Red Hat Enterprise Linux 10 Security Technical Implementation Guide

Checks: C-84655r1158919_chk

Verify RHEL 10 is configured to mask the debug-shell systemd service with the following command: $ sudo systemctl status debug-shell.service o debug-shell.service Loaded: masked (Reason: Unit debug-shell.service is masked.) Active: inactive (dead) If the "debug-shell.service" is loaded and not masked, this is a finding.

Fix: F-84560r1158920_fix

Configure RHEL 10 to mask the debug-shell systemd service with the following command: $ sudo systemctl disable --now debug-shell.service $ sudo systemctl mask --now debug-shell.service

Generate Mitigation Statement:

Checks: C-85492r1197212_chk

Verify RHEL 10 ensures cryptographic verification of vendor software packages. Confirm Red Hat package-signing keys are installed on the system and verify their fingerprints match vendor values. Note: For RHEL 10 software packages, Red Hat uses GPG keys labeled "release key 2", "auxiliary key 3", and "release key 4". The keys are defined in key file "/etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release" by default. List Red Hat GPG keys installed on the system: $ sudo rpm -q --queryformat "%{SUMMARY}\n" gpg-pubkey | grep -i "red hat" Red Hat, Inc. (release key 2) <security@redhat.com> public key Red Hat, Inc. (auxiliary key 3) <security@redhat.com> public key Red Hat, Inc. (release key 4) <security@redhat.com> public key If Red Hat GPG keys "release key 2", "auxiliary key 3", and "release key 4" are not installed, or if the key file "/etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release" is missing, this is a finding. List key fingerprints of installed Red Hat GPG keys: $ sq inspect /etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release /etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release: OpenPGP Certificate. Fingerprint: 567E347AD0044ADE55BA8A5F199E2F91FD431D51 Public-key algo: RSA Public-key size: 4096 bits Creation time: 2009-10-22 11:59:55 UTC Key flags: certification, signing UserID: Red Hat, Inc. (release key 2) <security@redhat.com> Note: There is another block of armored OpenPGP data. Note: This is a non-standard extension to OpenPGP. /etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release: OpenPGP Certificate. Fingerprint: 7E4624258C406535D56D6F135054E4A45A6340B3 Public-key algo: RSA Public-key size: 4096 bits Creation time: 2022-03-09 21:56:46 UTC Key flags: certification, signing UserID: Red Hat, Inc. (auxiliary key 3) <security@redhat.com> Note: There is another block of armored OpenPGP data. Note: This is a non-standard extension to OpenPGP. /etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release: OpenPGP Certificate. Fingerprint: FCD355B305707A62DA143AB6E422397E50FE8467A2A95343D246D6276AFEDF8F Public-key algo: ML-DSA-87+Ed448 Creation time: 2025-10-08 17:40:03 UTC Key flags: certification, signing UserID: Red Hat, Inc. (release key 4) <security@redhat.com> Compare key fingerprints of installed Red Hat GPG keys with fingerprints listed for RHEL 10 on the Red Hat "Product Signing Keys" webpage at https://access.redhat.com/security/team/key. If key fingerprints do not match, this is a finding.

Fix: F-85397r1165147_fix

Configure RHEL 10 to ensure cryptographic verification of vendor software packages. Install Red Hat package-signing keys on the system and verify their fingerprints match vendor values. Insert the RHEL 10 installation disc or attach the RHEL 10 installation image to the system. Mount the disc or image to make the contents accessible inside the system. Assuming the mounted location is "/media/cdrom", use the following command to copy the Red Hat GPG key file onto the system: $ sudo cp /media/cdrom/RPM-GPG-KEY-redhat-release /etc/pki/rpm-gpg/ Import Red Hat GPG keys from the key file into the system keyring: $ sudo rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release Using the steps listed in the Check Text, confirm the newly imported keys show as installed on the system and verify their fingerprints match vendor values.

Generate Mitigation Statement:

Checks: C-85498r1165164_chk

Verify RHEL 10 uses a separate file system/partition for "/home" with the following command: $ mount | grep /home /dev/mapper/luks-ca2261ed-7b00-4b7b-84cd-8cd6d8fa4b28 on /home type xfs (rw,nodev,nosuid,noexec,seclabel) Note: Options displayed for mount may differ. If a separate entry for "/home" is not in use, this is a finding.

Fix: F-85403r1165165_fix

Configure RHEL 10 to use a separate file system for user home directories by migrating the "/home" directory onto a separate file system/partition.

Generate Mitigation Statement:

Checks: C-85499r1165167_chk

Verify RHEL 10 uses a separate file system/partition for "/tmp" with the following command: $ mount | grep /tmp /dev/mapper/luks-2d7e1b45-73c4-4282-8838-15a897e0d04e on /tmp type xfs(rw,nodev,nosuid,noexec,seclabel) Note: Options displayed for mount may differ. If a separate entry for "/tmp" is not in use, this is a finding.

Fix: F-85404r1165168_fix

Configure RHEL 10 to use a separate file system for temporary storage directories by migrating the "/tmp" path onto a separate file system.

Generate Mitigation Statement:

Checks: C-85500r1165170_chk

Verify RHEL 10 uses a separate file system/partition for "/var" with the following command: $ mount | grep /var /dev/mapper/luks-51150299-f295-4145-b8f0-ebe9c6dfd5a0 on /var type xfs (rw,nodev,relatime,seclabel,attr2) Note: Options displayed for mount may differ. If a separate entry for "/var" is not in use, this is a finding.

Fix: F-85405r1165171_fix

Configure RHEL 10 to use a separate file system for the "/var" directory by migrating the "/var" path onto a separate file system.

Generate Mitigation Statement:

Checks: C-85501r1165173_chk

Verify RHEL 10 uses a separate file system/partition for "/var/log" with the following command: $ mount | grep /var/log /dev/mapper/luks-c651f493-9fdc-4c6e-a711-0a4f03149661 on /var/log type xfs (rw,nosuid,nodev,noexec,relatime,seclabel,attr2) Note: Options displayed for mount may differ. If a separate entry for "/var/log" is not in use, this is a finding.

Fix: F-85406r1165174_fix

Configure RHEL 10 to use a separate file system for log file directories by migrating the "/var/log" path onto a separate file system.

Generate Mitigation Statement:

Checks: C-85502r1165176_chk

Verify RHEL 10 uses a separate file system/partition for "/var/tmp" with the following command: $ mount | grep /var/tmp /dev/mapper/luks-c98555c8-0462-4b97-9afa-6db8c4bfee3b on /var/tmp type xfs (rw,nosuid,nodev,noexec,relatime,seclabel,attr2) Note: Options displayed for mount may differ. If a separate entry for "/var/tmp" is not in use, this is a finding.

Fix: F-85407r1165177_fix

Configure RHEL 10 to use a separate file system for the "/var/tmp" path by migrating "/var/tmp" onto a separate file system.

Generate Mitigation Statement:

Checks: C-85503r1165179_chk

Verify RHEL 10 removes all software components after updated versions have been installed with the following command: $ sudo grep -i clean_requirements_on_remove /etc/dnf/dnf.conf clean_requirements_on_remove=True If "clean_requirements_on_remove" is not set to "True", this is a finding.

Fix: F-85408r1165180_fix

Configure RHEL 10 to remove all software components after updated versions have been installed. Edit the file "/etc/dnf/dnf.conf" by adding or editing the following line: clean_requirements_on_remove=True

Generate Mitigation Statement:

Checks: C-85504r1165182_chk

Verify RHEL 10 does not have the "nfs-utils" package installed with the following command: $ sudo dnf list --installed nfs-utils Error: No matching Packages to list If the "nfs-utils" package is installed, this is a finding.

Fix: F-85409r1165183_fix

Configure RHEL 10 to not have the "nfs-utils" package installed with the following command: $ sudo dnf -y remove nfs-utils

Generate Mitigation Statement:

Checks: C-85506r1165188_chk

Note: If Network File System (NFS) mounts are authorized and in use on the system, this control is not applicable. Verify RHEL 10 does not have the "gssproxy" package installed with the following command: $ sudo dnf list --installed gssproxy Error: No matching Packages to list If the "gssproxy" package is installed and is not documented with the information system security officer as an operational requirement, this is a finding.

Fix: F-85411r1165189_fix

Configure RHEL 10 to not have the "gssproxy" package installed with the following command: $ sudo dnf -y remove gssproxy

Generate Mitigation Statement:

Checks: C-85507r1165191_chk

Verify RHEL 10 does not have the tuned package installed with the following command: $ sudo dnf list --installed tuned Error: No matching Packages to list If the "tuned" package is installed and is not documented with the information system security officer as an operational requirement, this is a finding.

Fix: F-85412r1165192_fix

Configure RHEL 10 to not have the tuned package installed with the following command: $ sudo dnf -y remove tuned

Generate Mitigation Statement:

Checks: C-85508r1165194_chk

Note: If TFTP is not required, it must not be installed. If TFTP is not installed, this rule is not applicable. Verify RHEL 10 is configured so that TFTP operates in secure mode if installed. Determine if TFTP server is installed with the following command: $ sudo dnf list --installed | grep tftp-server tftp-server.x86_64 5.2-48.el10 @rhel-10-for-x86_64-appstream-rpms If the TFTP server package is installed and is not required, or if it is not documented with the ISSM, this is a finding. Verify the TFTP daemon, if tftp.server is installed, is configured to operate in secure mode with the following command: $ grep -i execstart /usr/lib/systemd/system/tftp.service ExecStart=/usr/sbin/in.tftpd -s /var/lib/tftpboot Note: The "-s" option ensures the TFTP server only serves files from the specified directory, which is a security measure to prevent unauthorized access to other parts of the file system. If the "-s" option is not present in the "ExecStart" line, or if the line is missing, this is a finding.

Fix: F-85413r1165195_fix

Configure RHEL 10 so that TFTP operates in secure mode if installed. If TFTP server is not required, remove it with the following command: $ sudo dnf -y remove tftp-server Configure the TFTP daemon to operate in secure mode with the following command: $ sudo systemctl edit tftp.service In the editor, enter: [Service] ExecStart=/usr/sbin/in.tftpd -s /var/lib/tftpboot After making changes, reload the systemd daemon and restart the TFTP service as follows: $ sudo systemctl daemon-reload $ sudo systemctl restart tftp.service

Generate Mitigation Statement:

Checks: C-85509r1165197_chk

Verify RHEL 10 does not have a DNS package installed with the following command: $ sudo dnf list --installed unbound Error: No matching Packages to list If the "unbound" package is installed, and the information system security officer lacks a documented requirement for a DNS, this is a finding.

Fix: F-85414r1165198_fix

Configure RHEL 10 to not have the unbound package installed with the following command: $ sudo dnf -y remove unbound

Generate Mitigation Statement:

Checks: C-85511r1165203_chk

Verify RHEL 10 does not have the "gdm" package installed with the following command: $ sudo dnf list --installed gdm Error: No matching Packages to list If the "gdm" package is installed and the need for a GUI interface has not been documented with the information system security officer, this is a finding.

Fix: F-85416r1165204_fix

Configure RHEL 10 to not have the "gdm" package installed with the following command: $ sudo dnf -y remove gdm

Generate Mitigation Statement:

Checks: C-85513r1195339_chk

Note: If the system is not an internet connected system, this requirement is not applicable. Verify RHEL 10 has the "subscription-manager" package installed with the following command: $ sudo dnf list --installed subscription-manager Installed Packages subscription-manager.x86_64 1.30.6.1-1.el10_0 @rhel-10-for-x86_64-baseos-rpms If the "subscription-manager" package is not installed, this is a finding.

Fix: F-85418r1165210_fix

Configure RHEL 10 to have the "subscription-manager" package installed with the following command: $ sudo dnf -y install subscription-manager

Generate Mitigation Statement:

Checks: C-85514r1195341_chk

Verify RHEL 10 has the "nss-tools" package installed with the following command: $ sudo dnf list --installed nss-tools Installed Packages nss-tools.x86_64 3.112.0-4.el10_0 @rhel-10-for-x86_64-appstream-rpms If the "nss-tools" package is not installed, this is a finding.

Fix: F-85419r1165213_fix

Configure RHEL 10 to have the "nss-tools" package installed with the following command: $ sudo dnf -y install nss-tools

Generate Mitigation Statement:

Checks: C-85515r1195343_chk

Verify RHEL 10 is configured to allow sending email notifications. Verify the "s-nail" package is installed on the system with the following command: $ sudo dnf list --installed s-nail Installed Packages s-nail.x86_64 14.9.24-12.el10 @rhel-10-for-x86_64-appstream-rpms If the "s-nail" package is not installed, this is a finding.

Fix: F-85420r1165216_fix

Configure RHEL 10 to have the "s-nail" package installed with the following command: $ sudo dnf -y install s-nail

Generate Mitigation Statement:

Checks: C-85516r1208791_chk

Verify RHEL 10 has the "firewalld" package installed. Run the following command to determine if the "firewalld" package is installed: $ dnf list --installed firewalld Installed Packages firewalld.noarch 2.3.1-1.el10_0 @rhel-10-for-x86_64-baseos-rpms If the "firewall" package is not installed, this is a finding.

Fix: F-85421r1165219_fix

Configure RHEL 10 to have the "firewalld" package installed with the following command: $ sudo dnf -y install firewalld

Generate Mitigation Statement:

Checks: C-85517r1165221_chk

Verify RHEL 10 is configured so that "firewalld" is active with the following command: $ systemctl is-active firewalld active If the "firewalld" service is not active, this is a finding.

Fix: F-85422r1165222_fix

Configure RHEL 10 to have the "firewalld" service set to active. To enable the "firewalld" service, run the following command: $ sudo systemctl enable --now firewalld

Generate Mitigation Statement:

Checks: C-85518r1165224_chk

Verify RHEL 10 is configured so that "firewalld" employs a deny-all, allow-by-exception policy for allowing connections to other systems with the following commands (using ens133 as an example interface): $ sudo firewall-cmd --state running $ sudo firewall-cmd --get-active-zones drop (default) interfaces: ens33 $ sudo firewall-cmd --info-zone=drop | grep target target: DROP $ sudo firewall-cmd --permanent --info-zone=drop | grep target target: DROP If no zones are active on the RHEL 10 interfaces or if runtime and permanent targets are set to an option other than "DROP", this is a finding. Verify the permanent configuration is valid and there are no misconfigured zones or rules with the following command: $ sudo firewall-cmd --check-config success If this command does not return "success", this is a finding.

Fix: F-85423r1165225_fix

Configure RHEL 10 so that the "firewalld" daemon employs a deny-all, allow-by-exception policy with the following commands (using ens133 as an example interface): Start by adding the exceptions that are required for mission functionality to the "drop" zone. If SSH access on port 22 is needed, for example, run the following: $ sudo firewall-cmd --permanent --add-service=ssh --zone=drop Reload the firewall rules to update the runtime configuration from the "--permanent" changes made above: $ sudo firewall-cmd --reload Set the default zone to the drop zone: $ sudo firewall-cmd --set-default-zone=drop Note: This is a runtime and permanent change. Add any interfaces to the newly modified "drop" zone: $ sudo firewall-cmd --permanent --zone=drop --change-interface=ens33 Reload the firewall rules for changes to take effect: $ sudo firewall-cmd --reload

Generate Mitigation Statement:

Checks: C-85519r1195347_chk

Verify RHEL 10 has the "chrony" package installed with the following command: $ sudo dnf list --installed chrony Installed Packages chrony.x86_64 4.6.1-1.el10 @anaconda If the "chrony" package is not installed, this is a finding.

Fix: F-85424r1165228_fix

Configure RHEL 10 to have the "chrony" package installed with the following command: $ sudo dnf -y install chrony

Generate Mitigation Statement:

Checks: C-85520r1165230_chk

Verify RHEL 10 sets the chronyd service to active with the following command: $ systemctl is-active chronyd active If the chronyd service is not active, this is a finding.

Fix: F-85425r1165231_fix

Configure RHEL 10 to enable the chronyd service with the following command: $ sudo systemctl enable --now chronyd

Generate Mitigation Statement:

Checks: C-85521r1165233_chk

Verify RHEL 10 disables the chrony daemon from acting as a server with the following command: $ sudo grep -w port /etc/chrony.conf port 0 If the "port" option is not set to "0", is commented out, or is missing, this is a finding.

Fix: F-85426r1165234_fix

Configure RHEL 10 to disable the chrony daemon from acting as a server by adding/modifying the following line in the "/etc/chrony.conf" file: port 0 Restart the chronyd service with the following command for the changes to take effect: $ sudo systemctl restart chronyd

Generate Mitigation Statement:

Checks: C-85522r1165236_chk

Verify RHEL 10 disables network management of the chrony daemon with the following command: $ sudo grep -w cmdport /etc/chrony.conf cmdport 0 If the "cmdport" option is not set to "0", is commented out, or is missing, this is a finding.

Fix: F-85427r1165237_fix

Configure RHEL 10 to disable network management of the chrony daemon by adding/modifying the following line in the "/etc/chrony.conf" file: cmdport 0 Restart the chronyd service with the following command for the changes to take effect: $ sudo systemctl restart chronyd

Generate Mitigation Statement:

Checks: C-85523r1195349_chk

Verify RHEL 10 has USBGuard installed on the operating system with the following command: $ sudo dnf list --installed usbguard Installed Packages usbguard.x86_64 1.1.3-6.el10 @rhel-10-for-x86_64-appstream-rpms If the USBGuard package is not installed, ask the SA to indicate how unauthorized peripherals are being blocked. If there is no evidence that unauthorized peripherals are being blocked before establishing a connection, this is a finding. If the system is a virtual machine with no virtual or physical USB peripherals attached, this is not a finding.

Fix: F-85428r1165240_fix

Configure RHEL 10 to have the USBGuard package installed with the following command: $ sudo dnf -y install usbguard Enable the service to start on boot and then start it with the following commands: $ sudo systemctl enable usbguard $ sudo systemctl start usbguard Verify the status of the service with the following command: $ sudo systemctl status usbguard Note: USBGuard must be configured to allow authorized devices once it is enabled on RHEL 10.

Generate Mitigation Statement:

Checks: C-85524r1165242_chk

Note: If the system is virtual machine with no virtual or physical USB peripherals attached, this is not applicable. Verify RHEL 10 has USBGuard enabled with the following command: $ systemctl is-active usbguard active If USBGuard is not active, ask the SA to indicate how unauthorized peripherals are being blocked. If there is no evidence that unauthorized peripherals are being blocked before establishing a connection, this is a finding.

Fix: F-85429r1165243_fix

Configure RHEL 10 to have the USBGuard service enabled by running the following command: $ sudo systemctl enable --now usbguard

Generate Mitigation Statement:

Checks: C-85525r1165245_chk

Note: If the system is virtual machine with no virtual or physical USB peripherals attached, this is not applicable. Verify RHEL 10 USBGuard has a policy configured. Confirm the setting with the following command: $ sudo usbguard list-rules allow id 1d6b:0001 serial If the command does not return results, or an error is returned, ask the SA to indicate how unauthorized peripherals are being blocked. If there is no evidence that unauthorized peripherals are being blocked before establishing a connection, this is a finding.

Fix: F-85430r1165246_fix

Configure RHEL 10 to enable the blocking of unauthorized peripherals with the following command: Note: This command must be run from a root shell and will create an allowlist for any USB devices currently connected to the system. # usbguard generate-policy --no-hash > /etc/usbguard/rules.conf Note: Enabling and starting usbguard without properly configuring it for an individual system will immediately prevent any access over a USB device such as a keyboard or mouse.

Generate Mitigation Statement:

Checks: C-85526r1165248_chk

Note: If the system is a virtual machine with no virtual or physical USB peripherals attached, this is not applicable. Verify RHEL 10 audit logging is enabled for the USBGuard daemon. Confirm the setting with the following command: $ sudo grep AuditBackend /etc/usbguard/usbguard-daemon.conf AuditBackend=LinuxAudit If "AuditBackend" is not set to "LinuxAudit", this is a finding.

Fix: F-85431r1165249_fix

Configure RHEL 10 USBGuard AuditBackend to use the audit system. Add or edit the following line in "/etc/usbguard/usbguard-daemon.conf": AuditBackend=LinuxAudit

Generate Mitigation Statement:

Checks: C-85527r1195351_chk

Verify RHEL 10 has the "policycoreutils" package installed with the following command: $ sudo dnf list --installed policycoreutils Installed Packages policycoreutils.x86_64 3.8-1.el10 @anaconda If the "policycoreutils" package is not installed, this is a finding.

Fix: F-85432r1165252_fix

Configure RHEL 10 to have the "policycoreutils" package installed with the following command: $ sudo dnf -y install policycoreutils

Generate Mitigation Statement:

Checks: C-85528r1195353_chk

Verify RHEL 10 has the "policycoreutils-python-utils" service package installed with the following command: $ sudo dnf list --installed policycoreutils-python-utils Installed Packages policycoreutils-python-utils.noarch 3.8-1.el10 @AppStream If the "policycoreutils-python-utils" package is not installed, this is a finding.

Fix: F-85433r1165255_fix

Configure RHEL 10 to have the "policycoreutils-python-utils" service package installed with the following command: $ sudo dnf -y install policycoreutils-python-utils

Generate Mitigation Statement:

Checks: C-85529r1195355_chk

Verify RHEL 10 has the "sudo" package installed with the following command: $ sudo dnf list --installed sudo Installed Packages sudo.x86_64 1.9.15-8.p5.el10_0.2 @rhel-10-for-x86_64-baseos-rpms If the "sudo" package is not installed, this is a finding.

Fix: F-85434r1165258_fix

Configure RHEL 10 to have the "sudo" package installed with the following command: $ sudo dnf -y install sudo

Generate Mitigation Statement:

Checks: C-85530r1195357_chk

Verify RHEL 10 has the "fapolicyd" package installed with the following command: $ sudo dnf list --installed fapolicyd Installed Packages fapolicyd.x86_64 1.3.3-102.el10 @rhel-10-for-x86_64-appstream-rpms If the "fapolicyd" package is not installed, this is a finding.

Fix: F-85435r1165261_fix

Configure RHEL 10 to have the "fapolicyd" package installed with the following command: $ sudo dnf -y install fapolicyd

Generate Mitigation Statement:

Checks: C-85531r1165263_chk

Verify RHEL 10 "fapolicyd" is active with the following command: $ systemctl is-active fapolicyd active If the "fapolicyd" module is not active, this is a finding.

Fix: F-85436r1165264_fix

Configure RHEL 10 to enable "fapolicyd" with the following command: $ systemctl enable --now fapolicyd

Generate Mitigation Statement:

Checks: C-85532r1184778_chk

Verify the RHEL 10 "fapolicyd" employs a deny-all, permit-by-exception policy. Check that "fapolicyd" is in enforcement mode with the following command: $ sudo grep permissive /etc/fapolicyd/fapolicyd.conf permissive = 0 If "fapolicyd" is not running in enforcement mode, this is a finding. Check that "fapolicyd" employs a deny-all policy on system mounts with the following commands: $ sudo tail /etc/fapolicyd/compiled.rules allow exe=/usr/bin/python3.7 : ftype=text/x-python deny_audit perm=any pattern=ld_so : all deny perm=any all : all If "fapolicyd" is not running with a deny-all, permit-by-exception policy, this is a finding. Note: "deny_log" or "deny_audit" options meet the security requirements. These options will generate higher volumes of logs.

Fix: F-85437r1184779_fix

Configure RHEL 10 to employ a deny-all, permit-by-exception application allow listing policy with "fapolicyd". With the "fapolicyd" installed and enabled, configure the daemon to function in permissive mode until the allow list is built correctly to avoid system lockout. Do this by editing the "/etc/fapolicyd/fapolicyd.conf" file with the following line: permissive = 1 Build the allow list in a file within the "/etc/fapolicyd/rules.d" directory, ensuring the last rule implements a deny-all policy, such as "deny perm=any all : all". Once it is determined the allow list is built correctly, set the "fapolicyd" to enforcing mode by editing the "permissive" line in the /etc/fapolicyd/fapolicyd.conf file. permissive = 0

Generate Mitigation Statement:

Checks: C-85533r1195359_chk

Note: If the system administrator demonstrates the use of an approved alternate multifactor authentication method, this requirement is not applicable. Verify RHEL 10 has the "pcsc-lite" package installed with the following command: $ sudo dnf list --installed pcsc-lite Installed Packages pcsc-lite.x86_64 2.2.3-2.el10 @anaconda If the "pcsc-lite" package is not installed, this is a finding.

Fix: F-85438r1165270_fix

Configure RHEL 10 to have the "pcsc-lite" package installed with the following command: $ sudo dnf -y install pcsc-lite

Generate Mitigation Statement:

Checks: C-85534r1165272_chk

Verify RHEL 10 has the "pcscd" socket set to active with the following command: $ systemctl is-active pcscd.socket active If the "pcscd" socket is not active, this is a finding.

Fix: F-85439r1165273_fix

Configure RHEL 10 to have the "pcscd" socket set to active with the following command: $ sudo systemctl enable --now pcscd.socket

Generate Mitigation Statement:

Checks: C-85535r1195361_chk

Verify RHEL 10 has the "pcsc-lite-ccid" package installed with the following command: $ sudo dnf list --installed pcsc-lite-ccid Installed Packages pcsc-lite-ccid.x86_64 1.6.0-2.el10 @anaconda If the "pcsc-lite-ccid" package is not installed, this is a finding.

Fix: F-85440r1165276_fix

Configure RHEL 10 to have the "pcsc-lite-ccid" package installed with the following command: $ sudo dnf -y install pcsc-lite-ccid

Generate Mitigation Statement:

Checks: C-85536r1195363_chk

Verify RHEL 10 has the "opensc" package installed with the following command: $ sudo dnf list --installed opensc Installed Packages opensc.x86_64 0.26.1-1.el10 @rhel-10-for-x86_64-baseos-rpm If the "opensc" package is not installed, this is a finding.

Fix: F-85441r1165279_fix

Configure RHEL 10 to have the "opensc" package installed with the following command: $ sudo dnf -y install opensc

Generate Mitigation Statement:

Checks: C-85537r1165281_chk

Verify RHEL 10 loads the CAC driver with the following command: $ sudo opensc-tool --get-conf-entry app:default:card_drivers cac If "cac" is not listed as a card driver, or no line is returned for "card_drivers", this is a finding.

Fix: F-85442r1165282_fix

Configure RHEL 10 to load the CAC driver: $ sudo opensc-tool --set-conf-entry app:default:card_drivers:cac Restart the pcscd service with the following command for the changes to take effect: $ sudo systemctl restart pcscd

Generate Mitigation Statement:

Checks: C-85538r1195365_chk

Verify RHEL 10 has the AIDE package installed with the following command: $ sudo dnf list --installed aide Installed Packages aide.x86_64 0.18.6-8.el10_0.2 @rhel-10-for-x86_64-appstream-rpms If AIDE is not installed, ask the system administrator how file integrity checks are performed on the system. If no application is installed to perform integrity checks, this is a finding. If AIDE is installed, determine if it has been initialized with the following command: $ sudo /usr/sbin/aide --check If the output is "Couldn't open file /var/lib/aide/aide.db.gz for reading", this is a finding.

Fix: F-85443r1184613_fix

Configure RHEL 10 so that "AIDE" is installed and initialized, and then perform a manual check. Install AIDE: $ sudo dnf -y install aide Initialize AIDE: $ sudo /usr/sbin/aide --init Example output: Start timestamp: 2025-04-03 10:09:04 -0600 (AIDE 0.16) AIDE initialized database at /var/lib/aide/aide.db.new.gz Number of entries: 86833 --------------------------------------------------- The attributes of the (uncompressed) database(s): --------------------------------------------------- /var/lib/aide/aide.db.new.gz MD5 : coZUtPHhoFoeD7+k54fUvQ== SHA1 : DVpOEMWJwo0uPgrKZAygIUgSxeM= SHA256 : EQiZH0XNEk001tcDmJa+5STFEjDb4MPE TGdBJ/uvZKc= SHA512 : 86KUqw++PZhoPK0SZvT3zuFq9yu9nnPP toei0nENVELJ1LPurjoMlRig6q69VR8l +44EwO9eYyy9nnbzQsfG1g== End timestamp: 2025-04-03 10:09:57 -0600 (run time: 0m 53s) The new database must be renamed to be read by AIDE: $ sudo mv /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz Perform a manual check: $ sudo /usr/sbin/aide --check Example output: 2025-04-03 10:16:08 -0600 (AIDE 0.16) AIDE found NO differences between database and filesystem. Looks okay!! ...

Generate Mitigation Statement:

Checks: C-85540r1165290_chk

Verify RHEL 10 AIDE is configured to use FIPS 140-3 file hashing. Verify global default hash settings with the following command: $ sudo grep -iE 'sha|md5|rmd' /etc/aide.conf | grep -v ^# FIPSR = p+i+n+u+g+s+m+ftype+growing+acl+selinux+xattrs+sha512 ALLXTRAHASHES = sha512 /usr/sbin/auditctl p+i+n+u+g+s+b+acl+xattrs+sha512 /usr/sbin/auditd p+i+n+u+g+s+b+acl+xattrs+sha512 /usr/sbin/ausearch p+i+n+u+g+s+b+acl+xattrs+sha512 /usr/sbin/aureport p+i+n+u+g+s+b+acl+xattrs+sha512 /usr/sbin/augenrules p+i+n+u+g+s+b+acl+xattrs+sha512 NORMAL = FIPSR+sha512 LSPP = FIPSR+sha512 DATAONLY = R+sha512 /etc/gshadow NORMAL /etc/shadow NORMAL If any hashes other than "sha512" are present, this is a finding. Confirm no legacy hashes exist with the following command: $ sudo grep -iE 'md5|sha1|whirlpool|tiger' /etc/aide.conf | grep -v ^# If any uncommented lines are returned, this is a finding.

Fix: F-85445r1165291_fix

Configure RHEL 10 so that the file integrity tool uses FIPS 140-3 cryptographic hashes for validating file and directory contents. If AIDE is installed, ensure the "sha512" rule is present on all uncommented file and directory selection lists, and that no legacy hashes exist. By default, AIDE excludes log files such as "/var/log" and other volatile files to reduce unnecessary notifications.

Generate Mitigation Statement:

Checks: C-85541r1165293_chk

Verify RHEL 10 routinely executes a file integrity scan for changes to the system baseline. The command used in the example will use a daily occurrence. Check the cron directories for scripts controlling the execution and notification of results of the file integrity application. For example, if AIDE is installed on the system, use the following commands: $ sudo ls -al /etc/cron.* | grep aide -rwxr-xr-x 1 root root 29 Nov 22 2015 aide $ sudo grep aide /etc/crontab /var/spool/cron/root /etc/crontab: 30 04 * * * root usr/sbin/aide /var/spool/cron/root: 30 04 * * * root usr/sbin/aide $ sudo more /etc/cron.daily/aide #!/bin/bash /usr/sbin/aide --check | /bin/mail -s "$HOSTNAME - Daily aide integrity check run" root@sysname.mil If the file integrity application does not exist, a script file controlling the execution of the file integrity application does not exist, or the file integrity application does not notify designated personnel of changes, this is a finding.

Fix: F-85446r1165294_fix

Configure RHEL 10 to automatically run the file integrity tool on the system at least weekly and notify designated personnel if baseline configurations are changed in an unauthorized manner. The AIDE tool can be configured to email designated personnel with the use of the cron system. The following example output is generic. It will set cron to run AIDE daily and to send email at the completion of the analysis: $ sudo more /etc/cron.daily/aide #!/bin/bash /usr/sbin/aide --check | /bin/mail -s "$HOSTNAME - Daily aide integrity check run" root@sysname.mil

Generate Mitigation Statement:

Checks: C-85542r1165296_chk

Verify RHEL 10 AIDE is verifying ACLs. Verify ACL settings for all uncommented file and directory selection lists with the following command: $ sudo grep -E '^[^#]*acl' /etc/aide.conf FIPSR = p+i+n+u+g+s+m+growing+acl+selinux+xattrs+sha512 /usr/sbin/auditctl p+i+n+u+g+s+b+acl+xattrs+sha512 /usr/sbin/auditd p+i+n+u+g+s+b+acl+xattrs+sha512 /usr/sbin/ausearch p+i+n+u+g+s+b+acl+xattrs+sha512 /usr/sbin/aureport p+i+n+u+g+s+b+acl+xattrs+sha512 /usr/sbin/augenrules p+i+n+u+g+s+b+acl+xattrs+sha512 DIR = p+i+n+u+g+acl+selinux+xattrs PERMS = p+i+u+g+acl+selinux Open the file and verify no additional uncommented file and directory selection lines are missing the "acl" rule. If the "acl" rule is not being used on all uncommented selection lines in the "/etc/aide.conf" file, or ACLs are not being checked by another file integrity tool, this is a finding.

Fix: F-85447r1165297_fix

Configure RHEL 10 so that the file integrity tool checks file and directory ACLs. If AIDE is installed, ensure the "acl" rule is present on all uncommented file and directory selection lists.

Generate Mitigation Statement:

Checks: C-85543r1165299_chk

Verify RHEL 10 AIDE is configured to verify extended attributes with the following command: $ sudo grep -E '^[^#]*xattrs' /etc/aide.conf FIPSR = p+i+n+u+g+s+m+growing+acl+selinux+xattrs+sha512 /usr/sbin/auditctl p+i+n+u+g+s+b+acl+xattrs+sha512 /usr/sbin/auditd p+i+n+u+g+s+b+acl+xattrs+sha512 /usr/sbin/ausearch p+i+n+u+g+s+b+acl+xattrs+sha512 /usr/sbin/aureport p+i+n+u+g+s+b+acl+xattrs+sha512 /usr/sbin/augenrules p+i+n+u+g+s+b+acl+xattrs+sha512 DIR = p+i+n+u+g+acl+selinux+xattrs Open the file and verify that no additional uncommented file and directory selection lines are missing the "xattrs" rule. If the "xattrs" rule is not being used on all uncommented selection lines in the "/etc/aide.conf" file, or extended attributes are not being checked by another file integrity tool, this is a finding.

Fix: F-85448r1165300_fix

Configure RHEL 10 so that the file integrity tool checks file and directory extended attributes. If AIDE is installed, ensure the "xattrs" rule is present on all uncommented file and directory selection lists.

Generate Mitigation Statement:

Checks: C-85544r1195367_chk

Verify RHEL 10 has the "rsyslogd" package installed with the following command: $ sudo dnf list --installed rsyslog Installed Packages rsyslog.x86_64 8.2412.0-1.el10 @AppStream If the "rsyslogd" package is not installed, this is a finding.

Fix: F-85449r1165303_fix

Configure RHEL 10 to have the "rsyslogd" package installed with the following command: $ sudo dnf -y install rsyslogd

Generate Mitigation Statement:

Checks: C-85545r1165305_chk

Verify RHEL 10 rsyslog is active with the following command: $ systemctl is-active rsyslog active If the rsyslog service is not active, this is a finding.

Fix: F-85450r1165306_fix

Configure RHEL 10 to enable the rsyslog service with the following command: $ sudo systemctl enable --now rsyslog

Generate Mitigation Statement:

Checks: C-85546r1165308_chk

Verify RHEL 10 audit system off-loads audit records onto a different system or media from the system being audited via rsyslog using TCP with the following commands: To check for legacy configuration syntax, perform the following: $ sudo grep -ir '@@' /etc/rsyslog.conf /etc/rsyslog.d/ To check for Rainer script syntax, perform the following: $ sudo grep -rq 'type="omfwd"' /etc/rsyslog.conf /etc/rsyslog.d/ If a remote server is not configured, or the line is commented out, ask the system administrator to indicate how the audit logs are off-loaded to a different system or media. If there is no evidence that the audit logs are being off-loaded to another system or media, this is a finding.

Fix: F-85451r1184701_fix

Configure RHEL 10 to off-load audit records onto a different system or media from the system being audited via TCP using rsyslog by specifying the remote logging server in "/etc/rsyslog.conf" or "/etc/rsyslog.d/[customfile].conf" with the name or IP address of the log aggregation server. Using legacy "@host:port" syntax example: *.* @@[remoteloggingserver]:[port] Using Rainer script example: action( type="omfwd" target="logserver.example.com" port="514" protocol="tcp" action.resumeRetryCount="-1" queue.type="linkedList" que.size="10000" ) Note: The Rainer script above does not contain the required encryption settings.

Generate Mitigation Statement:

Checks: C-85547r1184781_chk

Note: If the SA can demonstrate that another tool (e.g., SPLUNK) is being used to manage log off-load and aggregation in lieu of rsyslog, this check is not applicable. Verify RHEL 10 is not configured to receive remote logs using rsyslog. Verify the setting with the following commands: $ ss -tulnp | grep rsyslog If no output is returned, rsyslog is not listening for remote logs. If output appears, check for configured ports (514 is the default for syslog). Check for remote logging configuration in rsyslog by examining the rsyslog configuration files: $ sudo grep -E 'InputTCPServerRun|UDPServerRun|RELPServerRun|imtcp|imudp|imrelp' /etc/rsyslog.conf /etc/rsyslog.d/* If this command returns uncommented lines enabling network listeners, the system is accepting remote logs. If this system is not documented and authorized as a log aggregation server, this is a finding. Note: An error about no files or directories from the above commands may be returned. This is not a finding. Additionally, if a port option used together with a target and protocol is returned from inside an action block, this is not a finding.

Fix: F-85452r1165312_fix

Configure RHEL 10 to not receive remote logs using rsyslog. Remove the lines in "/etc/rsyslog.conf" and any files in the "/etc/rsyslog.d" directory that match any of the following: InputTCPServerRun UDPServerRun RELPServerRun module(load="imtcp") module(load="imudp") module(load="imrelp") input(type="imudp" port="514") input(type="imtcp" port="514") input(type="imrelp" port="514") Restart the rsyslog daemon with the following command for the changes to take effect: $ sudo systemctl restart rsyslog.service

Generate Mitigation Statement:

Checks: C-85548r1195369_chk

Verify RHEL 10 authenticates the remote logging server for off-loading audit logs with the following command: $ sudo grep -r -E 'streamdriver.authmode|streamdriver.permittedpeer|tls.authmode|tls.permittedpeer' /etc/rsyslog.conf /etc/rsyslog.d/ /etc/rsyslog.d/99-forwarding.conf: streamdriver.authmode="x509/name" If the variable name "streamdriver.authmode" is present in an omfwd statement block, this is not a finding. However, if the "streamdriver.authmode" variable is in a module block, this is a finding. If the value of the "$ActionSendStreamDriverAuthMode" or "streamdriver.authmode" or "tls.authmode" option is not set to "x509/name", or the line is commented out, ask the system administrator to indicate how the audit logs are off-loaded to a different system or media. Additionally, if the permittedpeer is not specified in either of the following formats, this is a finding: streamdriver.permittedpeer="rsyslog.server.example.com" tls.permittedpeer="rsyslog.server.example.com" If there is no evidence that the transfer of the audit logs being off-loaded to another system or media is encrypted, this is a finding.

Fix: F-85453r1195370_fix

Configure RHEL 10 to authenticate the remote logging server for off-loading audit logs by setting the following options in "/etc/rsyslog.d/99-forwarding.conf": streamdriver.authmode="x509/name" Specify the logserver to prevent man-in-the-middle attacks in the following format: streamdriver.permittedpeer="rsyslog.server.example.com"

Generate Mitigation Statement:

Checks: C-85549r1195372_chk

Verify RHEL 10 encrypts audit records offloaded onto a different system via rsyslog using the modern "omfwd" action. Search for active TLS-enabling configurations within "omfwd" action blocks with the following command: $ sudo grep -rE 'tls="on"|StreamDriver.Mode\s*=\s*"1"' /etc/rsyslog.conf /etc/rsyslog.d/ If an active TCP-based "omfwd" forwarding rule exists on the system but the command above returns no active configuration lines, or if all results are commented out, this is a finding.

Fix: F-85454r1195373_fix

Configure RHEL 10 to encrypt off-loaded audit records via rsyslog by enabling TLS within the "omfwd" action rule. Edit the configuration file containing the "omfwd" rule (e.g., /etc/rsyslog.d/99-forwarding.conf) and add the tls="on" parameter. Example: action( type="omfwd" target="logserver.example.com" protocol="tcp" port="6514" tls="on" ) After applying the configuration, restart the rsyslog service: $ sudo systemctl restart rsyslog

Generate Mitigation Statement:

Checks: C-85550r1195375_chk

Verify RHEL 10 explicitly defines a TLS driver (gtls or ossl) for encrypted rsyslog off-loading. Search for an explicitly defined stream driver within "omfwd" action blocks with the following command: $ sudo grep -rE 'StreamDriver\s*=\s*"(gtls|ossl)"' /etc/rsyslog.conf /etc/rsyslog.d/ If TLS-based "omfwd" forwarding is configured, but the command above returns no active configuration lines specifying either "gtls" or "ossl" within the action block, this is a finding.

Fix: F-85455r1195376_fix

Configure RHEL 10 to explicitly define a TLS driver for rsyslog to use for encrypting off-loaded audit records. The "ossl" driver is required for environments operating in FIPS mode. Add the "streamdriver" parameter to the "omfwd" action rule in its configuration file (e.g., /etc/rsyslog.d/99-forwarding.conf). Example: action( type="omfwd" streamdriver="ossl" target="logserver.example.com" protocol="tcp" port="6514" tls="on" ) After applying the configuration, restart the rsyslog service: $ sudo systemctl restart rsyslog

Generate Mitigation Statement:

Checks: C-85551r1165323_chk

Verify RHEL 10 monitors all remote access methods with the following command: $ sudo grep -rE '(auth.\*|authpriv.\*|daemon.\*)' /etc/rsyslog.conf /etc/rsyslog.d/ /etc/rsyslog.conf:authpriv.* /var/log/secure If "auth.*", "authpriv.*", or "daemon.*" are not configured to be logged, this is a finding.

Fix: F-85456r1165324_fix

Configure RHEL 10 to monitor all remote access methods. Add or update the following lines to the "/etc/rsyslog.conf" file or a file in "/etc/rsyslog.d": auth.*;authpriv.*;daemon.* /var/log/secure Restart the "rsyslog" service with the following command for the changes to take effect: $ sudo systemctl restart rsyslog.service

Generate Mitigation Statement:

Checks: C-85552r1165326_chk

Verify RHEL 10 rsyslog is configured to log cron events with the following command: Note: If another logging package is used, substitute the utility configuration file for "/etc/rsyslog.conf" or "/etc/rsyslog.d/*.conf" files. $ sudo grep -s cron /etc/rsyslog.conf /etc/rsyslog.d/*.conf /etc/rsyslog.conf:*.info;mail.none;authpriv.none;cron.none /var/log/messages /etc/rsyslog.conf:cron.* /var/log/cron If the command does not return a response, check for cron logging all facilities with the following command: $ logger -p local0.info "Test message for all facilities." Check the logs for the test message with the following: $ sudo tail /var/log/messages If "rsyslog" is not logging messages for the cron facility or all facilities, this is a finding.

Fix: F-85457r1165327_fix

Configure RHEL 10 rsyslog to log all cron messages by adding or updating the following line to "/etc/rsyslog.conf" or a configuration file in the "/etc/rsyslog.d/" directory: cron.* /var/log/cron Restart the rsyslog daemon with the following command for the changes to take effect: $ sudo systemctl restart rsyslog.service

Generate Mitigation Statement:

Checks: C-85553r1195378_chk

Verify RHEL 10 has the "rsyslog-gnutls" package installed with the following command: $ sudo dnf list --installed rsyslog-gnutls Installed Packages rsyslog-gnutls.x86_64 8.2412.0-1.el10 @AppStream If the "rsyslog-gnutls" package is not installed, this is a finding.

Fix: F-85458r1165330_fix

Configure RHEL 10 to have the "rsyslog-gnutls" package installed with the following command: $ sudo dnf -y install rsyslog-gnutls

Generate Mitigation Statement:

Checks: C-85554r1195380_chk

Verify RHEL 10 has the "audit" service package installed with the following command: $ sudo dnf list --installed audit Installed Packages audit.x86_64 4.0.3-1.el10 @anaconda If the "audit" package is not installed, this is a finding.

Fix: F-85459r1165333_fix

Configure RHEL 10 to have the "audit" service package installed with the following command: $ sudo dnf -y install audit

Generate Mitigation Statement:

Checks: C-85555r1165335_chk

Verify RHEL 10 enables the audit service to produce audit records with the following command: $ systemctl status auditd.service o auditd.service - Security Audit Logging Service Loaded: loaded (/usr/lib/systemd/system/auditd.service; enabled; preset: enabled) Active: active (running) since Wed 2025-10-01 14:00:21 EDT; 1 week 6 days ago If the audit service is not "active" and "running", this is a finding.

Fix: F-85460r1165336_fix

Configure RHEL 10 to enable the auditd service with the following command: $ sudo systemctl enable --now auditd

Generate Mitigation Statement:

Checks: C-85557r1195384_chk

Note: If there is no operational need for Libreswan to be installed, this rule is not applicable. Verify RHEL 10 has the "libreswan" service package installed with the following command: $ sudo dnf list --installed libreswan Installed Packages libreswan.x86_64 5.2-1.el10_0 @AppStream If the "libreswan" package is not installed, this is a finding.

Fix: F-85462r1165342_fix

Configure RHEL 10 to have the "libreswan" service package installed with the following command: $ sudo dnf -y install libreswan

Generate Mitigation Statement:

Checks: C-85558r1195386_chk

Verify RHEL 10 is configured to allow sending email notifications. Note: The "postfix" package provides the "mail" command that is used to send email messages. Verify that the "postfix" package is installed on the system: $ sudo dnf list --installed postfix Installed Packages postfix.x86_64 2:3.8.5-8.el10 @AppStream If the "postfix" package is not installed, this is a finding.

Fix: F-85463r1165345_fix

Configure RHEL 10 to notify designated personnel if baseline configurations are changed in an unauthorized manner. Install the postfix package with the following command: $ sudo dnf -y install postfix

Generate Mitigation Statement:

Checks: C-85559r1208387_chk

Verify RHEL 10 is configured to notify the appropriate interactive users of an audit processing failure. Find the alias maps that are being used with the following command: $ postconf alias_maps alias_maps = lmdb:/etc/aliases Query the Postfix alias maps for an alias for the root user with the following command: $ postmap -q root lmdb:/etc/aliases ISSO If an alias is not set, this is a finding.

Fix: F-85464r1165348_fix

Configure RHEL 10 to have mail aliases notify the ISSO and SA (at a minimum) of an audit processing failure. Edit the aliases map file (by default /etc/aliases) used by Postfix and configure a root alias (using the user ISSO as an example): root: ISSO Update the aliases database with the following command: $ sudo newaliases

Generate Mitigation Statement:

Checks: C-85560r1165350_chk

Note: If postfix is not installed, this is not applicable. Verify RHEL 10 is configured to prevent unrestricted mail relaying with the following command: $ postconf -n smtpd_client_restrictions smtpd_client_restrictions = permit_mynetworks,reject If the "smtpd_client_restrictions" parameter contains any entries other than "permit_mynetworks" and "reject", and the additional entries have not been documented with the information system security officer, this is a finding.

Fix: F-85465r1165351_fix

Configure RHEL 10 so that the postfix configuration file restricts client connections to the local network with the following command: $ sudo postconf -e 'smtpd_client_restrictions = permit_mynetworks,reject'

Generate Mitigation Statement:

Checks: C-85561r1195388_chk

Verify RHEL 10 has the "cronie" package installed with the following command: $ sudo dnf list --installed cronie Installed Packages cronie.x86_64 1.7.0-9.el10 @anaconda If the "cronie" package is not installed, this is a finding.

Fix: F-85466r1165354_fix

Configure RHEL 10 to have the "cronie" package installed with the following command: $ sudo dnf -y install cronie

Generate Mitigation Statement:

Checks: C-85562r1195390_chk

Verify RHEL 10 has the "openssh-server" package installed with the following command: $ sudo dnf list --installed openssh-server Installed Packages openssh-server.x86_64 9.9p1-7.el10_0 @anaconda If the "openssh-server" package is not installed, this is a finding.

Fix: F-85467r1165357_fix

Configure RHEL 10 to have the "openssh-server" package installed with the following command: $ sudo dnf -y install openssh-server

Generate Mitigation Statement:

Checks: C-85563r1165359_chk

Verify RHEL 10 "sshd" is active with the following command: $ systemctl is-active sshd active If the "sshd" service is not active, this is a finding.

Fix: F-85468r1165360_fix

Configure RHEL 10 to enable the sshd service by running the following command: $ systemctl enable --now sshd

Generate Mitigation Statement:

Checks: C-85564r1195392_chk

Verify RHEL 10 has the "openssh-clients" package installed with the following command: $ sudo dnf list --installed openssh-clients Installed Packages openssh-clients.x86_64 9.9p1-7.el10_0 @anaconda If the "openssh-clients" package is not installed, this is a finding.

Fix: F-85469r1165363_fix

Configure RHEL 10 to have the "openssh-clients" package installed with the following command: $ sudo dnf -y install openssh-clients

Generate Mitigation Statement:

Checks: C-85566r1195394_chk

Note: If the system administrator demonstrates the use of an approved alternate multifactor authentication method, this requirement is not applicable. Verify RHEL 10 has the "openssl-pkcs11" package installed with the following command: $ sudo dnf list --installed pkcs11-provider Installed Packages pkcs11-provider.x86_64 1.0-3.el10_0 @rhel-10-for-x86_64-baseos-rpms If the "openssl-pkcs11" package is not installed, this is a finding.

Fix: F-85471r1165369_fix

Configure RHEL 10 to have the "openssl-pkcs11" package installed with the following command: $ sudo dnf -y install pkcs11-provider

Generate Mitigation Statement:

Checks: C-85567r1195396_chk

Verify RHEL 10 has the "gnutls-utils" package installed with the following command: $ sudo dnf list --installed gnutls-utils Installed Packages gnutls-utils.x86_64 3.8.9-9.el10_0.14 @rhel-10-for-x86_64-appstream-rpms If the "gnutls-utils" package is not installed, this is a finding.

Fix: F-85472r1165372_fix

Configure RHEL 10 to have the "gnutls-utils" package installed with the following command: $ sudo dnf -y install gnutls-utils

Generate Mitigation Statement:

Checks: C-85578r1165404_chk

Verify RHEL 10 is configured so that "/etc/group" file is owned by "root" with the following command: $ sudo stat -c "%U %n" /etc/group root /etc/group If the "/etc/group" file does not have an owner of "root", this is a finding.

Fix: F-85483r1165405_fix

Configure RHEL 10 so that the owner of the file "/etc/group" is set to "root" by running the following command: $ sudo chown root /etc/group

Generate Mitigation Statement:

Checks: C-85579r1165407_chk

Verify RHEL 10 is configured so that the "/etc/group" file is group-owned by "root" with the following command: $ sudo stat -c "%G %n" /etc/group root /etc/group If the "/etc/group" file does not have a group owner of "root", this is a finding.

Fix: F-85484r1165408_fix

Configure RHEL 10 so that the group of the file "/etc/group" is set to "root" by running the following command: $ sudo chgrp root /etc/group

Generate Mitigation Statement:

Checks: C-85580r1165410_chk

Verify RHEL 10 is configured so that the "/etc/group-" file is owned by "root" with the following command: $ sudo stat -c "%U %n" /etc/group- root /etc/group- If the "/etc/group-" file does not have an owner of "root", this is a finding.

Fix: F-85485r1165411_fix

Configure RHEL 10 so that the owner of the "/etc/group-" file is set to "root" by running the following command: $ sudo chown root /etc/group-

Generate Mitigation Statement:

Checks: C-85581r1165413_chk

Verify RHEL 10 is configured so that the "/etc/group-" file is group-owned by "root" with the following command: $ sudo stat -c "%G %n" /etc/group- root /etc/group- If the "/etc/group-" file does not have a group owner of "root", this is a finding.

Fix: F-85486r1165414_fix

Configure RHEL 10 so that the group of the "/etc/group-" file is set to "root" by running the following command: $ sudo chgrp root /etc/group-

Generate Mitigation Statement:

Checks: C-85582r1165416_chk

Verify RHEL 10 is configured so that the "/etc/gshadow" file is owned by "root" with the following command: $ sudo stat -c "%U %n" /etc/gshadow root /etc/gshadow If the "/etc/gshadow" file does not have an owner of "root", this is a finding.

Fix: F-85487r1165417_fix

Configure RHEL 10 so that the owner of the file "/etc/gshadow" is set to "root" by running the following command: $ sudo chown root /etc/gshadow

Generate Mitigation Statement:

Checks: C-85583r1165419_chk

Verify RHEL 10 is configured so that the "/etc/gshadow" file is group-owned by "root" with the following command: $ sudo stat -c "%G %n" /etc/gshadow root /etc/gshadow If the "/etc/gshadow" file does not have a group owner of "root", this is a finding.

Fix: F-85488r1165420_fix

Configure RHEL 10 so that the group of the "/etc/gshadow" file is set to "root" by running the following command: $ sudo chgrp root /etc/gshadow

Generate Mitigation Statement:

Checks: C-85584r1165422_chk

Verify RHEL 10 is configured so that the "/etc/gshadow-" file is owned by "root" with the following command: $ sudo stat -c "%U %n" /etc/gshadow- root /etc/gshadow- If the "/etc/gshadow-" file does not have an owner of "root", this is a finding.

Fix: F-85489r1165423_fix

Configure RHEL 10 so that the owner of the "/etc/gshadow-" file is set to "root" by running the following command: $ sudo chown root /etc/gshadow-

Generate Mitigation Statement:

Checks: C-85585r1165425_chk

Verify RHEL 10 is configured so that the "/etc/gshadow-" file is group-owned by "root" with the following command: $ sudo stat -c "%G %n" /etc/gshadow- root /etc/gshadow- If the "/etc/gshadow-" file does not have a group owner of "root", this is a finding.

Fix: F-85490r1165426_fix

Configure RHEL 10 so that the group of the "/etc/gshadow-" file is set to "root" by running the following command: $ sudo chgrp root /etc/gshadow-

Generate Mitigation Statement:

Checks: C-85586r1165428_chk

Verify RHEL 10 is configured so that the "/etc/passwd" file is owned by "root" with the following command: $ sudo stat -c "%U %n" /etc/passwd root /etc/passwd If the "/etc/passwd" file does not have an owner of "root", this is a finding.

Fix: F-85491r1165429_fix

Configure RHEL 10 so that the owner of the "/etc/passwd" file is set to "root" by running the following command: $ sudo chown root /etc/passwd

Generate Mitigation Statement:

Checks: C-85587r1165431_chk

Verify RHEL 10 is configured so that the "/etc/passwd" file is group-owned by "root" with the following command: $ sudo stat -c "%G %n" /etc/passwd root /etc/passwd If the "/etc/passwd" file does not have a group owner of "root", this is a finding.

Fix: F-85492r1165432_fix

Configure RHEL 10 so that the group of the "/etc/passwd" file is set to "root" by running the following command: $ sudo chgrp root /etc/passwd

Generate Mitigation Statement:

Checks: C-85588r1165434_chk

Verify RHEL 10 is configured so that the "/etc/passwd-" file is owned by "root" with the following command: $ sudo stat -c "%U %n" /etc/passwd- root /etc/passwd- If the "/etc/passwd-" file does not have an owner of "root", this is a finding.

Fix: F-85493r1165435_fix

Configure RHEL 10 so that the owner of the "/etc/passwd-" file is set to "root" by running the following command: $ sudo chown root /etc/passwd-

Generate Mitigation Statement:

Checks: C-85589r1165437_chk

Verify RHEL 10 is configured so that the "/etc/passwd-" file is group-owned by "root" with the following command: $ sudo stat -c "%G %n" /etc/passwd- root /etc/passwd- If the "/etc/passwd-" file does not have a group owner of "root", this is a finding.

Fix: F-85494r1165438_fix

Configure RHEL 10 so that the group of the "/etc/passwd-" file is set to "root" by running the following command: $ sudo chgrp root /etc/passwd-

Generate Mitigation Statement:

Checks: C-85590r1165440_chk

Verify RHEL 10 is configured so that the "/etc/shadow" file is owned by "root" with the following command: $ sudo stat -c "%U %n" /etc/shadow root /etc/shadow If the "/etc/shadow" file does not have an owner of "root", this is a finding.

Fix: F-85495r1165441_fix

Configure RHEL 10 so that the owner of the "/etc/shadow" file is set to "root" by running the following command: $ sudo chown root /etc/shadow

Generate Mitigation Statement:

Checks: C-85591r1165443_chk

Verify RHEL 10 is configured so that the "/etc/shadow" file is group-owned by "root" with the following command: $ sudo stat -c "%G %n" /etc/shadow root /etc/shadow If the "/etc/shadow" file does not have a group owner of "root", this is a finding.

Fix: F-85496r1165444_fix

Configure RHEL 10 so that the group of the "/etc/shadow" file is set to "root" by running the following command: $ sudo chgrp root /etc/shadow

Generate Mitigation Statement:

Checks: C-85592r1165446_chk

Verify RHEL 10 is configured so that the "/etc/shadow-" file is owned by "root" with the following command: $ sudo stat -c "%U %n" /etc/shadow- root /etc/shadow- If the "/etc/shadow-" file does not have an owner of "root", this is a finding.

Fix: F-85497r1165447_fix

Configure RHEL 10 so that the owner of the "/etc/shadow-" file is set to "root" by running the following command: $ sudo chown root /etc/shadow-

Generate Mitigation Statement:

Checks: C-85593r1165449_chk

Verify RHEL 10 is configured so that the "/etc/shadow-" file is group-owned by "root" with the following command: $ sudo stat -c "%G %n" /etc/shadow- root /etc/shadow- If the "/etc/shadow-" file does not have a group owner of "root", this is a finding.

Fix: F-85498r1165450_fix

Configure RHEL 10 so that the group of the "/etc/shadow-" file is set to "root" by running the following command: $ sudo chgrp root /etc/shadow-

Generate Mitigation Statement:

Checks: C-85594r1165452_chk

Verify RHEL 10 is configured so that the "/var/log" directory is owned by "root" with the following command: $ stat -c "%U %n" /var/log root /var/log If "/var/log" does not have an owner of "root", this is a finding.

Fix: F-85499r1165453_fix

Configure RHEL 10 so that the owner of the directory "/var/log" is set to "root" by running the following command: $ sudo chown root /var/log

Generate Mitigation Statement:

Checks: C-85595r1165455_chk

Verify RHEL 10 is configured so that the "/var/log" directory is group-owned by "root" with the following command: $ stat -c "%G %n" /var/log root /var/log If "/var/log" does not have a group owner of "root", this is a finding.

Fix: F-85500r1165456_fix

Configure RHEL 10 so that the group owner of the directory "/var/log" is set to "root" by running the following command: $ sudo chgrp root /var/log

Generate Mitigation Statement:

Checks: C-85596r1165458_chk

Verify RHEL 10 is configured so that the "/var/log/messages" file is owned by root with the following command: $ stat -c "%U %n" /var/log/messages root /var/log/messages If "/var/log/messages" does not have an owner of "root", this is a finding.

Fix: F-85501r1165459_fix

Configure RHEL 10 so that the owner of the "/var/log/messages" file is set to "root" by running the following command: $ sudo chown root /var/log/messages

Generate Mitigation Statement:

Checks: C-85597r1165461_chk

Verify RHEL 10 is configured so that the "/var/log/messages" file is group-owned by "root" with the following command: $ stat -c "%G %n" /var/log/messages root /var/log/messages If "/var/log/messages" does not have a group owner of "root", this is a finding.

Fix: F-85502r1165462_fix

Configure RHEL 10 so that the group owner of the "/var/log/messages" file is set to "root" by running the following command: $ sudo chgrp root /var/log/messages

Generate Mitigation Statement:

Checks: C-85598r1165464_chk

Verify RHEL 10 is configured so that the system commands contained in the following directories are owned by "root" with the following command: $ sudo find -L /bin /sbin /usr/bin /usr/sbin /usr/libexec /usr/local/bin /usr/local/sbin ! -user root -exec stat -L -c "%U %n" {} \; If any system commands are found to not be owned by root, this is a finding.

Fix: F-85503r1165465_fix

Configure RHEL 10 so that the system commands are protected from unauthorized access. Run the following command, replacing "[FILE]" with any system command file not owned by "root". $ sudo chown root [FILE]

Generate Mitigation Statement:

Checks: C-85599r1184671_chk

Verify RHEL 10 is configured so that the system commands contained in the following directories are group-owned by "root", or a required system account, with the following command: $ sudo find -L /bin /sbin /usr/bin /usr/sbin /usr/libexec /usr/local/bin /usr/local/sbin ! -group root -exec stat -L -c "%G %n" {} \; If any system commands are returned and are not group-owned by "root" or a required system account, this is a finding.

Fix: F-85504r1165468_fix

Configure RHEL 10 so that the system commands are protected from unauthorized access. Run the following command, replacing "[FILE]" with any system command file not group-owned by "root" or a required system account. $ sudo chgrp root [FILE]

Generate Mitigation Statement:

Checks: C-85600r1165470_chk

Verify RHEL 10 is configured so that the systemwide shared library files are owned by "root" with the following command: $ sudo find -L /lib /lib64 /usr/lib /usr/lib64 ! -user root ! -type d -exec stat -L -c "%U %n" {} \; If any systemwide shared library file is not owned by root, this is a finding.

Fix: F-85505r1165471_fix

Configure RHEL 10 so that the systemwide shared library files (/lib, /lib64, /usr/lib, and /usr/lib64) are protected from unauthorized access. Run the following command, replacing "[FILE]" with any library file not owned by "root". $ sudo chown root [FILE]

Generate Mitigation Statement:

Checks: C-85601r1184734_chk

Verify RHEL 10 is configured so that the systemwide shared library files are group-owned by "root" or a system account with the following command: $ sudo find -L /lib /lib64 /usr/lib /usr/lib64 ! -group root ! -type d -exec stat -L -c "%G %n" {} \; If any systemwide shared library file is returned and is not group-owned by "root" or a required system account, this is a finding.

Fix: F-85506r1165474_fix

Configure RHEL 10 so that the systemwide shared library files (/lib, /lib64, /usr/lib, and /usr/lib64) are protected from unauthorized access. Run the following command, replacing "[FILE]" with any library file not group-owned by "root". $ sudo chgrp root [FILE]

Generate Mitigation Statement:

Checks: C-85602r1165476_chk

Verify RHEL 10 is configured so that the systemwide shared library directories are owned by "root" with the following command: $ sudo find /lib /lib64 /usr/lib /usr/lib64 ! -user root -type d -exec stat -c "%U %n" {} \; If any systemwide shared library directory is not owned by "root", this is a finding.

Fix: F-85507r1165477_fix

Configure RHEL 10 so that the systemwide shared library directories (/lib, /lib64, /usr/lib, and /usr/lib64) are protected from unauthorized access. Run the following command, replacing "[DIRECTORY]" with any library directory not owned by "root". $ sudo chown root [DIRECTORY]

Generate Mitigation Statement:

Checks: C-85603r1184675_chk

Verify RHEL 10 is configured so that the systemwide shared library directories are group-owned by "root" or a system account with the following command: $ sudo find /lib /lib64 /usr/lib /usr/lib64 ! -group root -type d -exec stat -c "%G %n" {} \; If any systemwide shared library directory is returned and is not group-owned by "root" or a required system account, this is a finding.

Fix: F-85508r1165480_fix

Configure RHEL 10 so that the systemwide shared library directories (/lib, /lib64, /usr/lib and /usr/lib64) are protected from unauthorized access. Run the following command, replacing "[DIRECTORY]" with any library directory not group-owned by "root". $ sudo chgrp root [DIRECTORY]

Generate Mitigation Statement:

Checks: C-85604r1165482_chk

Verify RHEL 10 ownership of all cron configuration files with the following command: $ stat -c "%U %n" /etc/cron* root /etc/cron.d root /etc/cron.daily root /etc/cron.deny root /etc/cron.hourly root /etc/cron.monthly root /etc/crontab root /etc/cron.weekly If any crontab is not owned by root, this is a finding.

Fix: F-85509r1165483_fix

Configure RHEL 10 so that cron configuration file directories are owned by root with the following command: $ sudo chown root [cron config file]

Generate Mitigation Statement:

Checks: C-85605r1165485_chk

Verify RHEL 10 group ownership of all cron configuration files with the following command: $ stat -c "%G %n" /etc/cron* root /etc/cron.d root /etc/cron.daily root /etc/cron.deny root /etc/cron.hourly root /etc/cron.monthly root /etc/crontab root /etc/cron.weekly If any crontab is not group-owned by "root", this is a finding.

Fix: F-85510r1165486_fix

Configure RHEL 10 so that any cron configuration file directories are group-owned by "root" with the following command: $ sudo chgrp root [cron config file]

Generate Mitigation Statement:

Checks: C-85606r1165488_chk

Verify RHEL 10 world-writable directories are owned by root, a system account, or an application account with the following command: $ sudo find / -xdev -type d -perm -0002 -uid +999 -exec stat -c "%U, %u, %A, %n" {} \; 2>/dev/null If output indicates that world-writable directories are owned by any account other than root or an approved system account, this is a finding.

Fix: F-85511r1165489_fix

Configure RHEL 10 public directories to be owned by root or a system account to prevent unauthorized and unintended information transferred via shared system resources. Use the following command template to set ownership of public directories to root or a system account: $ sudo chown [root or system account] [Public Directory]

Generate Mitigation Statement:

Checks: C-85607r1165491_chk

Verify RHEL 10 is configured so that all system device files are correctly labeled to prevent unauthorized modification. List all device files on the system that are incorrectly labeled with the following commands: Note: Device files are normally found under "/dev", but applications may place device files in other directories and may necessitate a search of the entire system. $ sudo find /dev -context *:device_t:* \( -type c -o -type b \) -printf "%p %Z\n" $ sudo find /dev -context *:unlabeled_t:* \( -type c -o -type b \) -printf "%p %Z\n" Note: There are device files, such as "/dev/vmci", that are used when the operating system is a host virtual machine. They will not be owned by a user on the system and require the "device_t" label to operate. These device files are not a finding. If there is output from either of these commands, other than already noted, this is a finding.

Fix: F-85512r1165492_fix

Configure RHEL 10 so that all system device files are correctly labeled to prevent unauthorized modification. Restore the SELinux policy for the affected device file from the system policy database using the following command: $ sudo restorecon -v <device_path> Substitute "<device_path>" with the path to the affected device file (from the output of the previous commands). An example device file path would be "/dev/ttyUSB0". If the output of the above command does not indicate that the device was relabeled to a more specific SELinux type label, the SELinux policy of the system must be updated with more specific policy for the device class specified. If a package was used to install support for a device class, that package could be reinstalled using the following command: $ sudo dnf reinstall <package_name> If a package was not used to install the SELinux policy for a given device class, it must be generated manually and provide specific type labels.

Generate Mitigation Statement:

Checks: C-85608r1165494_chk

Verify RHEL 10 is configured so that the "/etc/ssh/sshd_config" file and the contents of "/etc/ssh/sshd_config.d" are group-owned by "root" with the following command: $ sudo find /etc/ssh/sshd_config /etc/ssh/sshd_config.d -exec stat -c "%G %n" {} \; root /etc/ssh/sshd_config root /etc/ssh/sshd_config.d root /etc/ssh/sshd_config.d/50-cloud-init.conf root /etc/ssh/sshd_config.d/50-redhat.conf If the "/etc/ssh/sshd_config" file or "/etc/ssh/sshd_config.d" or any files in the "sshd_config.d" directory do not have a group owner of "root", this is a finding.

Fix: F-85513r1165495_fix

Configure RHEL 10 so that the "/etc/ssh/sshd_config" file and the contents of "/etc/ssh/sshd_config.d" are group-owned by "root" with the following command: $ sudo chgrp root /etc/ssh/sshd_config /etc/ssh/sshd_config.d

Generate Mitigation Statement:

Checks: C-85609r1165497_chk

Verify RHEL 10 is configured so that the "/etc/ssh/sshd_config" file and the contents of "/etc/ssh/sshd_config.d" are owned by root with the following command: $ sudo find /etc/ssh/sshd_config /etc/ssh/sshd_config.d -exec stat -c "%U %n" {} \; root /etc/ssh/sshd_config root /etc/ssh/sshd_config.d root /etc/ssh/sshd_config.d/50-cloud-init.conf root /etc/ssh/sshd_config.d/50-redhat.conf If the "/etc/ssh/sshd_config" file or "/etc/ssh/sshd_config.d" or any files in the "sshd_config.d" directory do not have an owner of "root", this is a finding.

Fix: F-85514r1165498_fix

Configure RHEL 10 so that the "/etc/ssh/sshd_config" file and the contents of "/etc/ssh/sshd_config.d" are owned by "root" with the following command: $ sudo chown -R root /etc/ssh/sshd_config /etc/ssh/sshd_config.d

Generate Mitigation Statement:

Checks: C-85610r1184784_chk

Verify RHEL 10 interactive users' home directories are group-owned by the user's primary GID with the following command: Note: This may miss local interactive users that have been assigned a privileged user identifier (UID). Evidence of interactive use may be obtained from several log files containing system login information. The returned directory "/home/disauser" is used as an example. $ sudo ls -ld $(awk -F: '($3&gt;=1000)&amp;&amp;($7 !~ /nologin/){print $6}' /etc/passwd) drwxr-x--- 2 disauser admin 4096 Jun 5 12:41 disauser Check the user's primary group with the following command: $ sudo grep $(grep disauser /etc/passwd | awk -F: '{print $4}') /etc/group admin:x:250:disauser,doduser,nsauser If the user home directory referenced in "/etc/passwd" is not group-owned by that user's primary GID, this is a finding.

Fix: F-85515r1165501_fix

Configure RHEL 10 interactive users' home directories to be group-owned by the user's primary GID. Change the group owner of a local interactive user's home directory to the group found in "/etc/passwd". To change the group owner of a local interactive user's home directory, use the following command: Note: The example will be for the user "disauser", who has a home directory of "/home/disauser" and has a primary group of users. $ sudo chgrp users /home/disauser

Generate Mitigation Statement:

Checks: C-85611r1184684_chk

Verify RHEL 10 audit logs are group-owned by "root" or a restricted logging group. Determine where the audit logs are stored with the following command: $ sudo grep -iw log_file /etc/audit/auditd.conf log_file = /var/log/audit/audit.log Using the location of the audit log file, determine if the audit log is group-owned by "root" using the following command: $ sudo stat -c "%G %n" /var/log/audit/audit.log root /var/log/audit/audit.log If the audit log is not group-owned by "root" or the configured alternative logging group, this is a finding.

Fix: F-85516r1165504_fix

Configure RHEL 10 to prevent unauthorized read access by ensuring that audit logs are group-owned by root or by a restricted logging group. Change the group of the directory of "/var/log/audit" to be owned by a correct group. Identify the group that is configured to own audit logs: $ sudo grep -P '^[ ]*log_group[ ]+=.*$' /etc/audit/auditd.conf Change the ownership to that group: $ sudo chgrp ${GROUP} /var/log/audit

Generate Mitigation Statement:

Checks: C-85612r1165506_chk

Verify RHEL 10 audit logs directory is owned by "root". Determine where the audit logs are stored with the following command: $ sudo grep -iw log_file /etc/audit/auditd.conf log_file = /var/log/audit/audit.log Using the location of the audit log file, determine if the audit log directory is owned by "root" using the following command: $ sudo stat -c '%U %n' /var/log/audit root /var/log/audit If the audit log directory is not owned by "root", this is a finding.

Fix: F-85517r1165507_fix

Configure RHEL 10 to prevent unauthorized read access by ensuring the audit log directory is "root" owned with the following command: $ sudo chown root /var/log/audit

Generate Mitigation Statement:

Checks: C-85613r1165509_chk

Verify RHEL 10 enforces "root" ownership of audit logs to prevent unauthorized access. Determine where the audit logs are stored with the following command: $ sudo grep "^log_file" /etc/audit/auditd.conf log_file = /var/log/audit/audit.log Using the location of the audit log file, determine if the audit log files are owned by "root" using the following command: $ sudo ls -la /var/log/audit/audit.log rw-------. 2 root root 237923 Jun 11 11:56 /var/log/audit/audit.log If the audit logs are not owned by "root", this is a finding.

Fix: F-85518r1165510_fix

Configure RHEL 10 to enforce "root" ownership of audit logs to prevent unauthorized access with the following command: $ sudo chown root [audit_log_file] Replace "[audit_log_file]" with the correct audit log path. By default this location is "/var/log/audit/audit.log".

Generate Mitigation Statement:

Checks: C-85614r1165512_chk

Verify RHEL 10 enforces group ownership by "root" or a restricted logging group for audit log files to prevent unauthorized access. Determine where the audit logs are stored with the following command: $ sudo grep "^log_file" /etc/audit/auditd.conf log_file = /var/log/audit/audit.log Determine the audit log group by running the following command: $ sudo grep -P '^[ ]*log_group[ ]+=.*$' /etc/audit/auditd.conf log_group = root Check that the audit log file is owned by the correct group. Run the following command to display the owner of the audit log file: $ sudo stat -c "%n %G" /var/log/audit/audit.log /var/log/audit/audit.log root The audit log file must be owned by the "log_group" or by "root" if the "log_group" is not specified. If audit log files are owned by the incorrect group, this is a finding.

Fix: F-85519r1165513_fix

Configure RHEL 10 to enforce group ownership by "root" or a restricted logging group for audit log files to prevent unauthorized access. Identify the group that is configured to own the audit log: $ sudo grep -P '^[ ]*log_group[ ]+=.*$' /etc/audit/auditd.conf Change the ownership to that group using the following command: $ sudo chgrp ${log_group} ${log_file}

Generate Mitigation Statement:

Checks: C-85615r1165515_chk

Verify RHEL 10 audit logs have a mode of "0600". Determine where the audit logs are stored with the following command: $ sudo grep "^log_file" /etc/audit/auditd.conf log_file = /var/log/audit/audit.log Using the location of the audit log file, determine the mode of each audit log with the following command: $ sudo find /var/log/audit/ -type f -exec stat -c '%a %n' {} \; 600 /var/log/audit/audit.log If the audit logs have a mode more permissive than "0600", this is a finding.

Fix: F-85520r1165516_fix

Configure RHEL 10 audit logs to have a mode of "0600" with the following command: Replace "[audit_log_file]" with the path to each audit log file. By default, these logs are located in "/var/log/audit/": $ sudo chmod 0600 /var/log/audit/[audit_log_file] Check the group that owns the system audit logs: $ sudo grep -iw log_group /etc/audit/auditd.conf If "log_group" is set to a user other than "root", configure the permissions the following way: $ sudo chmod 0640 $log_file $ sudo chmod 0440 $log_file.* Otherwise, configure the permissions the following way: $ sudo chmod 0600 $log_file $ sudo chmod 0400 $log_file.*

Generate Mitigation Statement:

Checks: C-85616r1165518_chk

Verify RHEL 10 enforces the audit log directory to have a mode of "0750" or less permissive to prevent unauthorized read access. Determine where the audit logs are stored with the following command: $ sudo grep "^log_file" /etc/audit/auditd.conf log_file = /var/log/audit/audit.log Find the group that owns audit logs: $ sudo grep "^log_group" /etc/audit/auditd.conf log_group = root Run the following command to check the mode of the system audit logs: $ sudo stat -c "%a %n" [audit_log_directory] Replace "[audit_log_directory]" to the correct audit log directory path; by default this location is "/var/log/audit". If the log_group is "root" or is not set, the correct permissions are "0700". If the log_group is owned by anyone other than "root", the correct permissions are "0750". If audit logs have a more permissive mode than is required, this is a finding.

Fix: F-85521r1165519_fix

Configure RHEL 10 so that the audit log directories have a mode of "0750" or less permissive to prevent unauthorized read access with the following command: $ sudo chmod 0700 /var/log/audit Note: The correct permissions are "0700" if the directory is owned by "root"; otherwise, the correct permissions are "0750". Restart the audit daemon with the following command for the changes to take effect: $ sudo service auditd restart

Generate Mitigation Statement:

Checks: C-85617r1165521_chk

Verify RHEL 10 enforces root ownership of the "/etc/audit/" directory with the following command: $ sudo stat -c "%U %n" /etc/audit/ root /etc/audit/ If the "/etc/audit/" directory does not have an owner of "root", this is a finding.

Fix: F-85522r1165522_fix

Configure RHEL 10 so that the "/etc/audit/" directory is owned by "root" with the following command: $ sudo chown root /etc/audit/

Generate Mitigation Statement:

Checks: C-85618r1165524_chk

Verify RHEL 10 enforces root group ownership of the "/etc/audit/" directory with the following command: $ sudo stat -c "%G %n" /etc/audit/ root /etc/audit/ If "/etc/audit/" does not have a group owner of "root", this is a finding.

Fix: F-85523r1165525_fix

Configure RHEL 10 so that the "/etc/audit/" directory is group-owned by "root" with the following command: $ sudo chgrp root /etc/audit/

Generate Mitigation Statement:

Checks: C-85619r1165527_chk

Verify RHEL 10 is configured so that the system commands contained in the following directories have mode "755" or less permissive with the following command: $ sudo find -L /bin /sbin /usr/bin /usr/sbin /usr/libexec /usr/local/bin /usr/local/sbin -perm /022 -exec ls -l {} \; If any system commands are found to be group-writable or world-writable, this is a finding.

Fix: F-85524r1165528_fix

Configure RHEL 10 so that the system commands to be protected from unauthorized access. Run the following command, replacing "[FILE]" with any system command with a mode more permissive than "755". $ sudo chmod 755 [FILE]

Generate Mitigation Statement:

Checks: C-85620r1165530_chk

Verify RHEL 10 is configured so that the systemwide shared library directories have mode "755" or less permissive with the following command: $ sudo find -L /lib /lib64 /usr/lib /usr/lib64 -perm /022 -type d -exec ls -l {} \; If any systemwide shared library file is found to be group-writable or world-writable, this is a finding.

Fix: F-85525r1165531_fix

Configure RHEL 10 so that the systemwide shared library directories (/lib, /lib64, /usr/lib, and /usr/lib64) are protected from unauthorized access. Run the following command, replacing "[DIRECTORY]" with any library directory with a mode more permissive than "755". $ sudo chmod 755 [DIRECTORY]

Generate Mitigation Statement:

Checks: C-85621r1165533_chk

Verify RHEL 10 is configured so that the systemwide shared library files contained in the following directories have mode "755" or less permissive with the following command: $ sudo find -L /lib /lib64 /usr/lib /usr/lib64 -perm /022 -type f -exec ls -l {} \; If any systemwide shared library file is found to be group-writable or world-writable, this is a finding.

Fix: F-85526r1165534_fix

Configure RHEL 10 so that the library files are protected from unauthorized access. Run the following command, replacing "[FILE]" with any library file with a mode more permissive than "755". $ sudo chmod 755 [FILE]

Generate Mitigation Statement:

Checks: C-85622r1165536_chk

Verify RHEL 10 is configured so that the "/var/log" directory has a mode of "0755" or less permissive with the following command: $ stat -c '%a %n' /var/log 755 /var/log If "/var/log" does not have a mode of "0755" or less permissive, this is a finding.

Fix: F-85527r1165537_fix

Configure RHEL 10 so that the "/var/log" directory has a mode of "0755" by running the following command: $ sudo chmod 0755 /var/log

Generate Mitigation Statement:

Checks: C-85623r1165539_chk

Verify RHEL 10 is configured so that the "/var/log/messages" file has a mode of "0640" or less permissive with the following command: $ stat -c '%a %n' /var/log/messages 600 /var/log/messages If "/var/log/messages" does not have a mode of "0640" or less permissive, this is a finding.

Fix: F-85528r1165540_fix

Configure RHEL 10 so that the "/var/log/messages" file has a mode of "0640" by running the following command: $ sudo chmod 0640 /var/log/messages

Generate Mitigation Statement:

Checks: C-85624r1195402_chk

Verify RHEL 10 is configured so that the owner, group, and mode of cron configuration files and directories match the operating system defaults with the following command: $ rpm --verify cronie crontabs | awk '! ($2 == "c" &amp;&amp; $1 ~ /^.\..\.\.\.\..\./) {print $0}' If the command returns any output, this is a finding.

Fix: F-85529r1165543_fix

Configure RHEL 10 to prohibit modification of permissions for cron configuration files and directories from the operating system defaults with the following commands: $ sudo dnf reinstall cronie crontabs $ rpm --setugids cronie crontabs $ rpm --setperms cronie crontabs

Generate Mitigation Statement:

Checks: C-85625r1165545_chk

Verify RHEL 10 is configured so that all local initialization files have a mode of "0740" or less permissive with the following command: Note: The example will be for the "disauser" user, who has a home directory of "/home/disauser". $ sudo find /home -maxdepth 2 -type f -name ".*" -exec stat -c "%n %a" {} \; | awk '$2 &gt; 740' /home/disauser/.bash_profile 770 If any local initialization files are returned, this indicates a mode more permissive than "0740", and this is a finding.

Fix: F-85530r1165546_fix

Configure RHEL 10 so that all local initialization files have a mode of "0740" or less permissive with the following command: Note: The example will be for the "disauser" user, who has a home directory of "/home/disauser". $ sudo chmod 0740 /home/disauser/.<INIT_FILE>

Generate Mitigation Statement:

Checks: C-85626r1165548_chk

Verify RHEL 10 is configured so that the assigned home directory of all local interactive users has a mode of "0750" or less permissive with the following command: Note: This may miss interactive users that have been assigned a privileged user identifier (UID). Evidence of interactive use may be obtained from a number of log files containing system login information. $ stat -L -c '%a %n' $(awk -F: '($3&gt;=1000)&amp;&amp;($7 !~ /nologin/){print $6}' /etc/passwd) 2&gt;/dev/null 700 /home/disauser If home directories referenced in "/etc/passwd" do not have a mode of "0750" or less permissive, this is a finding.

Fix: F-85531r1165549_fix

Configure RHEL 10 so that the mode of interactive user's home directories is set to "0750". To change the mode of a local interactive user's home directory, use the following command: Note: The example will be for the user "disauser". $ sudo chmod 0750 /home/disauser

Generate Mitigation Statement:

Checks: C-85627r1165551_chk

Verify RHEL 10 is configured so that the "/etc/group" file has mode "0644" or less permissive with the following command: $ sudo stat -c "%a %n" /etc/group 644 /etc/group If a value of "0644" or less permissive is not returned, this is a finding.

Fix: F-85532r1165552_fix

Configure RHEL 10 so that the mode of the file "/etc/group" is set to "0644" by running the following command: $ sudo chmod 0644 /etc/group

Generate Mitigation Statement:

Checks: C-85628r1165554_chk

Verify RHEL 10 is configured so that the "/etc/group-" file has mode "0644" or less permissive with the following command: $ sudo stat -c "%a %n" /etc/group- 644 /etc/group- If a value of "0644" or less permissive is not returned, this is a finding.

Fix: F-85533r1165555_fix

Configure RHEL 10 so that the mode of the "/etc/group-" file is set to "0644" by running the following command: $ sudo chmod 0644 /etc/group-

Generate Mitigation Statement:

Checks: C-85629r1165557_chk

Verify RHEL 10 is configured so that the "/etc/gshadow" file has mode "0000" with the following command: $ sudo stat -c "%a %n" /etc/gshadow 0 /etc/gshadow If a value of "0" is not returned, this is a finding.

Fix: F-85534r1165558_fix

Configure RHEL 10 so that the mode of the "/etc/gshadow" file is set to "0000" by running the following command: $ sudo chmod 0000 /etc/gshadow

Generate Mitigation Statement:

Checks: C-85630r1165560_chk

Verify RHEL 10 is configured so that the "/etc/gshadow-" file has mode "0000" with the following command: $ sudo stat -c "%a %n" /etc/gshadow- 0 /etc/gshadow- If a value of "0" is not returned, this is a finding.

Fix: F-85535r1165561_fix

Configure RHEL 10 so that the mode of the "/etc/gshadow-" file is set to "0000" by running the following command: $ sudo chmod 0000 /etc/gshadow-

Generate Mitigation Statement:

Checks: C-85631r1165563_chk

Verify RHEL 10 is configured so that the "/etc/passwd" file has mode "0644" or less permissive with the following command: $ sudo stat -c "%a %n" /etc/passwd 644 /etc/passwd If a value of "0644" or less permissive is not returned, this is a finding.

Fix: F-85536r1165564_fix

Configure RHEL 10 so that the mode of the file "/etc/passwd" is set to "0644" by running the following command: $ sudo chmod 0644 /etc/passwd

Generate Mitigation Statement:

Checks: C-85632r1165566_chk

Verify RHEL 10 is configured so that the "/etc/passwd-" file has mode "0644" or less permissive with the following command: $ sudo stat -c "%a %n" /etc/passwd- 644 /etc/passwd- If a value of "0644" or less permissive is not returned, this is a finding.

Fix: F-85537r1165567_fix

Configure RHEL 10 so that the mode of the "/etc/passwd-" file is set to "0644" by running the following command: $ sudo chmod 0644 /etc/passwd-

Generate Mitigation Statement:

Checks: C-85633r1165569_chk

Verify RHEL 10 is configured so that the "/etc/shadow-" file has mode "0000" with the following command: $ sudo stat -c "%a %n" /etc/shadow- 0 /etc/shadow- If a value of "0" is not returned, this is a finding.

Fix: F-85538r1165570_fix

Configure RHEL 10 so that the mode of the "/etc/shadow-" file is set to "0000" by running the following command: $ sudo chmod 0000 /etc/shadow-

Generate Mitigation Statement:

Checks: C-85634r1165572_chk

Verify RHEL 10 is configured so that all world-writable directories have the sticky bit set with the following command: $ sudo find / -type d \( -perm -0002 -a ! -perm -1000 \) -print 2&gt;/dev/null drwxrwxrwt 7 root root 4096 Jul 26 11:19 /tmp If any of the returned directories are world-writable and do not have the sticky bit set, this is a finding.

Fix: F-85539r1165573_fix

Configure RHEL 10 so that all world-writable directories have the sticky bit set to prevent unauthorized and unintended information transferred via shared system resources. Set the sticky bit on all world-writable directories using the following command (replace "[World-Writable Directory]" with any directory path missing the sticky bit): $ chmod a+t [World-Writable Directory]

Generate Mitigation Statement:

Checks: C-85635r1165575_chk

Verify RHEL 10 is configured so that all local files and directories have a valid group with the following command: $ df --local -P | awk {'if (NR!=1) print $6'} | sudo xargs -I '{}' find '{}' -xdev -nogroup If any files on the system do not have an assigned group, this is a finding.

Fix: F-85540r1165576_fix

Configure RHEL 10 so that all local files and directories have a valid group owner. Either remove all files and directories from RHEL 10 that do not have a valid group, or assign a valid group to all files and directories on the system with the "chgrp" command: $ sudo chgrp <group> <file>

Generate Mitigation Statement:

Checks: C-85636r1165578_chk

Verify RHEL 10 is configured so that all local files and directories have a valid owner with the following command: $ df --local -P | awk {'if (NR!=1) print $6'} | sudo xargs -I '{}' find '{}' -xdev -nouser If any files on the system do not have an assigned owner, this is a finding.

Fix: F-85541r1165579_fix

Configure RHEL 10 so that all local files and directories must have a valid owner. Either remove all files and directories that do not have a valid user from the system, or assign a valid user to all unowned files and directories on RHEL 10 with the "chown" command: $ sudo chown <user> <file>

Generate Mitigation Statement:

Checks: C-85637r1165581_chk

Verify RHEL 10 is configured so that the "/etc/shadow" file has mode "0000" with the following command: $ sudo stat -c "%a %n" /etc/shadow 0 /etc/shadow If a value of "0" is not returned, this is a finding.

Fix: F-85542r1165582_fix

Configure RHEL 10 to enforce mode "0000" for "/etc/shadow" to prevent unauthorized access. Change the mode of the file "/etc/shadow" to "0000" by running the following command: $ sudo chmod 0000 /etc/shadow

Generate Mitigation Statement:

Checks: C-85638r1165584_chk

Verify RHEL 10 audit tools are owned by "root" with the following command: $ sudo stat -c "%U %n" /sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/auditd /sbin/rsyslogd /sbin/augenrules root /sbin/auditctl root /sbin/aureport root /sbin/ausearch root /sbin/auditd root /sbin/rsyslogd root /sbin/augenrules If any audit tools do not have an owner of "root", this is a finding.

Fix: F-85543r1165585_fix

Configure RHEL 10 so that the audit tools are owned by "root" by running the following command: $ sudo chown root [audit_tool] Replace "[audit_tool]" with each audit tool not owned by "root".

Generate Mitigation Statement:

Checks: C-85639r1165587_chk

Verify RHEL 10 audit tools are group-owned by "root" with the following command: $ sudo stat -c "%G %n" /sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/auditd /sbin/rsyslogd /sbin/augenrules root /sbin/auditctl root /sbin/aureport root /sbin/ausearch root /sbin/auditd root /sbin/rsyslogd root /sbin/augenrules If any audit tools do not have a group owner of "root", this is a finding.

Fix: F-85544r1165588_fix