perm_access -a always,exit -F arch=b64 -S truncate -F exit=-EACCES -F auid>=1000 -F auid!=-1 -k perm_access If the command does not return lines that match the example or the lines are commented out, this is a finding. Notes: For 32-bit architectures, only the 32-bit specific output lines from the commands are required. The '-k' allows for specifying an arbitrary identifier and the string after it does not need to match the example output above.
Fix: F-21017r485720_fix
Configure the audit system to generate an audit event for any unsuccessful use of the "truncate" system call. Add or update the following rules in the "/etc/audit/rules.d/stig.rules" file: -a always,exit -F arch=b32 -S truncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k perm_access -a always,exit -F arch=b32 -S truncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k perm_access -a always,exit -F arch=b64 -S truncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k perm_access -a always,exit -F arch=b64 -S truncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k perm_access Notes: For 32-bit architectures, only the 32-bit specific entries are required. The "root" account must be used to view/edit any files in the /etc/audit/rules.d/ directory. In order to reload the rules file, issue the following command: # sudo augenrules --load
- RMF Control
- AU-12
- Severity
- M
- CCI
- CCI-000172
- Version
- UBTU-18-010383
- Vuln IDs
-
- V-219294
- V-100811
- Rule IDs
-
- SV-219294r508662_rule
- SV-109915
Checks: C-21019r485722_chk
Verify the Ubuntu operating system generates an audit record when unsuccessful attempts to use the "ftruncate" system call. Check the configured audit rules with the following command: # sudo auditctl -l | grep ftruncate -a always,exit -F arch=b32 -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=-1 -k perm_access -a always,exit -F arch=b32 -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=-1 -k perm_access -a always,exit -F arch=b64 -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=-1 -k perm_access -a always,exit -F arch=b64 -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=-1 -k perm_access If the command does not return lines that match the example or the lines are commented out, this is a finding. Notes: For 32-bit architectures, only the 32-bit specific output lines from the commands are required. The '-k' allows for specifying an arbitrary identifier and the string after it does not need to match the example output above.
Fix: F-21018r485723_fix
Configure the audit system to generate an audit event for any unsuccessful use of the "ftruncate" system call. Add or update the following rules in the "/etc/audit/rules.d/stig.rules" file: -a always,exit -F arch=b32 -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k perm_access -a always,exit -F arch=b32 -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k perm_access -a always,exit -F arch=b64 -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k perm_access -a always,exit -F arch=b64 -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k perm_access Notes: For 32-bit architectures, only the 32-bit specific entries are required. The "root" account must be used to view/edit any files in the /etc/audit/rules.d/ directory. In order to reload the rules file, issue the following command: # sudo augenrules --load
- RMF Control
- AU-12
- Severity
- M
- CCI
- CCI-000172
- Version
- UBTU-18-010384
- Vuln IDs
-
- V-219295
- V-100813
- Rule IDs
-
- SV-219295r508662_rule
- SV-109917
Checks: C-21020r485725_chk
Verify the Ubuntu operating system generates an audit record when unsuccessful attempts to use the "creat" system call. Check the configured audit rules with the following commands: # sudo auditctl -l | grep creat -a always,exit -F arch=b32 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=-1 -k perm_access -a always,exit -F arch=b32 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=-1 -k perm_access -a always,exit -F arch=b64 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=-1 -k perm_access -a always,exit -F arch=b64 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=-1 -k perm_access If the command does not return lines that match the example or the lines are commented out, this is a finding. Notes: For 32-bit architectures, only the 32-bit specific output lines from the commands are required. The '-k' allows for specifying an arbitrary identifier and the string after it does not need to match the example output above.
Fix: F-21019r485726_fix
Configure the audit system to generate an audit event for any unsuccessful use of the "creat" system call. Add or update the following rules in the "/etc/audit/rules.d/stig.rules" file: -a always,exit -F arch=b32 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k perm_access -a always,exit -F arch=b32 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k perm_access -a always,exit -F arch=b64 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k perm_access -a always,exit -F arch=b64 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k perm_access Notes: For 32-bit architectures, only the 32-bit specific entries are required. The "root" account must be used to view/edit any files in the /etc/audit/rules.d/ directory. In order to reload the rules file, issue the following command: # sudo augenrules --load
- RMF Control
- AU-12
- Severity
- M
- CCI
- CCI-000172
- Version
- UBTU-18-010387
- Vuln IDs
-
- V-219296
- V-100815
- Rule IDs
-
- SV-219296r508662_rule
- SV-109919
Checks: C-21021r305216_chk
Verify if the Ubuntu operating system is configured to audit the "init_module" and "finit_module" syscalls, by running the following command: # sudo auditctl -l | grep -E 'init_module|finit_module' -a always,exit -F arch=b64 -S init_module -S finit_module -F key=modules -a always,exit -F arch=b32 -S init_module -S finit_module -F key=modules If the command does not return lines that match the example or the lines are commented out, this is a finding. Notes: For 32-bit architectures, only the 32-bit specific output lines from the commands are required. The '-k' allows for specifying an arbitrary identifier and the string after it does not need to match the example output above.
Fix: F-21020r305217_fix
Configure the audit system to generate an audit event for any use of the "init_module" or "finit_module" system calls. Add or update the following rules in the "/etc/audit/rules.d/stig.rules" file: -a always,exit -F arch=b32 -S init_module -S finit_module -F key=modules -a always,exit -F arch=b64 -S init_module -S finit_module -F key=modules Notes: For 32-bit architectures, only the 32-bit specific entries are required. The "root" account must be used to view/edit any files in the /etc/audit/rules.d/ directory. In order to reload the rules file, issue the following command: # sudo augenrules --load
- RMF Control
- AU-12
- Severity
- M
- CCI
- CCI-000172
- Version
- UBTU-18-010388
- Vuln IDs
-
- V-219297
- V-100817
- Rule IDs
-
- SV-219297r508662_rule
- SV-109921
Checks: C-21022r305219_chk
Verify if the Ubuntu operating system is configured to audit the "delete_module" syscall, by running the following command: # sudo auditctl -l | egrep delete_module -a always,exit -F arch=b64 -S delete_module -F key=modules -a always,exit -F arch=b32 -S delete_module -F key=modules If the command does not return lines that match the example or the lines are commented out, this is a finding. Notes: For 32-bit architectures, only the 32-bit specific output lines from the commands are required. The '-k' allows for specifying an arbitrary identifier and the string after it does not need to match the example output above.
Fix: F-21021r305220_fix
Configure the Ubuntu operating system to generate an audit event for any use of the delete_module system call. Add or update the following rule in the "/etc/audit/rules.d/stig.rules" file. -a always,exit -F arch=b32 -S delete_module -F key=modules -a always,exit -F arch=b64 -S delete_module -F key=modules Notes: For 32-bit architectures, only the 32-bit specific entries are required. The "root" account must be used to view/edit any files in the /etc/audit/rules.d/ directory. In order to reload the rules file, issue the following command: # sudo augenrules --load
- RMF Control
- AU-12
- Severity
- M
- CCI
- CCI-000172
- Version
- UBTU-18-010389
- Vuln IDs
-
- V-219298
- V-100819
- Rule IDs
-
- SV-219298r508662_rule
- SV-109923
Checks: C-21023r305222_chk
Verify if the Ubuntu operating system is configured to audit the execution of the module management program "modprobe", by running the following command: sudo auditctl -l | grep "/sbin/modprobe" -w /sbin/modprobe -p x -k modules If the command does not return a line, or the line is commented out, this is a finding. Note: The '-k' allows for specifying an arbitrary identifier and the string after it does not need to match the example output above.
Fix: F-21022r305223_fix
Configure the Ubuntu operating system to audit the execution of the module management program "modprobe". Add or update the following rule in the "/etc/audit/rules.d/stig.rules" file. -w /sbin/modprobe -p x -k modules Note: The "root" account must be used to view/edit any files in the /etc/audit/rules.d/ directory. In order to reload the rules file, issue the following command: # sudo augenrules --load
- RMF Control
- AU-12
- Severity
- M
- CCI
- CCI-000172
- Version
- UBTU-18-010391
- Vuln IDs
-
- V-219299
- V-100821
- Rule IDs
-
- SV-219299r508662_rule
- SV-109925
Checks: C-21024r305225_chk
Verify if the Ubuntu operating system is configured to audit the execution of the module management program "kmod". Check the currently configured audit rules with the following command: # sudo auditctl -l | grep kmod -w /bin/kmod -p x -k module If the command does not return a line, or the line is commented out, this is a finding. Note: The '-k' allows for specifying an arbitrary identifier and the string after it does not need to match the example output above.
Fix: F-21023r305226_fix
Configure the Ubuntu operating system to audit the execution of the module management program "kmod". Add or update the following rule in the "/etc/audit/rules.d/stig.rules" file. -w /bin/kmod -p x -k modules Note: The "root" account must be used to view/edit any files in the /etc/audit/rules.d/ directory. In order to reload the rules file, issue the following command: # sudo augenrules --load
- RMF Control
- AU-12
- Severity
- M
- CCI
- CCI-000172
- Version
- UBTU-18-010392
- Vuln IDs
-
- V-219300
- V-100823
- Rule IDs
-
- SV-219300r508662_rule
- SV-109927
Checks: C-21025r305228_chk
Verify if the Ubuntu operating system is configured to audit the execution of the partition management program "fdisk". Check the currently configured audit rules with the following command: # sudo auditctl -l | grep fdisk -w /sbin/fdisk -p x -k fdisk If the command does not return a line, or the line is commented out, this is a finding. Note: The '-k' allows for specifying an arbitrary identifier and the string after it does not need to match the example output above.
Fix: F-21024r305229_fix
Configure the Ubuntu operating system to audit the execution of the partition management program "fdisk". Add or update the following rule in the "/etc/audit/rules.d/stig.rules" file. -w /bin/fdisk -p x -k fdisk Note: The "root" account must be used to view/edit any files in the /etc/audit/rules.d/ directory. In order to reload the rules file, issue the following command: # sudo augenrules --load
- RMF Control
- AC-10
- Severity
- L
- CCI
- CCI-000054
- Version
- UBTU-18-010400
- Vuln IDs
-
- V-219301
- V-100825
- Rule IDs
-
- SV-219301r508662_rule
- SV-109929
Checks: C-21026r305231_chk
Verify that the Ubuntu operating system limits the number of concurrent sessions to ten for all accounts and/or account types by running the following command: # grep maxlogins /etc/security/limits.conf | grep -v '^* hard maxlogins' The result must contain the following line: * hard maxlogins 10 If the "maxlogins" item is missing or the value is not set to 10 or less, it is commented out, this is a finding.
Fix: F-21025r305232_fix
Configure the Ubuntu operating system to limit the number of concurrent sessions to ten for all accounts and/or account types. Add the following line to the top of the /etc/security/limits.conf: * hard maxlogins 10
- RMF Control
- AC-11
- Severity
- M
- CCI
- CCI-000056
- Version
- UBTU-18-010401
- Vuln IDs
-
- V-219302
- V-100827
- Rule IDs
-
- SV-219302r508662_rule
- SV-109931
Checks: C-21027r305234_chk
Verify the Ubuntu operation system has a graphical user interface session lock enabled. Note: If the Ubuntu operating system does not have a Graphical User Interface installed, this requirement is Not Applicable. Get the ""lock-enabled"" setting to verify if the graphical user interface session has the lock enabled with the following command: # sudo gsettings get org.gnome.desktop.screensaver lock-enabled true If "lock-enabled" is not set to "true", this is a finding.
Fix: F-21026r305235_fix
Configure the Ubuntu operating system so that it allows a user to lock the current graphical user interface session. Note: If the Ubuntu operating system does not have a Graphical User Interface installed, this requirement is Not Applicable. Set the ""lock-enabled"" setting to allow graphical user interface session locks with the following command: # sudo gsettings set org.gnome.desktop.screensaver lock-enabled true
- RMF Control
- AC-11
- Severity
- M
- CCI
- CCI-000057
- Version
- UBTU-18-010402
- Vuln IDs
-
- V-219303
- V-100829
- Rule IDs
-
- SV-219303r508662_rule
- SV-109933
Checks: C-21028r305237_chk
Verify the Ubuntu operating system initiates a session logout after a 15-minute period of inactivity. Check that the proper auto logout script exists with the following command: # cat /etc/profile.d/autologout.sh TMOUT=900 readonly TMOUT export TMOUT If the file "/etc/profile.d/autologout.sh" does not exist with the contents shown above, the value of "TMOUT" is greater than 900, or the timeout values are commented out, this is a finding.
Fix: F-21027r305238_fix
Configure the Ubuntu operating system to initiate a session logout after a 15-minute period of inactivity. Create a file to contain the system-wide session auto logout script (if it does not already exist) with the following command: # sudo touch /etc/profile.d/autologout.sh Add the following lines to the "/etc/profile.d/autologout.sh" script: TMOUT=900 readonly TMOUT export TMOUT
- RMF Control
- AC-11
- Severity
- M
- CCI
- CCI-000058
- Version
- UBTU-18-010403
- Vuln IDs
-
- V-219304
- V-100831
- Rule IDs
-
- SV-219304r508662_rule
- SV-109935
Checks: C-21029r305240_chk
Verify the Ubuntu operating system has the 'vlock' package installed, by running the following command: # dpkg -l | grep vlock If "vlock" is not installed, this is a finding.
Fix: F-21028r305241_fix
Install the "vlock" (if it is not already installed) package by running the following command: # sudo apt-get install vlock
- RMF Control
- AC-17
- Severity
- M
- CCI
- CCI-000067
- Version
- UBTU-18-010410
- Vuln IDs
-
- V-219306
- V-100835
- Rule IDs
-
- SV-219306r508662_rule
- SV-109939
Checks: C-21031r305246_chk
Verify that the Ubuntu operating system monitors all remote access methods. Check that remote access methods are being logged by running the following command: # grep -E -r '^(auth,authpriv\.\*|daemon\.\*)' /etc/rsyslog.* /etc/rsyslog.d/50-default.conf:auth,authpriv.* /var/log/auth.log /etc/rsyslog.d/50-default.conf:daemon.notice /var/log/messages If "auth.*", "authpriv.*" or "daemon.*" are not configured to be logged in at least one of the config files, this is a finding.
Fix: F-21030r305247_fix
Configure the Ubuntu operating system to monitor all remote access methods by adding the following lines to the "/etc/rsyslog.d/50-default.conf" file: auth.*,authpriv.* /var/log/secure daemon.notice /var/log/messages In order for the changes to take effect the "rsyslog" service must be restarted with the following command: # sudo systemctl restart rsyslog.service
- RMF Control
- AC-17
- Severity
- M
- CCI
- CCI-000068
- Version
- UBTU-18-010411
- Vuln IDs
-
- V-219307
- V-100837
- Rule IDs
-
- SV-219307r508662_rule
- SV-109941
Checks: C-21032r305249_chk
Verify the SSH daemon is configured to only implement DoD-approved encryption. Check the SSH daemon's current configured ciphers by running the following command: # grep -E '^Ciphers ' /etc/ssh/sshd_config Ciphers aes128-ctr,aes192-ctr,aes256-ctr If no lines are returned, or the returned ciphers list contains any cipher not starting with "aes", this is a finding.
Fix: F-21031r305250_fix
Configure the Ubuntu operating system to allow the SSH daemon to only implement DoD-approved encryption. Edit the SSH daemon configuration "/etc/ssh/sshd_config" and remove any ciphers not starting with "aes" and remove any ciphers ending with "cbc". If necessary, append the "Ciphers" line to the "/etc/ssh/sshd_config" document. Ciphers aes128-ctr,aes192-ctr,aes256-ctr In order for the changes to take effect, the SSH daemon must be restarted. # sudo systemctl restart sshd.service
- RMF Control
- IA-2
- Severity
- H
- CCI
- CCI-001941
- Version
- UBTU-18-010412
- Vuln IDs
-
- V-219308
- V-100839
- Rule IDs
-
- SV-219308r508662_rule
- SV-109943
Checks: C-21033r305252_chk
Verify that the Ubuntu operating system enforces SSH protocol 2 for network access. Check the protocol versions that SSH allows with the following command: # grep Protocol /etc/ssh/sshd_config Protocol 2 If the returned line allows for use of protocol "1", is commented out, or the line is missing, this is a finding.
Fix: F-21032r305253_fix
Configure the Ubuntu operating system to enforce SSHv2 for network access to all accounts. Add or update the following line in the "/etc/ssh/sshd_config" file: Protocol 2 Restart the ssh service. # systemctl restart sshd.service
- RMF Control
- MA-4
- Severity
- M
- CCI
- CCI-000877
- Version
- UBTU-18-010414
- Vuln IDs
-
- V-219309
- V-100841
- Rule IDs
-
- SV-219309r508662_rule
- SV-109945
Checks: C-21034r305255_chk
Verify the Ubuntu operating system is configured to use strong authenticators in the establishment of nonlocal maintenance and diagnostic maintenance. Check that "UsePAM" is set to yes in /etc/ssh/sshd_config: # grep UsePAM /etc/ssh/sshd_config UsePAM yes If "UsePAM" is not set to "yes", this is a finding.
Fix: F-21033r305256_fix
Configure the Ubuntu operating system to use strong authentication when establishing nonlocal maintenance and diagnostic sessions. Add or modify the following line to /etc/ssh/sshd_config UsePAM yes
- RMF Control
- MA-4
- Severity
- M
- CCI
- CCI-000879
- Version
- UBTU-18-010415
- Vuln IDs
-
- V-219310
- V-100843
- Rule IDs
-
- SV-219310r508662_rule
- SV-109947
Checks: C-21035r305258_chk
Verify that all network connections associated with SSH traffic automatically terminate after a period of inactivity. Check that "ClientAliveCountMax" variable is set in "/etc/ssh/sshd_config" file by performing the following command: # sudo grep -i clientalivecountmax /etc/ssh/sshd_config ClientAliveCountMax 1 If "ClientAliveCountMax" is not set, or not set to "1", or is commented out, this is a finding.
Fix: F-21034r305259_fix
Configure the Ubuntu operating system to automatically terminate inactive SSH sessions after a period of inactivity. Modify or append the following line in the "/etc/ssh/sshd_config" file replacing "[Count]" with a value of 1: ClientAliveCountMax 1 In order for the changes to take effect, the SSH daemon must be restarted. # sudo systemctl restart sshd.service
- RMF Control
- SC-10
- Severity
- M
- CCI
- CCI-001133
- Version
- UBTU-18-010416
- Vuln IDs
-
- V-219311
- V-100845
- Rule IDs
-
- SV-219311r508662_rule
- SV-109949
Checks: C-21036r485699_chk
Verify that all network connections associated with SSH traffic are automatically terminated at the end of the session or after 10 minutes of inactivity. Check that the "ClientAliveInterval" variable is set to a value of "600" or less by performing the following command: # sudo grep -i clientalive /etc/ssh/sshd_config ClientAliveInterval 600 If "ClientAliveInterval" does not exist, is not set to a value of "600" or less in "/etc/ssh/sshd_config", or is commented out, this is a finding.
Fix: F-21035r485700_fix
Configure the Ubuntu operating system to automatically terminate all network connections associated with SSH traffic at the end of a session or after a 10 minute period of inactivity. Modify or append the following line in the "/etc/ssh/sshd_config" file replacing "[Interval]" with a value of "600" or less: ClientAliveInterval 600 In order for the changes to take effect, the SSH daemon must be restarted. # sudo systemctl restart sshd.service
- RMF Control
- AC-17
- Severity
- H
- CCI
- CCI-001453
- Version
- UBTU-18-010417
- Vuln IDs
-
- V-219312
- V-100847
- Rule IDs
-
- SV-219312r508662_rule
- SV-109951
Checks: C-21037r305264_chk
Verify the Ubuntu operating system configures the SSH daemon to only use Message Authentication Codes (MACs) that employ FIPS 140-2 approved ciphers. Check that the SSH daemon is configured to only use MACs that employ FIPS 140-2 approved ciphers with the following command: # sudo grep -i macs /etc/ssh/sshd_config MACs hmac-sha2-256,hmac-sha2-512 If any ciphers other than "hmac-sha2-256" or "hmac-sha2-512" are listed or the returned line is commented out, this is a finding.
Fix: F-21036r305265_fix
Configure the Ubuntu operating system to allow the SSH daemon to only use Message Authentication Codes (MACs) that employ FIPS 140-2 approved ciphers. Edit the "/etc/ssh/sshd_config" file to uncomment or add the line for the "MACs" keyword and set its value to "hmac-sha2-256" and/or "hmac-sha2-512": MACs hmac-sha2-256,hmac-sha2-512 In order for the changes to take effect, reload the SSH daemon. # sudo systemctl reload sshd.service
- RMF Control
- SC-8
- Severity
- H
- CCI
- CCI-002418
- Version
- UBTU-18-010420
- Vuln IDs
-
- V-219313
- V-100849
- Rule IDs
-
- SV-219313r508662_rule
- SV-109953
Checks: C-21038r305267_chk
Check that the ssh package is installed with the following command: # sudo dpkg -l | grep openssh ii openssh-client 1:7.6p1-4ubuntu0.1 amd64 secure shell (SSH) client, for secure access to remote machines ii openssh-server 1:7.6p1-4ubuntu0.1 amd64 secure shell (SSH) server, for secure access from remote machines ii openssh-sftp-server 1:7.6p1-4ubuntu0.1 amd64 secure shell (SSH) sftp server module, for SFTP access from remote machines If the "openssh" server package is not installed, this is a finding. Check that the "sshd.service" is loaded and active with the following command: # sudo systemctl status sshd.service | egrep -i "(active|loaded)" Loaded: loaded (/lib/systemd/system/ssh.service; enabled; vendor preset: enabled) Active: active (running) since Thu 2019-01-24 22:52:58 UTC; 1 weeks 3 days ago If "sshd.service" is not active or loaded, this is a finding.
Fix: F-21037r305268_fix
Install the "ssh" meta-package on the system with the following command: # sudo apt install ssh Enable the "ssh" service to start automatically on reboot with the following command: # sudo systemctl enable sshd.service Ensure that the "ssh" service is running. # sudo systemctl start sshd.service
- RMF Control
- CM-6
- Severity
- H
- CCI
- CCI-000366
- Version
- UBTU-18-010424
- Vuln IDs
-
- V-219314
- V-100851
- Rule IDs
-
- SV-219314r508662_rule
- SV-109955
Checks: C-21039r305270_chk
Verify that unattended or automatic login via ssh is disabled. Check that unattended or automatic login via ssh is disabled with the following command: # egrep '(Permit(.*?)(Passwords|Environment))' /etc/ssh/sshd_config PermitEmptyPasswords no PermitUserEnvironment no If "PermitEmptyPasswords" or "PermitUserEnvironment" keywords are not set to "no", are missing completely, or they are commented out, this is a finding.
Fix: F-21038r305271_fix
Configure the Ubuntu operating system to allow the SSH daemon to not allow unattended or automatic login to the system. Add or edit the following lines in the "/etc/ssh/sshd_config" file: PermitEmptyPasswords no PermitUserEnvironment no In order for the changes to take effect, the SSH daemon must be restarted. # sudo systemctl restart sshd.service
- RMF Control
- IA-5
- Severity
- M
- CCI
- CCI-001991
- Version
- UBTU-18-010425
- Vuln IDs
-
- V-219315
- V-100853
- Rule IDs
-
- SV-219315r508662_rule
- SV-109957
Checks: C-21040r305273_chk
Verify the Ubuntu operating system, for PKI-based authentication, had valid certificates by constructing a certification path to an accepted trust anchor. Check which pkcs11 module is being used via the use_pkcs11_module in /etc/pam_pkcs11/pam_pkcs11.conf and then ensure "ca" is enabled in "cert_policy" with the following command: # sudo grep use_pkcs11_module /etc/pam_pkcs11/pam_pkcs11.conf | awk '/pkcs11_module opensc {/,/}/' /etc/pam_pkcs11/pam_pkcs11.conf | grep cert_policy | grep ca cert_policy = ca,signature,ocsp_on; If "cert_policy" is not set to "ca", or the line is commented out, this is a finding.
Fix: F-21039r305274_fix
Configure the Ubuntu operating system, for PKI-based authentication, to validate certificates by constructing a certification path to an accepted trust anchor. Determine which pkcs11 module is being used via the use_pkcs11_module in /etc/pam_pkcs11/pam_pkcs11.conf and ensure "ca" is enabled in "cert_policy". Add or update the "cert_policy" to ensure "ca" is enabled: cert_policy = ca,signature,ocsp_on; If the system is missing an "/etc/pam_pkcs11/" directory and an "/etc/pam_pkcs11/pam_pkcs11.conf", find an example to copy into place and modify accordingly at "/usr/share/doc/libpam-pkcs11/examples/pam_pkcs11.conf.example.gz".
- RMF Control
- IA-5
- Severity
- H
- CCI
- CCI-000187
- Version
- UBTU-18-010426
- Vuln IDs
-
- V-219316
- V-100855
- Rule IDs
-
- SV-219316r508662_rule
- SV-109959
Checks: C-21041r305276_chk
Verify the Ubuntu operating system has the 'libpam-pkcs11’ package installed, by running the following command: # dpkg -l | grep libpam-pkcs11 If "libpam-pkcs11" is not installed, this is a finding. Check if use_mappers is set to pwent in /etc/pam_pkcs11/pam_pkcs11.conf file # grep use_mappers /etc/pam_pkcs11/pam_pkcs11.conf use_mappers = pwent If ‘use_mappers’ is not found or is not set to pwent this is a finding.
Fix: F-21040r305277_fix
Install libpam-pkcs11 package on the system. Set use_mappers=pwent in /etc/pam_pkcs11/pam_pkcs11.conf If the system is missing an "/etc/pam_pkcs11/" directory and an "/etc/pam_pkcs11/pam_pkcs11.conf", find an example to copy into place and modify accordingly at "/usr/share/doc/libpam-pkcs11/examples/pam_pkcs11.conf.example.gz".
- RMF Control
- IA-2
- Severity
- M
- CCI
- CCI-001954
- Version
- UBTU-18-010427
- Vuln IDs
-
- V-219317
- V-100857
- Rule IDs
-
- SV-219317r508662_rule
- SV-109961
Checks: C-21042r305279_chk
Verify the Ubuntu operating system uses multifactor authentication for local access to accounts. Check that the "pam_pkcs11.so" option is configured in the "/etc/pam.d/common-auth" file with the following command: # grep pam_pkcs11.so /etc/pam.d/common-auth auth [success=2 default=ignore] pam_pkcs11.so If "pam_pkcs11.so" is not set in "/etc/pam.d/common-auth", this is a finding.
Fix: F-21041r305280_fix
Configure the Ubuntu operating system to use multifactor authentication for local access to accounts. Add or update "pam_pkcs11.so" in "/etc/pam.d/common-auth" to match the following line: auth [success=2 default=ignore] pam_pkcs11.so
- RMF Control
- IA-2
- Severity
- M
- CCI
- CCI-001948
- Version
- UBTU-18-010431
- Vuln IDs
-
- V-219318
- V-100859
- Rule IDs
-
- SV-219318r508662_rule
- SV-109963
Checks: C-21043r305282_chk
Verify the Ubuntu operating system has the packages required for multifactor authentication installed. Check for the presence of the packages required to support multifactor authentication with the following commands: # dpkg -l | grep libpam-pkcs11 ii libpam-pkcs11 0.6.8-4 amd64 Fully featured PAM module for using PKCS#11 smart cards If the "libpam-pkcs11" package is not installed, this is a finding.
Fix: F-21042r305283_fix
Configure the Ubuntu operating system to implement multifactor authentication by installing the required packages. Install the "libpam-pkcs11" package on the system with the following command: # sudo apt install libpam-pkcs11
- RMF Control
- IA-2
- Severity
- M
- CCI
- CCI-001953
- Version
- UBTU-18-010432
- Vuln IDs
-
- V-219319
- V-100861
- Rule IDs
-
- SV-219319r508662_rule
- SV-109965
Checks: C-21044r305285_chk
Verify the Ubuntu operating system accepts Personal Identity Verification (PIV) credentials. Check that the "opensc-pcks11" package is installed on the system with the following command: # dpkg -l | grep opensc-pkcs11 ii opensc-pkcs11:amd64 0.15.0-1Ubuntu1 amd64 Smart card utilities with support for PKCS#15 compatible cards If the "opensc-pcks11" package is not installed, this is a finding.
Fix: F-21043r305286_fix
Configure the Ubuntu operating system to accept Personal Identity Verification (PIV) credentials. Install the "opensc-pkcs11" package using the following command: # sudo apt-get install opensc-pkcs11
- RMF Control
- IA-2
- Severity
- M
- CCI
- CCI-001954
- Version
- UBTU-18-010434
- Vuln IDs
-
- V-219320
- V-100863
- Rule IDs
-
- SV-219320r508662_rule
- SV-109967
Checks: C-21045r305288_chk
Verify the Ubuntu operating system implements certificate status checking for multifactor authentication. Check that certificate status checking for multifactor authentication is implemented with the following command: # sudo grep use_pkcs11_module /etc/pam_pkcs11/pam_pkcs11.conf | awk '/pkcs11_module opensc {/,/}/' /etc/pam_pkcs11/pam_pkcs11.conf | grep cert_policy | grep ocsp_on cert_policy = ca,signature,ocsp_on; If "cert_policy" is not set to "ocsp_on", or the line is commented out, this is a finding.
Fix: F-21044r305289_fix
Configure the Ubuntu operating system to certificate status checking for multifactor authentication. Modify all of the cert_policy lines in "/etc/pam_pkcs11/pam_pkcs11.conf" to include ocsp_on.
- RMF Control
- SC-23
- Severity
- M
- CCI
- CCI-002470
- Version
- UBTU-18-010436
- Vuln IDs
-
- V-219321
- V-100865
- Rule IDs
-
- SV-219321r508662_rule
- SV-109969
Checks: C-21046r305291_chk
Verify the directory containing the root certificates for the Ubuntu operating system only contains certificate files for DoD PKI-established certificate authorities by iterating over all files in the '/etc/ssl/certs' directory and checking if, at least one, has the subject matching "DOD ROOT CA". If none is found, this is a finding.
Fix: F-21045r305292_fix
Add at least one DOD certificate authority to the '/usr/local/share/ca-certificates' directory, then run the 'update-ca-certificates' command.
- RMF Control
- AC-6
- Severity
- L
- CCI
- CCI-002235
- Version
- UBTU-18-010437
- Vuln IDs
-
- V-219322
- V-100867
- Rule IDs
-
- SV-219322r508662_rule
- SV-109971
Checks: C-21047r305294_chk
Verify that the Ubuntu operating system is configured to allow system administrators to pass information to any other Ubuntu operating system administrator or user. Check that "Pam_Apparmor" is installed on the system with the following command: # dpkg -l | grep -i apparmor ii libpam-apparmor 2.10.95-0Ubuntu2.6 If the "Pam_Apparmor" package is not installed, this is a finding. Check that the "AppArmor" daemon is running with the following command: # systemctl status apparmor.service | grep -i active If something other than "Active: active" is returned, this is a finding. Note: Pam_Apparmor must have properly configured profiles. All configurations will be based on the actual system setup and organization. See the "Pam_Apparmor" documentation for more information on configuring profiles.
Fix: F-21046r305295_fix
Configure the Ubuntu operating system to allow system administrators to pass information to any other Ubuntu operating system administrator or user. Install "Pam_Apparmor" (if it is not installed) with the following command: # sudo apt-get install libpam-apparmor Enable/Activate "Apparmor" (if it is not already active) with the following command: # sudo systemctl enable apparmor.service Start "Apparmor" with the following command: # sudo systemctl start apparmor.service Note: Pam_Apparmor must have properly configured profiles. All configurations will be based on the actual system setup and organization. See the "Pam_Apparmor" documentation for more information on configuring profiles.
- RMF Control
- CM-7
- Severity
- M
- CCI
- CCI-001764
- Version
- UBTU-18-010441
- Vuln IDs
-
- V-219323
- V-100869
- Rule IDs
-
- SV-219323r508662_rule
- SV-109973
Checks: C-21048r305297_chk
Verify the operating system prevents program execution in accordance with local policies. Check that apparmor is installed and active by running the following command: # dpkg -l | grep apparmor If the "apparmor" package is not installed, this is a finding. #systemctl is-active apparmor.service active If "active" is not returned, this is a finding. #systemctl is-enabled apparmor.service enabled If "enabled" is not returned, then this is a finding.
Fix: F-21047r305298_fix
Install "Apparmor" (if it is not installed) with the following command: # sudo apt-get install apparmor # sudo systemctl enable apparmor.service Start "Apparmor" with the following command: # sudo systemctl start apparmor.service Note: Apparmor must have properly configured profiles for applications and home directories. All configurations will be based on the actual system setup and organization and normally are on a per role basis. See the "Apparmor" documentation for more information on configuring profiles.
- RMF Control
- CM-7
- Severity
- M
- CCI
- CCI-001774
- Version
- UBTU-18-010442
- Vuln IDs
-
- V-219324
- V-100871
- Rule IDs
-
- SV-219324r508662_rule
- SV-109975
Checks: C-21049r305300_chk
Verify that the Ubuntu operating system is configured to employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs and access to user home directories. Check that "Apparmor" is configured to employ application whitelisting and home directory access control with the following command: # sudo apparmor_status apparmor module is loaded. 17 profiles are loaded. 17 profiles are in enforce mode. /sbin/dhclient /usr/bin/lxc-start ... 0 processes are in complain mode. 0 processes are unconfined but have a profile defined. If the defined profiles do not match the organization's list of authorized software, this is a finding.
Fix: F-21048r305301_fix
Configure the Ubuntu operating system to employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs. Install "Apparmor" (if it is not installed) with the following command: # sudo apt-get install apparmor Enable "Apparmor" (if it is not already active) with the following command: # sudo systemctl enable apparmor.service Start "Apparmor" with the following command: # sudo systemctl start apparmor.service Note: Apparmor must have properly configured profiles for applications and home directories. All configurations will be based on the actual system setup and organization and normally are on a per role basis. See the "Apparmor" documentation for more information on configuring profiles.
- RMF Control
- IA-2
- Severity
- M
- CCI
- CCI-000764
- Version
- UBTU-18-010444
- Vuln IDs
-
- V-219325
- V-100873
- Rule IDs
-
- SV-219325r508662_rule
- SV-109977
Checks: C-21050r305303_chk
Verify that the Ubuntu operating system contains no duplicate User IDs (UIDs) for interactive users. Check that the Ubuntu operating system contains no duplicate UIDs for interactive users with the following command: # awk -F ":" 'list[$3]++{print $1, $3}' /etc/passwd If output is produced, and the accounts listed are interactive user accounts, this is a finding.
Fix: F-21049r305304_fix
Edit the file "/etc/passwd" and provide each interactive user account that has a duplicate User ID (UID) with a unique UID.
- RMF Control
- IA-4
- Severity
- M
- CCI
- CCI-000795
- Version
- UBTU-18-010445
- Vuln IDs
-
- V-219326
- V-100875
- Rule IDs
-
- SV-219326r508662_rule
- SV-109979
Checks: C-21051r305306_chk
Verify the account identifiers (individuals, groups, roles, and devices) are disabled after 35 days of inactivity with the following command: Check the account inactivity value by performing the following command: # sudo grep INACTIVE /etc/default/useradd INACTIVE=35 If "INACTIVE" is not set to a value 0<[VALUE]<=35, or is commented out, this is a finding.
Fix: F-21050r305307_fix
Configure the Ubuntu operating system to disable account identifiers after 35 days of inactivity after the password expiration. Run the following command to change the configuration for adduser: # sudo useradd -D -f 35 Note: DoD recommendation is 35 days, but a lower value is acceptable. The value "0" will disable the account immediately after the password expires.
- RMF Control
- AC-2
- Severity
- L
- CCI
- CCI-001682
- Version
- UBTU-18-010447
- Vuln IDs
-
- V-219327
- V-100877
- Rule IDs
-
- SV-219327r508662_rule
- SV-109981
Checks: C-21052r305309_chk
Verify the Ubuntu operating system expires emergency accounts within 72 hours or less. For every emergency account, run the following command to obtain its account expiration information. # sudo chage -l account_name | grep expires Password expires : Aug 07, 2019 Account expires : Aug 07, 2019 Verify each of these accounts has an expiration date set within 72 hours of accounts' creation. If any of these accounts do not expire within 72 hours of that account's creation, this is a finding.
Fix: F-21051r305310_fix
If an emergency account must be created, configure the system to terminate the account after a 72 hour time period with the following command to set an expiration date on it. Substitute "account_name" with the account to be created. # sudo chage -E $(date -d "+3 days" +%F) account_name
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- UBTU-18-010448
- Vuln IDs
-
- V-219328
- V-100879
- Rule IDs
-
- SV-219328r508662_rule
- SV-109983
Checks: C-21053r305312_chk
Verify the Ubuntu operating system defines default permissions for all authenticated users in such a way that the user can only read and modify their own files. Check that the Ubuntu operating system defines default permissions for all authenticated users with the following command: # grep -i "umask" /etc/login.defs UMASK 077 If the "UMASK" variable is set to "000", this is a finding with the severity raised to a CAT I. If the value of "UMASK" is not set to "077", "UMASK" is commented out or "UMASK" is missing completely, this is a finding.
Fix: F-21052r305313_fix
Configure the system to define the default permissions for all authenticated users in such a way that the user can only read and modify their own files. Edit the "UMASK" parameter in the "/etc/login.defs" file to match the example below: UMASK 077
- RMF Control
- AC-2
- Severity
- M
- CCI
- CCI-000016
- Version
- UBTU-18-010449
- Vuln IDs
-
- V-219329
- V-100881
- Rule IDs
-
- SV-219329r508662_rule
- SV-109985
Checks: C-21054r305315_chk
Verify the Ubuntu operating system expires temporary user accounts within 72 hours or less. For every existing temporary account, run the following command to obtain its account expiration information. # sudo chage -l system_account_name | grep expires Password expires : Aug 07, 2019 Account expires : Aug 07, 2019 Verify each of these accounts has an expiration date set within 72 hours of accounts' creation. If any temporary account does not expire within 72 hours of that account's creation, this is a finding.
Fix: F-21053r305316_fix
If a temporary account must be created configure the system to terminate the account after a 72 hour time period with the following command to set an expiration date on it. Substitute "system_account_name" with the account to be created. # sudo chage -E $(date -d "+3 days" +%F) system_account_name
- RMF Control
- SC-5
- Severity
- M
- CCI
- CCI-001095
- Version
- UBTU-18-010500
- Vuln IDs
-
- V-219330
- V-100883
- Rule IDs
-
- SV-219330r508662_rule
- SV-109987
Checks: C-21055r305318_chk
Verify the Ubuntu operating system is configured to use TCP syncookies. Check the value of TCP syncookies with the following command: # sysctl net.ipv4.tcp_syncookies net.ipv4.tcp_syncookies = 1 If the value is not "1", this is a finding. Check the saved value of TCP syncookies with the following command: # sudo grep -i net.ipv4.tcp_syncookies /etc/sysctl.conf /etc/sysctl.d/* | grep -v '#' If no output is returned, this is a finding.
Fix: F-21054r305319_fix
Configure the Ubuntu operating system to use TCP syncookies, by running the following command: # sudo sysctl -w net.ipv4.tcp_syncookies=1 If "1" is not the system's default value then add or update the following line in "/etc/sysctl.conf": net.ipv4.tcp_syncookies = 1
- RMF Control
- AU-8
- Severity
- M
- CCI
- CCI-001891
- Version
- UBTU-18-010501
- Vuln IDs
-
- V-219331
- V-100885
- Rule IDs
-
- SV-219331r508662_rule
- SV-109989
Checks: C-21056r305321_chk
If the system is not networked this requirement is Not Applicable. The system clock must be configured to compare the system clock at least every 24 hours to the authoritative time source. Check the value of "maxpoll" in the "/etc/chrony/chrony.conf" file with the following command: # sudo grep maxpoll /etc/chrony/chrony.conf server tick.usno.navy.mil iburst maxpoll 17 If "maxpoll" is not set to "17" or does not exist, this is a finding. Verify that the "chrony.conf" file is configured to an authoritative DoD time source by running the following command: # grep -i server /etc/chrony/chrony.conf server tick.usno.navy.mil iburst maxpoll 17 server tock.usno.navy.mil iburst maxpoll 17 server ntp2.usno.navy.mil iburst maxpoll 17 If the parameter "server" is not set, is not set to an authoritative DoD time source, or is commented out, this is a finding.
Fix: F-21055r305322_fix
If the system is not networked this requirement is Not Applicable. To configure the system clock to compare the system clock at least every 24 hours to the authoritative time source, edit the "/etc/ntp.conf" file. Add or correct the following lines, by replacing "[source]" in the following line with an authoritative DoD time source. server [source] iburst maxpoll = 17 If the "chrony" service was running and the value of "maxpoll" or "server" was updated then the service must be restarted using the following command: # sudo systemctl restart chrony.service
- RMF Control
- AU-8
- Severity
- L
- CCI
- CCI-002046
- Version
- UBTU-18-010502
- Vuln IDs
-
- V-219332
- V-100887
- Rule IDs
-
- SV-219332r508662_rule
- SV-109991
Checks: C-21057r305324_chk
Verify the operating system synchronizes internal system clocks to the authoritative time source when the time difference is greater than one second. Check the value of "makestep" by running the following command: # sudo grep makestep /etc/chrony/chrony.conf makestep 1 -1 If the makestep option is commented out or is not set to "1 -1", this is a finding.
Fix: F-21056r305325_fix
Configure chrony to synchronize the internal system clocks to the authoritative source when the time difference is greater than one second by doing the following, Edit the /etc/chrony/chrony.conf file and add: makestep 1 -1 Restart the chrony service, # sudo systemctl restart chrony.service
- RMF Control
- AU-8
- Severity
- L
- CCI
- CCI-001890
- Version
- UBTU-18-010503
- Vuln IDs
-
- V-219333
- V-100889
- Rule IDs
-
- SV-219333r508662_rule
- SV-109993
Checks: C-21058r305327_chk
The time zone must be configured to use Coordinated Universal Time (UTC) or Greenwich Mean Time (GMT). To verify run the following command. # sudo timedatectl status | grep -i "time zone" Timezone: UTC (UTC, +0000) If "Timezone" is not set to UTC or GMT, this is a finding.
Fix: F-21057r305328_fix
To configure the system time zone to use Coordinated Universal Time (UTC) or Greenwich Mean Time (GMT), run the following command replacing [ZONE] with UTC or GMT. # sudo timedatectl set-timezone [ZONE]
- RMF Control
- CM-7
- Severity
- M
- CCI
- CCI-000382
- Version
- UBTU-18-010504
- Vuln IDs
-
- V-219334
- V-100891
- Rule IDs
-
- SV-219334r508662_rule
- SV-109995
Checks: C-21059r305330_chk
Verify the Ubuntu operating system is configured to prohibit or restrict the use of functions, ports, protocols, and/or services as defined in the Ports, Protocols, and Services Management (PPSM) Category Assignments List (CAL) and vulnerability assessments. Check the firewall configuration for any unnecessary or prohibited functions, ports, protocols, and/or services by running the following command: # sudo ufw show raw Chain OUTPUT (policy ACCEPT) target prot opt sources destination Chain INPUT (policy ACCEPT 1 packets, 40 bytes) pkts bytes target prot opt in out source destination Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination Ask the system administrator for the site or program PPSM CLSA. Verify the services allowed by the firewall match the PPSM Component Local Services Assessment (CLSA). If there are any additional ports, protocols, or services that are not included in the PPSM CLSA, this is a finding. If there are any ports, protocols, or services that are prohibited by the PPSM CAL, this is a finding.
Fix: F-21058r305331_fix
Add all ports, protocols or services allowed by the PPSM CLSA by using the following command: # ufw allow <direction> <port/protocol/service> where the direction is 'in' or 'out' and the port is the one corresponding to the protocol or service allowed. To deny access to port, protocols or services, use: # ufw deny <direction> <port/protocol/service>
- RMF Control
- SC-24
- Severity
- M
- CCI
- CCI-001190
- Version
- UBTU-18-010505
- Vuln IDs
-
- V-219335
- V-100893
- Rule IDs
-
- SV-219335r508662_rule
- SV-109997
Checks: C-21060r305333_chk
Verify that kernel core dumps are disabled unless needed. Check if "kdump" service is active with the following command: # systemctl is-active kdump.service inactive If the "kdump" service is active, ask the System Administrator if the use of the service is required and documented with the Information System Security Officer (ISSO). If the service is active and is not documented, this is a finding.
Fix: F-21059r305334_fix
If kernel core dumps are not required, disable the "kdump" service with the following command: # systemctl disable kdump.service If kernel core dumps are required, document the need with the Information System Security Officer (ISSO).
- RMF Control
- AU-9
- Severity
- M
- CCI
- CCI-001496
- Version
- UBTU-18-010506
- Vuln IDs
-
- V-219336
- V-100895
- Rule IDs
-
- SV-219336r508662_rule
- SV-109999
Checks: C-21061r305336_chk
Verify that Advanced Intrusion Detection Environment (AIDE) is properly configured to use cryptographic mechanisms to protect the integrity of audit tools. Check the selection lines that aide is configured to add/check with the following command: # egrep '(\/sbin\/(audit|au))' /etc/aide/aide.conf /sbin/auditctl p+i+n+u+g+s+b+acl+xattrs+sha512 /sbin/auditd p+i+n+u+g+s+b+acl+xattrs+sha512 /sbin/ausearch p+i+n+u+g+s+b+acl+xattrs+sha512 /sbin/aureport p+i+n+u+g+s+b+acl+xattrs+sha512 /sbin/autrace p+i+n+u+g+s+b+acl+xattrs+sha512 /sbin/audispd p+i+n+u+g+s+b+acl+xattrs+sha512 /sbin/augenrules p+i+n+u+g+s+b+acl+xattrs+sha512 If any of the seven audit tools does not have an appropriate selection line, this is a finding.
Fix: F-21060r305337_fix
Add or update the following selection lines to "/etc/aide/aide.conf", in order to protect the integrity of the audit tools. # Audit Tools /sbin/auditctl p+i+n+u+g+s+b+acl+xattrs+sha512 /sbin/auditd p+i+n+u+g+s+b+acl+xattrs+sha512 /sbin/ausearch p+i+n+u+g+s+b+acl+xattrs+sha512 /sbin/aureport p+i+n+u+g+s+b+acl+xattrs+sha512 /sbin/autrace p+i+n+u+g+s+b+acl+xattrs+sha512 /sbin/audispd p+i+n+u+g+s+b+acl+xattrs+sha512 /sbin/augenrules p+i+n+u+g+s+b+acl+xattrs+sha512
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- UBTU-18-010507
- Vuln IDs
-
- V-219337
- V-100897
- Rule IDs
-
- SV-219337r508662_rule
- SV-110001
Checks: C-21062r485706_chk
Verify the Uncomplicated Firewall is enabled on the system by running the following command: # systemctl is-enabled ufw If the above command returns the status as "disabled", this is a finding. Verify the Uncomplicated Firewall is active on the system by running the following command: # sudo systemctl is-active ufw If the above command returns 'inactive' or any kind of error, this is a finding. If the Uncomplicated Firewall is not installed ask the System Administrator if another application firewall is installed. If no application firewall is installed this is a finding.
Fix: F-21061r485707_fix
Enable the Uncomplicated Firewall by using the following command: # sudo systemctl enable ufw.service If the Uncomplicated Firewall is not currently running on the system, start it with the following command: # sudo systemctl start ufw.service
- RMF Control
- SI-6
- Severity
- M
- CCI
- CCI-002702
- Version
- UBTU-18-010508
- Vuln IDs
-
- V-219338
- V-100899
- Rule IDs
-
- SV-219338r508662_rule
- SV-110003
Checks: C-21063r305342_chk
Verify that Advanced Intrusion Detection Environment (AIDE) notifies the system administrator when anomalies in the operation of any security functions are discovered. Check that AIDE notifies the system administrator when anomalies in the operation of any security functions are discovered with the following command: #sudo grep SILENTREPORTS /etc/default/aide SILENTREPORTS=no If SILENTREPORTS is uncommented and set to yes, this is a finding.
Fix: F-21062r305343_fix
Configure the Ubuntu operating system to notify designated personnel if baseline configurations are changed in an unauthorized manner. Modify the "SILENTREPORTS" parameter in the "/etc/default/aide" file with a value of "no" if it does not already exist.
- RMF Control
- IA-3
- Severity
- M
- CCI
- CCI-001958
- Version
- UBTU-18-010509
- Vuln IDs
-
- V-219339
- V-100919
- Rule IDs
-
- SV-219339r508662_rule
- SV-110023
Checks: C-21064r305345_chk
Verify that Ubuntu operating system disables ability to load the USB storage kernel module. # grep usb-storage /etc/modprobe.d/* | grep "/bin/true" install usb-storage /bin/true If the command does not return any output, or the line is commented out, this is a finding. Verify the operating system disables the ability to use USB mass storage device. # grep usb-storage /etc/modprobe.d/* | grep -i "blacklist" blacklist usb-storage If the command does not return any output, or the line is commented out, this is a finding.
Fix: F-21063r305346_fix
Configure the Ubuntu operating system to disable using the USB storage kernel module. Create a file under "/etc/modprobe.d" to contain the following: # sudo su -c "echo install usb-storage /bin/true >> /etc/modprobe.d/DISASTIG.conf" Configure the operating system to disable the ability to use USB mass storage devices. # sudo su -c "echo blacklist usb-storage >> /etc/modprobe.d/DISASTIG.conf"
- RMF Control
- SC-5
- Severity
- M
- CCI
- CCI-002385
- Version
- UBTU-18-010512
- Vuln IDs
-
- V-219340
- V-100901
- Rule IDs
-
- SV-219340r508662_rule
- SV-110005
Checks: C-21065r305348_chk
Verify an application firewall is configured to rate limit any connection to the system. Check that the Uncomplicated Firewall is configured to rate limit any connection to the system with the following command: # sudo ufw show raw Chain ufw-user-input (1 references) pkts bytes target prot opt in out source destination 0 0 ufw-user-limit all -- eth0 * 0.0.0.0/0 0.0.0.0/0 ctstate NEW recent: UPDATE seconds: 30 hit_count: 6 name: DEFAULT side: source mask: 255.255.255.255 0 0 ufw-user-limit-accept all -- eth0 * 0.0.0.0/0 0.0.0.0/0 If any service is not rate limited by the Uncomplicated Firewall, this is a finding.
Fix: F-21064r305349_fix
Configure the application firewall to protect against or limit the effects of Denial of Service (DoS) attacks by ensuring the Ubuntu operating system is implementing rate-limiting measures on impacted network interfaces. Run the following command replacing "[service]" with the service that needs to be rate limited. # sudo ufw limit [service] Or rate-limiting can be done on an interface. An example of adding a rate-limit on the eth0 interface: # sudo ufw limit in on eth0
- RMF Control
- SI-16
- Severity
- M
- CCI
- CCI-002824
- Version
- UBTU-18-010513
- Vuln IDs
-
- V-219341
- V-100903
- Rule IDs
-
- SV-219341r508662_rule
- SV-110007
Checks: C-21066r305351_chk
Verify the NX (no-execution) bit flag is set on the system. Check that the no-execution bit flag is set with the following commands: # dmesg | grep -i "execute disable" [ 0.000000] NX (Execute Disable) protection: active If "dmesg" does not show "NX (Execute Disable) protection: active", check the cpuinfo settings with the following command: # grep flags /proc/cpuinfo | grep -w nx | sort -u flags : fpu vme de pse tsc ms nx rdtscp lm constant_tsc If "flags" does not contain the "nx" flag, this is a finding.
Fix: F-21065r305352_fix
Configure the Ubuntu operating system to enable NX. If "nx" is not showing up in /proc/cpuinfo and the system's BIOS setup configuration permits toggling the No Execution bit, then set it to "enable".
- RMF Control
- SI-16
- Severity
- M
- CCI
- CCI-002824
- Version
- UBTU-18-010514
- Vuln IDs
-
- V-219342
- V-100905
- Rule IDs
-
- SV-219342r508662_rule
- SV-110009
Checks: C-21067r485709_chk
Verify the Ubuntu operating system implements address space layout randomization (ASLR). Check that ASLR is configured on the system with the following command: # sudo sysctl kernel.randomize_va_space kernel.randomize_va_space = 2 Verify the kernel parameter "randomize_va_space" is set to 2 with the following command: # cat /proc/sys/kernel/randomize_va_space 2 If "kernel.randomize_va_space" is not set to 2, this is a finding. Check the saved value of the kernel.randomize_va_space variable is not different from 2. # sudo egrep -R "^kernel.randomize_va_space=[^2]" /etc/sysctl.conf /etc/sysctl.d If this returns a result, this is a finding.
Fix: F-21066r485710_fix
Set the "kernel.randomize_va_space" entry found in the "/etc/sysctl.conf" file to a value of "2". After the line has been modified the kernel settings from all system configuration files must be reloaded; before any of the changes will take effect. Run the following command to reload all of the kernel system configuration files: # sudo sysctl --system
- RMF Control
- SI-6
- Severity
- M
- CCI
- CCI-002696
- Version
- UBTU-18-010515
- Vuln IDs
-
- V-219343
- V-100907
- Rule IDs
-
- SV-219343r508662_rule
- SV-110011
Checks: C-21068r305357_chk
Verify that Advanced Intrusion Detection Environment (AIDE) is installed and verifies the correct operation of all security functions. Check that the AIDE package is installed with the following command: # sudo dpkg -l | grep aide aide/xenial,now 0.16~a2.git20130520-3 amd64 [installed] If AIDE is not installed, ask the System Administrator how file integrity checks are performed on the system. If there is no application installed to perform integrity checks, this is a finding.
Fix: F-21067r305358_fix
Install the AIDE package by running the following command: # sudo apt-get install aide
- RMF Control
- SI-6
- Severity
- M
- CCI
- CCI-002699
- Version
- UBTU-18-010516
- Vuln IDs
-
- V-219344
- V-100909
- Rule IDs
-
- SV-219344r508662_rule
- SV-110013
Checks: C-21069r305360_chk
Verify that Advanced Intrusion Detection Environment (AIDE) performs a verification of the operation of security functions every 30 days. Note: A file integrity tool other than AIDE may be used, but the tool must be executed at least once per week. Check that AIDE is being executed every 30 days or less with the following command: # ls -al /etc/cron.daily/aide -rwxr-xr-x 1 root root 26049 Oct 24 2014 /etc/cron.daily/aide If the "/etc/cron.daily/aide" file does not exist or a cron job is not configured to run at least every 30 days, this is a finding.
Fix: F-21068r305361_fix
The cron file for AIDE is fairly complex as it creates the report. This file is installed with the aide-common package and the default can be restored by copying it from another location: # sudo cp /usr/share/aide/config/cron.daily/aide /etc/cron.daily/aide
- RMF Control
- SC-8
- Severity
- M
- CCI
- CCI-002418
- Version
- UBTU-18-010521
- Vuln IDs
-
- V-219346
- V-100913
- Rule IDs
-
- SV-219346r508662_rule
- SV-110017
Checks: C-21071r305366_chk
Verify that there are no wireless interfaces configured on the system. Check that the system does not have active wireless interfaces with the following command: Note: This requirement is Not Applicable for systems that do not have physical wireless network radios. # ifconfig -a | more eth0 Link encap:Ethernet HWaddr ff:ff:ff:ff:ff:ff inet addr:192.168.2.100 Bcast:192.168.2.255 Mask:255.255.255.0 ... eth1 IEEE 802.11b ESSID:"tacnet" Mode:Managed Frequency:2.412 GHz Access Point: 00:40:E7:22:45:CD ... lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 inet6 addr: ::1/128 Scope:Host ... If a wireless interface is configured and has not been documented and approved by the Information System Security Officer (ISSO), this is a finding.
Fix: F-21070r305367_fix
Configure the system to disable all wireless network interfaces with the following command: # sudo ifdown [ADAPTER_NAME]