CloudLinux AlmaLinux OS 9 Security Technical Implementation Guide

Checks: C-73134r1049087_chk

Note: This requirement assumes the use of the AlmaLinux OS 9 default graphical user interface, the GNOME desktop environment. If the system does not have any graphical user interface installed, this requirement is Not Applicable. Verify AlmaLinux OS 9 initiates a session lock after a 10-minute period of inactivity for graphical user interfaces with the following command: $ gsettings get org.gnome.desktop.session idle-delay uint32 900 If "idle-delay" is set to "0" or a value greater than "900", this is a finding.

Fix: F-73035r1049088_fix

Configure AlmaLinux OS 9 to initiate a screensaver after a 10-minute period of inactivity for graphical user interfaces. Create a database to contain the systemwide screensaver settings (if it does not already exist) with the following command: $ touch /etc/dconf/db/local.d/00-screensaver Edit /etc/dconf/db/local.d/00-screensaver and add or update the following lines: [org/gnome/desktop/session] # Set the lock time out to 900 seconds before the session is considered idle idle-delay=uint32 900 Update the system databases: $ dconf update

Generate Mitigation Statement:

Checks: C-73135r1049090_chk

Note: This requirement assumes the use of the AlmaLinux OS 9 default graphical user interface, the GNOME desktop environment. If the system does not have any graphical user interface installed, this requirement is Not Applicable. To ensure the screensaver is configured to be blank, run the following command: $ gsettings get org.gnome.desktop.screensaver picture-uri If properly configured, the output should be "''". To ensure that users cannot set the screensaver background, run the following: $ grep picture-uri /etc/dconf/db/local.d/locks/* If properly configured, the output should be "/org/gnome/desktop/screensaver/picture-uri". If it is not set or configured properly, this is a finding.

Fix: F-73036r1049091_fix

Configure AlmaLinux OS 9 to prevent a user from overriding the picture-uri setting for graphical user interfaces. First, in the file "/etc/dconf/db/local.d/00-security-settings" add or update the following lines: [org/gnome/desktop/screensaver] picture-uri='' Then, prevent user modification by adding the following line to "/etc/dconf/db/local.d/locks/00-security-settings-lock": /org/gnome/desktop/screensaver/picture-uri Update the dconf system databases: $ dconf update

Generate Mitigation Statement:

Checks: C-73136r1049093_chk

Note: This requirement assumes the use of the AlmaLinux OS 9 default graphical user interface, the GNOME desktop environment. If the system does not have any graphical user interface installed, this requirement is Not Applicable. Verify AlmaLinux OS 9 prevents a user from overriding settings for graphical user interfaces. Determine which profile the system database is using with the following command: $ grep system-db /etc/dconf/profile/user system-db:local Check that graphical settings are locked from nonprivileged user modification with the following command: Note: The example below is using the database "local" for the system, so the path is "/etc/dconf/db/local.d". This path must be modified if a database other than "local" is being used. $ grep -i idle /etc/dconf/db/local.d/locks/* /org/gnome/desktop/session/idle-delay If the command does not return at least the example result, this is a finding.

Fix: F-73037r1049094_fix

Configure AlmaLinux OS 9 to prevent a user from overriding settings for graphical user interfaces. Create a database to contain the systemwide screensaver settings (if it does not already exist) with the following command: Note: The example below is using the database "local" for the system, so if the system is using another database in "/etc/dconf/profile/user", the file should be created under the appropriate subdirectory. $ touch /etc/dconf/db/local.d/locks/session Add the following setting to prevent nonprivileged users from modifying it: /org/gnome/desktop/session/idle-delay Update the system databases: $ dconf update

Generate Mitigation Statement:

Checks: C-73137r1049096_chk

Note: This requirement assumes the use of the AlmaLinux OS 9 default graphical user interface, the GNOME desktop environment. If the system does not have any graphical user interface installed, this requirement is Not Applicable. Verify AlmaLinux OS 9 initiates a session lock for graphical user interfaces when the screensaver is activated with the following command: $ gsettings get org.gnome.desktop.screensaver lock-delay uint32 5 If the "uint32" setting is not set to "5" or less, or is missing, this is a finding.

Fix: F-73038r1049097_fix

Configure AlmaLinux OS 9 to initiate a session lock for graphical user interfaces when a screensaver is activated. Create a database to contain the systemwide screensaver settings (if it does not already exist) with the following command: Note: The example below is using the database "local" for the system, so if the system is using another database in "/etc/dconf/profile/user", the file should be created under the appropriate subdirectory. $ touch /etc/dconf/db/local.d/00-screensaver [org/gnome/desktop/screensaver] lock-delay=uint32 5 The "uint32" must be included along with the integer key values as shown. Update the system databases: $ dconf update

Generate Mitigation Statement:

Checks: C-73138r1049099_chk

Note: This requirement assumes the use of the AlmaLinux OS 9 default graphical user interface, the GNOME desktop environment. If the system does not have any graphical user interface installed, this requirement is Not Applicable. Verify AlmaLinux OS 9 prevents a user from overriding settings for graphical user interfaces. Determine which profile the system database is using with the following command: $ grep system-db /etc/dconf/profile/user system-db:local Check that graphical settings are locked from nonprivileged user modification with the following command: Note: The example below is using the database "local" for the system, so the path is "/etc/dconf/db/local.d". This path must be modified if a database other than "local" is being used. $ grep -i lock-delay /etc/dconf/db/local.d/locks/* /etc/dconf/db/local.d/locks/session:/org/gnome/desktop/screensaver/lock-delay If the command does not return at least the example result, this is a finding.

Fix: F-73039r1049100_fix

Configure AlmaLinux OS 9 to prevent a user from overriding settings for graphical user interfaces. Create a database to contain the systemwide screensaver settings (if it does not already exist) with the following command: Note: The example below is using the database "local" for the system, so if the system is using another database in "/etc/dconf/profile/user", the file should be created under the appropriate subdirectory. $ touch /etc/dconf/db/local.d/locks/session Add the following setting to prevent nonprivileged users from modifying it: /org/gnome/desktop/screensaver/lock-delay Update the system databases: $ dconf update

Generate Mitigation Statement:

Checks: C-73139r1049102_chk

Verify AlmaLinux OS 9 is configured to exit interactive command shell user sessions after 10 minutes of inactivity or less with the following command: $ grep TMOUT /etc/profile /etc/profile.d/*.sh /etc/profile.d/tmout.sh:declare -xr TMOUT=600 If "TMOUT" is not set to "600" or less in a script located in the "/etc/'profile.d/ directory, is missing or is commented out, this is a finding.

Fix: F-73040r1049103_fix

Configure AlmaLinux OS 9 to exit interactive command shell user sessions after 10 minutes of inactivity using the following command: echo "declare -xr TMOUT=600" > /etc/profile.d/tmout.sh

Generate Mitigation Statement:

Checks: C-73140r1049105_chk

Note: This requirement assumes the use of the AlmaLinux OS 9 default graphical user interface, the GNOME desktop environment. If the system does not have any graphical user interface installed, this requirement is Not Applicable. Verify AlmaLinux OS 9 enables a user's session lock until that user re-establishes access using established identification and authentication procedures with the following command: $ grep -R removal-action= /etc/dconf/db/* /etc/dconf/db/distro.d/00-security-settings:removal-action='lock-screen' If the "removal-action='lock-screen'" setting is missing or commented out from the dconf database files, this is a finding.

Fix: F-73041r1049106_fix

Configure AlmaLinux OS 9 to enable a user's session lock until that user re-establishes access using established identification and authentication procedures. Select or create an authselect profile and incorporate the "with-smartcard-lock-on-removal" feature with the following example: $ authselect select sssd with-smartcard with-smartcard-lock-on-removal Alternatively, the dconf settings can be edited in the /etc/dconf/db/* location. Add or update the [org/gnome/settings-daemon/peripherals/smartcard] section of the /etc/dconf/db/local.d/00-security-settings" database file and add or update the following lines: [org/gnome/settings-daemon/peripherals/smartcard] removal-action='lock-screen' Then update the dconf system databases: $ dconf update

Generate Mitigation Statement:

Checks: C-73141r1049108_chk

Verify AlmaLinux OS 9 disables the ability of the user to override the smart card removal action setting. Note: This requirement assumes the use of the AlmaLinux OS 9 default graphical user interface, the GNOME desktop environment. If the system does not have any graphical user interface installed, this requirement is Not Applicable. Determine which profile the system database is using with the following command: $ grep system-db /etc/dconf/profile/user system-db:local Check that the removal action setting is locked from nonprivileged user modification with the following command: Note: The example below is using the database "local" for the system, so the path is "/etc/dconf/db/local.d". This path must be modified if a database other than "local" is being used. $ grep 'removal-action' /etc/dconf/db/local.d/locks/* /etc/dconf/db/local.d/locks/00-security-settings-lock:/org/gnome/settings-daemon/peripherals/smartcard/removal-action If the command does not return at least the example result, this is a finding.

Fix: F-73042r1047707_fix

Add the following line to "/etc/dconf/db/local.d/locks/00-security-settings-lock" to prevent user override of the smart card removal action: /org/gnome/settings-daemon/peripherals/smartcard/removal-action Then, update the dconf system databases: $ dconf update

Generate Mitigation Statement:

Checks: C-73142r1049110_chk

Verify AlmaLinux OS 9 logs SSH connection attempts and failures to the server. Check what the SSH daemon's "LogLevel" option is set to with the following command: $ sshd -T | grep loglevel loglevel VERBOSE If a value of "VERBOSE" is not returned, or is commented out, this is a finding.

Fix: F-73043r1049111_fix

Configure AlmaLinux OS 9 to log SSH connection attempts by running the following command: $ echo "LogLevel VERBOSE" > /etc/ssh/sshd_config.d/40-loglevel.conf

Generate Mitigation Statement:

Checks: C-73143r1049113_chk

Verify that AlmaLinux OS 9 monitors all remote access methods, by running the following command: $ grep -rsE '^(auth|authpriv|daemon)\.\*' /etc/rsyslog.conf /etc/rsyslog.d/*.conf /etc/rsyslog.conf:authpriv.* /var/log/secure If "auth.*", "authpriv.*" or "daemon.*" are not configured to be logged, this is a finding.

Fix: F-73044r1047713_fix

Add or update the following line to the "/etc/rsyslog.conf" file or a .conf file within /etc/rsyslog.d/: auth.*;authpriv.*;daemon.* /var/log/secure

Generate Mitigation Statement:

Checks: C-73144r1047715_chk

Verify the SSH client is configured to use only ciphers employing FIPS 140-3 approved algorithms with the following command: $ grep -i ciphers /etc/crypto-policies/back-ends/openssh.config Ciphers aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes128-ctr If the cipher entries in the "openssh.config" file have any ciphers other than "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes128-ctr", the order differs from the example above, they are missing, or commented out, this is a finding.

Fix: F-73045r1049115_fix

Configure the AlmaLinux OS 9 SSH client to use only ciphers employing FIPS 140-3 approved algorithms by updating the "/etc/crypto-policies/back-ends/openssh.config" file with the following line: Ciphers aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes128-ctr A reboot is required for the changes to take effect.

Generate Mitigation Statement:

Checks: C-73145r1049117_chk

Verify that systemwide crypto policies are in effect with the following command: $ sudo grep Include /etc/ssh/sshd_config /etc/ssh/sshd_config.d/* /etc/ssh/sshd_config:Include /etc/ssh/sshd_config.d/*.conf /etc/ssh/sshd_config.d/50-redhat.conf:Include /etc/crypto-policies/back-ends/opensshserver.config If "Include /etc/ssh/sshd_config.d/*.conf" or "Include /etc/crypto-policies/back-ends/opensshserver.config" are not included in the system sshd config or the file "/etc/ssh/sshd_config.d/50-redhat.conf" is missing, this is a finding.

Fix: F-73046r1049118_fix

Configure the AlmaLinux OS 9 SSH daemon to use systemwide crypto policies by running the following commands: $ sudo dnf reinstall openssh-clients

Generate Mitigation Statement:

Checks: C-73146r1047721_chk

Verify the SSH client is configured to use only ciphers employing FIPS 140-3 approved algorithms with the following command: $ grep -i macs /etc/crypto-policies/back-ends/openssh.config MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256 If the MACs entries in the "openssh.config" file have any hashes other than "MACs hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512", the order differs from the example above, they are missing, or commented out, this is a finding.

Fix: F-73047r1049120_fix

Configure the AlmaLinux OS 9 SSH client to use only MACs employing FIPS 140-3 approved algorithms by updating the "/etc/crypto-policies/back-ends/openssh.config" file with the following line: MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256 A reboot is required for the changes to take effect.

Generate Mitigation Statement:

Checks: C-73147r1047724_chk

Verify the SSH server is configured to use only ciphers employing FIPS 140-3 approved algorithms with the following command: First, ensure that FIPS mode is enabled with the following command: $ cat /proc/sys/crypto/fips_enabled 1 If the command does not return a "1", then the systemwide crypto policy is not set to FIPS, and this is a finding. To verify the Ciphers in the systemwide SSH configuration file, use the following command: $ sudo grep -i ciphers /etc/crypto-policies/back-ends/opensshserver.config Ciphers aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes128-ctr If the Ciphers entries in the "opensshserver.config" file have any hashes other than "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes128-ctr", the order differs from the example above, or they are missing or commented out, this is a finding.

Fix: F-73048r1049122_fix

Configure the AlmaLinux OS 9 SSH server to use only ciphers employing FIPS 140-3 approved algorithms by updating the "/etc/crypto-policies/back-ends/opensshserver.config" file with the following commands: Note: Before enabling FIPS mode, ensure that the dracut-fips package is installed on the system. Enable FIPS mode by updating the system's crypto policy with the following command: $ sudo update-crypto-policies --set FIPS Note: If FIPS mode has never been enabled on the system, additional steps will need to be conducted. Refer to vendor documentation. To manually update the Ciphers in the systemwide SSH configuration, use the following command: $ sudo sed -i -E '/^Ciphers/s/.*/Ciphers aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes128-ctr/' "$(readlink -f /etc/crypto-policies/back-ends/opensshserver.config)" A reboot is required for the changes to take effect.

Generate Mitigation Statement:

Checks: C-73148r1049124_chk

Verify that the SSH server is configured to use only FIPS 140-3 validated key exchange algorithms: First, ensure that FIPS mode is enabled with the following command: $ cat /proc/sys/crypto/fips_enabled 1 If the command does not return a "1", then the systemwide crypto policy is not set to FIPS, and this is a finding. $ sudo grep -i kexalgorithms /etc/crypto-policies/back-ends/opensshserver.config KexAlgorithms ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256 If the entries following "KexAlgorithms" have any algorithms defined other than "ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256", appear in different order than shown, or are missing or commented out, this is a finding.

Fix: F-73049r1049125_fix

Configure the AlmaLinux OS 9 SSH server to use only FIPS 140-3 approved algorithms by updating the "/etc/crypto-policies/back-ends/opensshserver.config" file with the following commands: Note: Before enabling FIPS mode, ensure that the dracut-fips package is installed on the system. Enable FIPS mode by updating the system's crypto policy with the following command: $ sudo update-crypto-policies --set FIPS Note: If FIPS mode has never been enabled on the system, additional steps will need to be conducted. Refer to vendor documentation. To manually update the Key Exchange Algorithms in the systemwide SSH configuration, use the following command: $ sudo sed -i -E '/^KexAlgorithms/s/.*/KexAlgorithms ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256/' "$(readlink -f /etc/crypto-policies/back-ends/opensshserver.config)" Reboot the system for the changes to take effect.

Generate Mitigation Statement:

Checks: C-73149r1047730_chk

Verify that systemwide crypto policies are in effect with the following command: $ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH '^\s*include' /etc/ssh/sshd_config:Include /etc/ssh/sshd_config.d/*.conf /etc/ssh/sshd_config.d/50-redhat.conf:Include /etc/crypto-policies/back-ends/opensshserver.config If "Include /etc/ssh/sshd_config.d/*.conf" or "Include /etc/crypto-policies/back-ends/opensshserver.config" are not included in the system sshd config or the file /etc/ssh/sshd_config.d/50-redhat.conf is missing, this is a finding.

Fix: F-73050r1049127_fix

Configure the AlmaLinux OS 9 SSH daemon to use systemwide crypto policies by running the following commands: $ sudo dnf reinstall openssh-server

Generate Mitigation Statement:

Checks: C-73150r1047733_chk

Verify the SSH server is configured to use only MACs employing FIPS 140-3 approved algorithms with the following command: First, ensure that FIPS mode is enabled with the following command: $ cat /proc/sys/crypto/fips_enabled 1 If the command does not return a "1", then the systemwide crypto policy is not set to FIPS, and this is a finding. To verify the MACs in the systemwide SSH configuration file, use the following command: $ sudo grep -i macs /etc/crypto-policies/back-ends/opensshserver.config MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256 If the MACs entries in the "opensshserver.config" file have any hashes other than "hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256", the order differs from the example above, or they are missing or commented out, this is a finding.

Fix: F-73051r1049129_fix

Configure the AlmaLinux OS 9 SSH server to use only MACs employing FIPS 140-3 approved algorithms by updating the "/etc/crypto-policies/back-ends/opensshserver.config" file with the following commands: Note: Before enabling FIPS mode, ensure that the dracut-fips package is installed on the system. Enable FIPS mode by updating the system's crypto policy with the following command: $ sudo update-crypto-policies --set FIPS Note: If FIPS mode has never been enabled on the system, additional steps will need to be conducted. Refer to vendor documentation. To manually update the MACs in the systemwide SSH configuration, use the following command: $ sudo sed -i -E '/^MACs/s/.*/MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256/' "$(readlink -f /etc/crypto-policies/back-ends/opensshserver.config)" A reboot is required for the changes to take effect.

Generate Mitigation Statement:

Checks: C-73151r1047736_chk

Verify the SSH server is configured to force frequent session key renegotiation with the following command: $ sshd -T | grep rekeylimit rekeylimit 1073741824 3600 If "RekeyLimit" does not have a maximum data amount and maximum time defined, this is a finding.

Fix: F-73052r1049131_fix

Configure AlmaLinux OS 9 to force a frequent session key renegotiation for SSH connections to the server by running the following command: $ echo "RekeyLimit 1G 1h" > /etc/ssh/sshd_config.d/40-rekeylimit.conf

Generate Mitigation Statement:

Checks: C-73153r1047742_chk

Note: If the Libreswan package is not installed, this requirement is Not Applicable. Verify that the IPsec service uses the system crypto policy with the following command: $ grep -rE '^include ' /etc/ipsec.conf /etc/ipsec.d/ /etc/ipsec.conf:include /etc/crypto-policies/back-ends/libreswan.config /etc/ipsec.conf:include /etc/ipsec.d/*.conf If the IPsec configuration file does not contain "include /etc/crypto-policies/back-ends/libreswan.config", this is a finding.

Fix: F-73054r1049135_fix

Configure Libreswan to use the systemwide cryptographic policy. Add the following line to "/etc/ipsec.conf": include /etc/crypto-policies/back-ends/libreswan.config

Generate Mitigation Statement:

Checks: C-73154r1049137_chk

Verify that AlmaLinux OS 9 OpenSSL library is configured to use only ciphers employing FIPS 140-3 approved algorithms with the following command: $ grep -i opensslcnf.config /etc/pki/tls/openssl.cnf .include = /etc/crypto-policies/back-ends/opensslcnf.config If the "opensslcnf.config" is not defined in the "/etc/pki/tls/openssl.cnf" file, this is a finding.

Fix: F-73055r1049138_fix

Configure the AlmaLinux OS 9 OpenSSL library to use the system cryptographic policy. Edit the "/etc/pki/tls/openssl.cnf" and add or modify the following line: .include = /etc/crypto-policies/back-ends/opensslcnf.config

Generate Mitigation Statement:

Checks: C-73155r1049140_chk

Verify that AlmaLinux OS 9 OpenSSL library is configured to use TLS 1.2 encryption or stronger with following command: $ grep -i minprotocol /etc/crypto-policies/back-ends/opensslcnf.config TLS.MinProtocol = TLSv1.2 DTLS.MinProtocol = DTLSv1.2 If the "TLS.MinProtocol" is set to anything older than "TLSv1.2" or the "DTLS.MinProtocol" is set to anything older than "DTLSv1.2", this is a finding.

Fix: F-73056r1049141_fix

Configure the AlmaLinux OS 9 OpenSSL library to use only DOD-approved TLS encryption by editing the following line in the "/etc/crypto-policies/back-ends/opensslcnf.config" file: TLS.MinProtocol = TLSv1.2 DTLS.MinProtocol = DTLSv1.2 A reboot is required for the changes to take effect.

Generate Mitigation Statement:

Checks: C-73159r1047760_chk

Verify temporary accounts have been provisioned with an expiration date of 72 hours. For every existing temporary account, run the following command to obtain its account expiration information: $ chage -l <account name> | grep -i "account expires" Verify each of these accounts has an expiration date set within 72 hours. If any temporary accounts have an expiration date set to "never" or do not expire within 72 hours, this is a finding.

Fix: F-73060r1047761_fix

Configure automatic account expiration after 72 hours by running the following command for each temporary account: $ chage -E $(date -d +3days +%Y-%m-%d) <account_name>

Generate Mitigation Statement:

Checks: C-73160r1049150_chk

Verify AlmaLinux OS 9 generates audit records for all account creations, modifications, disabling, and termination events that affect the "/etc/sudoers" file, with the following command: $ grep /etc/sudoers /etc/audit/audit.rules -w /etc/sudoers -p wa -k identity If the command does not return a line or the line is commented out, this is a finding. Note: The "-k" allows for specifying an arbitrary identifier, and the string after it does not need to match the example output above.

Fix: F-73061r1049151_fix

Configure AlmaLinux OS 9 to generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/sudoers. Add the following to the "/etc/audit/rules.d/audit.rules" file: -w /etc/sudoers -p wa -k identity Merge the rules into /etc/audit/audit.rules: $ augenrules --load Reboot the server so the changes to take effect.

Generate Mitigation Statement:

Checks: C-73161r1049153_chk

Verify AlmaLinux OS 9 generates audit records for all account creations, modifications, disabling, and termination events that affect the "/etc/group" file, with the following command: $ grep /etc/group /etc/audit/audit.rules -w /etc/group -p wa -k identity If the command does not return a line or the line is commented out, this is a finding. Note: The "-k" allows for specifying an arbitrary identifier, and the string after it does not need to match the example output above.

Fix: F-73062r1049154_fix

Configure AlmaLinux OS 9 to generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/group". Add the following to the "/etc/audit/rules.d/audit.rules" file: -w /etc/group -p wa -k identity Merge the rules into /etc/audit/audit.rules: $ augenrules --load Reboot the server so the changes to take effect.

Generate Mitigation Statement:

Checks: C-73162r1049156_chk

Verify AlmaLinux OS 9 generates audit records for all account creations, modifications, disabling, and termination events that affect the "/etc/gshadow" file, with the following command: $ grep /etc/gshadow /etc/audit/audit.rules -w /etc/gshadow -p wa -k identity If the command does not return a line or the line is commented out, this is a finding. Note: The "-k" allows for specifying an arbitrary identifier, and the string after it does not need to match the example output above.

Fix: F-73063r1049157_fix

Configure AlmaLinux OS 9 to generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/gshadow". Add the following to the "/etc/audit/rules.d/audit.rules" file: -w /etc/gshadow -p wa -k identity Merge the rules into /etc/audit/audit.rules: $ augenrules --load Reboot the server so the changes to take effect.

Generate Mitigation Statement:

Checks: C-73163r1049159_chk

Verify AlmaLinux OS 9 generates audit records for all account creations, modifications, disabling, and termination events that affect the "/etc/security/opasswd" file, with the following command: $ grep /etc/security/opasswd /etc/audit/audit.rules -w /etc/security/opasswd -p wa -k identity If the command does not return a line or the line is commented out, this is a finding. Note: The "-k" allows for specifying an arbitrary identifier, and the string after it does not need to match the example output above.

Fix: F-73064r1049160_fix

Configure AlmaLinux OS 9 to generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/security/opasswd". Add the following to the "/etc/audit/rules.d/audit.rules" file: -w /etc/security/opasswd -p wa -k identity Merge the rules into /etc/audit/audit.rules: $ augenrules --load Reboot the server so the changes to take effect.

Generate Mitigation Statement:

Checks: C-73164r1049162_chk

Verify AlmaLinux OS 9 generates audit records for all account creations, modifications, disabling, and termination events that affect the "/etc/passwd" file, with the following command: $ grep /etc/passwd /etc/audit/audit.rules -w /etc/passwd -p wa -k identity If the command does not return a line or the line is commented out, this is a finding. Note: The "-k" allows for specifying an arbitrary identifier, and the string after it does not need to match the example output above.

Fix: F-73065r1049163_fix

Configure AlmaLinux OS 9 to generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/passwd". Add the following to the "/etc/audit/rules.d/audit.rules" file: -w /etc/passwd -p wa -k identity Merge the rules into /etc/audit/audit.rules: $ augenrules --load Reboot the server so the changes to take effect.

Generate Mitigation Statement:

Checks: C-73165r1049165_chk

Verify AlmaLinux OS 9 generates audit records for all account creations, modifications, disabling, and termination events that affect the "/etc/shadow" file, with the following command: $ grep /etc/shadow /etc/audit/audit.rules -w /etc/shadow -p wa -k identity If the command does not return a line or the line is commented out, this is a finding. Note: The "-k" allows for specifying an arbitrary identifier, and the string after it does not need to match the example output above.

Fix: F-73066r1049166_fix

Configure AlmaLinux OS 9 to generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/shadow" using the following command. Add the following to the "/etc/audit/rules.d/audit.rules" file: -w /etc/shadow -p wa -k identity Merge the rules into /etc/audit/audit.rules: $ augenrules --load Reboot the server so the changes to take effect.

Generate Mitigation Statement:

Checks: C-73166r1049168_chk

Verify AlmaLinux OS 9 generates audit records for all account creations, modifications, disabling, and termination events that affect the files within "/etc/sudoers.d/", with the following command: $ grep /etc/sudoers.d/ /etc/audit/audit.rules -w /etc/sudoers.d/ -p wa -k identity If the command does not return a line or the line is commented out, this is a finding. Note: The "-k" allows for specifying an arbitrary identifier, and the string after it does not need to match the example output above.

Fix: F-73067r1049169_fix

Configure AlmaLinux OS 9 to generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/sudoers.d/. Add the following to the "/etc/audit/rules.d/audit.rules" file: -w /etc/sudoers.d/ -p wa -k identity Merge the rules into /etc/audit/audit.rules: $ augenrules --load Reboot the server so the changes to take effect.

Generate Mitigation Statement:

Checks: C-73167r1049171_chk

Verify that AlmaLinux OS 9 requires authentication for emergency mode with the following command: $ grep -E 'ExecStart.*sulogin' /usr/lib/systemd/system/emergency.service ExecStart=-/usr/lib/systemd/systemd-sulogin-shell emergency If this line is not returned, or is commented out, this is a finding. If the output is different, this is a finding.

Fix: F-73068r1049172_fix

Configure AlmaLinux OS 9 to require authentication for emergency mode. Add or modify the following line in the "/usr/lib/systemd/system/emergency.service" file: ExecStart=-/usr/lib/systemd/systemd-sulogin-shell emergency "sudo systemctl edit emergency.service" can also be used to create a "/etc/systemd/system/emergency.service.d/override.conf" file.

Generate Mitigation Statement:

Checks: C-73168r1047787_chk

Verify the boot loader superuser password is required using the following command: $ grep password /etc/grub2.cfg password_pbkdf2 superman ${GRUB2_PASSWORD} Verify the boot loader superuser password has been set and the password is encrypted using the following command: $ cat /boot/grub2/user.cfg GRUB2_PASSWORD=grub.pbkdf2.sha512.10000.5766DCE424DCD4F0A2F5AC774C044BE8B904BC F0022B671CD5E522A3568C599F327EBA3F3F5AB30D69A9B9A4FD172B12435BC10BE0A9B40669FB A5C5ECBE8D1B.EAC815AE6F8A3F79F800D2EC7F454933BC3D63282532AAB1C487CA25331DD359F 5BF61166EDB53FB33977E982A9F20327D988DA15CBF7E4238357E65C5AEAF3C If a "GRUB2_PASSWORD" is not set, this is a finding.

Fix: F-73069r1049174_fix

Configure AlmaLinux OS 9 to require a grub bootloader password for the grub superuser account. Generate an encrypted grub2 password for the grub superuser account with the following command: $ grub2-setpassword Enter password: Confirm password:

Generate Mitigation Statement:

Checks: C-73169r1047790_chk

Verify the boot loader superuser account has been set with the following command: $ grep -A1 "superusers" /etc/grub2.cfg set superusers="superman" export superusers password_pbkdf2 superman ${GRUB2_PASSWORD} In this example "superman" is the actual account name, changed from the default "root". If superusers contains easily guessable usernames, this is a finding.

Fix: F-73070r1049176_fix

Configure AlmaLinux OS 9 to have a unique username for the grub superuser account using the following commands: $ sed -ri 's/root/superman/' /etc/grub.d/01_users $ grub2-mkconfig -o /boot/grub2/grub.cfg

Generate Mitigation Statement:

Checks: C-73170r1049178_chk

Verify that AlmaLinux OS 9 requires authentication for single-user mode with the following command: $ grep -E 'ExecStart.*sulogin' /usr/lib/systemd/system/rescue.service ExecStart=-/usr/lib/systemd/systemd-sulogin-shell rescue If this line is not returned or is commented out, this is a finding.

Fix: F-73071r1049179_fix

Configure AlmaLinux OS 9 to require authentication for single-user mode. Add or modify the following line in the "/usr/lib/systemd/system/rescue.service" file: ExecStart=-/usr/lib/systemd/systemd-sulogin-shell rescue "sudo systemctl edit rescue.service" can also be used to create a "/etc/systemd/system/rescue.service.d/override.conf" file.

Generate Mitigation Statement:

Checks: C-73173r1049186_chk

Verify that the AlmaLinux OS 9 sudo package is installed with the following command: $ dnf list --installed sudo Installed Packages sudo.x86_64 1.9.5p2-9.el9 @anaconda If the "sudo" package is not installed, this is a finding.

Fix: F-73074r1047803_fix

The sudo package can be installed with the following command: $ dnf install sudo

Generate Mitigation Statement:

Checks: C-73174r1049188_chk

Verify AlmaLinux OS 9 is configured to mask the debug-shell systemd service with the following command: $ systemctl status debug-shell.service debug-shell.service Loaded: masked (Reason: Unit debug-shell.service is masked.) Active: inactive (dead) If the "debug-shell.service" is loaded and not masked, this is a finding.

Fix: F-73075r1049189_fix

Configure AlmaLinux OS 9 to mask the debug-shell systemd service with the following command: $ systemctl mask --now debug-shell.service

Generate Mitigation Statement:

Checks: C-73175r1049191_chk

Verify AlmaLinux OS 9 is configured to enable DAC on hardlinks with the following command: $ sysctl fs.protected_hardlinks fs.protected_hardlinks = 1 If "fs.protected_hardlinks" is not set to "1" or is missing, this is a finding. Check that the configuration files are present to enable this kernel parameter: $ /usr/lib/systemd/systemd-sysctl --cat-config | egrep -v '^(#|;)' | grep -F fs.protected_hardlinks | tail -1 fs.protected_hardlinks = 1 If "fs.protected_hardlinks" is not set to "1" or is missing, this is a finding.

Fix: F-73076r1049192_fix

Configure AlmaLinux OS 9 to enable DAC on hardlinks with the following command: $ echo "fs.protected_hardlinks = 1" > /etc/sysctl.d/60-hardlinks.conf Load settings from all system configuration files with the following command: $ sysctl –system

Generate Mitigation Statement:

Checks: C-73176r1049194_chk

Verify AlmaLinux OS 9 is configured to enable DAC on symlinks with the following command: $ sysctl fs.protected_symlinks fs.protected_symlinks = 1 If "fs.protected_symlinks " is not set to "1" or is missing, this is a finding. Check that the configuration files are present to enable this kernel parameter: $ /usr/lib/systemd/systemd-sysctl --cat-config | egrep -v '^(#|;)' | grep -F fs.protected_symlinks | tail -1 fs.protected_symlinks = 1 If "fs.protected_symlinks" is not set to "1" or is missing, this is a finding.

Fix: F-73077r1049195_fix

Configure AlmaLinux OS 9 to enable DAC on symlinks with the following command: $ echo "fs.protected_symlinks = 1" > /etc/sysctl.d/60-symlinks.conf Load settings from all system configuration files with the following command: $ sysctl --system

Generate Mitigation Statement:

Checks: C-73177r1049197_chk

Verify that AlmaLinux OS 9 is configured to audit the execution of the "execve" system call with the following command: $ auditctl -l | grep execve -a always,exit -F arch=b32 -S execve -C uid!=euid -F euid=0 -F key=execpriv -a always,exit -F arch=b64 -S execve -C uid!=euid -F euid=0 -F key=execpriv -a always,exit -F arch=b32 -S execve -C gid!=egid -F egid=0 -F key=execpriv -a always,exit -F arch=b64 -S execve -C gid!=egid -F egid=0 -F key=execpriv If the command does not return all lines, or the lines are commented out, this is a finding.

Fix: F-73078r1049198_fix

Configure AlmaLinux OS 9 to generate audit records upon successful/unsuccessful attempts to use the "sudo" command. Add the following to the "/etc/audit/rules.d/audit.rules" file: -a always,exit -F arch=b32 -S execve -C uid!=euid -F euid=0 -k execpriv -a always,exit -F arch=b64 -S execve -C uid!=euid -F euid=0 -k execpriv -a always,exit -F arch=b32 -S execve -C gid!=egid -F egid=0 -k execpriv -a always,exit -F arch=b64 -S execve -C gid!=egid -F egid=0 -k execpriv Merge the rules into /etc/audit/audit.rules: $ augenrules --load

Generate Mitigation Statement:

Checks: C-73178r1049200_chk

Verify AlmaLinux OS 9 is configured to lock an account after three unsuccessful logon attempts with the command: $ grep deny /etc/security/faillock.conf deny = 3 If the "deny" option is not set to 3 or less (but not 0), is missing or commented out, this is a finding.

Fix: F-73079r1049201_fix

Configure AlmaLinux OS 9 to lock an account when three unsuccessful logon attempts occur using pam_faillock. First, enable the feature using the following command: $ authselect enable-feature with-faillock Then, add or update the following line in the "/etc/security/faillock.conf" file: deny = 3

Generate Mitigation Statement:

Checks: C-73179r1049203_chk

Verify AlmaLinux OS 9 is configured to lock the root account after three unsuccessful logon attempts with the command: $ grep even_deny_root /etc/security/faillock.conf even_deny_root If the "even_deny_root" option is not set, is missing, or is commented out, this is a finding.

Fix: F-73080r1049204_fix

Configure AlmaLinux OS 9 to lock the root account after a number of incorrect login attempts using pam_faillock. First, enable the feature using the following command: $ authselect enable-feature with-faillock Then, add or uncomment the following line in the "/etc/security/faillock.conf" file: even_deny_root

Generate Mitigation Statement:

Checks: C-73180r1049206_chk

Note: If the system administrator demonstrates the use of an approved centralized account management method that locks an account after three unsuccessful logon attempts within a period of 15 minutes, this requirement is Not Applicable. Verify AlmaLinux OS 9 locks an account after three unsuccessful logon attempts within a period of 15 minutes with the following command: $ grep fail_interval /etc/security/faillock.conf fail_interval = 900 If the "fail_interval" option is not set to 900 or less (but not 0), the line is commented out, or the line is missing, this is a finding.

Fix: F-73081r1049207_fix

Configure AlmaLinux OS 9 to lock an account after a number of incorrect login attempts within 15 minutes using pam_faillock. First, enable the feature using the following command: $ authselect enable-feature with-faillock Then, add or uncomment the following line in the "/etc/security/faillock.conf" file: fail_interval = 900

Generate Mitigation Statement:

Checks: C-73181r1047826_chk

Verify the pam_faillock.so module is present in the "/etc/pam.d/system-auth" file: $ grep pam_faillock.so /etc/pam.d/system-auth auth required pam_faillock.so preauth auth required pam_faillock.so authfail account required pam_faillock.so If the pam_faillock.so module is not present in the "/etc/pam.d/system-auth" file with the "preauth" line listed before pam_unix.so, this is a finding. If the system administrator (SA) can demonstrate that the required configuration is contained in a PAM configuration file included or substacked from the system-auth file, this is not a finding.

Fix: F-73082r1049209_fix

Configure AlmaLinux OS 9 to include the use of the pam_faillock.so module in the /etc/pam.d/system-auth file. Add/modify the appropriate sections of the "/etc/pam.d/system-auth" file to match the following lines, ensuring that the "preauth" line is listed before pam_unix.so. auth required pam_faillock.so preauth auth required pam_faillock.so authfail account required pam_faillock.so Note: Do not simply copy these three lines into the file; their location/order is important.

Generate Mitigation Statement:

Checks: C-73182r1047829_chk

Verify the pam_faillock.so module is present in the "/etc/pam.d/password-auth" file: $ grep pam_faillock.so /etc/pam.d/password-auth auth required pam_faillock.so preauth auth required pam_faillock.so authfail account required pam_faillock.so If the pam_faillock.so module is not present in the "/etc/pam.d/password-auth" file with the "preauth" line listed before pam_unix.so, this is a finding. If the system administrator (SA) can demonstrate that the required configuration is contained in a PAM configuration file included or substacked from the system-auth file, this is not a finding.

Fix: F-73083r1049211_fix

Configure AlmaLinux OS 9 to include the use of the pam_faillock.so module in the /etc/pam.d/password-auth file. Add/modify the appropriate sections of the "/etc/pam.d/password-auth" file to match the following lines, ensuring that the "preauth" line is listed before pam_unix.so. auth required pam_faillock.so preauth auth required pam_faillock.so authfail account required pam_faillock.so Note: Do not simply copy these three lines into the file; their location/order is important.

Generate Mitigation Statement:

Checks: C-73183r1047832_chk

Verify the "/etc/security/faillock.conf" file is configured to log username information when unsuccessful logon attempts occur with the following command: $ grep audit /etc/security/faillock.conf audit If the "audit" option is not set, is missing, or is commented out, this is a finding.

Fix: F-73084r1049213_fix

Configure AlmaLinux OS 9 to log username information when unsuccessful logon attempts occur. Add/modify the "/etc/security/faillock.conf" file to match the following line: audit

Generate Mitigation Statement:

Checks: C-73184r1049215_chk

Verify AlmaLinux OS 9 is configured to lock an account until released by an administrator after three unsuccessful logon attempts with the command: $ grep unlock_time /etc/security/faillock.conf unlock_time = 0 If the "unlock_time" option is not set to "0", the line is missing, or is commented out, this is a finding.

Fix: F-73085r1049216_fix

Configure AlmaLinux OS 9 to lock accounts until released by an administrator using pam_faillock. First, enable the feature using the following command: $ authselect enable-feature with-faillock Then, add or uncomment the following line in the "/etc/security/faillock.conf" file: unlock_time = 0

Generate Mitigation Statement:

Checks: C-73185r1047838_chk

Verify the "/etc/security/faillock.conf" file is configured to use a nondefault faillock directory to ensure its contents persist after reboot with the following command: $ grep "dir =" /etc/security/faillock.conf dir = /var/log/faillock If the "dir" option is set to the default /var/run/faillock directory, is missing, or is commented out, this is a finding.

Fix: F-73086r1049218_fix

Configure AlmaLinux OS 9 to maintain the contents of the faillock directory after a reboot. Add/modify the "/etc/security/faillock.conf" file to match the following line: dir = /var/log/faillock

Generate Mitigation Statement:

Checks: C-73186r1047841_chk

Note: If the system does not have SELinux enabled and enforcing, a targeted policy, or if the pam_faillock module is not configured for use, this requirement is Not Applicable. Verify the location of the nondefault tally directory for the pam_faillock module with the following command: $ grep "dir =" /etc/security/faillock.conf dir = /var/log/faillock Check the security context type of the nondefault tally directory with the following command: $ ls -Zd /var/log/faillock system_u:object_r:faillog_t:s0 /var/log/faillock If the security context type of the nondefault tally directory is not "faillog_t", this is a finding.

Fix: F-73087r1049220_fix

Configure AlmaLinux OS 9 to allow the use of a nondefault faillock tally directory while SELinux enforces a targeted policy. Create a nondefault faillock tally directory (if it does not already exist) using the following command: $ mkdir /var/log/faillock Update the /etc/selinux/targeted/contexts/files/file_contexts.local file with the "faillog_t" context type for the nondefault faillock tally directory using the following command: $ semanage fcontext -a -t faillog_t "/var/log/faillock(/.*)?" Update the context type of the nondefault faillock directory and files within using the following command: $ restorecon -RFv /var/log/faillock

Generate Mitigation Statement:

Checks: C-73187r1049222_chk

Note: This requirement assumes the use of the default graphical user interface, the GNOME desktop environment. If the system does not have any graphical user interface installed, this requirement is Not Applicable. Verify AlmaLinux OS 9 prevents a user from disabling the banner for graphical user interfaces. Determine if the operating system prevents modification of the GNOME banner setting with the following command: $ grep banner-message-enable /etc/dconf/db/local.d/locks/* banner-message-enable If "banner-message-enable" is commented out or is missing, this is a finding.

Fix: F-73088r1049223_fix

Configure AlmaLinux OS 9 to prevent a user being able to override the GNOME banner setting by running the following commands: $ echo "banner-message-enable" | tee /etc/dconf/db/local.d/locks/00-banner > /dev/null $ dconf update

Generate Mitigation Statement:

Checks: C-73188r1049225_chk

Note: This requirement assumes the use of the default graphical user interface, the GNOME desktop environment. If the system does not have any graphical user interface installed, this requirement is Not Applicable. Verify AlmaLinux OS 9 displays a banner before granting access to the operating system via a graphical user logon. First, identify the location of the banner message file with the following command: $ grep banner-message-text /etc/dconf/db/local.d/* /etc/dconf/db/local.d/01-banner-message Determine if the operating system displays a banner at the logon screen with the following command: $ gsettings get org.gnome.login-screen banner-message-enable true Next, check that file contains the correct wording with the following command (substituting the path from above): $ cat /etc/dconf/db/local.d/01-banner-message If the banner is set correctly it will return the following text: "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." If the banner text does not match the Standard Mandatory DOD Notice and Consent Banner exactly, or the dconf database does not include the "banner-message-text" setting or if it is not enabled, this is a finding.

Fix: F-73089r1049226_fix

Configure AlmaLinux OS 9 to display the Standard Mandatory DOD Notice and Consent Banner before granting access to the system via a graphical user logon. Create a database to contain the systemwide graphical user logon settings (if it does not already exist) with the following command: $ touch /etc/dconf/db/local.d/01-banner-message Add the following lines to the [org/gnome/login-screen] section of the "/etc/dconf/db/local.d/01-banner-message": [org/gnome/login-screen] banner-message-enable=true banner-message-text='You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\n-At any time, the USG may inspect and seize data stored on this IS.\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.' Run the following command to update the database: $ dconf update

Generate Mitigation Statement:

Checks: C-73189r1049228_chk

Verify AlmaLinux OS 9 displays the Standard Mandatory DOD Notice and Consent Banner before granting access to the operating system via a command line user logon. Check that a banner is displayed at the command line login screen with the following command: $ cat /etc/issue If the banner is set correctly it will return the following text: "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." If the banner text does not match the Standard Mandatory DOD Notice and Consent Banner exactly, this is a finding.

Fix: F-73090r1049229_fix

Configure AlmaLinux OS 9 to display the Standard Mandatory DOD Notice and Consent Banner before granting access to the system via command line logon by running the command: $ cat << EOF | tee /etc/issue You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details. EOF

Generate Mitigation Statement:

Checks: C-73190r1049231_chk

Verify AlmaLinux OS 9 displays the Standard Mandatory DOD Notice and Consent Banner before granting access to the operating system via a command line user logon. First, check that a banner text is correct with the following command: $ cat /etc/issue.net If the banner is set correctly it will return the following text: "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." Next, check that the OpenSSH server is configured to display the banner using the following command: $ sshd -T | grep banner banner /etc/issue.net If the banner text does not match the Standard Mandatory DOD Notice and Consent Banner exactly, or the SSH configuration does not include "Banner /etc/issue.net", this is a finding.

Fix: F-73091r1049232_fix

Configure AlmaLinux OS 9 to display the Standard Mandatory DOD Notice and Consent Banner before granting access to the system via command line logon by running the command: cat << EOF | tee /etc/issue.net You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details. EOF

Generate Mitigation Statement:

Checks: C-73191r1049234_chk

Verify that AlmaLinux OS 9 has the "s-nail" package is installed on the system with the following command: $ dnf list --installed s-nail s-nail.x86_64 14.9.22-6.el9 @AppStream If "s-nail" package is not installed, this is a finding.

Fix: F-73092r1047857_fix

The s-nail package can be installed with the following command: $ dnf install s-nail

Generate Mitigation Statement:

Checks: C-73192r1047859_chk

Verify the SSH daemon does not allow GSSAPI authentication with the following command: $ /usr/sbin/sshd -dd 2&gt;&amp;1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH '^\s*gssapiauthentication' gssapiauthentication no If the value is returned as "yes", the returned line is commented out, no output is returned, and the use of GSSAPI authentication has not been documented with the information system security officer (ISSO), this is a finding. If the required value is not set, this is a finding.

Fix: F-73093r1047860_fix

Configure the SSH daemon to not allow GSSAPI authentication. Add the following line to "/etc/ssh/sshd_config", or uncomment the line and set the value to "no": GSSAPIAuthentication no Alternatively, add the setting to an included file if the line "Include /etc/ssh/sshd_config.d/*.conf" is found at the top of the "/etc/ssh/sshd_config" file: GSSAPIAuthentication no Restart the SSH daemon for the settings to take effect: $ systemctl restart sshd.service

Generate Mitigation Statement:

Checks: C-73193r1047862_chk

Verify the SSH daemon does not allow Kerberos authentication with the following command: $ /usr/sbin/sshd -dd 2&gt;&amp;1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH '^\s*kerberosauthentication' kerberosauthentication no If the value is returned as "yes", the returned line is commented out, no output is returned, and the use of Kerberos authentication has not been documented with the information system security officer (ISSO), this is a finding.

Fix: F-73094r1047863_fix

Configure the SSH daemon to not allow Kerberos authentication. Add the following line to "/etc/ssh/sshd_config", or uncomment the line and set the value to "no": KerberosAuthentication no Alternatively, add the setting to an included file if the line "Include /etc/ssh/sshd_config.d/*.conf" is found at the top of the "/etc/ssh/sshd_config" file: KerberosAuthentication no Restart the SSH daemon for the settings to take effect: $ systemctl restart sshd.service

Generate Mitigation Statement:

Checks: C-73199r1049243_chk

Verify AlmaLinux OS 9 is configured to disable kernel image loading. Check the status of the kernel.kexec_load_disabled kernel parameter with the following command: $ sysctl kernel.kexec_load_disabled kernel.kexec_load_disabled = 1 If "kernel.kexec_load_disabled" is not set to "1" or is missing, this is a finding. Check that the configuration files are present to enable this kernel parameter with the following command: $ /usr/lib/systemd/systemd-sysctl --cat-config | kernel.kexec_load_disabled kernel.kexec_load_disabled = 1 If "kernel.kexec_load_disabled" is not set to "1" or is missing, this is a finding.

Fix: F-73100r1047881_fix

Add or edit the following line in a system configuration file in the "/etc/sysctl.d/" directory: kernel.kexec_load_disabled = 1 Load settings from all system configuration files with the following command: $ sysctl –system

Generate Mitigation Statement:

Checks: C-73200r1047883_chk

Verify the system commands contained in the following directories are group-owned by "root", or a required system account, with the following command: $ find -L /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin ! -group root -exec ls -l {} \; If any system commands are returned and is not group-owned by a required system account, this is a finding.

Fix: F-73101r1047884_fix

Configure the system commands to be protected from unauthorized access. Run the following command, replacing "[FILE]" with any system command file not group-owned by "root" or a required system account. $ chgrp root [FILE]

Generate Mitigation Statement:

Checks: C-73201r1047886_chk

Verify the system commands contained in the following directories are owned by "root" with the following command: $ find -L /bin /sbin /usr/bin /usr/sbin /usr/libexec /usr/local/bin /usr/local/sbin ! -user root -exec ls -l {} \; If any system commands are found to not be owned by root, this is a finding.

Fix: F-73102r1047887_fix

Configure the system commands to be protected from unauthorized access. Run the following command, replacing "[FILE]" with any system command file not owned by "root". $ chown root [FILE]

Generate Mitigation Statement:

Checks: C-73202r1047889_chk

Verify the system commands contained in the following directories have mode "755" or less permissive with the following command: $ find -L /bin /sbin /usr/bin /usr/sbin /usr/libexec /usr/local/bin /usr/local/sbin -perm /022 -exec ls -l {} \; If any system commands are found to be group-writable or world-writable, this is a finding.

Fix: F-73103r1047890_fix

Configure the system commands to be protected from unauthorized access. Run the following command, replacing "[FILE]" with any system command with a mode more permissive than "755". $ chmod 755 [FILE]

Generate Mitigation Statement:

Checks: C-73203r1049248_chk

Verify the systemwide shared library directories are group-owned by "root" with the following command: $ find -L /lib /lib64 /usr/lib /usr/lib64 ! -group root -type d -exec stat -c "%n %G" '{}' \; If any systemwide shared library directory is returned and is not group owned by a required system account, this is a finding.

Fix: F-73104r1049249_fix

Configure the systemwide shared library directories (/lib, /lib64, /usr/lib and /usr/lib64) to be protected from unauthorized access. Run the following command, replacing "[DIRECTORY]" with any library directory not group-owned by "root". $ chgrp root [DIRECTORY]

Generate Mitigation Statement:

Checks: C-73204r1049251_chk

Verify the systemwide shared library directories are owned by "root" with the following command: $ find -L /lib /lib64 /usr/lib /usr/lib64 ! -user root -type d -exec stat -c "%n %U" '{}' \; If any systemwide shared library directory is not owned by root, this is a finding.

Fix: F-73105r1049252_fix

Configure the systemwide shared library directories within (/lib, /lib64, /usr/lib and /usr/lib64) to be protected from unauthorized access. Run the following command, replacing "[DIRECTORY]" with any library directory not owned by "root". $ chown root [DIRECTORY]

Generate Mitigation Statement:

Checks: C-73205r1049254_chk

Verify the systemwide shared library directories have mode "755" or less permissive with the following command: $ find -L /lib /lib64 /usr/lib /usr/lib64 -perm /022 -type d -exec ls -l {} \; If any systemwide shared library file is found to be group-writable or world-writable, this is a finding.

Fix: F-73106r1049255_fix

Configure the systemwide shared library directories (/lib, /lib64, /usr/lib and /usr/lib64) to be protected from unauthorized access. Run the following command, replacing "[DIRECTORY]" with any library directory with a mode more permissive than 755. $ chmod 755 [DIRECTORY]

Generate Mitigation Statement:

Checks: C-73206r1049257_chk

Verify the systemwide shared library files are group-owned by "root" with the following command: $ find -L /lib /lib64 /usr/lib /usr/lib64 ! -group root -exec ls -l {} \; If any systemwide shared library file is returned and is not group-owned by a required system account, this is a finding.

Fix: F-73107r1049258_fix

Configure the systemwide shared library files (/lib, /lib64, /usr/lib and /usr/lib64) to be protected from unauthorized access. Run the following command, replacing "[FILE]" with any library file not group-owned by "root". $ chgrp root [FILE]

Generate Mitigation Statement:

Checks: C-73207r1049260_chk

Verify the systemwide shared library files are owned by "root" with the following command: $ find -L /lib /lib64 /usr/lib /usr/lib64 ! -user root -exec ls -l {} \; If any systemwide shared library file is not owned by root, this is a finding.

Fix: F-73108r1049261_fix

Configure the systemwide shared library files (/lib, /lib64, /usr/lib and /usr/lib64) to be protected from unauthorized access. Run the following command, replacing "[FILE]" with any library file not owned by "root". $ chown root [FILE]

Generate Mitigation Statement:

Checks: C-73208r1049263_chk

Verify the systemwide shared library files contained in the following directories have mode "755" or less permissive with the following command: $ find -L /lib /lib64 /usr/lib /usr/lib64 -perm /022 -type f -exec ls -l {} \; If any systemwide shared library file is found to be group-writable or world-writable, this is a finding.

Fix: F-73109r1047908_fix

Configure the library files to be protected from unauthorized access. Run the following command, replacing "[FILE]" with any library file with a mode more permissive than 755. $ chmod 755 [FILE]

Generate Mitigation Statement:

Checks: C-73209r1049265_chk

Verify AlmaLinux OS 9 disables core dumps for all users by issuing the following command: $ grep -s core /etc/security/limits.conf /etc/security/limits.d/*.conf /etc/security/limits.conf:# - core - limits the core file size (KB) /etc/security/limits.conf:#* soft core 0 This can be set as a global domain (with the * wildcard) but may be set differently for multiple domains. If the "core" item is missing, commented out, or the value is anything other than "0" and the need for core dumps is not documented with the information system security officer (ISSO) as an operational requirement for all domains that have the "core" item assigned, this is a finding.

Fix: F-73110r1047911_fix

Configure the operating system to disable core dumps for all users. Create a *.conf file in /etc/security/limits.d/ with the following content: * hard core 0

Generate Mitigation Statement:

Checks: C-73210r1049267_chk

Verify AlmaLinux OS 9 is not configured to acquire, save, or process core dumps with the following command: $ systemctl status systemd-coredump.socket systemd-coredump.socket Loaded: masked (Reason: Unit systemd-coredump.socket is masked.) Active: inactive (dead) since Mon 2024-02-26 13:31:02 UTC; 26s ago Duration: 3h 13min 22.428s If the "systemd-coredump.socket" is loaded and not masked and the need for core dumps is not documented with the information system security officer (ISSO) as an operational requirement, this is a finding.

Fix: F-73111r1047914_fix

Configure the system to disable the systemd-coredump.socket with the following command: $ systemctl mask --now systemd-coredump.socket Create symlink /etc/systemd/system/systemd-coredump.socket -> /dev/null Reload the daemon for this change to take effect. $ systemctl daemon-reload

Generate Mitigation Statement:

Checks: C-73211r1049269_chk

Verify AlmaLinux OS 9 disables storing core dumps for all users by issuing the following command: $ systemd-analyze cat-config systemd/coredump.conf | grep Storage Storage=none If the "Storage" item is missing, commented out, or the value is anything other than "none" and the need for core dumps is not documented with the information system security officer (ISSO) as an operational requirement for all domains that have the "core" item assigned, this is a finding.

Fix: F-73112r1047917_fix

Configure the operating system to disable storing core dumps for all users. Add or modify the following line in the [Coredump} section of /etc/systemd/coredump.conf: Storage=none

Generate Mitigation Statement:

Checks: C-73212r1049271_chk

Verify AlmaLinux OS 9 disables core dump backtraces by issuing the following command: $ systemd-analyze cat-config systemd/coredump.conf | grep ProcessSizeMax ProcessSizeMax=0 If the "ProcessSizeMax" item is missing, commented out, or the value is anything other than "0" and the need for core dumps is not documented with the information system security officer (ISSO) as an operational requirement for all domains that have the "core" item assigned, this is a finding.

Fix: F-73113r1047920_fix

Configure the operating system to disable core dump backtraces. Add or modify the following line in the [Coredump} section of /etc/systemd/coredump.conf: ProcessSizeMax=0

Generate Mitigation Statement:

Checks: C-73213r1049273_chk

Verify AlmaLinux OS 9 disables storing core dumps with the following commands: $ sysctl kernel.core_pattern kernel.core_pattern = |/bin/false If the returned line does not have a value of "|/bin/false", or a line is not returned and the need for core dumps is not documented with the information system security officer (ISSO) as an operational requirement, this is a finding. Check that the configuration files are present to disable core dump storage. $ /usr/lib/systemd/systemd-sysctl --cat-config | egrep -v '^(#|;)' | grep -F kernel.core_pattern | tail -1 kernel.core_pattern = |/bin/false If "kernel.core_pattern" is not set to "|/bin/false" and is not documented with the ISSO as an operational requirement, or is missing, this is a finding.

Fix: F-73114r1049274_fix

Configure AlmaLinux OS 9 to disable storing core dumps. Create a numbered *.conf file in /etc/sysctl.d/ with the following content: kernel.core_pattern = |/bin/false The system configuration files need to be reloaded for the changes to take effect. To reload the contents of the files, run the following command: $ sysctl –system

Generate Mitigation Statement:

Checks: C-73214r1047925_chk

Verify the group ownership of all cron configuration files with the following command: $ stat -c "%G %n" /etc/cron* root /etc/cron.d root /etc/cron.daily root /etc/cron.deny root /etc/cron.hourly root /etc/cron.monthly root /etc/crontab root /etc/cron.weekly If any crontab is not group owned by root, this is a finding.

Fix: F-73115r1047926_fix

Configure any cron configuration not group-owned by root with the following command: $ chgrp root [cron config file]

Generate Mitigation Statement:

Checks: C-73215r1047928_chk

Verify the ownership of all cron configuration files with the command: $ stat -c "%U %n" /etc/cron* root /etc/cron.d root /etc/cron.daily root /etc/cron.deny root /etc/cron.hourly root /etc/cron.monthly root /etc/crontab root /etc/cron.weekly If any crontab is not owned by root, this is a finding.

Fix: F-73116r1047929_fix

Configure any cron configuration not owned by root with the following command: $ chown root [cron config file]

Generate Mitigation Statement:

Checks: C-73216r1047931_chk

Verify the permissions of the cron directories with the following command: $ find /etc/cron* -type d | xargs stat -c "%#a %n" 0700 /etc/cron.d 0700 /etc/cron.daily 0700 /etc/cron.hourly 0700 /etc/cron.monthly 0700 /etc/cron.weekly If any cron configuration directory is more permissive than "700", this is a finding.

Fix: F-73117r1049278_fix

Configure any AlmaLinux OS 9 cron configuration directory with a mode more permissive than "0700" as follows: chmod 0700 [cron configuration directory]

Generate Mitigation Statement:

Checks: C-73217r1047934_chk

Verify the permissions of /etc/crontab with the following command: $ stat -c "%#a %n" /etc/crontab 0600 If /etc/crontab does not have a mode of "0600", this is a finding.

Fix: F-73118r1049280_fix

Configure the AlmaLinux OS 9 file /etc/crontab with mode 600. $ chmod 0600 /etc/crontab

Generate Mitigation Statement:

Checks: C-73218r1049282_chk

Note: This requirement assumes the use of the AlmaLinux OS 9 default graphical user interface, the GNOME desktop environment. If the system does not have any graphical user interface installed, this requirement is Not Applicable. Verify AlmaLinux OS 9 is configured to ignore the Ctrl-Alt-Del sequence in the GNOME desktop with the following command: $ gsettings get org.gnome.settings-daemon.plugins.media-keys logout "['']" If the GNOME desktop is configured to shut down when Ctrl-Alt-Del is pressed, this is a finding.

Fix: F-73119r1049283_fix

Configure AlmaLinux OS 9 to ignore the Ctrl-Alt-Del sequence in the GNOME desktop. Add or update the [org/gnome/settings-daemon/plugins/media-keys] section of the /etc/dconf/db/local.d/00-security-settings database file and add or update the following lines: [org/gnome/settings-daemon/plugins/media-keys] logout=[''] Run the following command to update the database: $ dconf update

Generate Mitigation Statement:

Checks: C-73219r1049285_chk

Note: This requirement assumes the use of the AlmaLinux OS 9 default graphical user interface, the GNOME desktop environment. If the system does not have any graphical user interface installed, this requirement is Not Applicable. Verify that users cannot enable the Ctrl-Alt-Del sequence in the GNOME desktop with the following command: $ grep logout /etc/dconf/db/local.d/locks/* /org/gnome/settings-daemon/plugins/media-keys/logout If the output is not "/org/gnome/settings-daemon/plugins/media-keys/logout", the line is commented out, or the line is missing, this is a finding.

Fix: F-73120r1049286_fix

Configure AlmaLinux OS 9 to disallow the user changing the Ctrl-Alt-Del sequence in the GNOME desktop. Create a database to container systemwide graphical user logon settings (if it does not already exist) with the following command: $ touch /etc/dconf/db/local.d/locks/session Add the following line to the session locks file to prevent nonprivileged users from modifying the Ctrl-Alt-Del setting: /org/gnome/settings-daemon/plugins/media-keys/logout Run the following command to update the database: $ dconf update

Generate Mitigation Statement:

Checks: C-73220r1049288_chk

Verify all local files and directories on AlmaLinux OS 9 have a valid group with the following command: $ df --local -P | awk {'if (NR!=1) print $6'} | xargs -I '{}' find '{}' -xdev -nogroup If any files on the system do not have an assigned group, this is a finding.

Fix: F-73121r1049289_fix

Either remove all files and directories from AlmaLinux OS 9 that do not have a valid group, or assign a valid group to all files and directories on the system with the "chgrp" command: $ chgrp <group> <file>

Generate Mitigation Statement:

Checks: C-73221r1049291_chk

Verify all local files and directories on AlmaLinux OS 9 have a valid owner with the following command: $ df --local -P | awk {'if (NR!=1) print $6'} | xargs -I '{}' find '{}' -xdev -nouser If any files on the system do not have an assigned owner, this is a finding.

Fix: F-73122r1049292_fix

Either remove all files and directories from the system that do not have a valid user, or assign a valid user to all unowned files and directories on AlmaLinux OS 9 with the "chown" command: $ chown <user> <file>

Generate Mitigation Statement:

Checks: C-73222r1047949_chk

Verify the group ownership of the "/etc/group-" file with the following command: $ stat -c "%G %n" /etc/group- root /etc/group- If "/etc/group-" file does not have a group owner of "root", this is a finding.

Fix: F-73123r1047950_fix

Change the group of the file /etc/group- to root by running the following command: $ chgrp root /etc/group-

Generate Mitigation Statement:

Checks: C-73223r1047952_chk

Verify the ownership of the "/etc/group-" file with the following command: $ stat -c "%U %n" /etc/group- root /etc/group- If "/etc/group-" file does not have an owner of "root", this is a finding.

Fix: F-73124r1047953_fix

Change the owner of the file /etc/group- to root by running the following command: $ chown root /etc/group-

Generate Mitigation Statement:

Checks: C-73224r1047955_chk

Verify that the "/etc/group-" file has mode "0644" or less permissive with the following command: $ stat -c "%#a %n" /etc/group- 0644 /etc/group- If a value of "0644" or less permissive is not returned, this is a finding.

Fix: F-73125r1047956_fix

Change the mode of the file "/etc/group-" to "0644" by running the following command: $ chmod 0644 /etc/group-

Generate Mitigation Statement:

Checks: C-73225r1047958_chk

Verify the group ownership of the "/etc/group" file with the following command: $ stat -c "%G %n" /etc/group root /etc/group If "/etc/group" file does not have a group owner of "root", this is a finding.

Fix: F-73126r1047959_fix

Change the group of the file /etc/group to root by running the following command: $ chgrp root /etc/group

Generate Mitigation Statement:

Checks: C-73226r1047961_chk

Verify the ownership of the "/etc/group" file with the following command: $ stat -c "%U %n" /etc/group root /etc/group If "/etc/group" file does not have an owner of "root", this is a finding.

Fix: F-73127r1047962_fix

Change the owner of the file /etc/group to root by running the following command: $ chown root /etc/group

Generate Mitigation Statement:

Checks: C-73227r1047964_chk

Verify that the "/etc/group" file has mode "0644" or less permissive with the following command: $ stat -c "%#a %n" /etc/group 0644 /etc/group If a value of "0644" or less permissive is not returned, this is a finding.

Fix: F-73128r1047965_fix

Change the mode of the file "/etc/group" to "0644" by running the following command: $ chmod 0644 /etc/group

Generate Mitigation Statement:

Checks: C-73228r1047967_chk

Verify the group ownership of the "/boot/grub2/grub.cfg" file with the following command: $ stat -c "%G %n" /boot/grub2/grub.cfg root /boot/grub2/grub.cfg If "/boot/grub2/grub.cfg" file does not have a group owner of "root", this is a finding.

Fix: F-73129r1047968_fix

Change the group of the file /boot/grub2/grub.cfg to root by running the following command: $ chgrp root /boot/grub2/grub.cfg

Generate Mitigation Statement:

Checks: C-73229r1047970_chk

Verify the ownership of the "/boot/grub2/grub.cfg" file with the following command: $ stat -c "%U %n" /boot/grub2/grub.cfg root /boot/grub2/grub.cfg If "/boot/grub2/grub.cfg" file does not have an owner of "root", this is a finding.

Fix: F-73130r1047971_fix

Change the owner of the file /boot/grub2/grub.cfg to root by running the following command: $ chown root /boot/grub2/grub.cfg

Generate Mitigation Statement:

Checks: C-73230r1047973_chk

Verify that GRUB 2 is configured to disable interactive boot. Check that the current GRUB 2 configuration disables the ability of systemd to spawn an interactive boot process with the following command: $ grubby --info=ALL | grep args | grep 'systemd.confirm_spawn' If any output is returned, this is a finding.

Fix: F-73131r1049302_fix

Configure AlmaLinux OS 9 to disable the ability of systemd to spawn an interactive boot process with the following command: $ grubby --update-kernel=ALL --remove-args="systemd.confirm_spawn"

Generate Mitigation Statement:

Checks: C-73231r1047976_chk

Verify the group ownership of the "/etc/gshadow-" file with the following command: $ stat -c "%G %n" /etc/gshadow- root /etc/gshadow- If "/etc/gshadow-" file does not have a group owner of "root", this is a finding.

Fix: F-73132r1047977_fix

Change the group of the file /etc/gshadow- to root by running the following command: $ chgrp root /etc/gshadow-

Generate Mitigation Statement:

Checks: C-73232r1047979_chk

Verify the ownership of the "/etc/gshadow-" file with the following command: $ stat -c "%U %n" /etc/gshadow- root /etc/gshadow- If "/etc/gshadow-" file does not have an owner of "root", this is a finding.

Fix: F-73133r1047980_fix

Change the owner of the file /etc/gshadow- to root by running the following command: $ chown root /etc/gshadow-

Generate Mitigation Statement:

Checks: C-73233r1047982_chk

Verify that the "/etc/gshadow-" file has mode "0000" with the following command: $ stat -c "%a %n" /etc/gshadow- 0 /etc/gshadow- If a value of "0" is not returned, this is a finding.

Fix: F-73134r1047983_fix

Change the mode of the file "/etc/gshadow-" to "0000" by running the following command: $ chmod 0000 /etc/gshadow-

Generate Mitigation Statement:

Checks: C-73234r1047985_chk

Verify the group ownership of the "/etc/gshadow" file with the following command: $ stat -c "%G %n" /etc/gshadow root /etc/gshadow If "/etc/gshadow" file does not have a group owner of "root", this is a finding.

Fix: F-73135r1047986_fix

Change the group of the file /etc/gshadow to root by running the following command: $ chgrp root /etc/gshadow

Generate Mitigation Statement:

Checks: C-73235r1047988_chk

Verify the ownership of the "/etc/gshadow" file with the following command: $ stat -c "%U %n" /etc/gshadow root /etc/gshadow If "/etc/gshadow" file does not have an owner of "root", this is a finding.

Fix: F-73136r1047989_fix

Change the owner of the file /etc/gshadow to root by running the following command: $ chown root /etc/gshadow

Generate Mitigation Statement:

Checks: C-73236r1047991_chk

Verify that the "/etc/gshadow" file has mode "0000" with the following command: $ stat -c "%a %n" /etc/gshadow 0 /etc/gshadow If a value of "0" is not returned, this is a finding.

Fix: F-73137r1047992_fix

Change the mode of the file "/etc/gshadow" to "0000" by running the following command: $ chmod 0000 /etc/gshadow

Generate Mitigation Statement:

Checks: C-73237r1049310_chk

Verify that AlmaLinux OS 9 is configured to boot to the command line: $ systemctl get-default multi-user.target If the system default target is not set to "multi-user.target" and the information system security officer (ISSO) lacks a documented requirement for a graphical user interface, this is a finding.

Fix: F-73138r1047995_fix

Document the requirement for a graphical user interface with the ISSO or set the default target to multi-user with the following command: $ systemctl set-default multi-user.target

Generate Mitigation Statement:

Checks: C-73238r1049312_chk

Verify that AlmaLinux OS 9 disables the user logon list for graphical user interfaces with the following command: Note: This requirement assumes the use of the AlmaLinux OS 9 default graphical user interface, the GNOME desktop environment. If the system does not have any graphical user interface installed, this requirement is Not Applicable. $ gsettings get org.gnome.login-screen disable-user-list true If the setting is "false", this is a finding.

Fix: F-73139r1049313_fix

Configure AlmaLinux OS 9 to disable the user list at logon for graphical user interfaces. Create a database to contain the systemwide screensaver settings (if it does not already exist) with the following command: Note: The example below is using the database "local" for the system, so if the system is using another database in "/etc/dconf/profile/user", the file should be created under the appropriate subdirectory. $ touch /etc/dconf/db/local.d/02-login-screen [org/gnome/login-screen] disable-user-list=true Update the system databases: $ dconf update

Generate Mitigation Statement:

Checks: C-73239r1049315_chk

Verify all local interactive users on AlmaLinux OS 9 are assigned a home directory upon creation with the following command: $ grep CREATE_HOME /etc/login.defs CREATE_HOME yes If the value for "CREATE_HOME" parameter is not set to "yes", the line is missing, or the line is commented out, this is a finding.

Fix: F-73140r1049316_fix

Configure AlmaLinux OS 9 to assign home directories to all new local interactive users by setting the "CREATE_HOME" parameter in "/etc/login.defs" to "yes" as follows: CREATE_HOME yes

Generate Mitigation Statement:

Checks: C-73240r1048003_chk

Verify the assigned home directories of all interactive users on the system exist with the following command: $ pwck -r user 'testdupe': directory '/home/testdupe' does not exist The output should not return any interactive users. If users home directory does not exist, this is a finding.

Fix: F-73141r1048004_fix

Create home directories to all local interactive users that currently do not have a home directory assigned. Use the following commands to create the user home directory assigned in "/etc/ passwd": Note: The example will be for the user testdupe, who has a home directory of "/home/testdupe", a UID of "testdupe", and a GID of "testdupe" in "/etc/passwd": $ mkdir /home/testdupe $ chown testdupe /home/testdupe $ chgrp testdupe /home/testdupe $ chmod 0700 /home/testdupe

Generate Mitigation Statement:

Checks: C-73241r1048006_chk

Verify the assigned home directory of all local interactive users is group-owned by that user's primary GID with the following command: Note: This may miss local interactive users that have been assigned a privileged UID. Evidence of interactive use may be obtained from a number of log files containing system logon information. The returned directory "/home/test" is used as an example. $ stat --format="%n: GID=%g (%G), UID=%u (%U), MODE=%0.4a" $(awk -F: '($3&gt;=1000)&amp;&amp;($7 !~ /nologin/){print $6}' /etc/passwd) /home/test: GID=1001 (test), UID=1001 (test), MODE=0700 Check the user's primary group with the following command: $ grep $(grep -E '^test:' /etc/passwd | awk -F: '{print $4}') /etc/group test:x:1001: If the user home directory referenced in "/etc/passwd" is not group-owned by that user's primary GID (1001 in the above example) this is a finding.

Fix: F-73142r1048007_fix

Change the group owner of a local interactive user's home directory to the group found in "/etc/passwd". To change the group owner of a local interactive user's home directory, use the following command: Note: The example will be for the user "test", who has a home directory of "/home/test", and has a primary group of "test". $ chgrp test /home/test

Generate Mitigation Statement:

Checks: C-73242r1048009_chk

Verify "/home" is mounted with the "noexec" option with the following command: Note: If a separate file system has not been created for the user home directories (user home directories are mounted under "/"), this is automatically a finding, as the "noexec" option cannot be used on the "/" system. $ mount | grep /home /dev/mapper/luks-10a20c46-483d-4d12-831f-5328eda18fd1 on /home type xfs (rw,noexec,nosuid,nodev,relatime,seclabel,attr2,inode64,logbufs=8,logbsize=32k,noquota) If the "/home" file system is mounted without the "noexec" option, this is a finding.

Fix: F-73143r1048010_fix

Modify "/etc/fstab" to use the "noexec" option on the "/home" directory.

Generate Mitigation Statement:

Checks: C-73243r1048012_chk

Verify that a separate file system/partition has been created for "/home" with the following command: $ mount | grep /home /dev/mapper/luks-10a20c46-483d-4d12-831f-5328eda18fd1 on /home type xfs (rw,nosuid,nodev,relatime,seclabel,attr2,inode64,logbufs=8,logbsize=32k,noquota) If a separate entry for "/home" is not in use, this is a finding.

Fix: F-73144r1048013_fix

Migrate the "/home" directory onto a separate file system/partition.

Generate Mitigation Statement:

Checks: C-73244r1048015_chk

Verify that interactive users on the system have a home directory assigned with the following command: $ awk -F: '($3&gt;=1000)&amp;&amp;($7 !~ /nologin/){print $1, $6}' /etc/passwd simon /home/simon test /home/test testdupe /home/testdupe Inspect the output and verify that all interactive users (normally users with a UID greater that 1000) have a home directory defined. If users home directory is not defined, this is a finding.

Fix: F-73145r1049322_fix

Create and assign home directories to all local interactive users on AlmaLinux OS 9 that currently do not have a home directory assigned.

Generate Mitigation Statement:

Checks: C-73245r1048018_chk

Verify that all local interactive user initialization file executable search path statements do not contain statements that will reference a working directory other than user home directories with the following commands: $ grep -i path= /home/*/.* grep -i path= /home/*/.* 2&gt;/dev/null /home/simon/.bashrc: PATH="$HOME/.local/bin:$HOME/bin:$PATH" /home/test/.bashrc: PATH="$HOME/.local/bin:$HOME/bin:$PATH" If any local interactive user initialization files have executable search path statements that include directories outside of their home directory and is not documented with the ISSO as an operational requirement, this is a finding.

Fix: F-73146r1048019_fix

Edit the local interactive user initialization files to change any PATH variable statements that reference directories other than their home directory. If a local interactive user requires path variables to reference a directory owned by the application, it must be documented with the ISSO.

Generate Mitigation Statement:

Checks: C-73246r1048021_chk

Note: This may miss interactive users that have been assigned a privileged user identifier (UID). Evidence of interactive use may be obtained from a number of log files containing system logon information. Verify the assigned home directory of all local interactive users has a mode of "0750" or less permissive with the following command: $ ls -ld $(awk -F: '($3&gt;=1000)&amp;&amp;($7 !~ /nologin/){print $6}' /etc/passwd) drwx------. 2 simon simon 83 Nov 30 12:30 /home/simon drwx------. 2 test test 83 Jan 19 14:18 /home/test drwx------. 2 test testdupe 62 Jan 15 11:44 /home/testdupe If home directories referenced in "/etc/passwd" do not have a mode of "0750" or less permissive, this is a finding.

Fix: F-73147r1048022_fix

Change the mode of interactive user's home directories to "0750". To change the mode of a local interactive user's home directory, use the following command: Note: The example will be for the user "test". $ chmod 0750 /home/test

Generate Mitigation Statement:

Checks: C-73248r1049328_chk

Verify AlmaLinux OS 9 enforces a delay of at least four seconds between console logon prompts following a failed logon attempt with the following command: $ grep -i fail_delay /etc/login.defs FAIL_DELAY 4 If the value of "FAIL_DELAY" is not set to "4" or greater, or the line is commented out, this is a finding.

Fix: F-73149r1049329_fix

Configure the AlmaLinux OS 9 to enforce a delay of at least four seconds between logon prompts following a failed console logon attempt. Modify the "/etc/login.defs" file to set the "FAIL_DELAY" parameter to 4 or greater: FAIL_DELAY 4

Generate Mitigation Statement:

Checks: C-73249r1048030_chk

Verify that null passwords cannot be used with the following command: $ grep -i nullok /etc/pam.d/system-auth /etc/pam.d/password-auth If output is produced, this is a finding. If the system administrator (SA) can demonstrate that the required configuration is contained in a PAM configuration file included or substacked from the system-auth file, this is not a finding.

Fix: F-73150r1048031_fix

Remove any instances of the "nullok" option in the "/etc/pam.d/password-auth" and "/etc/pam.d/system-auth" files to prevent logons with empty passwords. Note: Manual changes to the listed file may be overwritten by the "authselect" program.

Generate Mitigation Statement:

Checks: C-73250r1048033_chk

Verify that null or blank passwords cannot be used with the following command: $ awk -F: '!$2 {print $1}' /etc/shadow If the command returns any results, this is a finding.

Fix: F-73151r1049332_fix

Configure all accounts on AlmaLinux OS 9 to have a password or lock the account with the following commands: Perform a password reset: $ passwd [username] To lock an account: $ passwd -l [username]

Generate Mitigation Statement:

Checks: C-73251r1048036_chk

Verify the group ownership of the "/etc/passwd-" file with the following command: $ stat -c "%G %n" /etc/passwd- root /etc/passwd- If "/etc/passwd-" file does not have a group owner of "root", this is a finding.

Fix: F-73152r1048037_fix

Change the group of the file /etc/passwd- to root by running the following command: $ chgrp root /etc/passwd-

Generate Mitigation Statement:

Checks: C-73252r1048039_chk

Verify the ownership of the "/etc/passwd-" file with the following command: $ stat -c "%U %n" /etc/passwd- root /etc/passwd- If "/etc/passwd-" file does not have an owner of "root", this is a finding.

Fix: F-73153r1048040_fix

Change the owner of the file /etc/passwd- to root by running the following command: $ chown root /etc/passwd-

Generate Mitigation Statement:

Checks: C-73253r1048042_chk

Verify that the "/etc/passwd-" file has mode "0644" or less permissive with the following command: $ stat -c "%#a %n" /etc/passwd- 0644 /etc/passwd- If a value of "0644" or less permissive is not returned, this is a finding.

Fix: F-73154r1048043_fix

Change the mode of the file "/etc/passwd-" to "0644" by running the following command: $ chmod 0644 /etc/passwd-

Generate Mitigation Statement:

Checks: C-73254r1048045_chk

Verify the group ownership of the "/etc/passwd" file with the following command: $ stat -c "%G %n" /etc/passwd root /etc/passwd If "/etc/passwd" file does not have a group owner of "root", this is a finding.

Fix: F-73155r1048046_fix

Change the group of the file /etc/passwd to root by running the following command: $ chgrp root /etc/passwd

Generate Mitigation Statement:

Checks: C-73255r1048048_chk

Verify the ownership of the "/etc/passwd" file with the following command: $ stat -c "%U %n" /etc/passwd root /etc/passwd If "/etc/passwd" file does not have an owner of "root", this is a finding.

Fix: F-73156r1048049_fix

Change the owner of the file /etc/passwd to root by running the following command: $ chown root /etc/passwd

Generate Mitigation Statement:

Checks: C-73256r1048051_chk

Verify that the "/etc/passwd" file has mode "0644" or less permissive with the following command: $ stat -c "%#a %n" /etc/passwd 0644 /etc/passwd If a value of "0644" or less permissive is not returned, this is a finding.

Fix: F-73157r1048052_fix

Change the mode of the file "/etc/passwd" to "0644" by running the following command: $ chmod 0644 /etc/passwd

Generate Mitigation Statement:

Checks: C-73257r1048054_chk

Verify the group ownership of the "/etc/shadow-" file with the following command: $ stat -c "%G %n" /etc/shadow- root /etc/shadow- If "/etc/shadow-" file does not have a group owner of "root", this is a finding.

Fix: F-73158r1048055_fix

Change the group of the file /etc/shadow- to root by running the following command: $ chgrp root /etc/shadow-

Generate Mitigation Statement:

Checks: C-73258r1048057_chk

Verify the ownership of the "/etc/shadow-" file with the following command: $ stat -c "%U %n" /etc/shadow- root /etc/shadow- If "/etc/shadow-" file does not have an owner of "root", this is a finding.

Fix: F-73159r1048058_fix

Change the owner of the file /etc/shadow- to root by running the following command: $ chown root /etc/shadow-

Generate Mitigation Statement:

Checks: C-73259r1048060_chk

Verify that the "/etc/shadow-" file has mode "0000" with the following command: $ stat -c "%a %n" /etc/shadow- 0 /etc/shadow- If a value of "0" is not returned, this is a finding.

Fix: F-73160r1048061_fix

Change the mode of the file "/etc/shadow-" to "0000" by running the following command: $ chmod 0000 /etc/shadow-

Generate Mitigation Statement:

Checks: C-73260r1048063_chk

Verify the group ownership of the "/etc/shadow" file with the following command: $ stat -c "%G %n" /etc/shadow root /etc/shadow If "/etc/shadow" file does not have a group owner of "root", this is a finding.

Fix: F-73161r1048064_fix

Change the group of the file /etc/shadow to root by running the following command: $ chgrp root /etc/shadow

Generate Mitigation Statement:

Checks: C-73261r1048066_chk

Verify the ownership of the "/etc/shadow" file with the following command: $ stat -c "%U %n" /etc/shadow root /etc/shadow If "/etc/shadow" file does not have an owner of "root", this is a finding.

Fix: F-73162r1048067_fix

Change the owner of the file /etc/shadow to root by running the following command: $ chown root /etc/shadow

Generate Mitigation Statement:

Checks: C-73262r1048069_chk

Verify that the "/etc/shadow" file has mode "0000" with the following command: $ stat -c "%a %n" /etc/shadow 0 /etc/shadow If a value of "0" is not returned, this is a finding.

Fix: F-73163r1048070_fix

Change the mode of the file "/etc/shadow" to "0000" by running the following command: $ chmod 0000 /etc/shadow

Generate Mitigation Statement:

Checks: C-73263r1049346_chk

Verify AlmaLinux OS 9 restricts privilege elevation to authorized personnel with the following command: $ grep -w ALL /etc/sudoers /etc/sudoers.d/* | grep -v '#' /etc/sudoers:root ALL=(ALL) ALL /etc/sudoers:%wheel ALL=(ALL) NOPASSWD: ALL If the either of the following entries are returned, including their NOPASSWD equivalents, this is a finding: ALL ALL=(ALL) ALL ALL ALL=(ALL:ALL) ALL

Fix: F-73164r1048073_fix

Remove the following entries from the /etc/sudoers file or configuration files under /etc/sudoers.d/ (including NOPASSWD equivalents): ALL ALL=(ALL) ALL ALL ALL=(ALL:ALL) ALL

Generate Mitigation Statement:

Checks: C-73264r1048075_chk

Verify that the sudoers security policy is configured to use the invoking user's password for privilege escalation with the following command: $ grep -E '(!rootpw|!targetpw|!runaspw)' /etc/sudoers /etc/sudoers.d/* | grep -v '#' /etc/sudoers.d/01_stig:Defaults !targetpw /etc/sudoers.d/01_stig:Defaults !rootpw /etc/sudoers.d/01_stig:Defaults !runaspw If no results are returned, this is a finding. If results are returned from more than one file location, this is a finding. If "Defaults !targetpw" is not defined, this is a finding. If "Defaults !rootpw" is not defined, this is a finding. If "Defaults !runaspw" is not defined, this is a finding.

Fix: F-73165r1048076_fix

Define the following in the Defaults section of the /etc/sudoers file or a single configuration file in the /etc/sudoers.d/ directory: Defaults !targetpw Defaults !rootpw Defaults !runaspw

Generate Mitigation Statement:

Checks: C-73265r1048078_chk

Verify that the default umask for all local interactive users is "077". Identify the locations of all local interactive user home directories by looking at the "/etc/passwd" file. Check all local interactive user initialization files for interactive users with the following command: Note: The example is for a system that is configured to create users home directories in the "/home" directory. $ grep -ir umask /home | grep -v '.bash_history' If any local interactive user initialization files are found to have a umask statement that sets a value less restrictive than "077", this is a finding.

Fix: F-73166r1048079_fix

Remove the umask statement from all local interactive user's initialization files. If the account is for an application, the requirement for a umask less restrictive than "077" can be documented with the information system security officer (ISSO), but the user agreement for access to the account must specify that the local interactive user must first log on to their account and then switch the user to the application account with the correct option to gain the account's environment variables.

Generate Mitigation Statement:

Checks: C-73266r1049350_chk

Verify AlmaLinux OS 9 defines default permissions for all authenticated users in such a way that the user can only read and modify their own files with the following command: Note: If the value of the "UMASK" parameter is set to "000" in the "/etc/login.defs" file, the severity is raised to a CAT I. $ grep UMASK /etc/login.defs UMASK 077 If the value for the "UMASK" parameter is not "077", or the "UMASK" parameter is missing or is commented out, this is a finding.

Fix: F-73167r1049351_fix

Configure AlmaLinux OS 9 to define default permissions for all authenticated users in such a way that the user can only read and modify their own files. Add or edit the lines for the "UMASK" parameter in the "/etc/login.defs" file to "077": UMASK 077

Generate Mitigation Statement:

Checks: C-73267r1048084_chk

Verify that the "pam_umask" module is enabled with the following command: $ grep -i umask /etc/pam.d/* /etc/pam.d/postlogin:session optional pam_umask.so silent umask=0022 If a "pam_umask.so" line is not returned, this is a finding. If the "umask" setting is set to anything other than "0077", this is a finding. Note: If the "umask" setting is not found, it will use the default UMASK entry in /etc/login.defs.

Fix: F-73168r1049353_fix

Configure AlmaLinux OS 9 to define default permissions for all authenticated users so the user can only read and modify their own files. Add or edit the following line at the top of /etc/pam.d/postlogin: session optional pam_umask.so silent

Generate Mitigation Statement:

Checks: C-73268r1048087_chk

Verify that the "umask" setting for installed shells is "077". Note: If the value of the "umask" parameter is set to "000", the severity is raised to a CAT I. $ grep -ir umask /etc/profile* /etc/bashrc* /etc/csh* /etc/csh.cshrc: umask 077 If the "umask" parameter is set to anything other than "077", this is a finding.

Fix: F-73169r1049355_fix

Configure AlmaLinux OS 9 to define default permissions for all authenticated users in such a way that the user can only read and modify their own files. Change any found "umask" parameters in the "/etc/bashrc*", "/etc/csh*", and "/etc/profile*" files to "077": umask 077

Generate Mitigation Statement:

Checks: C-73269r1048090_chk

Verify that there are no unauthorized interactive user accounts with the following command: $ cat /etc/passwd root:x:0:0:root:/root:/bin/bash ... sync:x:5:0:sync:/sbin:/bin/sync shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown halt:x:7:0:halt:/sbin:/sbin/halt simon:x:1000:1000::/home/simon:/bin/bash Interactive user accounts, generally will have a user identifier (UID) of 1000 or greater, a home directory in a specific partition, and an interactive shell. Obtain the list of interactive user accounts authorized to be on the system from the system administrator or information system security officer (ISSO) and compare it to the list of local interactive user accounts on the system. If there are unauthorized local user accounts on the system, this is a finding.

Fix: F-73170r1048091_fix

Remove unauthorized local interactive user accounts with the following command where <unauthorized_user> is the unauthorized account: $ userdel -rf <unauthorized_user>

Generate Mitigation Statement:

Checks: C-73270r1048093_chk

Verify that that AIDE is verifying ACLs with the following command: $ grep acl /etc/aide.conf All= p+i+n+u+g+s+m+S+sha512+acl+xattrs+selinux If the "acl" rule is not being used on all uncommented selection lines in the "/etc/aide.conf" file, or ACLs are not being checked by another file integrity tool, this is a finding.

Fix: F-73171r1048094_fix

Configure the file integrity tool to check file and directory ACLs. If AIDE is installed, ensure the "acl" rule is present on all uncommented file and directory selection lists.

Generate Mitigation Statement:

Checks: C-73271r1048096_chk

Verify that AIDE is configured to use FIPS 140-3 file hashing with the following command: $ grep sha512 /etc/aide.conf All=p+i+n+u+g+s+m+S+sha512+acl+xattrs+selinux If the "sha512" rule is not being used on all uncommented selection lines in the "/etc/aide.conf" file, or another file integrity tool is not using FIPS 140-3-approved cryptographic hashes for validating file contents and directories, this is a finding.

Fix: F-73172r1048097_fix

Configure the file integrity tool to use FIPS 140-3 cryptographic hashes for validating file and directory contents. If AIDE is installed, ensure the "sha512" rule is present on all uncommented file and directory selection lists. Exclude any log files, or files expected to change frequently, to reduce unnecessary notifications.

Generate Mitigation Statement:

Checks: C-73272r1048099_chk

Verify that AIDE is configured to verify extended attributes with the following command: $ grep xattrs /etc/aide.conf All= p+i+n+u+g+s+m+S+sha512+acl+xattrs+selinux If the "xattrs" rule is not being used on all uncommented selection lines in the "/etc/aide.conf" file, or extended attributes are not being checked by another file integrity tool, this is a finding. If the "acl" rule is not being used on all uncommented selection lines in the "/etc/aide.conf" file, or ACLs are not being checked by another file integrity tool, this is a finding.

Fix: F-73173r1048100_fix

Configure the file integrity tool to check file and directory extended attributes. If AIDE is installed, ensure the "xattrs" rule is present on all uncommented file and directory selection lists.

Generate Mitigation Statement:

Checks: C-73273r1049361_chk

Verify AlmaLinux OS 9 prevents the use of dictionary words for passwords with the following command: $ grep -r dictcheck /etc/security/pwquality.conf* /etc/security/pwquality.conf.d/stig.conf:dictcheck = 1 If the value of "dictcheck" is not "1" , is not set, is commented out, or if conflicting results are returned, this is a finding.

Fix: F-73174r1049362_fix

Configure AlmaLinux OS 9 to prevent the use of dictionary words for passwords. Add or update the following line in the "/etc/security/pwquality.conf" file or a configuration file in the "/etc/security/pwquality.conf.d/" directory: dictcheck = 1 Remove any configurations that conflict with the above value.

Generate Mitigation Statement:

Checks: C-73274r1049364_chk

Note: If IPv6 is disabled on the system, this requirement is Not Applicable. Verify AlmaLinux OS 9 does not accept router advertisements on any IPv6 interfaces, unless the system is a router. Determine if router advertisements are not accepted by using the following command: $ sysctl -a | grep 'accept_ra ' net.ipv6.conf.all.accept_ra = 1 net.ipv6.conf.default.accept_ra = 1 net.ipv6.conf.enp1s0.accept_ra = 0 net.ipv6.conf.lo.accept_ra = 1 If any of the returned lines are not set to "0" and it is not documented with the information system security officer (ISSO) as an operational requirement, this is a finding.

Fix: F-73175r1049365_fix

Configure AlmaLinux OS 9 to not accept router advertisements on all IPv6 interfaces unless the system is a router. Create a numbered *.conf file in /etc/sysctl.d/ with the following content: net.ipv6.conf.all.accept_ra = 0 net.ipv6.conf.default.accept_ra = 0 net.ipv6.conf.lo.accept_ra = 0 The system configuration files need to be reloaded for the changes to take effect. To reload the contents of the files, run the following command: $ sysctl –system

Generate Mitigation Statement:

Checks: C-73275r1049367_chk

Verify AlmaLinux OS 9 will not accept ICMP redirect messages. Check the value of the "accept_redirects" variables with the following command: $ sysctl -a | grep accept_redirects net.ipv4.conf.all.accept_redirects = 0 net.ipv4.conf.default.accept_redirects = 0 net.ipv4.conf.enp1s0.accept_redirects = 0 net.ipv4.conf.lo.accept_redirects = 0 net.ipv6.conf.all.accept_redirects = 0 net.ipv6.conf.default.accept_redirects = 0 net.ipv6.conf.enp1s0.accept_redirects = 0 net.ipv6.conf.lo.accept_redirects = 0 If the returned lines do not all have a value of "0", this is a finding.

Fix: F-73176r1049368_fix

Configure AlmaLinux OS 9 to ignore ICMP redirect messages. Create a numbered *.conf file in /etc/sysctl.d/ with the following content: net.ipv4.conf.all.accept_redirects = 0 net.ipv4.conf.default.accept_redirects = 0 net.ipv4.conf.lo.accept_redirects = 0 net.ipv6.conf.all.accept_redirects = 0 net.ipv6.conf.default.accept_redirects = 0 net.ipv6.conf.lo.accept_redirects = 0 The system configuration files need to be reloaded for the changes to take effect. To reload the contents of the files, run the following command: $ sysctl –system

Generate Mitigation Statement:

Checks: C-73276r1048111_chk

Verify that "firewalld" is active with the following command: $ systemctl is-active firewalld active If the firewalld service is not active, this is a finding.

Fix: F-73177r1048112_fix

Enable the firewalld service using the following command: $ systemctl enable --now firewalld

Generate Mitigation Statement:

Checks: C-73277r1049371_chk

Verify the AlmaLinux OS 9 "firewalld" is configured to employ a deny-all, allow-by-exception policy for allowing connections to other systems. First ensure firewalld is running: $ firewall-cmd --state running Next, get the active zones: $ firewall-cmd --get-active-zones public interfaces: enp1s0 Check the target of the zones returned from the previous command: $ firewall-cmd --info-zone=public | grep target target: DROP Check the runtime and permanent rules match: $ firewall-cmd --permanent --info-zone=public | grep target target: DROP If no zones are active on the AlmaLinux OS 9 interfaces or if runtime and permanent targets are set to a different option other than "DROP", this is a finding.

Fix: F-73178r1050780_fix

Configure the "firewalld" daemon to employ a deny-all, allow-by-exception. Start by adding the exceptions that are required for mission functionality to the "drop" zone. If SSH access on port 22 is needed for example, run the following command: $ firewall-cmd --permanent --add-service=ssh --zone=drop Set the default zone to the "drop" zone: $ firewall-cmd --set-default-zone=drop Note: This is a runtime and a permanent change. Add any interfaces to the newly modified "drop" zone: $ firewall-cmd --permanent --zone=drop --change-interface=enp1s0 Reload the firewall rules for changes to take effect: $ firewall-cmd --reload Check zones and interfaces: $ firewall-cmd --get-active-zones drop interfaces: enp1s0 Check new default zone's target is set to "DROP": $ firewall-cmd --permanent --info-zone=drop | grep target target: DROP The same outcome is achieved by creating a new zone, for example: $ firewall-cmd --permanent --new-zone=stig $ firewall-cmd --reload $ firewall-cmd --permanent --change-interface=enp1s0 --zone=stig $ firewall-cmd --permanent --add-service=ssh --zone=stig $ firewall-cmd --permanent --set-target=DROP --zone=stig $ firewall-cmd --set-default-zone=stig

Generate Mitigation Statement:

Checks: C-73278r1049373_chk

Verify AlmaLinux OS 9 ignores bogus ICMP error responses with the following command: $ sysctl net.ipv4.icmp_ignore_bogus_error_responses net.ipv4.icmp_ignore_bogus_error_responses = 1 If the returned line does not have a value of "1", this is a finding.

Fix: F-73179r1049374_fix

Configure AlmaLinux OS 9 to use reverse path filtering on all IP interfaces. Create a numbered *.conf file in /etc/sysctl.d/ with the following content: net.ipv4.icmp_ignore_bogus_error_responses = 1 The system configuration files need to be reloaded for the changes to take effect. To reload the contents of the files, run the following command: $ sysctl --system

Generate Mitigation Statement:

Checks: C-73279r1049376_chk

Verify AlmaLinux OS 9 does not respond to ICMP echoes sent to a broadcast address with the following command: $ sysctl net.ipv4.icmp_echo_ignore_broadcasts net.ipv4.icmp_echo_ignore_broadcasts = 1 If the returned line does not have a value of "1", this is a finding.

Fix: F-73180r1049377_fix

Configure AlmaLinux OS 9 to use reverse path filtering on all IP interfaces. Create a numbered *.conf file in /etc/sysctl.d/ with the following content: net.ipv4.icmp_echo_ignore_broadcasts = 1 The system configuration files need to be reloaded for the changes to take effect. To reload the contents of the files, run the following command: $ sysctl –system

Generate Mitigation Statement:

Checks: C-73280r1049379_chk

Verify AlmaLinux OS 9 is not performing IP packet forwarding, unless the system is a router. Check that IP forwarding is disabled using the following command: $ sysctl -a | grep -E '\.forwarding' net.ipv4.conf.all.forwarding = 0 net.ipv4.conf.default.forwarding = 0 net.ipv4.conf.enp1s0.forwarding = 0 net.ipv4.conf.lo.forwarding = 0 net.ipv6.conf.all.forwarding = 0 net.ipv6.conf.default.forwarding = 0 net.ipv6.conf.enp1s0.forwarding = 0 net.ipv6.conf.lo.forwarding = 0 If any of the returned lines are not set to "0" and it is not documented with the information system security officer (ISSO) as an operational requirement, this is a finding.

Fix: F-73181r1049380_fix

Configure AlmaLinux OS 9 to not allow IP packet forwarding, unless the system is a router. Create a numbered *.conf file in /etc/sysctl.d/ with the following content: net.ipv4.conf.all.forwarding = 0 net.ipv4.conf.default.forwarding = 0 net.ipv4.conf.lo.forwarding = 0 net.ipv6.conf.all.forwarding = 0 net.ipv6.conf.default.forwarding = 0 net.ipv6.conf.lo.forwarding = 0 The system configuration files need to be reloaded for the changes to take effect. To reload the contents of the files, run the following command: $ sysctl –system

Generate Mitigation Statement:

Checks: C-73281r1049382_chk

Verify that AlmaLinux OS 9 does not have unauthorized IP tunnels configured. Determine if the "IPsec" service is active with the following command: $ systemctl status ipsec ipsec.service - Internet Key Exchange (IKE) Protocol Daemon for IPsec Loaded: loaded (/usr/lib/systemd/system/ipsec.service; disabled; preset: disabled) Active: inactive (dead) If the "IPsec" service is active, check for configured IPsec connections ("conn"), with the following command: $ grep -ri conn /etc/ipsec.conf /etc/ipsec.d/ | grep -v '#' Verify any returned results are documented with the ISSO. If the IPsec tunnels are active and not approved, this is a finding.

Fix: F-73182r1048127_fix

Remove all unapproved tunnels from the system, or document them with the ISSO.

Generate Mitigation Statement:

Checks: C-73282r1049384_chk

Verify AlmaLinux OS 9 logs martian packets. Check the value of the "log_martians" variables with the following command: $ sysctl -a | grep log_martians net.ipv4.conf.all.log_martians = 1 net.ipv4.conf.default.log_martians = 1 net.ipv4.conf.enp1s0.log_martians = 1 net.ipv4.conf.lo.log_martians = 1 If the returned lines do not all have a value of "1", this is a finding.

Fix: F-73183r1049385_fix

Configure AlmaLinux OS 9 to log martian packets. Create a numbered *.conf file in /etc/sysctl.d/ with the following content: net.ipv4.conf.all.log_martians = 1 net.ipv4.conf.default.log_martians = 1 net.ipv4.conf.lo.log_martians = 1 The system configuration files need to be reloaded for the changes to take effect. To reload the contents of the files, run the following command: $ sysctl --system

Generate Mitigation Statement:

Checks: C-73283r1049387_chk

Note: If postfix is not installed, this is Not Applicable. Verify AlmaLinux OS 9 is configured to prevent unrestricted mail relaying with the following command: $ postconf -n smtpd_client_restrictions smtpd_client_restrictions = permit_mynetworks,reject If the "smtpd_client_restrictions" parameter contains any entries other than "permit_mynetworks" and "reject", and the additional entries have not been documented with the information system security officer (ISSO), this is a finding.

Fix: F-73184r1048133_fix

Modify the postfix configuration file to restrict client connections to the local network with the following command: $ postconf -e 'smtpd_client_restrictions = permit_mynetworks,reject'

Generate Mitigation Statement:

Checks: C-73284r1049389_chk

Verify that AlmaLinux OS 9 has the nss-tools package installed with the following command: $ dnf list --installed nss-tools Installed Packages nss-tools.x86_64 3.90.0-6.el9_2.tuxcare.1 @@commandline If the "nss-tools" package is not installed, this is a finding.

Fix: F-73185r1048136_fix

The nss-tools package can be installed with the following command: $ dnf install nss-tools

Generate Mitigation Statement:

Checks: C-73285r1048138_chk

Verify network interfaces are not in promiscuous mode with the following command: $ ip link | grep -i promisc If network interfaces are found on the system in promiscuous mode and their use has not been approved by the ISSO and documented, this is a finding.

Fix: F-73186r1048139_fix

Configure network interfaces to turn off promiscuous mode unless approved by the ISSO and documented. Set the promiscuous mode of an interface to off with the following command: $ ip link set dev <devicename> multicast off promisc off

Generate Mitigation Statement:

Checks: C-73286r1049392_chk

Verify AlmaLinux OS 9 uses reverse path filtering on all IP interfaces with the following command: $ sysctl -a | grep -E '\.rp_filter' net.ipv4.conf.all.rp_filter = 0 net.ipv4.conf.default.rp_filter = 1 net.ipv4.conf.enp1s0.rp_filter = 1 net.ipv4.conf.lo.rp_filter = 1 If the returned lines do not all have a value of "1", this is a finding.

Fix: F-73187r1049393_fix

Configure AlmaLinux OS 9 to use reverse path filtering on all IP interfaces. Create a numbered *.conf file in /etc/sysctl.d/ with the following content: net.ipv4.conf.all.rp_filter = 1 net.ipv4.conf.default.rp_filter = 1 net.ipv4.conf.lo.rp_filter = 1 The system configuration files need to be reloaded for the changes to take effect. To reload the contents of the files, run the following command: $ sysctl --system

Generate Mitigation Statement:

Checks: C-73287r1049395_chk

Verify AlmaLinux OS 9 does not send ICMP redirects. Check the value of the "send_redirects" variables with the following command: $ sysctl -a | grep send_redirects net.ipv4.conf.all.send_redirects = 0 net.ipv4.conf.default.send_redirects = 0 net.ipv4.conf.enp1s0.send_redirects = 0 net.ipv4.conf.lo.send_redirects = 0 If the returned lines do not all have a value of "0", this is a finding.

Fix: F-73188r1049396_fix

Configure AlmaLinux OS 9 to not allow interfaces to perform ICMP redirects. Create a numbered *.conf file in /etc/sysctl.d/ with the following content: net.ipv4.conf.all.send_redirects = 0 net.ipv4.conf.default.send_redirects = 0 net.ipv4.conf.lo.send_redirects = 0 EOF The system configuration files need to be reloaded for the changes to take effect. To reload the contents of the files, run the following command: $ sysctl –system

Generate Mitigation Statement:

Checks: C-73288r1049398_chk

Verify there are no ".shosts" files on AlmaLinux OS 9 with the following command: $ find / -name .shosts If a ".shosts" file is found, this is a finding.

Fix: F-73189r1048148_fix

Remove any found ".shosts" files from the system. $ rm /[path]/[to]/[file]/.shosts

Generate Mitigation Statement:

Checks: C-73289r1049400_chk

Verify there are no "shosts.equiv" files on AlmaLinux OS 9 with the following command: $ find / -name shosts.equiv If a "shosts.equiv" file is found, this is a finding.

Fix: F-73190r1048151_fix

Remove any found "shosts.equiv" files from the system. $ rm /[path]/[to]/[file]/shosts.equiv

Generate Mitigation Statement:

Checks: C-73290r1049402_chk

Verify AlmaLinux OS 9 will not accept source-routed packets. Check the value of the "accept_source_route" variables with the following command: $ sysctl -a | grep accept_source_route net.ipv4.conf.all.accept_source_route = 0 net.ipv4.conf.default.accept_source_route = 0 net.ipv4.conf.enp1s0.accept_source_route = 0 net.ipv4.conf.lo.accept_source_route = 0 net.ipv6.conf.all.accept_source_route = 0 net.ipv6.conf.default.accept_source_route = 0 net.ipv6.conf.enp1s0.accept_source_route = 0 net.ipv6.conf.lo.accept_source_route = 0 If the returned lines do not all have a value of "0", this is a finding.

Fix: F-73191r1049403_fix

Configure AlmaLinux OS 9 to ignore source-routed packets. Create a numbered *.conf file in /etc/sysctl.d/ with the following content: net.ipv4.conf.all.accept_source_route = 0 net.ipv4.conf.default.accept_source_route = 0 net.ipv4.conf.lo.accept_source_route = 0 net.ipv6.conf.all.accept_source_route = 0 net.ipv6.conf.default.accept_source_route = 0 net.ipv6.conf.lo.accept_source_route = 0 The system configuration files must be reloaded for the changes to take effect. To reload the contents of the files, run the following command: $ sysctl –system

Generate Mitigation Statement:

Checks: C-73291r1048156_chk

Verify the SSH daemon performs compression after a user successfully authenticates with the following command: $ sshd -T | grep compression Compression no If the "Compression" keyword is set to "yes", this is a finding.

Fix: F-73192r1048157_fix

Configure the SSH daemon to not allow compression. Add the following line to "/etc/ssh/sshd_config", or uncomment the line and set the value to "delayed" or preferably "no": Compression no Alternatively, add the setting to an include file if the line "Include /etc/ssh/sshd_config.d/*.conf" is found at the top of the "/etc/ssh/sshd_config" file: $ echo 'Compression no' > /etc/ssh/sshd_config.d/40-compression.conf Restart the SSH daemon for the settings to take effect: $ systemctl restart sshd.service

Generate Mitigation Statement:

Checks: C-73292r1048159_chk

Verify the group ownership of "/etc/ssh/sshd_config" and any "/etc/ssh/sshd_config.d/*.conf" files with the following command: $ find /etc/ssh/sshd_config /etc/ssh/sshd_config.d -exec stat -c "%G %n" {} \; root /etc/ssh/sshd_config root /etc/ssh/sshd_config.d root /etc/ssh/sshd_config.d/40-stig.conf root /etc/ssh/sshd_config.d/50-redhat.conf root /etc/ssh/sshd_config.d/clientalive.conf If any of the files do not have a group owner of "root", this is a finding.

Fix: F-73193r1048160_fix

Configure the SSHD config files to be group-owned by root with the following command: $ chgrp root /etc/ssh/sshd_config /etc/ssh/sshd_config.d/*.conf

Generate Mitigation Statement:

Checks: C-73293r1048162_chk

Verify the ownership of "/etc/ssh/sshd_config" and any "/etc/ssh/sshd_config.d/*.conf" files with the following command: $ find /etc/ssh/sshd_config /etc/ssh/sshd_config.d -exec stat -c "%U %n" {} \; root /etc/ssh/sshd_config root /etc/ssh/sshd_config.d root /etc/ssh/sshd_config.d/40-stig.conf root /etc/ssh/sshd_config.d/50-redhat.conf root /etc/ssh/sshd_config.d/clientalive.conf If any of the files do not have an owner of "root", this is a finding.

Fix: F-73194r1048163_fix

Configure the SSHD config files to be owned by root with the following command: $ chown root /etc/ssh/sshd_config /etc/ssh/sshd_config.d/*.conf

Generate Mitigation Statement:

Checks: C-73294r1048165_chk

Verify the permissions of "/etc/ssh/sshd_config" and any "/etc/ssh/sshd_config.d/*.conf" files with the following command: $ find /etc/ssh/sshd_config /etc/ssh/sshd_config.d -exec stat -c "%#a %n" {} \; 600 /etc/ssh/sshd_config 755 /etc/ssh/sshd_config.d 600 /etc/ssh/sshd_config.d/40-stig.conf 600 /etc/ssh/sshd_config.d/50-redhat.conf 600 /etc/ssh/sshd_config.d/clientalive.conf If any of the files do not have "0600" permissions, this is a finding.

Fix: F-73195r1048166_fix

Configure the SSHD config files to have "0600" permissions with the following command: $ chmod 0600 /etc/ssh/sshd_config /etc/ssh/sshd_config.d/*.conf

Generate Mitigation Statement:

Checks: C-73295r1048168_chk

Verify the operating system does not allow a noncertificate trusted host SSH logon to the system with the following command: $ sshd -T | grep hostbasedauthentication hostbasedauthentication no If the "HostbasedAuthentication" keyword is not set to "no", this is a finding.

Fix: F-73196r1049409_fix

Configure the AlmaLinux OS 9 SSH daemon to not allow a noncertificate trusted host SSH logon to the system with the following command: Add the following line to "/etc/ssh/sshd_config", or uncomment the line and set the value to "no": HostbasedAuthentication no Alternatively, add the setting to an include file if the line "Include /etc/ssh/sshd_config.d/*.conf" is found at the top of the "/etc/ssh/sshd_config" file: $ echo 'HostbasedAuthentication no' > /etc/ssh/sshd_config.d/40-hostbasedauthentication.conf Restart the SSH daemon for the settings to take effect: $ systemctl restart sshd.service

Generate Mitigation Statement:

Checks: C-73296r1048171_chk

Verify the SSH private host key files have a mode of "0640" or less permissive with the following command: $ stat -c "%#a %n" /etc/ssh/ssh_host*key 0640 /etc/ssh/ssh_host_ecdsa_key 0640 /etc/ssh/ssh_host_rsa_key If any private host key file has a mode more permissive than "0640", this is a finding.

Fix: F-73197r1048172_fix

Configure the mode of SSH private host key files under "/etc/ssh" to "0640" with the following command: $ chmod 0640 /etc/ssh/ssh_host*key Restart the SSH daemon for the changes to take effect: $ systemctl restart sshd.service

Generate Mitigation Statement:

Checks: C-73297r1048174_chk

Verify the SSH public host key files have a mode of "0644" or less permissive with the following command: Note: SSH public key files may be found in other directories on the system depending on the installation. $ stat -c "%#a %n" /etc/ssh/ssh_host*key.pub 0644 /etc/ssh/ssh_host_ecdsa_key.pub 0644 /etc/ssh/ssh_host_rsa_key.pub If any public key has a mode more permissive than "0644", this is a finding.

Fix: F-73198r1048175_fix

Change the mode of public host key files under "/etc/ssh" to "0644" with the following command: $ chmod 0644 /etc/ssh/*key.pub Restart the SSH daemon for the changes to take effect: $ systemctl restart sshd.service

Generate Mitigation Statement:

Checks: C-73298r1048177_chk

Verify the SSH daemon does not allow known hosts authentication with the following command: $ sshd -T | grep ignoreuserknownhosts ignoreuserknownhosts yes If the value is returned as "no", this is a finding.

Fix: F-73199r1048178_fix

Configure the SSH daemon to not allow known hosts authentication. Add the following line to "/etc/ssh/sshd_config", or uncomment the line and set the value to "yes": IgnoreUserKnownHosts yes Alternatively, add the setting to an include file if the line "Include /etc/ssh/sshd_config.d/*.conf" is found at the top of the "/etc/ssh/sshd_config" file: $ echo 'IgnoreUserKnownHosts yes' > /etc/ssh/sshd_config.d/40-knownhosts.conf Restart the SSH daemon for the settings to take effect: $ systemctl restart sshd.service

Generate Mitigation Statement:

Checks: C-73299r1048180_chk

Verify the SSH daemon provides users with feedback on when account accesses last occurred with the following command: $ sshd -T | grep printlastlog printlastlog yes If the value is returned as "no", this is a finding.

Fix: F-73200r1048181_fix

Configure the SSH daemon to provide users with feedback on when account accesses last occurred. Add the following line to "/etc/ssh/sshd_config", or uncomment the line and set the value to "yes": PrintLastLog yes Alternatively, add the setting to an include file if the line "Include /etc/ssh/sshd_config.d/*.conf" is found at the top of the "/etc/ssh/sshd_config" file: $ echo 'PrintLastLog yes' > /etc/ssh/sshd_config.d/40-lastlog.conf Restart the SSH daemon for the settings to take effect: $ systemctl restart sshd.service

Generate Mitigation Statement:

Checks: C-73300r1048183_chk

Verify the SSH daemon does not allow rhosts authentication with the following command: $ sshd -T | grep ignorerhosts ignorerhosts yes If the "IgnoreRhosts" keyword is set to "no", this is a finding.

Fix: F-73201r1048184_fix

Configure the SSH daemon to not allow rhosts authentication. Add the following line to "/etc/ssh/sshd_config", or uncomment the line and set the value to "yes": IgnoreRhosts yes Alternatively, add the setting to an include file if the line "Include /etc/ssh/sshd_config.d/*.conf" is found at the top of the "/etc/ssh/sshd_config" file: $ echo 'IgnoreRhosts yes' > /etc/ssh/sshd_config.d/40-rhosts.conf Restart the SSH daemon for the settings to take effect: $ systemctl restart sshd.service

Generate Mitigation Statement:

Checks: C-73301r1048186_chk

Verify the SSH daemon does not allow X11Forwarding with the following command: $ sshd -T | grep x11forwarding x11forwarding no If the value is returned as "yes" and X11 forwarding is not documented with the information system security officer (ISSO) as an operational requirement, this is a finding.

Fix: F-73202r1048187_fix

Configure the SSH daemon to not allow X11 forwarding. Add the following line to "/etc/ssh/sshd_config", or uncomment the line and set the value to "no": X11forwarding no Alternatively, add the setting to an include file if the line "Include /etc/ssh/sshd_config.d/*.conf" is found at the top of the "/etc/ssh/sshd_config" file: $ echo 'X11forwarding no' > /etc/ssh/sshd_config.d/40-x11forwarding.conf Restart the SSH daemon for the settings to take effect: $ systemctl restart sshd.service

Generate Mitigation Statement:

Checks: C-73302r1048189_chk

Verify the SSH daemon prevents remote hosts from connecting to the proxy display with the following command: $ sshd -T | grep x11uselocalhost x11uselocalhost yes If the value is returned as "no", this is a finding.

Fix: F-73203r1048190_fix

Configure the SSH daemon to prevent remote hosts from connecting to the proxy display. Add the following line to "/etc/ssh/sshd_config", or uncomment the line and set the value to "yes": X11UseLocalhost yes Alternatively, add the setting to an include file if the line "Include /etc/ssh/sshd_config.d/*.conf" is found at the top of the "/etc/ssh/sshd_config" file: $ echo 'X11UseLocalhost yes' > /etc/ssh/sshd_config.d/40-x11local.conf Restart the SSH daemon for the settings to take effect: $ systemctl restart sshd.service

Generate Mitigation Statement:

Checks: C-73303r1048192_chk

Note: If a TFTP server is not installed, this requirement is Not Applicable. Verify the TFTP daemon is configured to operate in secure mode. Check if a TFTP server is installed with the following command: $ dnf list --installed tftp-server Installed Packages tftp-server.x86_64 5.2-37.el9 @appstream If a TFTP server is installed, check for the server arguments with the following command: $ systemctl cat tftp | grep ExecStart= ExecStart=/usr/sbin/in.tftpd -s /var/lib/tftpboot If the "ExecStart" line does not have a "-s" option, and a subdirectory is not assigned, this is a finding.

Fix: F-73204r1048193_fix

Configure the TFTP daemon to operate in secure mode with the following command: $ systemctl edit tftp.service Insert the following between the two sets of comments, making sure to add the "-s" option with a nonroot ("/") directory. [Service] ExecStart= ExecStart=/usr/sbin/in.tftpd -s /tftp

Generate Mitigation Statement:

Checks: C-73304r1049419_chk

Verify AlmaLinux OS 9 enables hardening for the BPF JIT with the following commands: $ sysctl net.core.bpf_jit_harden net.core.bpf_jit_harden = 2 If the returned line does not have a value of "2", or a line is not returned, this is a finding. Check that the configuration files are present to enable this kernel parameter. $ /usr/lib/systemd/systemd-sysctl --cat-config | egrep -v '^(#|;)' | grep -F net.core.bpf_jit_harden | tail -1 net.core.bpf_jit_harden = 2 If the network parameter "net.core.bpf_jit_harden" is not equal to "2" or nothing is returned, this is a finding.

Fix: F-73205r1049420_fix

Configure AlmaLinux OS 9 to enable hardening for the BPF JIT compiler. Create a numbered *.conf file in /etc/sysctl.d/ with the following content: net.core.bpf_jit_harden = 2 The system configuration files must be reloaded for the changes to take effect. To reload the contents of the files, run the following command: $ sysctl –system

Generate Mitigation Statement:

Checks: C-73305r1049422_chk

Note: This requirement assumes the use of the AlmaLinux OS 9 default graphical user interface, the GNOME desktop environment. If the system does not have any graphical user interface installed, this requirement is Not Applicable. Check the last modification time of the local databases, comparing it to the last modification time of the related keyfiles. The following command will check every dconf database and compare its modification time to the related system keyfiles: $ function dconf_needs_update { for db in $(find /etc/dconf/db -maxdepth 1 -type f); do db_mtime=$(stat -c %Y "$db"); keyfile_mtime=$(stat -c %Y "$db".d/* | sort -n | tail -1); if [ -n "$db_mtime" ] &amp;&amp; [ -n "$keyfile_mtime" ] &amp;&amp; [ "$db_mtime" -lt "$keyfile_mtime" ]; then echo "$db needs update"; return 1; fi; done; }; dconf_needs_update If the command has any output, then a dconf database needs to be updated, and this is a finding.

Fix: F-73206r1048199_fix

Update the dconf databases by running the following command: $ dconf update

Generate Mitigation Statement:

Checks: C-73306r1048201_chk

Verify that all system device files are correctly labeled to prevent unauthorized modification. List all device files on the system that are incorrectly labeled with the following commands: Note: Device files are normally found under "/dev", but applications may place device files in other directories and may necessitate a search of the entire system. # find /dev -context *:device_t:* \( -type c -o -type b \) -printf "%p %Z\n" # find /dev -context *:unlabeled_t:* \( -type c -o -type b \) -printf "%p %Z\n" Note: There are device files, such as "/dev/vmci", that are used when the operating system is a host virtual machine. They will not be owned by a user on the system and require the "device_t" label to operate. These device files are not a finding. If there is output from either of these commands, other than already noted, this is a finding.

Fix: F-73207r1048202_fix

Restore the SELinux policy for the affected device file from the system policy database using the following command: $ restorecon -v <device_path> Substituting "<device_path>" with the path to the affected device file (from the output of the previous commands). An example device file path would be "/dev/ttyUSB0". If the output of the above command does not indicate that the device was relabeled to a more specific SELinux type label, then the SELinux policy of the system must be updated with more specific policy for the device class specified. If a package was used to install support for a device class, that package could be reinstalled using the following command: $ dnf reinstall <package_name> If a package was not used to install the SELinux policy for a given device class, then it must be generated manually and provide specific type labels.

Generate Mitigation Statement:

Checks: C-73307r1048204_chk

Verify that all local initialization files have a mode of "0740" or less permissive with the following command: Note: The example will be for the "testuser" account, who has a home directory of "/home/testuser". $ find /home/testuser/.[^.]* -maxdepth 0 -perm -740 -exec stat -c "%a %n" {} \; | more 755 /home/testuser/.cache 755 /home/testuser/.mozilla If any local initialization files have a mode more permissive than "0740", this is a finding.

Fix: F-73208r1048205_fix

Set the mode of the local initialization files to "0740" with the following command: Note: The example will be for the "testuser" account, who has a home directory of "/home/testuser". $ chmod 0740 /home/testuser/.<INIT_FILE>

Generate Mitigation Statement:

Checks: C-73308r1049426_chk

Verify that AlmaLinux OS 9 has the gnutls-utils package installed with the following command: $ dnf list --installed gnutls-utils Installed Packages gnutls-utils.x86_64 3.7.6-23.el9_2.tuxcare.3 @@commandline If the "gnutls-utils" package is not installed, this is a finding.

Fix: F-73209r1048208_fix

The gnutls-utils package can be installed with the following command: $ dnf install gnutls-utils

Generate Mitigation Statement:

Checks: C-73309r1048210_chk

Verify that the kdump service is disabled in system boot configuration with the following command: $ systemctl is-enabled kdump masked Verify that the kdump service is not active (i.e., not running) through current runtime configuration with the following command: $ systemctl is-active kdump inactive Verify that the kdump service is masked with the following command: $ systemctl show kdump | grep "LoadState\|UnitFileState" LoadState=masked UnitFileState=masked If the "kdump" service is loaded or active, and is not masked, this is a finding.

Fix: F-73210r1048211_fix

Disable the kdump service with the following command: $ systemctl mask --now kdump

Generate Mitigation Statement:

Checks: C-73310r1049429_chk

Note: This requirement assumes the use of the AlmaLinux OS 9 default graphical user interface, Gnome Shell. If the system does not have any graphical user interface installed, this requirement is Not Applicable. Verify AlmaLinux OS 9 disables a user's ability to restart the system with the following command: $ grep -R disable-restart-buttons /etc/dconf/db/* /etc/dconf/db/distro.d/20-authselect:disable-restart-buttons='true' If the "disable-restart-button" setting is not set to "true", is missing or commented out from the dconf database files, this is a finding.

Fix: F-73211r1049430_fix

Configure AlmaLinux OS 9 to disable a user's ability to restart the system. Add or update the [org/gnome/settings-daemon/] section of the /etc/dconf/db/local.d/00-security-settings" database file and add or update the following lines: [org/gnome/login-screen] disable-restart-buttons=true Then update the dconf system databases: $ dconf update

Generate Mitigation Statement:

Checks: C-73311r1049432_chk

Note: This requirement assumes the use of the AlmaLinux OS 9 default graphical user interface, the GNOME desktop environment. If the system does not have any graphical user interface installed, this requirement is Not Applicable. Verify AlmaLinux OS 9 prevents a user from overriding the disable-restart-buttons setting for graphical user interfaces. Determine which profile the system database is using with the following command: $ grep system-db /etc/dconf/profile/user system-db:local Check that graphical settings are locked from nonprivileged user modification with the following command: Note: The example below is using the database "local" for the system, so the path is "/etc/dconf/db/local.d". This path must be modified if a database other than "local" is being used. $ grep disable-restart-buttons /etc/dconf/db/local.d/locks/* /org/gnome/login-screen/disable-restart-buttons If the command does not return at least the example result, this is a finding.

Fix: F-73212r1049433_fix

Configure AlmaLinux OS 9 to prevent a user from overriding the disable-restart-buttons setting for graphical user interfaces. Create a database to contain the systemwide graphical user logon settings (if it does not already exist) with the following command: $ touch /etc/dconf/db/local.d/locks/session Add the following line to prevent nonprivileged users from modifying it: /org/gnome/login-screen/disable-restart-buttons Run the following command to update the database: $ dconf update

Generate Mitigation Statement:

Checks: C-73312r1048219_chk

Verify file systems that are used for removable media are mounted with the "nodev" option with the following command: $ cat /etc/fstab UUID=0cb43738-b102-48f8-9174-061d8ee537b8 /mnt/usbdrive vfat noauto,owner,ro,nosuid,nodev,noexec 0 0 If a file system found in "/etc/fstab" refers to removable media and it does not have the "nodev" option set, this is a finding.

Fix: F-73213r1048220_fix

Configure the "/etc/fstab" to use the "nodev" option on file systems that are associated with removable media.

Generate Mitigation Statement:

Checks: C-73313r1048222_chk

Verify file systems that are used for removable media are mounted with the "noexec" option with the following command: $ cat /etc/fstab UUID=0cb43738-b102-48f8-9174-061d8ee537b8 /mnt/usbdrive vfat noauto,owner,ro,nosuid,nodev,noexec 0 0 If a file system found in "/etc/fstab" refers to removable media and it does not have the "noexec" option set, this is a finding.

Fix: F-73214r1048223_fix

Configure the "/etc/fstab" to use the "noexec" option on file systems that are associated with removable media.

Generate Mitigation Statement:

Checks: C-73314r1048225_chk

Verify file systems that are used for removable media are mounted with the "nosuid" option with the following command: $ cat /etc/fstab UUID=0cb43738-b102-48f8-9174-061d8ee537b8 /mnt/usbdrive vfat noauto,owner,ro,nosuid,nodev,noexec 0 0 If a file system found in "/etc/fstab" refers to removable media and it does not have the "nosuid" option set, this is a finding.

Fix: F-73215r1048226_fix

Configure the "/etc/fstab" to use the "nosuid" option on file systems that are associated with removable media.

Generate Mitigation Statement:

Checks: C-73315r1049438_chk

Verify AlmaLinux OS 9 disables the use of user namespaces with the following commands: $ sysctl user.max_user_namespaces user.max_user_namespaces = 0 If the returned line does not have a value of "0", or a line is not returned, this is a finding. Check that the configuration files are present to enable this kernel parameter. $ /usr/lib/systemd/systemd-sysctl --cat-config | egrep -v '^(#|;)' | grep -F user.max_user_namespaces | tail -1 user.max_user_namespaces = 0 If the network parameter "user.max_user_namespaces" is not equal to "0", or nothing is returned, this is a finding.

Fix: F-73216r1049439_fix

Configure AlmaLinux OS 9 to disable the use of user namespaces. $ sysctl -w user.max_user_namespaces=0 The system configuration files need to be reloaded for the changes to take effect. To reload the contents of the files, run the following command: $ sysctl --system

Generate Mitigation Statement:

Checks: C-73316r1049441_chk