DoD Compliance · STIG

Tri-Lab Operating System Stack (TOSS) 5 Security Technical Implementation Guide

V1R1 · · · Released 26 Mar 2026 · 391 rules
Compare

Pick two releases to diff their requirements.

View

Open a previous version of this STIG.

This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DOD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.
Sort by
b
TOSS 5 must automatically expire temporary accounts within 72 hours.
AC-2 - Medium - CCI-000016 - V-282352 - SV-282352r1200036_rule
RMF Control
AC-2
Severity
M
CCI
CCI-000016
Version
TOSS-05-000297
Vuln IDs
  • V-282352
Rule IDs
  • SV-282352r1200036_rule
Temporary accounts are privileged or nonprivileged accounts that are established during pressing circumstances, such as new software or hardware configuration or an incident response, where the need for prompt account activation requires bypassing normal account authorization procedures. If any inactive temporary accounts are left enabled on the system and are not either manually removed or automatically expired within 72 hours, the security posture of the system will be degraded and exposed to exploitation by unauthorized users or insider threat actors. Temporary accounts are different from emergency accounts. Emergency accounts, also known as "last resort" or "break glass" accounts, are local login accounts enabled on the system for emergency use by authorized system administrators to manage a system when standard login methods are failing or not available. Emergency accounts are not subject to manual removal or scheduled expiration requirements. The automatic expiration of temporary accounts may be extended as needed by the circumstances but it must not be extended indefinitely. A documented permanent account should be established for privileged users who need long-term maintenance accounts. Satisfies: SRG-OS-000002-GPOS-00002, SRG-OS-000123-GPOS-00064
Checks: C-86913r1200034_chk

Verify temporary accounts have been provisioned with an expiration date of 72 hours. For every existing temporary account, run the following command to obtain its account expiration information: $ sudo chage -l <temporary_account_name> | grep -i "account expires" Verify each of these accounts has an expiration date set within 72 hours. If any temporary accounts have no expiration date or do not expire within 72 hours, this is a finding.

Fix: F-86818r1200035_fix

Configure the operating system to expire temporary accounts after 72 hours using the following command: $ sudo chage -E $(date -d +3days +%Y-%m-%d) <temporary_account_name>

b
TOSS 5 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/sudoers.
AC-2 - Medium - CCI-000018 - V-282353 - SV-282353r1200039_rule
RMF Control
AC-2
Severity
M
CCI
CCI-000018
Version
TOSS-05-000452
Vuln IDs
  • V-282353
Rule IDs
  • SV-282353r1200039_rule
The actions taken by system administrators must be audited to keep a record of what was executed on the system, as well as for accountability purposes. Editing the sudoers file may be sign of an attacker trying to establish persistent methods to a system, auditing the editing of the sudoers files mitigates this risk. Satisfies: SRG-OS-000004-GPOS-00004, SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000239-GPOS-00089, SRG-OS-000240-GPOS-00090, SRG-OS-000241-GPOS-00091, SRG-OS-000303-GPOS-00120, SRG-OS-000304-GPOS-00121, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000466-GPOS-00210, SRG-OS-000470-GPOS-00214, SRG-OS-000471-GPOS-00215, SRG-OS-000476-GPOS-00221
Checks: C-86914r1200037_chk

Verify TOSS 5 generates audit records for all account creations, modifications, disabling, and termination events that affect "/etc/sudoers" using the following command: $ sudo auditctl -l | grep /etc/sudoers -w /etc/sudoers -p wa -k identity If the command does not return a line or the line is commented out, this is a finding.

Fix: F-86819r1200038_fix

Configure TOSS 5 to generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/sudoers". Add or update the following file system rule to "/etc/audit/rules.d/audit.rules": -w /etc/sudoers -p wa -k identity Restart the audit daemon for the changes to take effect.

b
TOSS 5 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/sudoers.d/ directory.
AC-2 - Medium - CCI-000018 - V-282354 - SV-282354r1201500_rule
RMF Control
AC-2
Severity
M
CCI
CCI-000018
Version
TOSS-05-000453
Vuln IDs
  • V-282354
Rule IDs
  • SV-282354r1201500_rule
The actions taken by system administrators (SAs) must be audited to keep a record of what was executed on the system, as well as for accountability purposes. Editing the sudoers file may be a sign of an attacker trying to establish persistent methods to a system, auditing the editing of the sudoers files mitigates this risk. Satisfies: SRG-OS-000004-GPOS-00004, SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000239-GPOS-00089, SRG-OS-000240-GPOS-00090, SRG-OS-000241-GPOS-00091, SRG-OS-000303-GPOS-00120, SRG-OS-000304-GPOS-00121, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000466-GPOS-00210, SRG-OS-000470-GPOS-00214, SRG-OS-000471-GPOS-00215, SRG-OS-000476-GPOS-00221, SRG-OS-000274-GPOS-00104
Checks: C-86915r1200040_chk

Verify TOSS 5 generates audit records for all account creations, modifications, disabling, and termination events that affect "/etc/sudoers.d/" using the following command: $ sudo auditctl -l | grep /etc/sudoers.d -w /etc/sudoers.d/ -p wa -k identity If the command does not return a line or the line is commented out, this is a finding.

Fix: F-86820r1200041_fix

Configure TOSS 5 to generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/sudoers.d/". Add or update the following file system rule to "/etc/audit/rules.d/audit.rules": -w /etc/sudoers.d/ -p wa -k identity Restart the audit daemon for the changes to take effect.

b
TOSS 5 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/group.
AC-2 - Medium - CCI-000018 - V-282355 - SV-282355r1200045_rule
RMF Control
AC-2
Severity
M
CCI
CCI-000018
Version
TOSS-05-000454
Vuln IDs
  • V-282355
Rule IDs
  • SV-282355r1200045_rule
In addition to auditing new user and group accounts, these watches will alert the system administrator(s) to any modifications. Any unexpected users, groups, or modifications must be investigated for legitimacy. Satisfies: SRG-OS-000004-GPOS-00004, SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000239-GPOS-00089, SRG-OS-000240-GPOS-00090, SRG-OS-000241-GPOS-00091, SRG-OS-000303-GPOS-00120, SRG-OS-000304-GPOS-00121, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000466-GPOS-00210, SRG-OS-000470-GPOS-00214, SRG-OS-000471-GPOS-00215, SRG-OS-000476-GPOS-00221
Checks: C-86916r1200043_chk

Verify TOSS 5 generates audit records for all account creations, modifications, disabling, and termination events that affect "/etc/group" using the following command: $ sudo auditctl -l | egrep '(/etc/group)' -w /etc/group -p wa -k identity If the command does not return a line or the line is commented out, this is a finding.

Fix: F-86821r1200044_fix

Configure TOSS 5 to generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/group". Add or update the following file system rule to "/etc/audit/rules.d/audit.rules": -w /etc/group -p wa -k identity Restart the audit daemon for the changes to take effect.

b
TOSS 5 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/gshadow.
AC-2 - Medium - CCI-000018 - V-282356 - SV-282356r1200048_rule
RMF Control
AC-2
Severity
M
CCI
CCI-000018
Version
TOSS-05-000455
Vuln IDs
  • V-282356
Rule IDs
  • SV-282356r1200048_rule
In addition to auditing new user and group accounts, these watches will alert the system administrator(s) to any modifications. Any unexpected users, groups, or modifications should be investigated for legitimacy. Satisfies: SRG-OS-000004-GPOS-00004, SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000239-GPOS-00089, SRG-OS-000240-GPOS-00090, SRG-OS-000241-GPOS-00091, SRG-OS-000303-GPOS-00120, SRG-OS-000304-GPOS-00121, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000466-GPOS-00210, SRG-OS-000470-GPOS-00214, SRG-OS-000471-GPOS-00215, SRG-OS-000476-GPOS-00221
Checks: C-86917r1200046_chk

Verify TOSS 5 generates audit records for all account creations, modifications, disabling, and termination events that affect "/etc/gshadow" using the following command: $ sudo auditctl -l | egrep '(/etc/gshadow)' -w /etc/gshadow -p wa -k identity If the command does not return a line or the line is commented out, this is a finding.

Fix: F-86822r1200047_fix

Configure TOSS 5 to generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/gshadow". Add or update the following file system rule to "/etc/audit/rules.d/audit.rules": -w /etc/gshadow -p wa -k identity Restart the audit daemon for the changes to take effect.

b
TOSS 5 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/opasswd.
AC-2 - Medium - CCI-000018 - V-282357 - SV-282357r1200051_rule
RMF Control
AC-2
Severity
M
CCI
CCI-000018
Version
TOSS-05-000456
Vuln IDs
  • V-282357
Rule IDs
  • SV-282357r1200051_rule
In addition to auditing new user and group accounts, these watches will alert the system administrator(s) to any modifications. Any unexpected users, groups, or modifications should be investigated for legitimacy. Satisfies: SRG-OS-000004-GPOS-00004, SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000239-GPOS-00089, SRG-OS-000240-GPOS-00090, SRG-OS-000241-GPOS-00091, SRG-OS-000303-GPOS-00120, SRG-OS-000304-GPOS-00121, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000466-GPOS-00210, SRG-OS-000470-GPOS-00214, SRG-OS-000471-GPOS-00215, SRG-OS-000476-GPOS-00221
Checks: C-86918r1200049_chk

Verify TOSS 5 generates audit records for all account creations, modifications, disabling, and termination events that affect "/etc/security/opasswd" using the following command: $ sudo auditctl -l | egrep '(/etc/security/opasswd)' -w /etc/security/opasswd -p wa -k identity If the command does not return a line or the line is commented out, this is a finding.

Fix: F-86823r1200050_fix

Configure TOSS 5 to generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/security/opasswd". Add or update the following file system rule to "/etc/audit/rules.d/audit.rules": -w /etc/security/opasswd -p wa -k identity Restart the audit daemon for the changes to take effect.

b
TOSS 5 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/passwd.
AC-2 - Medium - CCI-000018 - V-282358 - SV-282358r1200054_rule
RMF Control
AC-2
Severity
M
CCI
CCI-000018
Version
TOSS-05-000457
Vuln IDs
  • V-282358
Rule IDs
  • SV-282358r1200054_rule
In addition to auditing new user and group accounts, these watches will alert the system administrator(s) to any modifications. Any unexpected users, groups, or modifications should be investigated for legitimacy. Satisfies: SRG-OS-000004-GPOS-00004, SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000239-GPOS-00089, SRG-OS-000240-GPOS-00090, SRG-OS-000241-GPOS-00091, SRG-OS-000303-GPOS-00120, SRG-OS-000304-GPOS-00121, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000466-GPOS-00210, SRG-OS-000470-GPOS-00214, SRG-OS-000471-GPOS-00215, SRG-OS-000476-GPOS-00221
Checks: C-86919r1200052_chk

Verify TOSS 5 generates audit records for all account creations, modifications, disabling, and termination events that affect "/etc/passwd" using the following command: $ sudo auditctl -l | egrep '(/etc/passwd)' -w /etc/passwd -p wa -k identity If the command does not return a line or the line is commented out, this is a finding.

Fix: F-86824r1200053_fix

Configure TOSS 5 to generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/passwd". Add or update the following file system rule to "/etc/audit/rules.d/audit.rules": -w /etc/passwd -p wa -k identity Restart the audit daemon for the changes to take effect.

b
TOSS 5 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/shadow.
AC-2 - Medium - CCI-000018 - V-282359 - SV-282359r1200057_rule
RMF Control
AC-2
Severity
M
CCI
CCI-000018
Version
TOSS-05-000458
Vuln IDs
  • V-282359
Rule IDs
  • SV-282359r1200057_rule
In addition to auditing new user and group accounts, these watches will alert the system administrator(s) to any modifications. Any unexpected users, groups, or modifications should be investigated for legitimacy. Satisfies: SRG-OS-000004-GPOS-00004, SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000239-GPOS-00089, SRG-OS-000240-GPOS-00090, SRG-OS-000241-GPOS-00091, SRG-OS-000303-GPOS-00120, SRG-OS-000304-GPOS-00121, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000466-GPOS-00210, SRG-OS-000470-GPOS-00214, SRG-OS-000471-GPOS-00215, SRG-OS-000476-GPOS-00221
Checks: C-86920r1200055_chk

Verify TOSS 5 generates audit records for all account creations, modifications, disabling, and termination events that affect "/etc/passwd using the following command: $ sudo auditctl -l | egrep '(/etc/shadow)' -w /etc/shadow -p wa -k identity If the command does not return a line or the line is commented out, this is a finding.

Fix: F-86825r1200056_fix

Configure TOSS 5 to generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/shadow". Add or update the following file system rule to "/etc/audit/rules.d/audit.rules": -w /etc/shadow -p wa -k identity Restart the audit daemon for the changes to take effect.

b
TOSS 5 must automatically lock an account when three unsuccessful login attempts occur.
AC-7 - Medium - CCI-000044 - V-282360 - SV-282360r1200060_rule
RMF Control
AC-7
Severity
M
CCI
CCI-000044
Version
TOSS-05-000304
Vuln IDs
  • V-282360
Rule IDs
  • SV-282360r1200060_rule
By limiting the number of failed login attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute-force attacks, is reduced. Limits are imposed by locking the account. Satisfies: SRG-OS-000021-GPOS-00005, SRG-OS-000329-GPOS-00128
Checks: C-86921r1200058_chk

Verify TOSS 5 is configured to lock an account after three unsuccessful login attempts using the command: $ grep 'deny =' /etc/security/faillock.conf deny = 3 If the "deny" option is not set to "3" or less (but not "0"), is missing or commented out, this is a finding.

Fix: F-86826r1200059_fix

Configure TOSS 5 to lock an account when three unsuccessful login attempts occur. Add or modify the "/etc/security/faillock.conf" file to match the following line: deny = 3

b
TOSS 5 must automatically lock an account when three unsuccessful login attempts occur during a 15-minute time period.
AC-7 - Medium - CCI-000044 - V-282361 - SV-282361r1200063_rule
RMF Control
AC-7
Severity
M
CCI
CCI-000044
Version
TOSS-05-000305
Vuln IDs
  • V-282361
Rule IDs
  • SV-282361r1200063_rule
By limiting the number of failed login attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute-forcing, is reduced. Limits are imposed by locking the account. Satisfies: SRG-OS-000021-GPOS-00005, SRG-OS-000329-GPOS-00128
Checks: C-86922r1200061_chk

Note: If the system administrator (SA) demonstrates the use of an approved centralized account management method that locks an account after three unsuccessful login attempts within a period of 15 minutes, this requirement is not applicable. Verify TOSS 5 locks an account after three unsuccessful login attempts within a period of 15 minutes using the following command: $ grep fail_interval /etc/security/faillock.conf fail_interval = 900 If the "fail_interval" option is not set to "900" or less (but not "0"), the line is commented out, or the line is missing, this is a finding.

Fix: F-86827r1200062_fix

Configure TOSS 5 to lock out the "root" account after a number of incorrect login attempts within 15 minutes. Enable "pam_faillock.so" using the following command: $ authselect enable-feature with-faillock Edit the "/etc/security/faillock.conf" file as follows: fail_interval = 900

b
TOSS 5 must ensure account lockouts persist.
AC-7 - Medium - CCI-000044 - V-282362 - SV-282362r1200066_rule
RMF Control
AC-7
Severity
M
CCI
CCI-000044
Version
TOSS-05-000308
Vuln IDs
  • V-282362
Rule IDs
  • SV-282362r1200066_rule
Lockouts persisting across reboots ensure that the account is only unlocked by an administrator. If the lockouts did not persist across reboots, an attacker could simply reboot the system to continue brute-force attacks against the accounts on the system.
Checks: C-86923r1200064_chk

Verify the "/etc/security/faillock.conf" file is configured use a nondefault faillock directory to ensure contents persist after reboot using the following command: $ grep 'dir =' /etc/security/faillock.conf dir = /var/log/faillock If the "dir" option is not set to a nondefault documented tally log directory, is missing or commented out, this is a finding.

Fix: F-86828r1200065_fix

Configure TOSS 5 to maintain the contents of the faillock directory after a reboot. Add or modify the "/etc/security/faillock.conf" file to match the following line: dir = /var/log/faillock

b
TOSS 5 must log username information when unsuccessful login attempts occur.
AC-7 - Medium - CCI-000044 - V-282363 - SV-282363r1200069_rule
RMF Control
AC-7
Severity
M
CCI
CCI-000044
Version
TOSS-05-000314
Vuln IDs
  • V-282363
Rule IDs
  • SV-282363r1200069_rule
Without auditing these events, it may be harder or impossible to identify what an attacker did after an attack.
Checks: C-86924r1200067_chk

Verify the "/etc/security/faillock.conf" file is configured to log username information when unsuccessful login attempts occur using the following command: $ grep audit /etc/security/faillock.conf audit If the "audit" option is not set, is missing, or is commented out, this is a finding.

Fix: F-86829r1200068_fix

Configure TOSS 5 to log username information when unsuccessful login attempts occur. Add or modify the "/etc/security/faillock.conf" file to match the following line: audit

b
TOSS 5 must configure the use of the pam_faillock.so module in the /etc/pam.d/system-auth file.
AC-7 - Medium - CCI-000044 - V-282364 - SV-282364r1200072_rule
RMF Control
AC-7
Severity
M
CCI
CCI-000044
Version
TOSS-05-000332
Vuln IDs
  • V-282364
Rule IDs
  • SV-282364r1200072_rule
If the "pam_faillock.so" module is not loaded, the system will not correctly lockout accounts to prevent password guessing attacks.
Checks: C-86925r1200070_chk

Verify the "pam_faillock.so" module is present in the "/etc/pam.d/system-auth" file: $ grep pam_faillock.so /etc/pam.d/system-auth auth required pam_faillock.so preauth auth required pam_faillock.so authfail account required pam_faillock.so If the "pam_faillock.so" module is not present in the "/etc/pam.d/system-auth" file with the "preauth" line listed before "pam_unix.so", this is a finding.

Fix: F-86830r1200071_fix

Configure TOSS 5 to include the use of the "pam_faillock.so" module in the /etc/pam.d/system-auth file. Add/modify the appropriate sections of the "/etc/pam.d/system-auth" file to match the following lines: Note: The "preauth" line must be listed before "pam_unix.so". auth required pam_faillock.so preauth auth required pam_faillock.so authfail account required pam_faillock.so

b
TOSS 5 must configure the use of the pam_faillock.so module in the /etc/pam.d/password-auth file.
AC-7 - Medium - CCI-000044 - V-282365 - SV-282365r1200075_rule
RMF Control
AC-7
Severity
M
CCI
CCI-000044
Version
TOSS-05-000333
Vuln IDs
  • V-282365
Rule IDs
  • SV-282365r1200075_rule
If the "pam_faillock.so" module is not loaded, the system will not correctly lockout accounts to prevent password guessing attacks.
Checks: C-86926r1200073_chk

Verify the "pam_faillock.so" module is present in the "/etc/pam.d/password-auth" file: $ grep pam_faillock.so /etc/pam.d/password-auth auth required pam_faillock.so preauth auth required pam_faillock.so authfail account required pam_faillock.so If the "pam_faillock.so" module is not present in the "/etc/pam.d/password-auth" file with the "preauth" line listed before pam_unix.so, this is a finding.

Fix: F-86831r1200074_fix

Configure TOSS 5 to include the use of the "pam_faillock.so" module in the "/etc/pam.d/password-auth" file. Add/modify the appropriate sections of the "/etc/pam.d/password-auth" file to match the following lines: Note: The "preauth" line must be listed before pam_unix.so. auth required pam_faillock.so preauth auth required pam_faillock.so authfail account required pam_faillock.so

b
TOSS 5 must display the Standard Mandatory DOD or other applicable U.S. Government Notice and Consent Banner before granting local or remote access to the system via a command line user login.
AC-8 - Medium - CCI-000048 - V-282366 - SV-282366r1200078_rule
RMF Control
AC-8
Severity
M
CCI
CCI-000048
Version
TOSS-05-000086
Vuln IDs
  • V-282366
Rule IDs
  • SV-282366r1200078_rule
Display of a standardized and approved use notification before granting access to the operating system ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. System use notifications are required only for access via login interfaces with human users and are not required when such human interfaces do not exist. Satisfies: SRG-OS-000023-GPOS-00006, SRG-OS-000228-GPOS-00088
Checks: C-86927r1200076_chk

For nodes of the cluster that are only privately (within the cluster) accessible, this requirement is not applicable. Verify TOSS 5 displays the Standard Mandatory DOD or other applicable U.S. Government Notice and Consent Banner before granting access to the operating system via a command line user login. Check that a banner is displayed at the command line login screen using the following command: $ sudo cat /etc/issue If the banner is set correctly, it will return the following text: "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." If the banner text does not match the Standard Mandatory DOD or other applicable U.S. Government Notice and Consent Banner exactly, or the line is commented out, this is a finding.

Fix: F-86832r1200077_fix

Configure TOSS 5 to display the Standard Mandatory DOD or other applicable U.S. Government Notice and Consent Banner before granting access to the system via command line login. Edit the "/etc/issue" file to replace the default text with the Standard Mandatory DOD or other applicable U.S. Government Notice and Consent Banner. The DOD-required text is: "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests -- not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details."

b
TOSS 5 must display the Standard Mandatory DOD or other applicable U.S. Government agency Notice and Consent Banner before granting local or remote access to the system via a SSH login.
AC-8 - Medium - CCI-000048 - V-282367 - SV-282367r1201610_rule
RMF Control
AC-8
Severity
M
CCI
CCI-000048
Version
TOSS-05-000236
Vuln IDs
  • V-282367
Rule IDs
  • SV-282367r1201610_rule
The warning message reinforces policy awareness during the login process and facilitates possible legal action against attackers. Alternatively, systems whose ownership should not be obvious should ensure usage of a banner that does not provide easy attribution. Satisfies: SRG-OS-000023-GPOS-00006, SRG-OS-000228-GPOS-00088
Checks: C-86928r1200079_chk

Verify any SSH connection to the operating system displays the Standard Mandatory DOD or other applicable U.S. Government agency Notice and Consent Banner before granting access to the system. For nodes of the cluster that are only privately (within the cluster) accessible, this requirement is not applicable. Check for the location of the banner file being used using the following command: $ sudo /usr/sbin/sshd -dd 2&gt;&amp;1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH '^\s*banner' banner /etc/issue This command will return the banner keyword and the name of the file that contains the SSH banner (in this case "/etc/issue"). If the line is commented out, this is a finding.

Fix: F-86833r1201609_fix

Configure TOSS 5 to display the Standard Mandatory DOD or other applicable U.S. Government agency Notice and Consent Banner before granting access to the system via SSH. Edit the "/etc/ssh/sshd_config" file to uncomment the banner keyword and configure it to point to a file that contains the login banner (this file may be named differently or be in a different location if using a version of SSH that is provided by a third-party vendor). An example configuration line is: Banner /etc/issue

b
TOSS 5 must display the Standard Mandatory DOD or other applicable U.S. Government agency Notice and Consent Banner before granting local or remote access to the system via a graphical user login.
AC-8 - Medium - CCI-000048 - V-282368 - SV-282368r1200084_rule
RMF Control
AC-8
Severity
M
CCI
CCI-000048
Version
TOSS-05-000262
Vuln IDs
  • V-282368
Rule IDs
  • SV-282368r1200084_rule
Display of a standardized and approved use notification before granting access to the operating system ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. For U.S. Government systems, system use notifications are required only for access via login interfaces with human users and are not required when such human interfaces do not exist. Satisfies: SRG-OS-000023-GPOS-00006, SRG-OS-000228-GPOS-00088
Checks: C-86929r1200082_chk

Verify TOSS 5 displays a banner before granting access to the operating system via a graphical user login. Note: This requirement assumes the use of the TOSS 5 default graphical user interface—the GNOME desktop environment. If the system does not have a graphical user interface installed, this requirement is not applicable. Determine if the operating system displays a banner at the login screen using the following command: $ sudo grep banner-message-enable /etc/dconf/db/local.d/* banner-message-enable=true If "banner-message-enable" is set to "false", is commented out, or is missing, this is a finding.

Fix: F-86834r1200083_fix

Configure TOSS 5 to display the Standard Mandatory DOD or other applicable U.S. Government agency Notice and Consent Banner before granting access to the system via a graphical user login. Create a database to contain the systemwide graphical user login settings (if it does not already exist) using the following command: $ sudo touch /etc/dconf/db/local.d/01-banner-message Add the following lines to the [org/gnome/login-screen] section of the "/etc/dconf/db/local.d/01-banner-message": [org/gnome/login-screen] banner-message-enable=true Run the following command to update the database: $ sudo dconf update

b
TOSS 5 must prevent a user from overriding the banner-message-enable setting for the graphical user interface.
AC-8 - Medium - CCI-000048 - V-282369 - SV-282369r1200087_rule
RMF Control
AC-8
Severity
M
CCI
CCI-000048
Version
TOSS-05-000263
Vuln IDs
  • V-282369
Rule IDs
  • SV-282369r1200087_rule
Display of a standardized and approved use notification before granting access to the operating system ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. For U.S. Government systems, system use notifications are required only for access via login interfaces with human users and are not required when such human interfaces do not exist. Satisfies: SRG-OS-000023-GPOS-00006, SRG-OS-000228-GPOS-00088
Checks: C-86930r1200085_chk

Verify TOSS 5 prevents a user from overriding settings for graphical user interfaces. Note: This requirement assumes the use of the TOSS 5 default graphical user interface—the GNOME desktop environment. If the system does not have a graphical user interface installed, this requirement is not applicable. Determine which profile the system database is using by running the following command: $ sudo grep system-db /etc/dconf/profile/user system-db:local Verify the graphical settings are locked from nonprivileged user modification using the following command: Note: The example below is using the database "local" for the system, so the path is "/etc/dconf/db/local.d". This path must be modified if a database other than "local" is being used. $ sudo grep banner-message-enable /etc/dconf/db/local.d/* /org/gnome/login-screen/banner-message-enable If the output is not "/org/gnome/login-screen/banner-message-enable", the line is commented out, or the line is missing, this is a finding.

Fix: F-86835r1200086_fix

Configure TOSS 5 to prevent a user from overriding the banner setting for graphical user interfaces. Create a database to contain the systemwide graphical user login settings (if it does not already exist) using the following command: $ sudo touch /etc/dconf/db/local.d/locks/session Add the following setting to prevent nonprivileged users from modifying it: banner-message-enable Update the database with the following command: $ sudo dconf update

a
TOSS 5 must limit the number of concurrent sessions to 256 for all accounts and/or account types.
AC-10 - Low - CCI-000054 - V-282371 - SV-282371r1200093_rule
RMF Control
AC-10
Severity
L
CCI
CCI-000054
Version
TOSS-05-000313
Vuln IDs
  • V-282371
Rule IDs
  • SV-282371r1200093_rule
Operating system management includes the ability to control the number of users and user sessions that use an operating system. Limiting the number of allowed users and sessions per user is helpful in reducing the risks related to denial-of-service (DoS) attacks. This requirement addresses concurrent sessions for information system accounts and does not address concurrent sessions by single users via multiple system accounts. The maximum number of concurrent sessions should be defined based upon mission needs and the operational environment for each system.
Checks: C-86932r1200091_chk

Verify TOSS limits the number of concurrent sessions to 256 or less for all accounts and/or account types using the following command: $ sudo grep -r -s '^[^#].*maxlogins' /etc/security/limits.conf /etc/security/limits.d/*.conf * hard maxlogins 256 This can be set as a global domain (with the * wildcard) but may be set differently for multiple domains. If the "maxlogins" item is missing, commented out, or the value is set greater than "256" and is not documented with the information system security officer (ISSO) as an operational requirement for all domains that have the "maxlogins" item assigned, this is a finding.

Fix: F-86837r1200092_fix

Configure TOSS to limit the number of concurrent sessions to 256 or less for all accounts and/or account types. Add the following line to the top of the "/etc/security/limits.conf" or in a ."conf" file defined in "/etc/security/limits.d/": * hard maxlogins 256

b
TOSS 5 must directly initiate a session lock for all connection types when the smart card is removed.
AC-11 - Medium - CCI-000056 - V-282372 - SV-282372r1201380_rule
RMF Control
AC-11
Severity
M
CCI
CCI-000056
Version
TOSS-05-000269
Vuln IDs
  • V-282372
Rule IDs
  • SV-282372r1201380_rule
A session lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not want to log out because of the temporary nature of the absence. The session lock is implemented at the point where session activity can be determined. Rather than be forced to wait for a period of time to expire before the user session can be locked, TOSS 5 must provide users with the ability to manually invoke a session lock so users can secure their session if it is necessary to temporarily vacate the immediate physical vicinity. Satisfies: SRG-OS-000028-GPOS-00009, SRG-OS-000029-GPOS-00010
Checks: C-86933r1200094_chk

Verify TOSS 5 enables a user's session lock until that user reestablishes access using established identification and authentication procedures using the following command: Note: This requirement assumes the use of the TOSS 5 default graphical user interface—the GNOME desktop environment. If the system does not have a graphical user interface installed, this requirement is not applicable. $ grep -R removal-action /etc/dconf/db/* /etc/dconf/db/distro.d/20-authselect:removal-action='lock-screen' If the "removal-action='lock-screen'" setting is missing or commented out from the dconf database files, and is not documented with the information system security officer (ISSO) as an operational requirement, this is a finding.

Fix: F-86838r1200095_fix

Configure TOSS 5 to enable a user's session lock until that user reestablishes access using established identification and authentication procedures. Select or create an authselect profile and incorporate the "with-smartcard-lock-on-removal" feature with the following example: $ sudo authselect select sssd with-smartcard with-smartcard-lock-on-removal Alternatively, edit the dconf settings in the /etc/dconf/db/* location. Add or update the [org/gnome/settings-daemon/peripherals/smartcard] section of the /etc/dconf/db/local.d/00-security-settings" database file and add or update the following lines: [org/gnome/settings-daemon/peripherals/smartcard] removal-action='lock-screen' Update the dconf system databases: $ sudo dconf update

b
TOSS 5 must prevent a user from overriding the disabling of the graphical user smart card removal action.
AC-11 - Medium - CCI-000056 - V-282373 - SV-282373r1200099_rule
RMF Control
AC-11
Severity
M
CCI
CCI-000056
Version
TOSS-05-000270
Vuln IDs
  • V-282373
Rule IDs
  • SV-282373r1200099_rule
A session lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not want to log out because of the temporary nature of the absence. The session lock is implemented at the point where session activity can be determined. Rather than be forced to wait for a period of time to expire before the user session can be locked, TOSS 5 must provide users with the ability to manually invoke a session lock so users can secure their session if it is necessary to temporarily vacate the immediate physical vicinity. Satisfies: SRG-OS-000028-GPOS-00009, SRG-OS-000029-GPOS-00010
Checks: C-86934r1200097_chk

Verify TOSS 5 disables the user's ability to override the smart card removal action setting. Note: This requirement assumes the use of the TOSS 5 default graphical user interface—the GNOME desktop environment. If the system does not have a graphical user interface installed, this requirement is not applicable. Determine which profile the system database is using by running the following command: $ sudo grep system-db /etc/dconf/profile/user system-db:local Verify the removal action setting is locked from nonprivileged user modification using the following command: Note: The example below is using the database "local" for the system, so the path is "/etc/dconf/db/local.d". This path must be modified if a database other than "local" is being used. $ grep 'removal-action' /etc/dconf/db/local.d/locks/* /org/gnome/settings-daemon/peripherals/smartcard/removal-action If the command does not return at least the example result, this is a finding.

Fix: F-86839r1200098_fix

Add the following line to "/etc/dconf/db/local.d/locks/00-security-settings-lock" to prevent user override of the smart card removal action: /org/gnome/settings-daemon/peripherals/smartcard/removal-action Update the dconf system databases: $ sudo dconf update

b
TOSS 5 must enable a user session lock until that user reestablishes access using established identification and authentication procedures for graphical user sessions.
AC-11 - Medium - CCI-000056 - V-282374 - SV-282374r1201498_rule
RMF Control
AC-11
Severity
M
CCI
CCI-000056
Version
TOSS-05-000271
Vuln IDs
  • V-282374
Rule IDs
  • SV-282374r1201498_rule
A session lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not want to log out because of the temporary nature of the absence. The session lock is implemented at the point where session activity can be determined. Regardless of where the session lock is determined and implemented, once invoked, the session lock must remain in place until the user reauthenticates. No other activity aside from reauthentication must unlock the system. Satisfies: SRG-OS-000028-GPOS-00009, SRG-OS-000029-GPOS-00010
Checks: C-86935r1200100_chk

Verify TOSS 5 enables a user's session lock until that user reestablishes access using established identification and authentication procedures using the following command: Note: This requirement assumes the use of the TOSS 5 default graphical user interface—the GNOME desktop environment. If the system does not have a graphical user interface installed, this requirement is not applicable. $ gsettings get org.gnome.desktop.screensaver lock-enabled true If the setting is "false", this is a finding.

Fix: F-86840r1201498_fix

Configure TOSS 5 to enable a user's session lock until that user reestablishes access using established identification and authentication procedures. Create a database to contain the systemwide screensaver settings (if it does not already exist) with the following example: $ sudo vi /etc/dconf/db/local.d/00-screensaver Edit the "[org/gnome/desktop/screensaver]" section of the database file and add or update the following lines: # Set this to true to lock the screen when the screensaver activates lock-enabled=true Update the system databases: $ sudo dconf update

b
TOSS 5 must prevent a user from overriding the screensaver lock-enabled setting for the graphical user interface.
AC-11 - Medium - CCI-000056 - V-282375 - SV-282375r1200105_rule
RMF Control
AC-11
Severity
M
CCI
CCI-000056
Version
TOSS-05-000272
Vuln IDs
  • V-282375
Rule IDs
  • SV-282375r1200105_rule
A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not log out because of the temporary nature of the absence. Rather than relying on the user to manually lock their operating system session prior to vacating the vicinity, operating systems must be able to identify when a user's session has idled and take action to initiate the session lock. The session lock is implemented at the point where session activity can be determined and/or controlled. Implementing session settings will have little value if a user is able to manipulate these settings from the defaults prescribed in the other requirements of this implementation guide. Satisfies: SRG-OS-000028-GPOS-00009, SRG-OS-000029-GPOS-00010
Checks: C-86936r1200103_chk

Verify TOSS 5 prevents a user from overriding settings for graphical user interfaces. Note: This requirement assumes the use of the TOSS 5 default graphical user interface—Gnome Shell. If the system does not have a graphical user interface installed, this requirement is not applicable. Determine which profile the system database is using by running the following command: $ sudo grep system-db /etc/dconf/profile/user system-db:local Check that graphical settings are locked from nonprivileged user modification using the following command: Note: The example below is using the database "local" for the system, so the path is "/etc/dconf/db/local.d". This path must be modified if a database other than "local" is being used. $ sudo grep -i lock-enabled /etc/dconf/db/local.d/locks/* /org/gnome/desktop/screensaver/lock-enabled If the command does not return at least the example result, this is a finding.

Fix: F-86841r1200104_fix

Configure TOSS 5 to prevent a user from overriding settings for graphical user interfaces. Create a database to contain the systemwide screensaver settings (if it does not already exist) using the following command: Note: The example below is using the database "local" for the system, so if the system is using another database in "/etc/dconf/profile/user", the file should be created under the appropriate subdirectory. $ sudo touch /etc/dconf/db/local.d/locks/session Add the following setting to prevent nonprivileged users from modifying it: /org/gnome/desktop/screensaver/lock-enabled

b
TOSS 5 must have the tmux package installed.
AC-11 - Medium - CCI-000056 - V-282376 - SV-282376r1200108_rule
RMF Control
AC-11
Severity
M
CCI
CCI-000056
Version
TOSS-05-000311
Vuln IDs
  • V-282376
Rule IDs
  • SV-282376r1200108_rule
"tmux" is a terminal multiplexer that enables a number of terminals to be created, accessed, and controlled from a single screen. Red Hat endorses "tmux" as the recommended session controlling package. Satisfies: SRG-OS-000028-GPOS-00009, SRG-OS-000030-GPOS-00011
Checks: C-86937r1200106_chk

Verify TOSS 5 has the "tmux" package installed using the following command: $ sudo dnf list --installed tmux Example output: tmux.x86_64 3.2a-4.el9 If the "tmux" package is not installed, this is a finding.

Fix: F-86842r1200107_fix

Install the "tmux" package using the following command: $ sudo dnf install tmux

b
TOSS 5 must automatically lock graphical user sessions after 10 minutes of inactivity.
AC-11 - Medium - CCI-000057 - V-282377 - SV-282377r1200111_rule
RMF Control
AC-11
Severity
M
CCI
CCI-000057
Version
TOSS-05-000273
Vuln IDs
  • V-282377
Rule IDs
  • SV-282377r1200111_rule
A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not log out because of the temporary nature of the absence. Rather than relying on the user to manually lock their operating system session prior to vacating the vicinity, the GNOME desktop can be configured to identify when a user's session has idled and take action to initiate a session lock. Satisfies: SRG-OS-000029-GPOS-00010, SRG-OS-000031-GPOS-00012
Checks: C-86938r1200109_chk

Verify TOSS 5 initiates a session lock after at most a 10-minute period of inactivity for graphical user interfaces with the following commands: Note: This requirement assumes the use of the TOSS default graphical user interface—Gnome Shell. If the system does not have a graphical user interface installed, this requirement is not applicable. $ sudo gsettings get org.gnome.desktop.session idle-delay uint32 600 If "idle-delay" is set to "0" or a value greater than "600", this is a finding.

Fix: F-86843r1200110_fix

Configure the operating system to initiate a screensaver after a 10-minute period of inactivity for graphical user interfaces. Create a database to contain the systemwide screensaver settings (if it does not already exist) using the following command: $ sudo touch /etc/dconf/db/local.d/00-screensaver Edit "/etc/dconf/db/local.d/00-screensaver" and add or update the following lines: [org/gnome/desktop/session] # Set the lock time out to 600 seconds before the session is considered idle idle-delay=uint32 600 Update the system databases: $ sudo dconf update

b
TOSS 5 must prevent a user from overriding the session idle-delay setting for the graphical user interface.
AC-11 - Medium - CCI-000057 - V-282378 - SV-282378r1200114_rule
RMF Control
AC-11
Severity
M
CCI
CCI-000057
Version
TOSS-05-000274
Vuln IDs
  • V-282378
Rule IDs
  • SV-282378r1200114_rule
A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not log out because of the temporary nature of the absence. Rather than relying on the user to manually lock their operating system session prior to vacating the vicinity, the GNOME desktop can be configured to identify when a user's session has idled and act to initiate the session lock. As such, users should not be allowed to change session settings. Satisfies: SRG-OS-000029-GPOS-00010, SRG-OS-000031-GPOS-00012
Checks: C-86939r1200112_chk

Verify TOSS 5 prevents a user from overriding settings for graphical user interfaces. Note: This requirement assumes the use of the TOSS 5 default graphical user interface—the GNOME desktop environment. If the system does not have a graphical user interface installed, this requirement is not applicable. Determine which profile the system database is using by running the following command: $ sudo grep system-db /etc/dconf/profile/user system-db:local Verify the graphical settings are locked from nonprivileged user modification using the following command: Note: The example below is using the database "local" for the system, so the path is "/etc/dconf/db/local.d". This path must be modified if a database other than "local" is being used. $ sudo grep -i idle /etc/dconf/db/local.d/locks/* /org/gnome/desktop/session/idle-delay If the command does not return at least the example result, this is a finding.

Fix: F-86844r1200113_fix

Configure TOSS 5 to prevent a user from overriding settings for graphical user interfaces. Create a database to contain the systemwide screensaver settings (if it does not already exist) using the following command: Note: The example below is using the database "local" for the system, so if the system is using another database in "/etc/dconf/profile/user", the file should be created under the appropriate subdirectory. $ sudo touch /etc/dconf/db/local.d/locks/session Add the following setting to prevent nonprivileged users from modifying it: /org/gnome/desktop/session/idle-delay

b
TOSS 5 must initiate a session lock for graphical user interfaces when the screensaver is activated.
AC-11 - Medium - CCI-000057 - V-282379 - SV-282379r1200117_rule
RMF Control
AC-11
Severity
M
CCI
CCI-000057
Version
TOSS-05-000275
Vuln IDs
  • V-282379
Rule IDs
  • SV-282379r1200117_rule
A session lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not want to log out because of the temporary nature of the absence.
Checks: C-86940r1200115_chk

Verify TOSS 5 initiates a session lock for graphical user interfaces when the screensaver is activated using the following command: Note: This requirement assumes the use of the TOSS 5 default graphical user interface—the GNOME desktop environment. If the system does not have a graphical user interface installed, this requirement is not applicable. $ gsettings get org.gnome.desktop.screensaver lock-delay uint32 5 If the "uint32" setting is not "5" or less or is missing, this is a finding.

Fix: F-86845r1200116_fix

Configure TOSS 5 to initiate a session lock for graphical user interfaces when a screensaver is activated. Create a database to contain the systemwide screensaver settings (if it does not already exist) using the following command: Note: The example below is using the database "local" for the system, so if the system is using another database in "/etc/dconf/profile/user", the file should be created under the appropriate subdirectory. $ sudo touch /etc/dconf/db/local.d/00-screensaver [org/gnome/desktop/screensaver] lock-delay=uint32 5 The "uint32" must be included along with the integer key values as shown. Update the system databases: $ sudo dconf update

b
TOSS 5 must prevent a user from overriding the session lock-delay setting for the graphical user interface.
AC-11 - Medium - CCI-000057 - V-282380 - SV-282380r1200120_rule
RMF Control
AC-11
Severity
M
CCI
CCI-000057
Version
TOSS-05-000276
Vuln IDs
  • V-282380
Rule IDs
  • SV-282380r1200120_rule
A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not log out because of the temporary nature of the absence. Rather than relying on the user to manually lock their operating system session prior to vacating the vicinity, the GNOME desktop can be configured to identify when a user's session has idled and take action to initiate the session lock. As such, users should not be allowed to change session settings.
Checks: C-86941r1200118_chk

Verify TOSS 5 prevents a user from overriding settings for graphical user interfaces. Note: This requirement assumes the use of the TOSS 5 default graphical user interface—the GNOME desktop environment. If the system does not have a graphical user interface installed, this requirement is not applicable. Determine which profile the system database is using by running the following command: $ sudo grep system-db /etc/dconf/profile/user system-db:local Check that graphical settings are locked from nonprivileged user modification using the following command: Note: The example below is using the database "local" for the system, so the path is "/etc/dconf/db/local.d". This path must be modified if a database other than "local" is being used. $ sudo grep -i lock-delay /etc/dconf/db/local.d/locks/* /org/gnome/desktop/screensaver/lock-delay If the command does not return at least the example result, this is a finding.

Fix: F-86846r1200119_fix

Configure TOSS 5 to prevent a user from overriding settings for graphical user interfaces. Create a database to contain the systemwide screensaver settings (if it does not already exist) using the following command: Note: The example below is using the database "local" for the system, so if the system is using another database in "/etc/dconf/profile/user", the file should be created under the appropriate subdirectory. $ sudo touch /etc/dconf/db/local.d/locks/session Add the following setting to prevent nonprivileged users from modifying it: /org/gnome/desktop/screensaver/lock-delay

b
TOSS 5 must automatically exit interactive command shell user sessions after 15 minutes of inactivity.
AC-11 - Medium - CCI-000057 - V-282381 - SV-282381r1200123_rule
RMF Control
AC-11
Severity
M
CCI
CCI-000057
Version
TOSS-05-000312
Vuln IDs
  • V-282381
Rule IDs
  • SV-282381r1200123_rule
Terminating an idle interactive command shell user session within a short time period reduces the window of opportunity for unauthorized personnel to take control of it when left unattended in a virtual terminal or physical console. Satisfies: SRG-OS-000030-GPOS-00011, SRG-OS-000163-GPOS-00072, SRG-OS-000279-GPOS-00109
Checks: C-86942r1200121_chk

Verify TOSS 5 is configured to exit interactive command shell user sessions after 15 minutes of inactivity or less using the following command: $ sudo grep -i tmout /etc/profile /etc/profile.d/*.sh /etc/profile.d/tmout.sh:declare -xr TMOUT=900 If "TMOUT" is not set to "900" or less in a script located in the "/etc/'profile.d/" directory, is missing or is commented out, this is a finding.

Fix: F-86847r1200122_fix

Configure TOSS 5 to exit interactive command shell user sessions after 15 minutes of inactivity. Add or edit the following line in "/etc/profile.d/tmout.sh": #!/bin/bash declare -xr TMOUT=900

b
TOSS 5 must conceal via the session lock information previously visible on the display with a publicly viewable image.
AC-11 - Medium - CCI-000060 - V-282382 - SV-282382r1200126_rule
RMF Control
AC-11
Severity
M
CCI
CCI-000060
Version
TOSS-05-000277
Vuln IDs
  • V-282382
Rule IDs
  • SV-282382r1200126_rule
Setting the screensaver mode to blank-only conceals the contents of the display from passersby.
Checks: C-86943r1200124_chk

To ensure the screensaver is configured to be blank, run the following command: Note: This requirement assumes the use of the TOSS 5 default graphical user interface—the GNOME desktop environment. If the system does not have a graphical user interface installed, this requirement is not applicable. $ gsettings get org.gnome.desktop.screensaver picture-uri If properly configured, the output should be "''". To ensure that users cannot set the screensaver background, run the following: $ grep picture-uri /etc/dconf/db/local.d/locks/* If properly configured, the output should be "/org/gnome/desktop/screensaver/picture-uri". If it is not set or configured properly, this is a finding.

Fix: F-86848r1200125_fix

Edit the "dconf" settings in the /etc/dconf/db/* location. First, add or update the [org/gnome/desktop/screensaver] section of the "/etc/dconf/db/local.d/00-security-settings" database file and add or update the following lines: [org/gnome/desktop/screensaver] picture-uri='' Add the following line to "/etc/dconf/db/local.d/locks/00-security-settings-lock" to prevent user modification: /org/gnome/desktop/screensaver/picture-uri Update the dconf system databases: $ sudo dconf update

b
TOSS 5 must log SSH connection attempts and failures to the server.
AC-17 - Medium - CCI-000067 - V-282383 - SV-282383r1200129_rule
RMF Control
AC-17
Severity
M
CCI
CCI-000067
Version
TOSS-05-000237
Vuln IDs
  • V-282383
Rule IDs
  • SV-282383r1200129_rule
SSH provides several logging levels with varying amounts of verbosity. "DEBUG" is specifically not recommended, other than strictly for debugging SSH communications, because it provides so much data that it is difficult to identify important security information. "INFO" or "VERBOSE" level are the basic levels that only record SSH user login activity. In many situations, such as Incident Response, it is important to determine when a particular user was active on a system. The logout record can eliminate those users who disconnected, which helps narrow the field.
Checks: C-86944r1200127_chk

Verify TOSS 5 logs SSH connection attempts and failures to the server. Verify what the SSH daemon's "LogLevel" option is set to using the following command: $ sudo /usr/sbin/sshd -dd 2&gt;&amp;1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH '^\s*loglevel' LogLevel VERBOSE If a value of "VERBOSE" is not returned or the line is commented out or missing, this is a finding.

Fix: F-86849r1200128_fix

Configure TOSS 5 to log connection attempts add or modify the following line in "/etc/ssh/sshd_config": LogLevel VERBOSE Restart the SSH daemon for the settings to take effect: $ sudo systemctl restart sshd.service

b
All TOSS 5 remote access methods must be monitored.
AC-17 - Medium - CCI-000067 - V-282384 - SV-282384r1200132_rule
RMF Control
AC-17
Severity
M
CCI
CCI-000067
Version
TOSS-05-000379
Vuln IDs
  • V-282384
Rule IDs
  • SV-282384r1200132_rule
Logging remote access methods can be used to trace the decrease in the risks associated with remote user access management. It can also be used to spot cyberattacks and ensure ongoing compliance with organizational policies surrounding the use of remote access methods.
Checks: C-86945r1200130_chk

Verify TOSS 5 monitors all remote access methods. Check that remote access methods are being logged using the following command: $ grep -rE '(auth.\*|authpriv.\*|daemon.\*)' /etc/rsyslog.conf /etc/rsyslog.conf:authpriv.* If "auth.*", "authpriv.*" or "daemon.*" are not configured to be logged, this is a finding.

Fix: F-86850r1200131_fix

Add or update the following lines to the "/etc/rsyslog.conf" file: auth.*;authpriv.*;daemon.* /var/log/secure Restart the "rsyslog" service for the changes to take effect using the following command: $ sudo systemctl restart rsyslog.service

b
TOSS 5 must force a frequent session key renegotiation for SSH connections to the server.
AC-17 - Medium - CCI-000068 - V-282385 - SV-282385r1200135_rule
RMF Control
AC-17
Severity
M
CCI
CCI-000068
Version
TOSS-05-000247
Vuln IDs
  • V-282385
Rule IDs
  • SV-282385r1200135_rule
Without protection of the transmitted information, confidentiality and integrity may be compromised because unprotected communications can be intercepted and either read or altered. This requirement applies to both internal and external networks and all types of information system components from which information can be transmitted (e.g., servers, mobile devices, notebook computers, printers, copiers, scanners, and facsimile machines). Communication paths outside the physical protection of a controlled boundary are exposed to the possibility of interception and modification. Protecting the confidentiality and integrity of organizational information can be accomplished by physical means (e.g., employing physical distribution systems) or by logical means (e.g., employing cryptographic techniques). If physical means of protection are employed, then logical means (cryptography) do not have to be employed, and vice versa. Session key regeneration limits the chances of a session key becoming compromised. Satisfies: SRG-OS-000033-GPOS-00014, SRG-OS-000423-GPOS-00187, SRG-OS-000424-GPOS-00188
Checks: C-86946r1200133_chk

Verify the SSH server is configured to force frequent session key renegotiation using the following command: $ sudo /usr/sbin/sshd -dd 2&gt;&amp;1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH '^\s*rekeylimit' RekeyLimit 1G 1h If "RekeyLimit" does not have a maximum data amount and maximum time defined, is missing, or is commented out, this is a finding.

Fix: F-86851r1200134_fix

Configure TOSS 5 to force a frequent session key renegotiation for SSH connections to the server by adding or modifying the following line in the "/etc/ssh/sshd_config" file: RekeyLimit 1G 1h Restart the SSH daemon for the settings to take effect. $ sudo systemctl restart sshd.service

c
TOSS 5 IP tunnels must use FIPS 140-3-approved cryptographic algorithms.
AC-17 - High - CCI-000068 - V-282386 - SV-282386r1200138_rule
RMF Control
AC-17
Severity
H
CCI
CCI-000068
Version
TOSS-05-000466
Vuln IDs
  • V-282386
Rule IDs
  • SV-282386r1200138_rule
Overriding the system crypto policy makes the behavior of the Libreswan service violate expectations and makes system configuration more fragmented.
Checks: C-86947r1200136_chk

Verify the IPsec service uses the system crypto policy using the following command: Note: If the IPsec service is not installed, this requirement is not applicable. $ sudo grep include /etc/ipsec.conf /etc/ipsec.d/*.conf /etc/ipsec.conf:include /etc/crypto-policies/back-ends/libreswan.config If the ipsec configuration file does not contain "include /etc/crypto-policies/back-ends/libreswan.config", this is a finding.

Fix: F-86852r1200137_fix

Configure Libreswan to use the system cryptographic policy. Add the following line to "/etc/ipsec.conf": include /etc/crypto-policies/back-ends/libreswan.config

a
TOSS 5 must enable auditing of processes that start prior to the audit daemon.
AU-3 - Low - CCI-000130 - V-282387 - SV-282387r1200141_rule
RMF Control
AU-3
Severity
L
CCI
CCI-000130
Version
TOSS-05-000097
Vuln IDs
  • V-282387
Rule IDs
  • SV-282387r1200141_rule
Without the capability to generate audit records, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. If auditing is enabled late in the startup process, the actions of some startup processes may not be audited. Some audit systems also maintain state information only available if auditing is enabled before a given process is created. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215, SRG-OS-000473-GPOS-00218, SRG-OS-000254-GPOS-00095
Checks: C-86948r1200139_chk

Verify that GRUB 2 is configured to enable auditing of processes that start prior to the audit daemon with the following command: $ sudo grubby --info=ALL | grep audit args="ro crashkernel=auto resume=/dev/mapper/rhel-swap rd.lvm.lv=rhel/root rd.lvm.lv=rhel/swap rhgb quiet fips=1 audit=1 audit_backlog_limit=8192 pti=on If "audit" is not set to "1" or is missing, this is a finding.

Fix: F-86853r1200140_fix

Enable auditing of processes that start prior to the audit daemon with the following command: $ sudo grubby --update-kernel=ALL --args="audit=1" Add or modify the following line in "/etc/default/grub" to ensure the configuration survives kernel updates: GRUB_CMDLINE_LINUX="audit=1"

b
TOSS 5 must audit all uses of the chmod, fchmod, and fchmodat system calls.
AU-3 - Medium - CCI-000130 - V-282388 - SV-282388r1201627_rule
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
TOSS-05-000412
Vuln IDs
  • V-282388
Rule IDs
  • SV-282388r1201627_rule
Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary since these affect performance. The more rules, the bigger the performance hit. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172
Checks: C-86949r1200142_chk

Verify that TOSS 5 is configured to audit the execution of the "chmod", "fchmod", and "fchmodat" system calls with the following command: $ sudo auditctl -l | grep chmod -a always,exit -F arch=b32 -S chmod,fchmod,fchmodat -F auid&gt;=1000 -F auid!=unset -k perm_mod -a always,exit -F arch=b64 -S chmod,fchmod,fchmodat -F auid&gt;=1000 -F auid!=unset -k perm_mod If both the "b32" and "b64" audit rules are not defined for the "chmod", "fchmod", and "fchmodat" system calls, this is a finding.

Fix: F-86854r1201626_fix

Configure TOSS 5 to generate audit records upon successful/unsuccessful attempts to use the "chmod", "fchmod", and "fchmodat" syscalls. Add or update the following rules in "/etc/audit/rules.d/audit.rules": -a always,exit -F arch=b32 -S chmod,fchmod,fchmodat -F auid>=1000 -F auid!=unset -k perm_mod -a always,exit -F arch=b64 -S chmod,fchmod,fchmodat -F auid>=1000 -F auid!=unset -k perm_mod Restart the audit daemon for changes to take effect.

b
TOSS 5 must audit all uses of the chown, fchown, fchownat, and lchown system calls.
AU-3 - Medium - CCI-000130 - V-282389 - SV-282389r1201629_rule
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
TOSS-05-000413
Vuln IDs
  • V-282389
Rule IDs
  • SV-282389r1201629_rule
Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary since these affect performance. The more rules, the bigger the performance hit. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000477-GPOS-00222
Checks: C-86950r1200145_chk

Verify that TOSS 5 is configured to audit the execution of the "chown", "fchown", "fchownat", and "lchown" system calls with the following command: $ sudo auditctl -l | grep chown -a always,exit -F arch=b32 -S chown,fchown,fchownat,lchown -F auid&gt;=1000 -F auid!=unset -k perm_mod -a always,exit -F arch=b64 -S chown,fchown,fchownat,lchown -F auid&gt;=1000 -F auid!=unset -k perm_mod If both the "b32" and "b64" audit rules are not defined for the "chown", "fchown", "fchownat", and "lchown" system calls, this is a finding.

Fix: F-86855r1201628_fix

Configure TOSS 5 to generate audit records upon successful/unsuccessful attempts to use the "chown", "fchown", "fchownat", and "lchown"" system calls. Add or update the following rules in "/etc/audit/rules.d/audit.rules": -a always,exit -F arch=b32 -S chown,fchown,fchownat,lchown -F auid>=1000 -F auid!=unset -k perm_mod -a always,exit -F arch=b64 -S chown,fchown,fchownat,lchown -F auid>=1000 -F auid!=unset -k perm_mod Restart the audit daemon for changes to take effect.

b
TOSS 5 must audit all uses of the setxattr, fsetxattr, lsetxattr, removexattr, fremovexattr, and lremovexattr system calls.
AU-3 - Medium - CCI-000130 - V-282390 - SV-282390r1201503_rule
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
TOSS-05-000414
Vuln IDs
  • V-282390
Rule IDs
  • SV-282390r1201503_rule
Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary since these affect performance. The more rules, the bigger the performance hit. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000477-GPOS-00222
Checks: C-86951r1200148_chk

Verify that TOSS 5 is configured to audit the execution of the "setxattr", "fsetxattr", "lsetxattr", "removexattr", "fremovexattr", and "lremovexattr" system calls with the following command: $ sudo auditctl -l | grep xattr -a always,exit -F arch=b32 -S setxattr,fsetxattr,lsetxattr,removexattr,fremovexattr,lremovexattr -F auid&gt;=1000 -F auid!=unset -k perm_mod -a always,exit -F arch=b64 -S setxattr,fsetxattr,lsetxattr,removexattr,fremovexattr,lremovexattr -F auid&gt;=1000 -F auid!=unset -k perm_mod -a always,exit -F arch=b32 -S setxattr,fsetxattr,lsetxattr,removexattr,fremovexattr,lremovexattr -F auid=0 -k perm_mod -a always,exit -F arch=b64 -S setxattr,fsetxattr,lsetxattr,removexattr,fremovexattr,lremovexattr -F auid=0 -k perm_mod If both the "b32" and "b64" audit rules are not defined for the "chmod", "fchmod", and "fchmodat" system calls "setxattr", "fsetxattr", "lsetxattr", "removexattr", "fremovexattr", and "lremovexattr" system calls, or any of the lines returned are commented out, this is a finding.

Fix: F-86856r1201502_fix

Configure TOSS 5 to audit the execution of the "setxattr", "fsetxattr", "lsetxattr", "removexattr", "fremovexattr", and "lremovexattr" system calls by adding or updating the following lines to "/etc/audit/rules.d/audit.rules": -a always,exit -F arch=b32 -S setxattr,fsetxattr,lsetxattr,removexattr,fremovexattr,lremovexattr -F auid>=1000 -F auid!=unset -k perm_mod -a always,exit -F arch=b64 -S setxattr,fsetxattr,lsetxattr,removexattr,fremovexattr,lremovexattr -F auid>=1000 -F auid!=unset -k perm_mod -a always,exit -F arch=b32 -S setxattr,fsetxattr,lsetxattr,removexattr,fremovexattr,lremovexattr -F auid=0 -k perm_mod -a always,exit -F arch=b64 -S setxattr,fsetxattr,lsetxattr,removexattr,fremovexattr,lremovexattr -F auid=0 -k perm_mod Restart the audit daemon for changes to take effect.

b
TOSS 5 must audit all uses of umount system calls.
AU-3 - Medium - CCI-000130 - V-282391 - SV-282391r1201505_rule
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
TOSS-05-000415
Vuln IDs
  • V-282391
Rule IDs
  • SV-282391r1201505_rule
Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary since these affect performance. The more rules, the bigger the performance hit. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000477-GPOS-00222
Checks: C-86952r1200151_chk

Verify that TOSS 5 is configured to audit the execution of the "umount" command with the following command: $ sudo auditctl -l | grep umount -a always,exit -F path=/usr/bin/umount -F perm=x -F auid&gt;=1000 -F auid!=unset -k privileged-mount If the command does not return an audit rule for "umount" or any of the lines returned are commented out, this is a finding.

Fix: F-86857r1201504_fix

Configure TOSS 5 to generate audit records upon successful/unsuccessful attempts to use the "umount" command by adding or updating the following rules in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/bin/umount -F perm=x -F auid>=1000 -F auid!=unset -k privileged-mount Restart the audit daemon for changes to take effect.

b
TOSS 5 must audit all uses of the chacl command.
AU-3 - Medium - CCI-000130 - V-282392 - SV-282392r1201507_rule
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
TOSS-05-000416
Vuln IDs
  • V-282392
Rule IDs
  • SV-282392r1201507_rule
Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary since these affect performance. The more rules, the bigger the performance hit. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000477-GPOS-00222
Checks: C-86953r1201399_chk

Verify that TOSS 5 is configured to audit the execution of the "chacl" command with the following command: $ sudo auditctl -l | grep chacl -a always,exit -F path=/usr/bin/chacl -F perm=x -F auid&gt;=1000 -F auid!=unset -k perm_mod If the command does not return a line or the line is commented out, this is a finding.

Fix: F-86858r1201506_fix

Configure TOSS 5 to generate audit records upon successful/unsuccessful attempts to use the "chacl" command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/bin/chacl -F perm=x -F auid>=1000 -F auid!=unset -k perm_mod Restart the audit daemon for changes to take effect.

b
TOSS 5 must audit all uses of the setfacl command.
AU-3 - Medium - CCI-000130 - V-282393 - SV-282393r1201509_rule
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
TOSS-05-000417
Vuln IDs
  • V-282393
Rule IDs
  • SV-282393r1201509_rule
Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary since these affect performance. The more rules, the bigger the performance hit. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000477-GPOS-00222
Checks: C-86954r1201402_chk

Verify that TOSS 5 is configured to audit the execution of the "setfacl" command with the following command: $ sudo auditctl -l | grep setfacl -a always,exit -F path=/usr/bin/setfacl -F perm=x -F auid&gt;=1000 -F auid!=unset -k perm_mod If the command does not return a line or the line is commented out, this is a finding.

Fix: F-86859r1201508_fix

Configure TOSS 5 to generate audit records upon successful/unsuccessful attempts to use the "setfacl" command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/bin/setfacl -F perm=x -F auid>=1000 -F auid!=unset -k perm_mod Restart the audit daemon for changes to take effect.

b
TOSS 5 must audit all uses of the chcon command.
AU-3 - Medium - CCI-000130 - V-282394 - SV-282394r1201511_rule
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
TOSS-05-000418
Vuln IDs
  • V-282394
Rule IDs
  • SV-282394r1201511_rule
Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary since these affect performance. The more rules, the bigger the performance hit. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000477-GPOS-00222
Checks: C-86955r1201405_chk

Verify that TOSS 5 is configured to audit the execution of the "chcon" command with the following command: $ sudo auditctl -l | grep chcon -a always,exit -F path=/usr/bin/chcon -F perm=x -F auid&gt;=1000 -F auid!=unset -k perm_mod If the command does not return a line or the line is commented out, this is a finding.

Fix: F-86860r1201510_fix

Configure TOSS 5 to generate audit records upon successful/unsuccessful attempts to use the "chcon" command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/bin/chcon -F perm=x -F auid>=1000 -F auid!=unset -k perm_mod Restart the audit daemon for changes to take effect.

b
TOSS 5 must audit all uses of the semanage command.
AU-3 - Medium - CCI-000130 - V-282395 - SV-282395r1201513_rule
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
TOSS-05-000419
Vuln IDs
  • V-282395
Rule IDs
  • SV-282395r1201513_rule
Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary since these affect performance. The more rules, the bigger the performance hit. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000477-GPOS-00222
Checks: C-86956r1201408_chk

Verify that TOSS 5 is configured to audit the execution of the "semanage" command with the following command: $ sudo auditctl -l | grep semanage -a always,exit -F path=/usr/sbin/semanage -F perm=x -F auid&gt;=1000 -F auid!=unset -k privileged-unix-update If the command does not return a line or the line is commented out, this is a finding.

Fix: F-86861r1201512_fix

Configure TOSS 5 to generate audit records upon successful/unsuccessful attempts to use the "semanage" command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/sbin/semanage -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update Restart the audit daemon for changes to take effect.

b
TOSS 5 must audit all uses of the setfiles command.
AU-3 - Medium - CCI-000130 - V-282396 - SV-282396r1201515_rule
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
TOSS-05-000420
Vuln IDs
  • V-282396
Rule IDs
  • SV-282396r1201515_rule
Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary since these affect performance. The more rules, the bigger the performance hit. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000477-GPOS-00222
Checks: C-86957r1201411_chk

Verify that TOSS 5 is configured to audit the execution of the "setfiles" command with the following command: $ sudo auditctl -l | grep setfiles -a always,exit -F path=/usr/sbin/setfiles -F perm=x -F auid&gt;=1000 -F auid!=unset -k privileged-unix-update If the command does not return a line or the line is commented out, this is a finding.

Fix: F-86862r1201514_fix

Configure TOSS 5 to generate audit records upon successful/unsuccessful attempts to use the "setfiles" command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/sbin/setfiles -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update Restart the audit daemon for changes to take effect.

b
TOSS 5 must audit all uses of the setsebool command.
AU-3 - Medium - CCI-000130 - V-282397 - SV-282397r1201517_rule
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
TOSS-05-000421
Vuln IDs
  • V-282397
Rule IDs
  • SV-282397r1201517_rule
Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary since these affect performance. The more rules, the bigger the performance hit. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000477-GPOS-00222
Checks: C-86958r1201414_chk

Verify that TOSS 5 is configured to audit the execution of the "setsebool" command with the following command: $ sudo auditctl -l | grep setsebool -a always,exit -F path=/usr/sbin/setsebool -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged If the command does not return a line or the line is commented out, this is a finding.

Fix: F-86863r1201516_fix

Configure TOSS 5 to generate an audit event for any successful/unsuccessful use of the "setsebool " command by adding or updating the following rules in the "/etc/audit/rules.d/audit.rules" file: -a always,exit -F path=/usr/sbin/setsebool -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged Restart the audit daemon for changes to take effect.

b
TOSS 5 must audit all uses of the rename, unlink, rmdir, renameat, and unlinkat system calls.
AU-3 - Medium - CCI-000130 - V-282398 - SV-282398r1201519_rule
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
TOSS-05-000422
Vuln IDs
  • V-282398
Rule IDs
  • SV-282398r1201519_rule
Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary since these affect performance. The more rules, the bigger the performance hit. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000477-GPOS-00222
Checks: C-86959r1200172_chk

Verify that TOSS 5 is configured to audit successful/unsuccessful attempts to use the "rename", "unlink", "rmdir", "renameat", and "unlinkat" system calls with the following command: $ sudo auditctl -l | grep 'rename\|unlink\|rmdir' -a always,exit -F arch=b32 -S rename,unlink,rmdir,renameat,unlinkat -F auid&gt;=1000 -F auid!=unset -k delete -a always,exit -F arch=b64 -S rename,unlink,rmdir,renameat,unlinkat -F auid&gt;=1000 -F auid!=unset -k delete If the command does not return an audit rule for "rename", "unlink", "rmdir", "renameat", and "unlinkat" or any of the lines returned are commented out, this is a finding.

Fix: F-86864r1201518_fix

Configure TOSS 5 to generate an audit event for any successful/unsuccessful use of the "rename", "unlink", "rmdir", "renameat", and "unlinkat" system calls by adding or updating the following rules in the "/etc/audit/rules.d/audit.rules" file: -a always,exit -F arch=b32 -S rename,unlink,rmdir,renameat,unlinkat -F auid>=1000 -F auid!=unset -k delete -a always,exit -F arch=b64 -S rename,unlink,rmdir,renameat,unlinkat -F auid>=1000 -F auid!=unset -k delete Restart the audit daemon for changes to take effect.

b
TOSS 5 must audit all uses of the truncate, ftruncate, creat, open, openat, and open_by_handle_at system calls.
AU-3 - Medium - CCI-000130 - V-282399 - SV-282399r1201521_rule
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
TOSS-05-000423
Vuln IDs
  • V-282399
Rule IDs
  • SV-282399r1201521_rule
Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary since these affect performance. The more rules, the bigger the performance hit. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000477-GPOS-00222
Checks: C-86960r1200175_chk

Verify that TOSS 5 is configured to audit successful/unsuccessful attempts to use the "truncate", "ftruncate", "creat", "open", "openat", and "open_by_handle_at" system calls with the following command: $ sudo auditctl -l | grep 'open\|truncate\|creat' -a always,exit -F arch=b32 -S truncate,ftruncate,creat,open,openat,open_by_handle_at -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -k perm_access -a always,exit -F arch=b64 -S truncate,ftruncate,creat,open,openat,open_by_handle_at -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -k perm_access -a always,exit -F arch=b32 -S truncate,ftruncate,creat,open,openat,open_by_handle_at -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -k perm_access -a always,exit -F arch=b64 -S truncate,ftruncate,creat,open,openat,open_by_handle_at -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -k perm_access If the output does not produce rules containing "-F exit=-EPERM", this is a finding. If the output does not produce rules containing "-F exit=-EACCES", this is a finding. If the command does not return an audit rule for "truncate", "ftruncate", "creat", "open", "openat", and "open_by_handle_at" or any of the lines returned are commented out, this is a finding.

Fix: F-86865r1201520_fix

Configure TOSS 5 to generate an audit event for any successful/unsuccessful use of the "truncate", "ftruncate", "creat", "open", "openat", and "open_by_handle_at" system calls by adding or updating the following rules in the "/etc/audit/rules.d/audit.rules" file: -a always,exit -F arch=b32 -S truncate,ftruncate,creat,open,openat,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -k perm_access -a always,exit -F arch=b64 -S truncate,ftruncate,creat,open,openat,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -k perm_access -a always,exit -F arch=b32 -S truncate,ftruncate,creat,open,openat,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -k perm_access -a always,exit -F arch=b64 -S truncate,ftruncate,creat,open,openat,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -k perm_access Restart the audit daemon for changes to take effect.

b
TOSS 5 must audit all uses of the delete_module system call.
AU-3 - Medium - CCI-000130 - V-282400 - SV-282400r1201523_rule
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
TOSS-05-000424
Vuln IDs
  • V-282400
Rule IDs
  • SV-282400r1201523_rule
Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary since these affect performance. The more rules, the bigger the performance hit. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000477-GPOS-00222
Checks: C-86961r1200178_chk

Verify that TOSS 5 is configured to audit the execution of the "delete_module" system call with the following command: $ sudo auditctl -l | grep delete_module -a always,exit -F arch=b32 -S delete_module -F auid&gt;=1000 -F auid!=unset -k module_chng -a always,exit -F arch=b64 -S delete_module -F auid&gt;=1000 -F auid!=unset -k module_chng If both the "b32" and "b64" audit rules are not defined for the "delete_module" system call, or any of the lines returned are commented out, this is a finding.

Fix: F-86866r1201522_fix

Configure TOSS 5 to generate an audit event for any successful/unsuccessful use of the "delete_module" system call by adding or updating the following rules in the "/etc/audit/rules.d/audit.rules" file: -a always,exit -F arch=b32 -S delete_module -F auid>=1000 -F auid!=unset -k module_chng -a always,exit -F arch=b64 -S delete_module -F auid>=1000 -F auid!=unset -k module_chng Restart the audit daemon for changes to take effect.

b
TOSS 5 must audit all uses of the init_module and finit_module system calls.
AU-3 - Medium - CCI-000130 - V-282401 - SV-282401r1201525_rule
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
TOSS-05-000425
Vuln IDs
  • V-282401
Rule IDs
  • SV-282401r1201525_rule
Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary since these affect performance. The more rules, the bigger the performance hit. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000477-GPOS-00222
Checks: C-86962r1200181_chk

Verify that TOSS 5 is configured to audit the execution of the "init_module" and "finit_module" system calls with the following command: $ sudo auditctl -l | grep init_module -a always,exit -F arch=b32 -S init_module,finit_module -F auid&gt;=1000 -F auid!=unset -k module_chng -a always,exit -F arch=b64 -S init_module,finit_module -F auid&gt;=1000 -F auid!=unset -k module_chng If both the "b32" and "b64" audit rules are not defined for the "delete_module" system call, or any of the lines returned are commented out, this is a finding.

Fix: F-86867r1201524_fix

Configure TOSS 5 to generate an audit event for any successful/unsuccessful use of the "init_module" and "finit_module" system calls by adding or updating the following rules in the "/etc/audit/rules.d/audit.rules" file: -a always,exit -F arch=b32 -S init_module,finit_module -F auid>=1000 -F auid!=unset -k module_chng -a always,exit -F arch=b64 -S init_module,finit_module -F auid>=1000 -F auid!=unset -k module_chng Restart the audit daemon for changes to take effect.

b
TOSS 5 must audit all uses of the chage command.
AU-3 - Medium - CCI-000130 - V-282402 - SV-282402r1201527_rule
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
TOSS-05-000426
Vuln IDs
  • V-282402
Rule IDs
  • SV-282402r1201527_rule
Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary since these affect performance. The more rules, the bigger the performance hit. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000477-GPOS-00222
Checks: C-86963r1201425_chk

Verify that TOSS 5 is configured to audit the execution of the "chage" command with the following command: $ sudo auditctl -l | grep chage -a always,exit -F path=/usr/bin/chage -F perm=x -F auid&gt;=1000 -F auid!=unset -k privileged-chage If the command does not return a line or the line is commented out, this is a finding.

Fix: F-86868r1201526_fix

Configure TOSS 5 to generate audit records upon successful/unsuccessful attempts to use the "chage" command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/bin/chage -F perm=x -F auid>=1000 -F auid!=unset -k privileged-chage Restart the audit daemon for changes to take effect.

b
TOSS 5 must audit all uses of the chsh command.
AU-3 - Medium - CCI-000130 - V-282403 - SV-282403r1201529_rule
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
TOSS-05-000427
Vuln IDs
  • V-282403
Rule IDs
  • SV-282403r1201529_rule
Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary since these affect performance. The more rules, the bigger the performance hit. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000477-GPOS-00222
Checks: C-86964r1201428_chk

Verify that TOSS 5 is configured to audit the execution of the "chsh" command with the following command: $ sudo auditctl -l | grep chsh -a always,exit -F path=/usr/bin/chsh -F perm=x -F auid&gt;=1000 -F auid!=unset -k priv_cmd If the command does not return a line or the line is commented out, this is a finding.

Fix: F-86869r1201528_fix

Configure TOSS 5 to generate audit records upon successful/unsuccessful attempts to use the "chsh" command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/bin/chsh -F perm=x -F auid>=1000 -F auid!=unset -k priv_cmd Restart the audit daemon for changes to take effect.

b
TOSS 5 must audit all uses of the crontab command.
AU-3 - Medium - CCI-000130 - V-282404 - SV-282404r1201531_rule
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
TOSS-05-000428
Vuln IDs
  • V-282404
Rule IDs
  • SV-282404r1201531_rule
Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary since these affect performance. The more rules, the bigger the performance hit. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000477-GPOS-00222
Checks: C-86965r1201431_chk

Verify that TOSS 5 is configured to audit the execution of the "crontab" command with the following command: $ sudo auditctl -l | grep crontab -a always,exit -F path=/usr/bin/crontab -F perm=x -F auid&gt;=1000 -F auid!=unset -k privileged-crontab If the command does not return a line or the line is commented out, this is a finding.

Fix: F-86870r1201530_fix

Configure TOSS 5 to generate audit records upon successful/unsuccessful attempts to use the "crontab" command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/bin/crontab -F perm=x -F auid>=1000 -F auid!=unset -k privileged-crontab Restart the audit daemon for changes to take effect.

b
TOSS 5 must audit all uses of the gpasswd command.
AU-3 - Medium - CCI-000130 - V-282405 - SV-282405r1201533_rule
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
TOSS-05-000429
Vuln IDs
  • V-282405
Rule IDs
  • SV-282405r1201533_rule
Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary since these affect performance. The more rules, the bigger the performance hit. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000477-GPOS-00222
Checks: C-86966r1201434_chk

Verify that TOSS 5 is configured to audit the execution of the "gpasswd" command with the following command: $ sudo auditctl -l | grep gpasswd -a always,exit -F path=/usr/bin/gpasswd -F perm=x -F auid&gt;=1000 -F auid!=unset -k privileged-gpasswd If the command does not return a line or the line is commented out, this is a finding.

Fix: F-86871r1201532_fix

Configure TOSS 5 to generate audit records upon successful/unsuccessful attempts to use the "gpasswd" command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/bin/gpasswd -F perm=x -F auid>=1000 -F auid!=unset -k privileged-gpasswd Restart the audit daemon for changes to take effect.

b
TOSS 5 must audit all uses of the kmod command.
AU-3 - Medium - CCI-000130 - V-282406 - SV-282406r1201535_rule
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
TOSS-05-000430
Vuln IDs
  • V-282406
Rule IDs
  • SV-282406r1201535_rule
Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary since these affect performance. The more rules, the bigger the performance hit. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000477-GPOS-00222
Checks: C-86967r1201437_chk

Verify that TOSS 5 is configured to audit the execution of the "kmod" command with the following command: $ sudo auditctl -l | grep kmod -a always,exit -F path=/usr/bin/kmod -F perm=x -F auid&gt;=1000 -F auid!=unset -k modules If the command does not return a line or the line is commented out, this is a finding.

Fix: F-86872r1201534_fix

Configure TOSS 5 to generate audit records upon successful/unsuccessful attempts to use the "kmod" command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/bin/kmod -F perm=x -F auid>=1000 -F auid!=unset -k modules Restart the audit daemon for changes to take effect.

b
TOSS 5 must audit all uses of the newgrp command.
AU-3 - Medium - CCI-000130 - V-282407 - SV-282407r1201537_rule
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
TOSS-05-000431
Vuln IDs
  • V-282407
Rule IDs
  • SV-282407r1201537_rule
Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary since these affect performance. The more rules, the bigger the performance hit. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000477-GPOS-00222
Checks: C-86968r1201440_chk

Verify that TOSS 5 is configured to audit the execution of the "newgrp" command with the following command: $ sudo auditctl -l | grep newgrp -a always,exit -F path=/usr/bin/newgrp -F perm=x -F auid&gt;=1000 -F auid!=unset -k priv_cmd If the command does not return a line or the line is commented out, this is a finding.

Fix: F-86873r1201536_fix

Configure TOSS 5 to generate audit records upon successful/unsuccessful attempts to use the "newgrp" command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/bin/newgrp -F perm=x -F auid>=1000 -F auid!=unset -k priv_cmd Restart the audit daemon for changes to take effect.

b
TOSS 5 must audit all uses of the pam_timestamp_check command.
AU-3 - Medium - CCI-000130 - V-282408 - SV-282408r1201539_rule
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
TOSS-05-000432
Vuln IDs
  • V-282408
Rule IDs
  • SV-282408r1201539_rule
Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary since these affect performance. The more rules, the bigger the performance hit. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000477-GPOS-00222
Checks: C-86969r1201443_chk

Verify that TOSS 5 is configured to audit the execution of the "pam_timestamp_check" command with the following command: $ sudo auditctl -l | grep timestamp -a always,exit -F path=/usr/sbin/pam_timestamp_check -F perm=x -F auid&gt;=1000 -F auid!=unset -k privileged-pam_timestamp_check If the command does not return a line or the line is commented out, this is a finding.

Fix: F-86874r1201538_fix

Configure TOSS 5 to generate audit records upon successful/unsuccessful attempts to use the "pam_timestamp_check" command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/sbin/pam_timestamp_check -F perm=x -F auid>=1000 -F auid!=unset -k privileged-pam_timestamp_check Restart the audit daemon for changes to take effect.

b
TOSS 5 must audit all uses of the passwd command.
AU-3 - Medium - CCI-000130 - V-282409 - SV-282409r1201541_rule
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
TOSS-05-000433
Vuln IDs
  • V-282409
Rule IDs
  • SV-282409r1201541_rule
Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary since these affect performance. The more rules, the bigger the performance hit. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000477-GPOS-00222
Checks: C-86970r1201446_chk

Verify TOSS 5 generates audit records for all account creations, modifications, disabling, and termination events that affect "/etc/gshadow" with the following command: $ sudo auditctl -l | egrep '(/usr/bin/passwd)' -a always,exit -F path=/usr/bin/passwd -F perm=x -F auid&gt;=1000 -F auid!=unset -k privileged-passwd If the command does not return a line or the line is commented out, this is a finding.

Fix: F-86875r1201540_fix

Configure TOSS 5 to generate audit records upon successful/unsuccessful attempts to use the "passwd" command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/bin/passwd -F perm=x -F auid>=1000 -F auid!=unset -k privileged-passwd Restart the audit daemon for changes to take effect.

b
TOSS 5 must audit all uses of the postdrop command.
AU-3 - Medium - CCI-000130 - V-282410 - SV-282410r1201543_rule
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
TOSS-05-000434
Vuln IDs
  • V-282410
Rule IDs
  • SV-282410r1201543_rule
Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary since these affect performance. The more rules, the bigger the performance hit. The performance can be helped however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000477-GPOS-00222
Checks: C-86971r1201449_chk

Verify that TOSS 5 is configured to audit the execution of the "postdrop" command with the following command: $ sudo auditctl -l | grep postdrop -a always,exit -F path=/usr/sbin/postdrop -F perm=x -F auid&gt;=1000 -F auid!=unset -k privileged-unix-update If the command does not return a line or the line is commented out, this is a finding.

Fix: F-86876r1201542_fix

Configure TOSS 5 to generate audit records upon successful/unsuccessful attempts to use the "postdrop" command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/sbin/postdrop -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update Restart the audit daemon for changes to take effect.

b
TOSS 5 must audit all uses of the postqueue command.
AU-3 - Medium - CCI-000130 - V-282411 - SV-282411r1201545_rule
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
TOSS-05-000435
Vuln IDs
  • V-282411
Rule IDs
  • SV-282411r1201545_rule
Without generating audit record specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary since these affect performance. The more rules, the bigger the performance hit. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000477-GPOS-00222
Checks: C-86972r1201452_chk

Verify that TOSS 5 is configured to audit the execution of the "postqueue" command with the following command: $ sudo auditctl -l | grep postqueue -a always,exit -F path=/usr/sbin/postqueue -F perm=x -F auid&gt;=1000 -F auid!=unset -k privileged-unix-update If the command does not return a line or the line is commented out, this is a finding.

Fix: F-86877r1201544_fix

Configure TOSS 5 to generate audit records upon successful/unsuccessful attempts to use the "postqueue" command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/sbin/postqueue -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update Restart the audit daemon for changes to take effect.

b
TOSS 5 must audit all uses of the ssh-agent command.
AU-3 - Medium - CCI-000130 - V-282412 - SV-282412r1201547_rule
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
TOSS-05-000436
Vuln IDs
  • V-282412
Rule IDs
  • SV-282412r1201547_rule
Without generating audit record specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary since these affect performance. The more rules, the bigger the performance hit. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000477-GPOS-00222
Checks: C-86973r1201455_chk

Verify that TOSS 5 is configured to audit the execution of the "ssh-agent" command with the following command: $ sudo auditctl -l | grep ssh-agent -a always,exit -F path=/usr/bin/ssh-agent -F perm=x -F auid&gt;=1000 -F auid!=unset -k privileged-ssh If the command does not return a line or the line is commented out, this is a finding.

Fix: F-86878r1201546_fix

Configure TOSS 5 to generate audit records upon successful/unsuccessful attempts to use the "ssh-agent" command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/bin/ssh-agent -F perm=x -F auid>=1000 -F auid!=unset -k privileged-ssh Restart the audit daemon for changes to take effect.

b
TOSS 5 must audit all uses of the ssh-keysign command.
AU-3 - Medium - CCI-000130 - V-282413 - SV-282413r1201549_rule
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
TOSS-05-000437
Vuln IDs
  • V-282413
Rule IDs
  • SV-282413r1201549_rule
Without generating audit record specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary since these affect performance. The more rules, the bigger the performance hit. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000477-GPOS-00222
Checks: C-86974r1201458_chk

Verify that TOSS 5 is configured to audit the execution of the "ssh-keysign" command with the following command: $ sudo auditctl -l | grep ssh-keysign -a always,exit -F path=/usr/libexec/openssh/ssh-keysign -F perm=x -F auid&gt;=1000 -F auid!=unset -k privileged-ssh If the command does not return a line or the line is commented out, this is a finding.

Fix: F-86879r1201548_fix

Configure TOSS 5 to generate audit records upon successful/unsuccessful attempts to use the "ssh-keysign" command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/libexec/openssh/ssh-keysign -F perm=x -F auid>=1000 -F auid!=unset -k privileged-ssh Restart the audit daemon for changes to take effect.

b
TOSS 5 must audit all uses of the su command.
AU-3 - Medium - CCI-000130 - V-282414 - SV-282414r1201551_rule
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
TOSS-05-000438
Vuln IDs
  • V-282414
Rule IDs
  • SV-282414r1201551_rule
Without generating audit record specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary since these affect performance. The more rules, the bigger the performance hit. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000477-GPOS-00222
Checks: C-86975r1201461_chk

Verify that TOSS 5 is configured to audit the execution of the "su" command with the following command: $ sudo auditctl -l | grep /usr/bin/su -a always,exit -F path=/usr/bin/su -F perm=x -F auid&gt;=1000 -F auid!=unset -k privileged-priv_change If the command does not return a line or the line is commented out, this is a finding.

Fix: F-86880r1201550_fix

Configure TOSS 5 to generate audit records upon successful/unsuccessful attempts to use the "su" command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/bin/su -F perm=x -F auid>=1000 -F auid!=unset -k privileged-priv_change Restart the audit daemon for changes to take effect.

b
TOSS 5 must audit all uses of the sudo command.
AU-3 - Medium - CCI-000130 - V-282415 - SV-282415r1201553_rule
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
TOSS-05-000439
Vuln IDs
  • V-282415
Rule IDs
  • SV-282415r1201553_rule
Without generating audit record specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary since these affect performance. The more rules, the bigger the performance hit. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000477-GPOS-00222
Checks: C-86976r1201464_chk

Verify that TOSS 5 is configured to audit the execution of the "sudo" command with the following command: $ sudo auditctl -l | grep /usr/bin/sudo -a always,exit -F path=/usr/bin/sudo -F perm=x -F auid&gt;=1000 -F auid!=unset -k priv_cmd If the command does not return a line or the line is commented out, this is a finding.

Fix: F-86881r1201552_fix

Configure TOSS 5 to generate audit records upon successful/unsuccessful attempts to use the "sudo" command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/bin/sudo -F perm=x -F auid>=1000 -F auid!=unset -k priv_cmd Restart the audit daemon for changes to take effect.

b
TOSS 5 must audit all uses of the sudoedit command.
AU-3 - Medium - CCI-000130 - V-282416 - SV-282416r1201555_rule
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
TOSS-05-000440
Vuln IDs
  • V-282416
Rule IDs
  • SV-282416r1201555_rule
Without generating audit record specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary since these affect performance. The more rules, the bigger the performance hit. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000477-GPOS-00222
Checks: C-86977r1201467_chk

Verify that TOSS 5 is configured to audit the execution of the "sudoedit" command with the following command: $ sudo auditctl -l | grep /usr/bin/sudoedit -a always,exit -F path=/usr/bin/sudoedit -F perm=x -F auid&gt;=1000 -F auid!=unset -k priv_cmd If the command does not return a line or the line is commented out, this is a finding.

Fix: F-86882r1201554_fix

Configure TOSS 5 to generate audit records upon successful/unsuccessful attempts to use the "sudoedit" command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/bin/sudoedit -F perm=x -F auid>=1000 -F auid!=unset -k priv_cmd Restart the audit daemon for changes to take effect.

b
TOSS 5 must audit all uses of the unix_chkpwd command.
AU-3 - Medium - CCI-000130 - V-282417 - SV-282417r1201557_rule
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
TOSS-05-000441
Vuln IDs
  • V-282417
Rule IDs
  • SV-282417r1201557_rule
Without generating audit record specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary since these affect performance. The more rules, the bigger the performance hit. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000477-GPOS-00222
Checks: C-86978r1201470_chk

Verify that TOSS 5 is configured to audit the execution of the "unix_chkpwd" command with the following command: $ sudo auditctl -l | grep unix_chkpwd -a always,exit -F path=/usr/sbin/unix_chkpwd -F perm=x -F auid&gt;=1000 -F auid!=unset -k privileged-unix-update If the command does not return a line or the line is commented out, this is a finding.

Fix: F-86883r1201556_fix

Configure TOSS 5 to generate audit records upon successful/unsuccessful attempts to use the "unix_chkpwd" command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/sbin/unix_chkpwd -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update Restart the audit daemon for changes to take effect.

b
TOSS 5 must audit all uses of the unix_update command.
AU-3 - Medium - CCI-000130 - V-282418 - SV-282418r1201559_rule
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
TOSS-05-000442
Vuln IDs
  • V-282418
Rule IDs
  • SV-282418r1201559_rule
Without generating audit record specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary since these affect performance. The more rules, the bigger the performance hit. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000477-GPOS-00222
Checks: C-86979r1201473_chk

Verify that TOSS 5 is configured to audit the execution of the "unix_update" command with the following command: $ sudo auditctl -l | grep unix_update -a always,exit -F path=/usr/sbin/unix_update -F perm=x -F auid&gt;=1000 -F auid!=unset -k privileged-unix-update If the command does not return a line or the line is commented out, this is a finding.

Fix: F-86884r1201558_fix

Configure TOSS 5 to generate audit records upon successful/unsuccessful attempts to use the "unix_update" command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/sbin/unix_update -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update Restart the audit daemon for changes to take effect.

b
TOSS 5 must audit all uses of the userhelper command.
AU-3 - Medium - CCI-000130 - V-282419 - SV-282419r1201561_rule
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
TOSS-05-000443
Vuln IDs
  • V-282419
Rule IDs
  • SV-282419r1201561_rule
Without generating audit record specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary since these affect performance. The more rules, the bigger the performance hit. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000477-GPOS-00222
Checks: C-86980r1201476_chk

Verify that TOSS 5 is configured to audit the execution of the "userhelper" command with the following command: $ sudo auditctl -l | grep userhelper -a always,exit -F path=/usr/sbin/userhelper -F perm=x -F auid&gt;=1000 -F auid!=unset -k privileged-unix-update If the command does not return a line or the line is commented out, this is a finding.

Fix: F-86885r1201560_fix

Configure TOSS 5 to generate audit records upon successful/unsuccessful attempts to use the "userhelper" command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/sbin/userhelper -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update Restart the audit daemon for changes to take effect.

b
TOSS 5 must audit all uses of the usermod command.
AU-3 - Medium - CCI-000130 - V-282420 - SV-282420r1201563_rule
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
TOSS-05-000444
Vuln IDs
  • V-282420
Rule IDs
  • SV-282420r1201563_rule
Without generating audit record specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary since these affect performance. The more rules, the bigger the performance hit. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000477-GPOS-00222
Checks: C-86981r1201479_chk

Verify that TOSS 5 is configured to audit the execution of the "usermod" command with the following command: $ sudo auditctl -l | grep usermod -a always,exit -F path=/usr/sbin/usermod -F perm=x -F auid&gt;=1000 -F auid!=unset -k privileged-usermod If the command does not return a line or the line is commented out, this is a finding.

Fix: F-86886r1201562_fix

Configure TOSS 5 to generate audit records upon successful/unsuccessful attempts to use the "usermod " command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/sbin/usermod -F perm=x -F auid>=1000 -F auid!=unset -k privileged-usermod Restart the audit daemon for changes to take effect.

b
TOSS 5 must audit all uses of the mount command.
AU-3 - Medium - CCI-000130 - V-282421 - SV-282421r1201565_rule
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
TOSS-05-000445
Vuln IDs
  • V-282421
Rule IDs
  • SV-282421r1201565_rule
Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary since these affect performance. The more rules, the bigger the performance hit. The performance can be helped, however, by combining system calls into one rule whenever possible. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000477-GPOS-00222
Checks: C-86982r1201482_chk

Verify that TOSS 5 is configured to audit the execution of the "mount" command with the following command: $ sudo auditctl -l | grep /usr/bin/mount -a always,exit -F path=/usr/bin/mount -F perm=x -F auid&gt;=1000 -F auid!=unset -k privileged-mount If the command does not return a line or the line is commented out, this is a finding.

Fix: F-86887r1201564_fix

Configure TOSS 5 to generate audit records upon successful/unsuccessful attempts to use the "mount" command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/bin/mount -F perm=x -F auid>=1000 -F auid!=unset -k privileged-mount Restart the audit daemon for changes to take effect.

b
Successful/unsuccessful uses of the umount system call in TOSS 5 must generate an audit record.
AU-3 - Medium - CCI-000130 - V-282422 - SV-282422r1201567_rule
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
TOSS-05-000450
Vuln IDs
  • V-282422
Rule IDs
  • SV-282422r1201567_rule
The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications can facilitate the identification of patterns of abuse among both authorized and unauthorized users. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000477-GPOS-00222
Checks: C-86983r1201485_chk

Verify that TOSS 5 generates an audit record for all uses of the "umount" and system call with the following command: $ sudo grep "umount" /etc/audit/audit.* -a always,exit -F arch=b32 -S umount -F auid&gt;=1000 -F auid!=unset -k privileged-umount If the command does not return a line or the line is commented out, this is a finding.

Fix: F-86888r1201566_fix

Configure the audit system to generate an audit event for any successful/unsuccessful use of the "umount" system call by adding or updating the following rules in "/etc/audit/audit.rules" and adding the following rules to "/etc/audit/rules.d/perm_mod.rules" or updating the existing rules in files in the "/etc/audit/rules.d/" directory: -a always,exit -F arch=b32 -S umount -F auid>=1000 -F auid!=unset -k privileged-umount Restart the audit daemon for changes to take effect.

b
Successful/unsuccessful uses of the umount2 system call in TOSS 5 must generate an audit record.
AU-3 - Medium - CCI-000130 - V-282423 - SV-282423r1201569_rule
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
TOSS-05-000451
Vuln IDs
  • V-282423
Rule IDs
  • SV-282423r1201569_rule
The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications can facilitate the identification of patterns of abuse among both authorized and unauthorized users. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000477-GPOS-00222
Checks: C-86984r1200247_chk

To determine if the system is configured to audit calls to the umount2 system call, run the following command: $ sudo grep "umount2" /etc/audit/audit.* If no line is returned, this is a finding.

Fix: F-86889r1201568_fix

Configure the audit system to generate an audit event for any successful/unsuccessful use of the "umount2" system call by adding or updating the following rules in "/etc/audit/audit.rules" and adding the following rules to "/etc/audit/rules.d/perm_mod.rules" or updating the existing rules in files in the "/etc/audit/rules.d/" directory: -a always,exit -F arch=b32 -S umount2 -F auid>=1000 -F auid!=unset -k perm_mod -a always,exit -F arch=b64 -S umount2 -F auid>=1000 -F auid!=unset -k perm_mod Restart the audit daemon for changes to take effect.

b
TOSS 5 must generate audit records for all account creations, modifications, disabling, and termination events that affect /var/log/lastlog.
AU-3 - Medium - CCI-000130 - V-282424 - SV-282424r1201571_rule
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
TOSS-05-000460
Vuln IDs
  • V-282424
Rule IDs
  • SV-282424r1201571_rule
Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000477-GPOS-00222
Checks: C-86985r1201490_chk

Verify TOSS 5 generates audit records for all account creations, modifications, disabling, and termination events that affect "/var/log/lastlog" with the following command: $ sudo auditctl -l | grep /var/log/lastlog -w /var/log/lastlog -p wa -k logins If the command does not return a line or the line is commented out, this is a finding.

Fix: F-86890r1201570_fix

Configure TOSS 5 to generate audit records for all account creations, modifications, disabling, and termination events that affect "/var/log/lastlog". Add or update the following file system rule to "/etc/audit/rules.d/audit.rules": -w /var/log/lastlog -p wa -k logins Restart the audit daemon for changes to take effect.

b
TOSS 5 must label all offloaded audit logs before sending them to the central log server.
AU-3 - Medium - CCI-000132 - V-282425 - SV-282425r1201625_rule
RMF Control
AU-3
Severity
M
CCI
CCI-000132
Version
TOSS-05-000396
Vuln IDs
  • V-282425
Rule IDs
  • SV-282425r1201625_rule
Enriched logging is needed to determine who, what, and when events occur on a system. Without this, determining root cause of an event will be much more difficult. When audit logs are not labeled before they are sent to a central log server, the audit data will not be able to be analyzed and tied back to the correct system.
Checks: C-86986r1200253_chk

Verify that TOSS 5 Audit Daemon is configured to label all offloaded audit logs, with the following command: $ sudo grep name_format /etc/audit/auditd.conf name_format = hostname If the "name_format" option is not "hostname", "fqd", or "numeric", or the line is commented out, this is a finding.

Fix: F-86891r1201624_fix

Edit the /etc/audit/auditd.conf file and add or update the "name_format" option: name_format = hostname Restart the audit daemon for changes to take effect.

b
TOSS 5 must forward mail from postmaster to the root account using a postfix alias.
AU-5 - Medium - CCI-000139 - V-282426 - SV-282426r1200258_rule
RMF Control
AU-5
Severity
M
CCI
CCI-000139
Version
TOSS-05-000209
Vuln IDs
  • V-282426
Rule IDs
  • SV-282426r1200258_rule
It is critical for the appropriate personnel to be aware if a system is at risk of failing to process audit logs as required. Without this notification, the security personnel may be unaware of an impending failure of the audit capability, and system operation may be adversely affected. Audit processing failures include software/hardware errors, failures in the audit capturing mechanisms, and audit storage capacity being reached or exceeded.
Checks: C-86987r1200256_chk

Verify the administrators are notified in the event of an audit processing failure. Verify the "/etc/aliases" file has a defined value for "root". $ sudo grep "postmaster:\s*root$" /etc/aliases If the command does not return a line, or the line is commented out, ask the system administrator to indicate how they and the information systems security officer (ISSO) are notified of an audit process failure. If there is no evidence of the proper personnel being notified of an audit processing failure, this is a finding.

Fix: F-86892r1200257_fix

Configure a valid email address as an alias for the root account. Append the following line to "/etc/aliases": postmaster: root Run the following command: $ sudo newaliases

b
TOSS 5 system administrators (SAs) and/or information system security officer (ISSOs) (at a minimum) must be alerted of an audit processing failure event.
AU-5 - Medium - CCI-000139 - V-282427 - SV-282427r1200261_rule
RMF Control
AU-5
Severity
M
CCI
CCI-000139
Version
TOSS-05-000398
Vuln IDs
  • V-282427
Rule IDs
  • SV-282427r1200261_rule
It is critical for the appropriate personnel to be aware if a system is at risk of failing to process audit logs as required. Without this notification, the security personnel may be unaware of an impending failure of the audit capability, and system operation may be adversely affected. Audit processing failures include software/hardware errors, failures in the audit capturing mechanisms, and audit storage capacity being reached or exceeded. This requirement applies to each audit data storage repository (i.e., distinct information system component where audit records are stored), the centralized audit storage capacity of organizations (i.e., all audit data storage repositories combined), or both. Satisfies: SRG-OS-000046-GPOS-00022, SRG-OS-000343-GPOS-00134
Checks: C-86988r1200259_chk

Verify TOSS 5 is configured to notify the SA and/or ISSO (at a minimum) in the event of an audit processing failure using the following command: $ sudo grep action_mail_acct /etc/audit/auditd.conf action_mail_acct = root If the value of the "action_mail_acct" keyword is not set to "root" and/or other accounts for security personnel, the "action_mail_acct" keyword is missing, or the retuned line is commented out, ask the SA to indicate how they and the ISSO are notified of an audit process failure. If there is no evidence of the proper personnel being notified of an audit processing failure, this is a finding.

Fix: F-86893r1200260_fix

Configure "auditd" service to notify the SA and ISSO in the event of an audit processing failure. Edit the following line in "/etc/audit/auditd.conf" to ensure that administrators are notified via email for those situations: action_mail_acct = root Restart the audit daemon for changes to take effect.

b
TOSS 5 must have mail aliases to notify the information system security officer (ISSO) and system administrator (SA) (at a minimum) in the event of an audit processing failure.
AU-5 - Medium - CCI-000139 - V-282428 - SV-282428r1200264_rule
RMF Control
AU-5
Severity
M
CCI
CCI-000139
Version
TOSS-05-000409
Vuln IDs
  • V-282428
Rule IDs
  • SV-282428r1200264_rule
It is critical for the appropriate personnel to be aware if a system is at risk of failing to process audit logs as required. Without this notification, the security personnel may be unaware of an impending failure of the audit capability, and system operation may be adversely affected. Audit processing failures include software/hardware errors, failures in the audit capturing mechanisms, and audit storage capacity being reached or exceeded. This requirement applies to each audit data storage repository (i.e., distinct information system component where audit records are stored), the centralized audit storage capacity of organizations (i.e., all audit data storage repositories combined), or both.
Checks: C-86989r1200262_chk

Verify TOSS 5 is configured to notify the appropriate interactive users in the event of an audit processing failure. Find the alias maps in use with the following command: $ postconf alias_maps alias_maps = hash:/etc/aliases Query the Postfix alias maps for an alias for the root user with the following command: $ postmap -q root hash:/etc/aliases isso If an alias is not set, this is a finding.

Fix: F-86894r1200263_fix

Edit the aliases map file (by default, /etc/aliases) used by Postfix and configure a root alias (using the user ISSO as an example): root: ISSO Update the aliases database with the command: $ sudo newaliases

b
TOSS 5 must take appropriate action when a critical audit processing failure occurs.
AU-5 - Medium - CCI-000139 - V-282429 - SV-282429r1200267_rule
RMF Control
AU-5
Severity
M
CCI
CCI-000139
Version
TOSS-05-000462
Vuln IDs
  • V-282429
Rule IDs
  • SV-282429r1200267_rule
It is critical for the appropriate personnel to be aware if a system is at risk of failing to process audit logs as required. Without this notification, the security personnel may be unaware of an impending failure of the audit capability, and system operation may be adversely affected. Audit processing failures include software/hardware errors, failures in the audit capturing mechanisms, and audit storage capacity being reached or exceeded.
Checks: C-86990r1200265_chk

Verify the audit service is configured to panic on a critical error using the following command: $ sudo grep "\-f" /etc/audit/audit.rules -f 2 If the value for "-f" is not "2", and availability is not documented as an overriding concern, this is a finding.

Fix: F-86895r1200266_fix

Configure TOSS 5 to shut down when auditing failures occur. Add the following line to the bottom of the "/etc/audit/audit.rules" file: -f 2

b
TOSS 5 must periodically flush audit records to disk to prevent the loss of audit records.
AU-6 - Medium - CCI-000154 - V-282430 - SV-282430r1200270_rule
RMF Control
AU-6
Severity
M
CCI
CCI-000154
Version
TOSS-05-000403
Vuln IDs
  • V-282430
Rule IDs
  • SV-282430r1200270_rule
If option "freq" is not set to a value that requires audit records being written to disk after a threshold number is reached, then audit records may be lost.
Checks: C-86991r1200268_chk

Verify the audit system is configured to flush to disk after every 100 records using the following command: $ sudo grep freq /etc/audit/auditd.conf freq = 100 If "freq" isn't set to a value between "1" and "100", the value is missing, or the line is commented out, this is a finding.

Fix: F-86896r1200269_fix

Configure TOSS 5 to flush audit to disk by adding or updating the following rule in "/etc/audit/auditd.conf": freq = 100 Restart the audit daemon for the changes to take effect.

b
TOSS 5 audit logs must be group-owned by root or by a restricted logging group to prevent unauthorized read access.
AU-9 - Medium - CCI-000162 - V-282431 - SV-282431r1200273_rule
RMF Control
AU-9
Severity
M
CCI
CCI-000162
Version
TOSS-05-000400
Vuln IDs
  • V-282431
Rule IDs
  • SV-282431r1200273_rule
Unauthorized disclosure of audit records can reveal system and configuration data to attackers, thus compromising its confidentiality. Satisfies: SRG-OS-000057-GPOS-00027, SRG-OS-000058-GPOS-00028, SRG-OS-000059-GPOS-00029, SRG-OS-000206-GPOS-00084
Checks: C-86992r1200271_chk

Verify the audit logs are group-owned by "root" or a restricted logging group. First determine if a group other than "root" has been assigned to the audit logs using the following command: $ sudo grep log_group /etc/audit/auditd.conf Determine where the audit logs are stored using the following command: $ sudo grep -iw log_file /etc/audit/auditd.conf log_file = /var/log/audit/audit.log Using the location of the audit log file, determine if the audit log is group-owned by "root" using the following command: $ sudo stat -c "%G %n" /var/log/audit/audit.log root /var/log/audit/audit.log If the audit log is not group-owned by "root" or the configured alternative logging group, this is a finding.

Fix: F-86897r1200272_fix

Change the group of the directory of "/var/log/audit" to be owned by a correct group. Identify the group that is configured to own audit log: $ sudo grep -P '^[ ]*log_group[ ]+=.*$' /etc/audit/auditd.conf Change the ownership to that group: $ sudo chgrp ${GROUP} /var/log/audit

b
TOSS 5 audit log directory must be owned by root to prevent unauthorized read access.
AU-9 - Medium - CCI-000162 - V-282432 - SV-282432r1200276_rule
RMF Control
AU-9
Severity
M
CCI
CCI-000162
Version
TOSS-05-000401
Vuln IDs
  • V-282432
Rule IDs
  • SV-282432r1200276_rule
Unauthorized disclosure of audit records can reveal system and configuration data to attackers, thus compromising its confidentiality. Satisfies: SRG-OS-000057-GPOS-00027, SRG-OS-000058-GPOS-00028, SRG-OS-000059-GPOS-00029, SRG-OS-000206-GPOS-00084
Checks: C-86993r1200274_chk

Verify the audit logs directory is owned by "root". Determine where the audit logs are stored using the following command: $ sudo grep -iw log_file /etc/audit/auditd.conf log_file = /var/log/audit/audit.log Using the location of the audit log file, determine if the audit log directory is owned by "root" using the following command: $ sudo ls -ld /var/log/audit drwx------ 2 root root 23 Jun 11 11:56 /var/log/audit If the audit log directory is not owned by "root", this is a finding.

Fix: F-86898r1200275_fix

Configure the audit log to be protected from unauthorized read access by setting the correct owner as "root" using the following command: $ sudo chown root /var/log/audit

b
TOSS 5 audit logs file must have mode 0600 or less permissive to prevent unauthorized access to the audit log.
AU-9 - Medium - CCI-000162 - V-282433 - SV-282433r1200279_rule
RMF Control
AU-9
Severity
M
CCI
CCI-000162
Version
TOSS-05-000402
Vuln IDs
  • V-282433
Rule IDs
  • SV-282433r1200279_rule
Only authorized personnel should be aware of errors and the details of the errors. Error messages are an indicator of an organization's operational state or can identify the TOSS 5 system or platform. Additionally, Personally Identifiable Information (PII) and operational information must not be revealed through error messages to unauthorized personnel or their designated representatives. The structure and content of error messages must be carefully considered by the organization and development team. The extent to which the information system is able to identify and handle error conditions is guided by organizational policy and operational requirements. Satisfies: SRG-OS-000057-GPOS-00027, SRG-OS-000058-GPOS-00028, SRG-OS-000059-GPOS-00029, SRG-OS-000206-GPOS-00084
Checks: C-86994r1200277_chk

Verify the audit logs have a mode of "0600". Determine where the audit logs are stored using the following command: $ sudo grep -iw log_file /etc/audit/auditd.conf log_file = /var/log/audit/audit.log Using the location of the audit log file, determine if the audit log files as a mode of "0640" using the following command: $ sudo ls -la /var/log/audit/*.log rw-------. 2 root root 237923 Jun 11 11:56 /var/log/audit/audit.log If the audit logs have a mode more permissive than "0600", this is a finding.

Fix: F-86899r1200278_fix

Configure the audit logs to have a mode of "0600" using the following command: Replace "[audit_log_file]" to the correct audit log path, by default this location is "/var/log/audit/audit.log". $ sudo chmod 0600 /var/log/audit/[audit_log_file] Check the group that owns the system audit logs: $ sudo grep -m 1 -q ^log_group /etc/audit/auditd.conf If the "log_group" is not defined or it is set to "root", configure the permissions as follows: $ sudo chmod 0640 $log_file $ sudo chmod 0440 $log_file.* Otherwise, configure the permissions as follows: $ sudo chmod 0600 $log_file $ sudo chmod 0400 $log_file.*

b
TOSS 5 audit system must protect login user identifiers (UIDs) from unauthorized change.
AU-9 - Medium - CCI-000162 - V-282434 - SV-282434r1200282_rule
RMF Control
AU-9
Severity
M
CCI
CCI-000162
Version
TOSS-05-000463
Vuln IDs
  • V-282434
Rule IDs
  • SV-282434r1200282_rule
If modification of login UIDs is not prevented, they can be changed by nonprivileged users and make auditing complicated or impossible. Satisfies: SRG-OS-000057-GPOS-00027, SRG-OS-000058-GPOS-00028, SRG-OS-000059-GPOS-00029, SRG-OS-000462-GPOS-00206, SRG-OS-000475-GPOS-00220
Checks: C-86995r1200280_chk

Verify the audit system prevents unauthorized changes to login UIDs using the following command: $ sudo grep -i immutable /etc/audit/audit.rules --loginuid-immutable If the "--loginuid-immutable" option is not returned in the "/etc/audit/audit.rules", or the line is commented out, this is a finding.

Fix: F-86900r1200281_fix

Configure TOSS 5 auditing to prevent modification of login UIDs once they are set by adding the following line to "/etc/audit/rules.d/audit.rules": --loginuid-immutable Restart the audit daemon for the changes to take effect.

b
TOSS 5 audit system must protect auditing rules from unauthorized change.
AU-9 - Medium - CCI-000162 - V-282435 - SV-282435r1200285_rule
RMF Control
AU-9
Severity
M
CCI
CCI-000162
Version
TOSS-05-000464
Vuln IDs
  • V-282435
Rule IDs
  • SV-282435r1200285_rule
Unauthorized disclosure of audit records can reveal system and configuration data to attackers, thus compromising its confidentiality. Audit information includes all information (e.g., audit records, audit settings, audit reports) needed to successfully audit TOSS 5 system activity. In immutable mode, unauthorized users cannot execute changes to the audit system to potentially hide malicious activity and then put the audit rules back. A system reboot would be noticeable, and a system administrator could then investigate the unauthorized changes. Satisfies: SRG-OS-000057-GPOS-00027, SRG-OS-000058-GPOS-00028, SRG-OS-000059-GPOS-00029
Checks: C-86996r1200283_chk

Verify the audit system prevents unauthorized changes using the following command: $ sudo grep "^\s*[^#]" /etc/audit/audit.rules | tail -1 -e 2 If the audit system is not set to be immutable by adding the "-e 2" option to the end of "/etc/audit/audit.rules", this is a finding.

Fix: F-86901r1200284_fix

Configure the audit system to set the audit rules to be immutable by adding the following line to end of "/etc/audit/rules.d/audit.rules": -e 2 Restart the audit daemon for the changes to take effect.

a
TOSS 5 must enable Linux audit logging for the USBGuard daemon.
AU-12 - Low - CCI-000169 - V-282436 - SV-282436r1200288_rule
RMF Control
AU-12
Severity
L
CCI
CCI-000169
Version
TOSS-05-000287
Vuln IDs
  • V-282436
Rule IDs
  • SV-282436r1200288_rule
Without the capability to generate audit records, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. If auditing is enabled late in the startup process, the actions of some startup processes may not be audited. Some audit systems also maintain state information only available if auditing is enabled before a given process is created. Audit records can be generated from various components within the information system (e.g., module or policy filter). The list of audited events is the set of events for which audits are to be generated. This set of events is typically a subset of the list of all events for which the system can generate audit records. DOD has defined the list of events for which TOSS 5 will provide an audit record generation capability as the following: 1) Successful and unsuccessful attempts to access, modify, or delete privileges, security objects, security levels, or categories of information (e.g., classification levels); 2) Access actions, such as successful and unsuccessful login attempts, privileged activities or other system-level access, starting and ending time for user access to the system, concurrent logins from different workstations, successful and unsuccessful accesses to objects, all program initiations, and all direct access to the information system; 3) All account creations, modifications, disabling, and terminations; and 4) All kernel module load, unload, and restart actions.
Checks: C-86997r1200286_chk

Verify Linux Audit logging is enabled for the USBGuard daemon using the following command: $ sudo grep AuditBackend /etc/usbguard/usbguard-daemon.conf AuditBackend=LinuxAudit If "AuditBackend" is not set to "LinuxAudit", this is a finding.

Fix: F-86902r1200287_fix

Configure TOSS 5 USBGuard AuditBackend to use the audit system. Add or edit the following line in "/etc/usbguard/usbguard-daemon.conf": AuditBackend=LinuxAudit

b
TOSS 5 audit package must be installed.
AU-12 - Medium - CCI-000169 - V-282437 - SV-282437r1200291_rule
RMF Control
AU-12
Severity
M
CCI
CCI-000169
Version
TOSS-05-000386
Vuln IDs
  • V-282437
Rule IDs
  • SV-282437r1200291_rule
Without establishing what type of events occurred, the source of events, where events occurred, and the outcome of events, it would be difficult to establish, correlate, and investigate the events leading up to an outage or attack. Audit record content that may be necessary to satisfy this requirement includes, for example, time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, filenames involved, and access control or flow control rules invoked. Associating event types with detected events in audit logs provides a means of investigating an attack, recognizing resource utilization or capacity thresholds, or identifying an improperly configured TOSS 5 system. Satisfies: SRG-OS-000062-GPOS-00031, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000458-GPOS-00203, SRG-OS-000461-GPOS-00205, SRG-OS-000463-GPOS-00207, SRG-OS-000465-GPOS-00209, SRG-OS-000467-GPOS-00211, SRG-OS-000468-GPOS-00212, SRG-OS-000471-GPOS-00216, SRG-OS-000473-GPOS-00218, SRG-OS-000475-GPOS-00220
Checks: C-86998r1200289_chk

Verify the TOSS 5 audit service package is installed. Check that the audit service package is installed using the following command: $ sudo dnf list --installed audit Example output: audit-3.0.7-101.el9_0.2.x86_64 If the "audit" package is not installed, this is a finding.

Fix: F-86903r1200290_fix

Install the audit service package (if the audit service is not already installed) using the following command: $ sudo dnf install audit

b
TOSS 5 audit service must be enabled.
AU-12 - Medium - CCI-000169 - V-282438 - SV-282438r1200294_rule
RMF Control
AU-12
Severity
M
CCI
CCI-000169
Version
TOSS-05-000387
Vuln IDs
  • V-282438
Rule IDs
  • SV-282438r1200294_rule
Without establishing what type of events occurred, it would be difficult to establish, correlate, and investigate the events leading up to an outage or attack. Ensuring the "auditd" service is active ensures audit records generated by the kernel are appropriately recorded. Additionally, a properly configured audit subsystem ensures that actions of individual system users can be uniquely traced to those users so they can be held accountable for their actions. Satisfies: SRG-OS-000062-GPOS-00031, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220
Checks: C-86999r1200292_chk

Verify the audit service is configured to produce audit records using the following command: $ systemctl status auditd.service auditd.service - Security Auditing Service Loaded:loaded (/usr/lib/systemd/system/auditd.service; enabled; vendor preset: enabled) Active: active (running) since Tues 2022-05-24 12:56:56 EST; 4 weeks 0 days ago If the audit service is not "active" and "running", this is a finding.

Fix: F-86904r1200293_fix

To enable the audit service, run the following command: $ sudo systemctl enable --now auditd

b
The TOSS 5 audit system must audit local events.
AU-12 - Medium - CCI-000169 - V-282439 - SV-282439r1200297_rule
RMF Control
AU-12
Severity
M
CCI
CCI-000169
Version
TOSS-05-000399
Vuln IDs
  • V-282439
Rule IDs
  • SV-282439r1200297_rule
Without establishing what type of events occurred, the source of events, where events occurred, and the outcome of events, it would be difficult to establish, correlate, and investigate the events leading up to an outage or attack. If option "local_events" isn't set to "yes", only events from network will be aggregated.
Checks: C-87000r1200295_chk

Verify the TOSS 5 audit system is configured to audit local events using the following command: $ sudo grep local_events /etc/audit/auditd.conf local_events = yes If "local_events" is not set to "yes", if the command does not return a line, or the line is commented out, this is a finding.

Fix: F-86905r1200296_fix

Configure TOSS 5 to generate audit records for local events by adding or updating the following line in "/etc/audit/auditd.conf": local_events = yes Restart the audit daemon for the changes to take effect.

b
TOSS 5 must allow only the information system security manager (ISSM) (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited.
AU-12 - Medium - CCI-000171 - V-282440 - SV-282440r1200300_rule
RMF Control
AU-12
Severity
M
CCI
CCI-000171
Version
TOSS-05-000406
Vuln IDs
  • V-282440
Rule IDs
  • SV-282440r1200300_rule
Without the capability to restrict the roles and individuals that can select which events are audited, unauthorized personnel may be able to prevent the auditing of critical events. Misconfigured audits may degrade the system's performance by overwhelming the audit log. Misconfigured audits may also make it more difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.
Checks: C-87001r1200298_chk

Verify the files in directory "/etc/audit/rules.d/" and "/etc/audit/auditd.conf" file have a mode of "0640" or less permissive using the following command: # stat -c "%a %n" /etc/audit/rules.d/*.rules 640 /etc/audit/rules.d/audit.rules If the files in the "/etc/audit/rules.d/" directory or the "/etc/audit/auditd.conf" file have a mode more permissive than "0640", this is a finding.

Fix: F-86906r1200299_fix

Configure the files in directory "/etc/audit/rules.d/" and the "/etc/audit/auditd.conf" file to have a mode of "0640" with the following commands: $ sudo chmod 0640 /etc/audit/rules.d/audit.rules $ sudo chmod 0640 /etc/audit/rules.d/[customrulesfile].rules $ sudo chmod 0640 /etc/audit/auditd.conf

b
TOSS 5 /etc/audit/auditd.conf file must have 0640 or less permissive to prevent unauthorized access.
AU-12 - Medium - CCI-000171 - V-282441 - SV-282441r1200303_rule
RMF Control
AU-12
Severity
M
CCI
CCI-000171
Version
TOSS-05-000407
Vuln IDs
  • V-282441
Rule IDs
  • SV-282441r1200303_rule
Without the capability to restrict the roles and individuals that can select which events are audited, unauthorized personnel may be able to prevent the auditing of critical events. Misconfigured audits may degrade the system's performance by overwhelming the audit log. Misconfigured audits may also make it more difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.
Checks: C-87002r1200301_chk

Verify the mode of the "/etc/audit/auditd.conf" file with the command: $ sudo stat -c "%a %n" /etc/audit/auditd.conf 640 /etc/audit/auditd.conf If "/etc/audit/auditd.conf" does not have a mode of "0640", this is a finding.

Fix: F-86907r1200302_fix

Set the mode of the "/etc/audit/auditd.conf" file to "0640" with the command: $ sudo chmod 0640 /etc/audit/auditd.conf

b
TOSS 5, for PKI-based authentication, must validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor.
IA-5 - Medium - CCI-000185 - V-282442 - SV-282442r1200306_rule
RMF Control
IA-5
Severity
M
CCI
CCI-000185
Version
TOSS-05-000366
Vuln IDs
  • V-282442
Rule IDs
  • SV-282442r1200306_rule
Without path validation, an informed trust decision by the relying party cannot be made when presented with any certificate not already explicitly trusted. A trust anchor is an authoritative entity represented via a public key and associated data. It is used in the context of public key infrastructures, X.509 digital certificates, and DNSSEC. When there is a chain of trust, usually the top entity to be trusted becomes the trust anchor; it can be, for example, a Certification Authority (CA). A certification path starts with the subject certificate and proceeds through a number of intermediate certificates up to a trusted root certificate, typically issued by a trusted CA. This requirement verifies that a certification path to an accepted trust anchor is used for certificate validation and that the path includes status information. Path validation is necessary for a relying party to make an informed trust decision when presented with any certificate not already explicitly trusted. Status information for certification paths includes certificate revocation lists or online certificate status protocol responses. Validating the certificate status information is out of scope for this requirement. Satisfies: SRG-OS-000066-GPOS-00034, SRG-OS-000384-GPOS-00167
Checks: C-87003r1200304_chk

If PKI-based authentication is used, verify TOSS 5 has valid certificates by constructing a certification path (which includes status information) to an accepted trust anchor. Check that the system has a valid DOD root CA installed using the following command: Note: If the system does not support PKI authentication, this requirement is not applicable. $ sudo openssl x509 -text -in /etc/sssd/pki/sssd_auth_ca_db.pem Certificate: Data: Version: 3 (0x2) Serial Number: 1 (0x1) Signature Algorithm: sha256WithRSAEncryption Issuer: C = US, O = U.S. Government, OU = DOD, OU = PKI, CN = DOD Root CA 3 Validity Not Before: Mar 20 18:46:41 2012 GMT Not After : Dec 30 18:46:41 2029 GMT Subject: C = US, O = U.S. Government, OU = DOD, OU = PKI, CN = DOD Root CA 3 Subject Public Key Info: Public Key Algorithm: rsaEncryption If the root CA file is not a DOD-issued certificate with a valid date and installed in the "/etc/sssd/pki/sssd_auth_ca_db.pem" location, this is a finding.

Fix: F-86908r1200305_fix

If PKI-based authentication is used, configure TOSS 5 to validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor. Obtain a valid copy of the DOD root CA file from the PKI CA certificate bundle from cyber.mil and copy it into the following file: /etc/sssd/pki/sssd_auth_ca_db.pem

b
TOSS 5, for public key infrastructure (PKI)-based authentication, must enforce authorized access to the corresponding private key.
IA-5 - Medium - CCI-000186 - V-282443 - SV-282443r1200309_rule
RMF Control
IA-5
Severity
M
CCI
CCI-000186
Version
TOSS-05-000074
Vuln IDs
  • V-282443
Rule IDs
  • SV-282443r1200309_rule
If the private key is discovered, an attacker can use it to authenticate as an authorized user and gain access to the network infrastructure. The cornerstone of the PKI is the private key used to encrypt or digitally sign information. If the private key is stolen, this will lead to the compromise of the authentication and nonrepudiation gained through PKI because the attacker can use the private key to digitally sign documents and pretend to be the authorized user. Both the holders of a digital certificate and the issuing authority must protect the computers, storage devices, or whatever they use to keep the private keys.
Checks: C-87004r1200307_chk

If the system does not allow PKI authentication, this requirement is not applicable. Verify the operating system, for PKI-based authentication, enforces authorized access to the corresponding private key. Verify the SSH private key files have a passphrase. For each private key stored on the system, use the following command: $ sudo ssh-keygen -y -f /path/to/file If the contents of the key are displayed, and use of un-passphrased Secure Shell (SSH) keys is not documented with the information system security officer, this is a finding.

Fix: F-86909r1200308_fix

Create a new private and public key pair that uses a passcode using the following command: $ sudo ssh-keygen -n [passphrase]

b
TOSS 5 must map the authenticated identity to the user or group account for PKI-based authentication.
IA-5 - Medium - CCI-000187 - V-282444 - SV-282444r1200312_rule
RMF Control
IA-5
Severity
M
CCI
CCI-000187
Version
TOSS-05-000367
Vuln IDs
  • V-282444
Rule IDs
  • SV-282444r1200312_rule
Without mapping the certificate used to authenticate to the user account, the ability to determine the identity of the individual user or group will not be available for forensic analysis.
Checks: C-87005r1200310_chk

Verify the certificate of the user or group is mapped to the corresponding user or group in the "sssd.conf" file using the following command: $ sudo cat /etc/sssd/sssd.conf [certmap/testing.test/rule_name] matchrule =&lt;SAN&gt;.*EDIPI@mil maprule = (userCertificate;binary={cert!bin}) domains = testing.test If the certmap section does not exist, ask the system administrator (SA) to indicate how certificates are mapped to accounts. If there is no evidence of certificate mapping, this is a finding.

Fix: F-86910r1200311_fix

Configure TOSS 5 to map the authenticated identity to the user or group account by adding or modifying the certmap section of the "/etc/sssd/sssd.conf" file based on the following example: [certmap/testing.test/rule_name] matchrule = .*EDIPI@mil maprule = (userCertificate;binary={cert!bin}) dmains = testing.test Restart the "sssd" service for the changes to take effect. To restart the "sssd" service, run the following command: $ sudo systemctl restart sssd.service

b
TOSS 5 must ensure the password complexity module in the system-auth file is configured for three retries or less.
Medium - CCI-004066 - V-282445 - SV-282445r1200315_rule
RMF Control
Severity
M
CCI
CCI-004066
Version
TOSS-05-000330
Vuln IDs
  • V-282445
Rule IDs
  • SV-282445r1200315_rule
Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. "pwquality" enforces complex password construction configuration and has the ability to limit brute-force attacks on the system. TOSS 5 uses "pwquality" as a mechanism to enforce password complexity. This is set in both: /etc/pam.d/password-auth /etc/pam.d/system-auth By limiting the number of attempts to meet the pwquality module complexity requirements before returning with an error, the system will audit abnormal attempts at password changes.
Checks: C-87006r1200313_chk

Verify TOSS 5 is configured to limit the "pwquality" retry option to "3". Verify the use of the "pwquality" retry option in the "system-auth file" using the following command: $ cat /etc/pam.d/system-auth | grep pam_pwquality password required pam_pwquality.so retry=3 If the value of "retry" is set to "0" or greater than "3", or is missing, this is a finding.

Fix: F-86911r1200314_fix

Configure TOSS 5 to limit the "pwquality" retry option to "3". Add the following line to the "/etc/pam.d/system-auth" file (or modify the line to have the required value): password required pam_pwquality.so retry=3

c
TOSS 5 must ensure the password complexity module is enabled in the password-auth file.
High - CCI-004066 - V-282446 - SV-282446r1200318_rule
RMF Control
Severity
H
CCI
CCI-004066
Version
TOSS-05-000334
Vuln IDs
  • V-282446
Rule IDs
  • SV-282446r1200318_rule
Enabling PAM password complexity permits enforcement of strong passwords and consequently makes the system less prone to dictionary attacks.
Checks: C-87007r1200316_chk

Verify TOSS 5 uses "pwquality" to enforce the password complexity rules in the "password-auth" file using the following command: $ cat /etc/pam.d/password-auth | grep pam_pwquality password required pam_pwquality.so If the command does not return a line containing the value "pam_pwquality.so", or the line is commented out, this is a finding.

Fix: F-86912r1200317_fix

Configure TOSS 5 to use "pwquality" to enforce password complexity rules. Add the following line to the "/etc/pam.d/password-auth" file (or modify the line to have the required value): password required pam_pwquality.so

b
TOSS 5 must enforce password complexity by requiring at least one uppercase character.
Medium - CCI-004066 - V-282447 - SV-282447r1200321_rule
RMF Control
Severity
M
CCI
CCI-004066
Version
TOSS-05-000348
Vuln IDs
  • V-282447
Rule IDs
  • SV-282447r1200321_rule
Using a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that must be tested before the password is compromised. Requiring a minimum number of uppercase characters makes password guessing attacks more difficult by ensuring a larger search space.
Checks: C-87008r1200319_chk

Verify TOSS 5 enforces password complexity by requiring at least one uppercase character. Check the value for "ucredit" using the following command: $ sudo grep ucredit /etc/security/pwquality.conf /etc/security/pwquality.conf/*.conf ucredit = -1 If the value of "ucredit" is a positive number or is commented out, this is a finding.

Fix: F-86913r1200320_fix

Configure TOSS 5 to enforce password complexity by requiring that at least one uppercase character be used by setting the "ucredit" option. Add the following line to /etc/security/pwquality.conf (or modify the line to have the required value): ucredit = -1

b
TOSS 5 must enforce password complexity by requiring that at least one lowercase character be used.
Medium - CCI-004066 - V-282448 - SV-282448r1200324_rule
RMF Control
Severity
M
CCI
CCI-004066
Version
TOSS-05-000339
Vuln IDs
  • V-282448
Rule IDs
  • SV-282448r1200324_rule
Using a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that must be tested before the password is compromised. Requiring a minimum number of lowercase characters makes password guessing attacks more difficult by ensuring a larger search space.
Checks: C-87009r1200322_chk

Verify TOSS 5 enforces password complexity by requiring at least one lowercase character. Check the value for "lcredit" using the following command: $ sudo grep lcredit /etc/security/pwquality.conf /etc/security/pwquality.conf/*.conf /etc/security/pwquality.conf:lcredit = -1 If the value of "lcredit" is a positive number or is commented out, this is a finding.

Fix: F-86914r1200323_fix

Configure TOSS 5 to enforce password complexity by requiring at least one lowercase character be used by setting the "lcredit" option. Add the following line to "/etc/security/pwquality.conf" (or modify the line to have the required value): lcredit = -1

b
TOSS 5 must enforce password complexity by requiring that at least one numeric character be used.
Medium - CCI-004066 - V-282449 - SV-282449r1200327_rule
RMF Control
Severity
M
CCI
CCI-004066
Version
TOSS-05-000340
Vuln IDs
  • V-282449
Rule IDs
  • SV-282449r1200327_rule
Using a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that must be tested before the password is compromised. Requiring digits makes password guessing attacks more difficult by ensuring a larger search space.
Checks: C-87010r1200325_chk

Verify TOSS 5 enforces password complexity by requiring at least one numeric character. Check the value for "dcredit" using the following command: $ sudo grep dcredit /etc/security/pwquality.conf /etc/security/pwquality.conf/*.conf /etc/security/pwquality.conf:dcredit = -1 If the value of "dcredit" is a positive number or is commented out, this is a finding.

Fix: F-86915r1200326_fix

Configure TOSS 5 to enforce password complexity by requiring at least one numeric character be used by setting the "dcredit" option. Add the following line to "/etc/security/pwquality.conf" (or modify the line to have the required value): dcredit = -1

b
TOSS 5 must enforce password complexity rules for the root account.
Medium - CCI-004066 - V-282450 - SV-282450r1200330_rule
RMF Control
Severity
M
CCI
CCI-004066
Version
TOSS-05-000338
Vuln IDs
  • V-282450
Rule IDs
  • SV-282450r1200330_rule
Using a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that must be tested before the password is compromised.
Checks: C-87011r1200328_chk

Verify TOSS 5 enforces password complexity rules for the root account. Check if root user is required to use complex passwords using the following command: $ grep enforce_for_root /etc/security/pwquality.conf /etc/security/pwquality.conf/*.conf /etc/security/pwquality.conf:enforce_for_root If "enforce_for_root" is commented or missing, this is a finding.

Fix: F-86916r1200329_fix

Configure TOSS 5 to enforce password complexity on the root account. Add or update the following line in "/etc/security/pwquality.conf": enforce_for_root

b
TOSS 5 must require users to change at least eight characters when changing passwords.
Medium - CCI-004066 - V-282451 - SV-282451r1200333_rule
RMF Control
Severity
M
CCI
CCI-004066
Version
TOSS-05-000349
Vuln IDs
  • V-282451
Rule IDs
  • SV-282451r1200333_rule
Using a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that must be tested before the password is compromised. Requiring a minimum number of different characters during password changes ensures that newly changed passwords will not resemble previously compromised ones. Note that passwords changed on compromised systems will still be compromised.
Checks: C-87012r1200331_chk

Verify the value of the "difok" option in "/etc/security/pwquality.conf" using the following command: $ sudo grep difok /etc/security/pwquality.conf difok = 8 If the value of "difok" is set to less than "8", or is commented out, this is a finding.

Fix: F-86917r1200332_fix

Configure TOSS 5 to require the change of at least eight of the total number of characters when passwords are changed by setting the "difok" option. Add the following line to "/etc/security/pwquality.conf" (or modify the line to have the required value): difok = 8

b
TOSS 5 must limit the maximum number of repeating characters of the same character class to four when passwords are changed.
Medium - CCI-004066 - V-282452 - SV-282452r1200336_rule
RMF Control
Severity
M
CCI
CCI-004066
Version
TOSS-05-000350
Vuln IDs
  • V-282452
Rule IDs
  • SV-282452r1200336_rule
Using a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password complexity is one factor of several that determines how long it takes to crack a password. The more complex a password, the greater the number of possible combinations that must be tested before the password is compromised.
Checks: C-87013r1200334_chk

Verify the value of the "maxclassrepeat" option in "/etc/security/pwquality.conf" using the following command: $ grep maxclassrepeat /etc/security/pwquality.conf maxclassrepeat = 4 If the value of "maxclassrepeat" is set to "0", more than "4", or is commented out, this is a finding.

Fix: F-86918r1200335_fix

Configure TOSS 5 to require the change of the number of repeating characters of the same character class when passwords are changed by setting the "maxclassrepeat" option. Add the following line to "/etc/security/pwquality.conf" conf (or modify the line to have the required value): maxclassrepeat = 4

b
TOSS 5 must limit the maximum number of repeating characters to three when passwords are changed.
Medium - CCI-004066 - V-282453 - SV-282453r1200339_rule
RMF Control
Severity
M
CCI
CCI-004066
Version
TOSS-05-000351
Vuln IDs
  • V-282453
Rule IDs
  • SV-282453r1200339_rule
Using a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password complexity is one factor of several that determines how long it takes to crack a password. The more complex a password, the greater the number of possible combinations that must be tested before the password is compromised.
Checks: C-87014r1200337_chk

Verify the value of the "maxrepeat" option in "/etc/security/pwquality.conf" using the following command: $ grep maxrepeat /etc/security/pwquality.conf maxrepeat = 3 If the value of "maxrepeat" is set to more than "3", or is commented out, this is a finding.

Fix: F-86919r1200338_fix

Configure TOSS 5 to require changing the number of repeating consecutive characters when passwords are changed by setting the "maxrepeat" option. Add the following line to "/etc/security/pwquality.conf" (or modify the line to have the required value): maxrepeat = 3

b
TOSS 5 must require the change of at least four character classes when passwords are changed.
Medium - CCI-004066 - V-282454 - SV-282454r1200342_rule
RMF Control
Severity
M
CCI
CCI-004066
Version
TOSS-05-000352
Vuln IDs
  • V-282454
Rule IDs
  • SV-282454r1200342_rule
Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password complexity is one factor of several that determines how long it takes to crack a password. The more complex a password, the greater the number of possible combinations that must be tested before the password is compromised.
Checks: C-87015r1200340_chk

Verify the value of the "minclass" option in "/etc/security/pwquality.conf" using the following command: $ grep minclass /etc/security/pwquality.conf minclass = 4 If the value of "minclass" is set to less than "4", or is commented out, this is a finding.

Fix: F-86920r1200341_fix

Configure TOSS 5 to require the change of at least four character classes when passwords are changed by setting the "minclass" option. Add the following line to "/etc/security/pwquality.conf" (or modify the line to have the required value): minclass = 4

b
TOSS 5 password-auth must be configured to use a sufficient number of hashing rounds.
Medium - CCI-004062 - V-282455 - SV-282455r1201382_rule
RMF Control
Severity
M
CCI
CCI-004062
Version
TOSS-05-000336
Vuln IDs
  • V-282455
Rule IDs
  • SV-282455r1201382_rule
Passwords must be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. Passwords encrypted with a weak algorithm are no more protected than if they are kept in plain text. Using more hashing rounds makes password cracking attacks more difficult. Satisfies: SRG-OS-000073-GPOS-00041, SRG-OS-000120-GPOS-00061
Checks: C-87016r1201381_chk

Verify the number of rounds for the password hashing algorithm is configured using the following command: $ sudo grep rounds /etc/pam.d/password-auth password sufficient pam_unix.so sha512 rounds=5000 If a matching line is not returned or "rounds" is less than "5000", this is a finding.

Fix: F-86921r1200344_fix

Configure Red Hat Enterprise Linux 9 to use 5000 hashing rounds for hashing passwords. Add or modify the following line in "/etc/pam.d/password-auth" and set "rounds" to "5000". password sufficient pam_unix.so sha512 rounds=5000

b
TOSS 5 system-auth must be configured to use a sufficient number of hashing rounds.
Medium - CCI-004062 - V-282456 - SV-282456r1201574_rule
RMF Control
Severity
M
CCI
CCI-004062
Version
TOSS-05-000337
Vuln IDs
  • V-282456
Rule IDs
  • SV-282456r1201574_rule
Passwords must be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. Passwords that are encrypted with a weak algorithm are no more protected than if they are kept in plain text. Using more hashing rounds makes password cracking attacks more difficult. Satisfies: SRG-OS-000073-GPOS-00041, SRG-OS-000120-GPOS-00061
Checks: C-87017r1201572_chk

Verify the number of rounds for the password hashing algorithm is configured using the following command: $ sudo grep rounds /etc/pam.d/system-auth password sufficient pam_unix.so sha512 rounds=5000 If a matching line is not returned or "rounds" is less than "5000", this is a finding.

Fix: F-86922r1201573_fix

Configure Red Hat Enterprise Linux 9 to use 5000 hashing rounds for hashing passwords. Add or modify the following line in "/etc/pam.d/system-auth" and set "rounds" to "5000". password sufficient pam_unix.so sha512 rounds=5000'

b
TOSS 5 must be configured so that user and group account administration utilities are configured to store only encrypted representations of passwords.
Medium - CCI-004062 - V-282457 - SV-282457r1200351_rule
RMF Control
Severity
M
CCI
CCI-004062
Version
TOSS-05-000353
Vuln IDs
  • V-282457
Rule IDs
  • SV-282457r1200351_rule
Passwords must be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. Passwords that are encrypted with a weak algorithm are no more protected than if they are kept in plain text. This setting ensures user and group account administration utilities are configured to store only encrypted representations of passwords. Additionally, the "crypt_style" configuration option ensures the use of a strong hashing algorithm that makes password cracking attacks more difficult.
Checks: C-87018r1200349_chk

Verify the user and group account administration utilities are configured to store only encrypted representations of passwords using the following command: # grep crypt /etc/libuser.conf crypt_style = sha512 If the "crypt_style" variable is not set to "sha512", is not in the defaults section, is commented out, or does not exist, this is a finding.

Fix: F-86923r1200350_fix

Configure TOSS 5 to use the SHA-512 algorithm for password hashing. Add or change the following line in the "[default]" section of "/etc/libuser.conf" file: crypt_style = sha512

b
TOSS 5 must be configured to use the shadow file to store only encrypted representations of passwords.
Medium - CCI-004062 - V-282458 - SV-282458r1200354_rule
RMF Control
Severity
M
CCI
CCI-004062
Version
TOSS-05-000354
Vuln IDs
  • V-282458
Rule IDs
  • SV-282458r1200354_rule
Passwords must be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. Passwords that are encrypted with a weak algorithm are no more protected than if they are kept in plain text. This setting ensures user and group account administration utilities are configured to store only encrypted representations of passwords. Additionally, the "crypt_style" configuration option ensures the use of a strong hashing algorithm that makes password cracking attacks more difficult.
Checks: C-87019r1200352_chk

Verify the system's shadow file is configured to store only encrypted representations of passwords with a hash value of "SHA512" using the following command: # grep -i encrypt_method /etc/login.defs ENCRYPT_METHOD SHA512 If "ENCRYPT_METHOD" does not have a value of "SHA512", or the line is commented out, this is a finding.

Fix: F-86924r1200353_fix

Configure TOSS 5 to store only SHA-512 encrypted representations of passwords. Add or update the following line in the "/etc/login.defs" file: ENCRYPT_METHOD SHA512

b
TOSS 5 shadow password suite must be configured to use a sufficient number of hashing rounds.
Medium - CCI-004062 - V-282459 - SV-282459r1200357_rule
RMF Control
Severity
M
CCI
CCI-004062
Version
TOSS-05-000356
Vuln IDs
  • V-282459
Rule IDs
  • SV-282459r1200357_rule
Passwords must be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. Passwords that are encrypted with a weak algorithm are no more protected than if they are kept in plain text. Using more hashing rounds makes password cracking attacks more difficult. Satisfies: SRG-OS-000073-GPOS-00041, SRG-OS-000120-GPOS-00061
Checks: C-87020r1200355_chk

Verify TOSS 5 has a minimum number of hash rounds configured using the following command: $ grep -i sha_crypt /etc/login.defs If "SHA_CRYPT_MIN_ROUNDS" or "SHA_CRYPT_MAX_ROUNDS" is less than "5000", this is a finding.

Fix: F-86925r1200356_fix

Configure TOSS 5 to encrypt all stored passwords with a strong cryptographic hash. Edit/modify the following line in the "/etc/login.defs" file and set "SHA_CRYPT_MIN_ROUNDS" to a value no lower than "5000": SHA_CRYPT_MIN_ROUNDS 5000

b
TOSS 5 must employ FIPS 140-3-approved cryptographic hashing algorithms for all stored passwords.
Medium - CCI-004062 - V-282460 - SV-282460r1200360_rule
RMF Control
Severity
M
CCI
CCI-004062
Version
TOSS-05-000465
Vuln IDs
  • V-282460
Rule IDs
  • SV-282460r1200360_rule
The system must use a strong hashing algorithm to store the password. Passwords must be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. Satisfies: SRG-OS-000073-GPOS-00041, SRG-OS-000120-GPOS-00061
Checks: C-87021r1200358_chk

Verify the interactive user account passwords are using a strong password hash using the following command: $ sudo cut -d: -f2 /etc/shadow $6$kcOnRq/5$NUEYPuyL.wghQwWssXRcLRFiiru7f5JPV6GaJhNC2aK5F3PZpE/BCCtwrxRc/AInKMNX3CdMw11m9STiql12f/ Password hashes "!" or "*" indicate inactive accounts not available for login and are not evaluated. If any interactive user password hash does not begin with "$6", this is a finding.

Fix: F-86926r1200359_fix

Lock all interactive user accounts not using SHA-512 hashing until the passwords can be regenerated with SHA-512.

b
The TOSS 5 pam_unix.so module must be configured in the password-auth file to use a FIPS 140-3-approved cryptographic hashing algorithm for system authentication.
Medium - CCI-004062 - V-282461 - SV-282461r1200363_rule
RMF Control
Severity
M
CCI
CCI-004062
Version
TOSS-05-000467
Vuln IDs
  • V-282461
Rule IDs
  • SV-282461r1200363_rule
Unapproved mechanisms that are used for authentication to the cryptographic module are not verified and; therefore, cannot be relied upon to provide confidentiality or integrity, and DOD data may be compromised. TOSS 5 systems using encryption are required to use FIPS-compliant mechanisms for authenticating to cryptographic modules. FIPS 140-3 is the current standard for validating that mechanisms used to access cryptographic modules use authentication that meets DOD requirements. This allows for Security Levels 1, 2, 3, or 4 for use on a general-purpose computing system.
Checks: C-87022r1200361_chk

Verify the pam_unix.so module is configured to use sha512 in /etc/pam.d/password-auth using the following command: $ grep "^password.*pam_unix.so.*sha512" /etc/pam.d/password-auth password sufficient pam_unix.so sha512 If "sha512" is missing, or the line is commented out, this is a finding.

Fix: F-86927r1200362_fix

Configure TOSS 5 to use a FIPS 140-3-approved cryptographic hashing algorithm for system authentication. Edit or modify the following line in the "/etc/pam.d/password-auth" file to include the sha512 option for pam_unix.so: password sufficient pam_unix.so sha512

b
TOSS 5 must not have the rsh-server package installed.
IA-5 - Medium - CCI-000197 - V-282462 - SV-282462r1200366_rule
RMF Control
IA-5
Severity
M
CCI
CCI-000197
Version
TOSS-05-000038
Vuln IDs
  • V-282462
Rule IDs
  • SV-282462r1200366_rule
Passwords must be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. The rsh-server service provides an unencrypted remote access service that does not provide for the confidentiality and integrity of user passwords or the remote session and has very weak authentication.
Checks: C-87023r1200364_chk

Determine if the rsh-server package is installed using the following command: $ sudo yum list installed rsh-server If the rsh-server package is installed, this is a finding.

Fix: F-86928r1200365_fix

Configure the operating system to disable nonessential capabilities by removing the rsh-server package from the system using the following command: $ sudo yum remove rsh-server

b
TOSS 5 passwords for new users or password changes must have a 24 hours minimum password lifetime restriction in /etc/login.defs.
Medium - CCI-004066 - V-282463 - SV-282463r1200369_rule
RMF Control
Severity
M
CCI
CCI-004066
Version
TOSS-05-000341
Vuln IDs
  • V-282463
Rule IDs
  • SV-282463r1200369_rule
Enforcing a minimum password lifetime helps to prevent repeated password changes to defeat the password reuse or history enforcement requirement. If users are allowed to immediately and continually change their password, then the password could be repeatedly changed in a short period of time to defeat the organization's policy regarding password reuse. Setting the minimum password age protects against users cycling back to a favorite password after satisfying the password reuse requirement.
Checks: C-87024r1200367_chk

Verify TOSS 5 enforces 24 hours as the minimum password lifetime for new user accounts. Check for the value of "PASS_MIN_DAYS" in "/etc/login.defs" using the following command: $ grep -i pass_min_days /etc/login.defs PASS_MIN_DAYS 1 If the "PASS_MIN_DAYS" parameter value is not "1" or greater, or is commented out, this is a finding.

Fix: F-86929r1200368_fix

Configure TOSS 5 to enforce 24 hours as the minimum password lifetime. Add the following line in "/etc/login.defs" (or modify the line to have the required value): PASS_MIN_DAYS 1

b
TOSS 5 passwords must have a 24 hours minimum password lifetime restriction in /etc/shadow.
Medium - CCI-004066 - V-282464 - SV-282464r1200372_rule
RMF Control
Severity
M
CCI
CCI-004066
Version
TOSS-05-000342
Vuln IDs
  • V-282464
Rule IDs
  • SV-282464r1200372_rule
Enforcing a minimum password lifetime helps to prevent repeated password changes to defeat the password reuse or history enforcement requirement. If users are allowed to immediately and continually change their password, the password could be repeatedly changed in a short period of time to defeat the organization's policy regarding password reuse.
Checks: C-87025r1200370_chk

Verify TOSS 5 has configured the minimum time period between password changes for each user account as one day or greater using the following command: $ sudo awk -F: '$4 &lt; 1 {print $1 " " $4}' /etc/shadow If any results are returned that are not associated with a system account, this is a finding.

Fix: F-86930r1200371_fix

Configure noncompliant accounts to enforce a 24 hour minimum password lifetime: $ sudo passwd -n 1 [user]

b
TOSS 5 user account passwords for new users or password changes must have a 60-day maximum password lifetime restriction in /etc/login.defs.
Medium - CCI-004066 - V-282465 - SV-282465r1200375_rule
RMF Control
Severity
M
CCI
CCI-004066
Version
TOSS-05-000291
Vuln IDs
  • V-282465
Rule IDs
  • SV-282465r1200375_rule
Any password, no matter how complex, can eventually be cracked; therefore, passwords must be changed periodically. If the operating system does not limit the lifetime of passwords and force users to change their passwords, there is the risk that the operating system passwords could be compromised. Setting the password maximum age ensures users are required to periodically change their passwords. Requiring shorter password lifetimes increases the risk of users writing down the password in a convenient location subject to physical compromise.
Checks: C-87026r1200373_chk

Verify TOSS 5 enforces a 60-day maximum password lifetime for new user accounts using the following command: $ grep -i pass_max_days /etc/login.defs PASS_MAX_DAYS 60 If the "PASS_MAX_DAYS" parameter value is greater than "60" or commented out, this is a finding.

Fix: F-86931r1200374_fix

Configure TOSS 5 to enforce a 60-day maximum password lifetime. Add or modify the following line in the "/etc/login.defs" file: PASS_MAX_DAYS 60

b
TOSS 5 user account passwords must have a 60-day maximum password lifetime restriction.
Medium - CCI-004066 - V-282466 - SV-282466r1200378_rule
RMF Control
Severity
M
CCI
CCI-004066
Version
TOSS-05-000292
Vuln IDs
  • V-282466
Rule IDs
  • SV-282466r1200378_rule
Any password, no matter how complex, can eventually be cracked; therefore, passwords must be changed periodically. If TOSS 5 does not limit the lifetime of passwords and force users to change their passwords, there is the risk that TOSS 5 passwords could be compromised.
Checks: C-87027r1200376_chk

Check whether the maximum time period for existing passwords is restricted to 60 days with the following commands: $ sudo awk -F: '$5 &gt; 60 {print $1 "" "" $5}' /etc/shadow $ sudo awk -F: '$5 &lt;= 0 {print $1 "" "" $5}' /etc/shadow If any results are returned that are not associated with a system account, this is a finding.

Fix: F-86932r1200377_fix

Configure noncompliant accounts to enforce a 60-day maximum password lifetime restriction. passwd -x 60 [user]

b
TOSS 5 passwords must be created with a minimum of 15 characters.
Medium - CCI-004066 - V-282467 - SV-282467r1200381_rule
RMF Control
Severity
M
CCI
CCI-004066
Version
TOSS-05-000344
Vuln IDs
  • V-282467
Rule IDs
  • SV-282467r1200381_rule
The shorter the password, the lower the number of possible combinations that must be tested before the password is compromised. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password length is one factor of several that helps to determine strength and how long it takes to crack a password. Use of more characters in a password helps to increase exponentially the time and/or resources required to compromise the password. TOSS 5 uses "pwquality" as a mechanism to enforce password complexity. Configurations are set in the "etc/security/pwquality.conf" file. The "minlen", sometimes noted as minimum length, acts as a "score" of complexity based on the credit components of the "pwquality" module. By setting the credit components to a negative value, not only will those components be required, but they will not count toward the total "score" of "minlen". This will enable "minlen" to require a 15-character minimum. The DOD minimum password requirement is 15 characters.
Checks: C-87028r1200379_chk

Verify TOSS 5 enforces a minimum 15-character password length using the following command: $ grep minlen /etc/security/pwquality.conf minlen = 15 If the command does not return a "minlen" value of "15" or greater, does not return a line, or the line is commented out, this is a finding.

Fix: F-86933r1200380_fix

Configure TOSS 5 to enforce a minimum 15-character password length. Add the following line to "/etc/security/pwquality.conf" (or modify the line to have the required value): minlen = 15

b
TOSS 5 passwords, for new users, must have a minimum of 15 characters.
Medium - CCI-004066 - V-282468 - SV-282468r1200384_rule
RMF Control
Severity
M
CCI
CCI-004066
Version
TOSS-05-000345
Vuln IDs
  • V-282468
Rule IDs
  • SV-282468r1200384_rule
The shorter the password, the lower the number of possible combinations that must be tested before the password is compromised. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password length is one factor of several that helps to determine strength and how long it takes to crack a password. Use of more characters in a password helps to increase exponentially the time and/or resources required to compromise the password. The DOD minimum password requirement is 15 characters.
Checks: C-87029r1200382_chk

Verify TOSS 5 enforces a minimum 15-character password length for new user accounts using the following command: $ sudo grep -i pass_min_len /etc/login.defs PASS_MIN_LEN 15 If the command does not return a "PASS_MIN_LEN" value of "15" or greater, does not return a line, or the line is commented out, this is a finding.

Fix: F-86934r1200383_fix

Configure TOSS 5 to enforce a minimum 15-character password length for new user accounts. Add or modify the following line in the "/etc/login.defs" file: PASS_MIN_LEN 15

c
TOSS 5 must require a unique superuser name upon booting into single-user and maintenance modes.
AC-3 - High - CCI-000213 - V-282470 - SV-282470r1201601_rule
RMF Control
AC-3
Severity
H
CCI
CCI-000213
Version
TOSS-05-000094
Vuln IDs
  • V-282470
Rule IDs
  • SV-282470r1201601_rule
Having a nondefault grub superuser username makes password-guessing attacks less effective.
Checks: C-87031r1200388_chk

Verify the boot loader superuser account has been set using the following command: $ sudo grep -A1 "superusers" /etc/grub2.cfg set superusers="&lt;superusers-account&gt;" export superusers The &lt;superusers-account&gt; is the actual account name, which is different from common names like "root", "admin", or "administrator". If superusers contains easily guessable usernames, this is a finding.

Fix: F-86936r1200389_fix

Configure TOSS 5 to have a unique username for the grub superuser account. Edit the "/etc/grub.d/01_users" file and add or modify the following lines in the "### BEGIN /etc/grub.d/01_users ###" section: set superusers="superusers-account" export superusers Once the superuser account has been added, update the grub.cfg file using the following command: $ sudo grubby --update-kernel=ALL

b
TOSS 5 must require authentication to access emergency mode.
AC-3 - Medium - CCI-000213 - V-282471 - SV-282471r1200393_rule
RMF Control
AC-3
Severity
M
CCI
CCI-000213
Version
TOSS-05-000364
Vuln IDs
  • V-282471
Rule IDs
  • SV-282471r1200393_rule
To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DOD-approved PKIs, all DOD systems (e.g., web servers and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement. This requirement prevents attackers with physical access from trivially bypassing security on the machine and gaining root access. Such accesses are further prevented by configuring the bootloader password.
Checks: C-87032r1200391_chk

Verify TOSS 5 requires authentication for emergency mode using the following command: $ grep sulogin /usr/lib/systemd/system/emergency.service ExecStart=-/usr/lib/systemd/systemd-sulogin-shell emergency If this line is not returned, or is commented out, this is a finding. If the output is different, this is a finding.

Fix: F-86937r1200392_fix

Configure TOSS 5 to require authentication for emergency mode. Add or modify the following line in the "/usr/lib/systemd/system/emergency.service" file: ExecStart=-/usr/lib/systemd/systemd-sulogin-shell emergency

b
TOSS 5 must require authentication to access single-user mode.
AC-3 - Medium - CCI-000213 - V-282472 - SV-282472r1200396_rule
RMF Control
AC-3
Severity
M
CCI
CCI-000213
Version
TOSS-05-000365
Vuln IDs
  • V-282472
Rule IDs
  • SV-282472r1200396_rule
To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DOD-approved PKIs, all DOD systems (e.g., web servers and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement. This requirement prevents attackers with physical access from trivially bypassing security on the machine and gaining root access. Such accesses are further prevented by configuring the bootloader password.
Checks: C-87033r1200394_chk

Verify TOSS 5 requires authentication for single-user mode using the following command: $ grep sulogin /usr/lib/systemd/system/rescue.service ExecStart=-/usr/lib/systemd/systemd-sulogin-shell rescue If this line is not returned, or is commented out, this is a finding.

Fix: F-86938r1200395_fix

Configure TOSS 5 to require authentication for single-user mode. Add or modify the following line in the "/usr/lib/systemd/system/rescue.service" file: ExecStart=-/usr/lib/systemd/systemd-sulogin-shell rescue

a
TOSS 5 must enable mitigations against processor-based vulnerabilities.
CM-7 - Low - CCI-000381 - V-282473 - SV-282473r1200399_rule
RMF Control
CM-7
Severity
L
CCI
CCI-000381
Version
TOSS-05-000032
Vuln IDs
  • V-282473
Rule IDs
  • SV-282473r1200399_rule
Kernel page-table isolation is a kernel feature that mitigates the Meltdown security vulnerability and hardens the kernel against attempts to bypass kernel address space layout randomization (KASLR). Satisfies: SRG-OS-000095-GPOS-00049, SRG-OS-000433-GPOS-00193
Checks: C-87034r1200397_chk

Verify TOSS 5 enables kernel page-table isolation using the following command: $ sudo grubby --info=ALL | grep pti args="ro crashkernel=auto resume=/dev/mapper/rhel-swap rd.lvm.lv=rhel/root rd.lvm.lv=rhel/swap rhgb quiet fips=1 audit=1 audit_backlog_limit=8192 pti=on If the "pti" entry does not equal "on" or is missing, this is a finding.

Fix: F-86939r1200398_fix

Configure TOSS 5 to enable kernel page-table isolation using the following command: $ sudo grubby --update-kernel=ALL --args="pti=on" Add or modify the following line in "/etc/default/grub" to ensure the configuration survives kernel updates: GRUB_CMDLINE_LINUX="pti=on"

b
TOSS 5 must be configured to disable the Asynchronous Transfer Mode (ATM) kernel module.
CM-7 - Medium - CCI-000381 - V-282474 - SV-282474r1200402_rule
RMF Control
CM-7
Severity
M
CCI
CCI-000381
Version
TOSS-05-000104
Vuln IDs
  • V-282474
Rule IDs
  • SV-282474r1200402_rule
Disabling ATM protects the system against exploitation of any flaws in its implementation.
Checks: C-87035r1200400_chk

Verify TOSS 5 disables the ability to load the ATM kernel module using the following command: $ sudo grep -r atm /etc/modprobe.conf /etc/modprobe.d/* blacklist atm If the command does not return any output, or the line is commented out, and use of ATM is not documented with the information system security officer (ISSO) as an operational requirement, this is a finding.

Fix: F-86940r1200401_fix

Configure the system to prevent the atm kernel module from being loaded by adding the following line to the file /etc/modprobe.d/atm.conf (or create atm.conf if it does not exist): install atm /bin/false blacklist atm

b
TOSS 5 must be configured to disable the Controller Area Network (CAN) kernel module.
CM-7 - Medium - CCI-000381 - V-282475 - SV-282475r1200405_rule
RMF Control
CM-7
Severity
M
CCI
CCI-000381
Version
TOSS-05-000105
Vuln IDs
  • V-282475
Rule IDs
  • SV-282475r1200405_rule
Disabling CAN protects the system against exploitation of any flaws in its implementation.
Checks: C-87036r1200403_chk

Verify TOSS 5 disables the ability to load the "CAN" kernel module using the following command: $ sudo grep -r can /etc/modprobe.conf /etc/modprobe.d/* blacklist can If the command does not return any output, or the line is commented out, and use of CAN is not documented with the information system security officer (ISSO) as an operational requirement, this is a finding.

Fix: F-86941r1200404_fix

Configure the system to prevent the "CAN" kernel module from being loaded by adding the following line to the file /etc/modprobe.d/can.conf (or create atm.conf if it does not exist): install can /bin/false blacklist can

b
TOSS 5 must be configured to disable the FireWire kernel module.
CM-7 - Medium - CCI-000381 - V-282476 - SV-282476r1200408_rule
RMF Control
CM-7
Severity
M
CCI
CCI-000381
Version
TOSS-05-000106
Vuln IDs
  • V-282476
Rule IDs
  • SV-282476r1200408_rule
Disabling FireWire protects the system against exploitation of any flaws in its implementation.
Checks: C-87037r1200406_chk

Verify TOSS 5 disables the ability to load the "firewire-core" kernel module using the following command: $ sudo grep -r firewire-core /etc/modprobe.conf /etc/modprobe.d/* blacklist firewire-core If the command does not return any output, or the line is commented out, and use of firewire-core is not documented with the information system security officer (ISSO) as an operational requirement, this is a finding.

Fix: F-86942r1200407_fix

To configure the system to prevent the "firewire-core" kernel module from being loaded, add the following line to the file /etc/modprobe.d/firewire-core.conf (or create firewire-core.conf if it does not exist): install firewire-core /bin/false blacklist firewire-core

b
TOSS 5 must disable the Stream Control Transmission Protocol (SCTP) kernel module.
CM-7 - Medium - CCI-000381 - V-282477 - SV-282477r1200411_rule
RMF Control
CM-7
Severity
M
CCI
CCI-000381
Version
TOSS-05-000107
Vuln IDs
  • V-282477
Rule IDs
  • SV-282477r1200411_rule
It is detrimental for operating systems to provide, or install by default, functionality exceeding requirements or mission objectives. These unnecessary capabilities or services are often overlooked and therefore may remain unsecured. They increase the risk to the platform by providing additional attack vectors. Failing to disconnect unused protocols can result in a system compromise. The SCTP is a transport layer protocol, designed to support the idea of message-oriented communication, with several streams of messages within one connection. Disabling SCTP protects the system against exploitation of any flaws in its implementation.
Checks: C-87038r1200409_chk

Verify TOSS 5 disables the ability to load the "sctp" kernel module using the following command: $ sudo grep -r sctp /etc/modprobe.conf /etc/modprobe.d/* blacklist sctp If the command does not return any output, or the line is commented out, and use of sctp is not documented with the information system security officer (ISSO) as an operational requirement, this is a finding.

Fix: F-86943r1200410_fix

To configure the system to prevent the "sctp" kernel module from being loaded, add the following line to the file /etc/modprobe.d/sctp.conf (or create sctp.conf if it does not exist): install sctp /bin/false blacklist sctp

b
TOSS 5 must disable the Transparent Inter Process Communication (TIPC) kernel module.
CM-7 - Medium - CCI-000381 - V-282478 - SV-282478r1200414_rule
RMF Control
CM-7
Severity
M
CCI
CCI-000381
Version
TOSS-05-000108
Vuln IDs
  • V-282478
Rule IDs
  • SV-282478r1200414_rule
It is detrimental for operating systems to provide, or install by default, functionality exceeding requirements or mission objectives. These unnecessary capabilities or services are often overlooked and therefore may remain unsecured. They increase the risk to the platform by providing additional attack vectors. Failing to disconnect unused protocols can result in a system compromise. The TIPC is a protocol that is specially designed for intra-cluster communication. It can be configured to transmit messages either on UDP or directly across Ethernet. Message delivery is sequence guaranteed, loss free and flow controlled. Disabling TIPC protects the system against exploitation of any flaws in its implementation.
Checks: C-87039r1200412_chk

Verify TOSS 5 disables the ability to load the "tipc" kernel module using the following command: $ sudo grep -r tipc /etc/modprobe.conf /etc/modprobe.d/* blacklist tipc If the command does not return any output, or the line is commented out, and use of TIPC is not documented with the information system security officer (ISSO) as an operational requirement, this is a finding.

Fix: F-86944r1200413_fix

To configure the system to prevent the "tipc" kernel module from being loaded, add the following line to the file /etc/modprobe.d/tipc.conf (or create tipc.conf if it does not exist): install tipc /bin/false blacklist tipc

b
TOSS 5 must not have the ypserv package installed.
CM-7 - Medium - CCI-000381 - V-282479 - SV-282479r1200417_rule
RMF Control
CM-7
Severity
M
CCI
CCI-000381
Version
TOSS-05-000123
Vuln IDs
  • V-282479
Rule IDs
  • SV-282479r1200417_rule
The NIS service provides an unencrypted authentication service, which does not provide for the confidentiality and integrity of user passwords or the remote session. Removing the "ypserv" package decreases the risk of the accidental (or intentional) activation of NIS or NIS+ services.
Checks: C-87040r1200415_chk

Verify the "ypserv" package is not installed using the following command: $ sudo dnf list --installed ypserv Error: No matching Packages to list If the "ypserv" package is installed, this is a finding.

Fix: F-86945r1200416_fix

Remove the "ypserv" package using the following command: $ sudo dnf remove ypserv

b
TOSS 5 must not have the rsh-server package installed.
CM-7 - Medium - CCI-000381 - V-282480 - SV-282480r1200420_rule
RMF Control
CM-7
Severity
M
CCI
CCI-000381
Version
TOSS-05-000124
Vuln IDs
  • V-282480
Rule IDs
  • SV-282480r1200420_rule
The "rsh-server" service provides unencrypted remote access service, which does not provide for the confidentiality and integrity of user passwords or the remote session and has very weak authentication. If a privileged user were to login using this service, the privileged user password could be compromised. The "rsh-server" package provides several obsolete and insecure network services. Removing it decreases the risk of accidental (or intentional) activation of those services.
Checks: C-87041r1200418_chk

Verify the "rsh-server" package is not installed using the following command: $ sudo dnf list --installed rsh-server Error: No matching Packages to list If the "rsh-server" package is installed, this is a finding.

Fix: F-86946r1200419_fix

Remove the "rsh-server" package using the following command: $ sudo dnf remove rsh-server

b
TOSS 5 must not have the telnet-server package installed.
CM-7 - Medium - CCI-000381 - V-282481 - SV-282481r1200423_rule
RMF Control
CM-7
Severity
M
CCI
CCI-000381
Version
TOSS-05-000125
Vuln IDs
  • V-282481
Rule IDs
  • SV-282481r1200423_rule
It is detrimental for operating systems to provide, or install by default, functionality exceeding requirements or mission objectives. These unnecessary capabilities are often overlooked and therefore, may remain unsecure. They increase the risk to the platform by providing additional attack vectors. The telnet service provides an unencrypted remote access service, which does not provide for the confidentiality and integrity of user passwords or the remote session. If a privileged user were to login using this service, the privileged user password could be compromised. Removing the "telnet-server" package decreases the risk of accidental (or intentional) activation of the telnet service.
Checks: C-87042r1200421_chk

Verify the "telnet-server" package is not installed using the following command: $ sudo dnf list --installed telnet-server Error: No matching Packages to list If the "telnet-server" package is installed, this is a finding.

Fix: F-86947r1200422_fix

Remove the "telnet-server" package using the following command: $ sudo dnf remove telnet-server

b
TOSS 5 must not have the iprutils package installed.
CM-7 - Medium - CCI-000381 - V-282482 - SV-282482r1200426_rule
RMF Control
CM-7
Severity
M
CCI
CCI-000381
Version
TOSS-05-000126
Vuln IDs
  • V-282482
Rule IDs
  • SV-282482r1200426_rule
It is detrimental for operating systems to provide, or install by default, functionality exceeding requirements or mission objectives. These unnecessary capabilities or services are often overlooked and therefore may remain unsecured. They increase the risk to the platform by providing additional attack vectors. Operating systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). The iprutils package provides a suite of utilities to manage and configure SCSI devices supported by the ipr SCSI storage device driver.
Checks: C-87043r1200424_chk

Verify the "iprutils" package is not installed using the following command: $ sudo dnf list --installed iprutils Error: No matching Packages to list If the "iprutils" package is installed and is not documented with the information system security officer (ISSO) as an operational requirement, this is a finding.

Fix: F-86948r1200425_fix

Remove the "iprutils" package using the following command: $ sudo dnf remove iprutils

a
TOSS 5 must disable mounting of cramfs.
CM-7 - Low - CCI-000381 - V-282483 - SV-282483r1200429_rule
RMF Control
CM-7
Severity
L
CCI
CCI-000381
Version
TOSS-05-000138
Vuln IDs
  • V-282483
Rule IDs
  • SV-282483r1200429_rule
It is detrimental for operating systems to provide, or install by default, functionality exceeding requirements or mission objectives. These unnecessary capabilities or services are often overlooked and therefore may remain unsecured. They increase the risk to the platform by providing additional attack vectors. Removing support for unneeded file system types reduces the local attack surface of the server. Compressed ROM/RAM file system (or cramfs) is a read-only file system designed for simplicity and space-efficiency. It is mainly used in embedded and small-footprint systems.
Checks: C-87044r1200427_chk

Verify TOSS 5 disables the ability to load the "cramfs" kernel module using the following command: $ sudo grep -r cramfs /etc/modprobe.conf /etc/modprobe.d/* blacklist cramfs If the command does not return any output, or the line is commented out, and use of "cramfs" is not documented with the information system security officer (ISSO) as an operational requirement, this is a finding.

Fix: F-86949r1200428_fix

To configure the system to prevent the "cramfs" kernel module from being loaded, add the following line to the file "/etc/modprobe.d/blacklist.conf" (or create blacklist.conf if it does not exist): install cramfs /bin/false blacklist cramfs

a
TOSS 5 must disable network management of the chrony daemon.
CM-7 - Low - CCI-000381 - V-282484 - SV-282484r1201332_rule
RMF Control
CM-7
Severity
L
CCI
CCI-000381
Version
TOSS-05-000203
Vuln IDs
  • V-282484
Rule IDs
  • SV-282484r1201332_rule
Not exposing the management interface of the chrony daemon on the network diminishes the attack space. Satisfies: SRG-OS-000095-GPOS-00049, SRG-OS-000096-GPOS-00050
Checks: C-87045r1200430_chk

Verify TOSS 5 disables network management of the chrony daemon using the following command: $ grep -w cmdport /etc/chrony.conf cmdport 0 If the "cmdport" option is not set to "0", is commented out, or is missing, this is a finding.

Fix: F-86950r1201331_fix

Configure TOSS 5 to disable network management of the chrony daemon by adding/modifying the following line in the "/etc/chrony.conf" file: cmdport 0

b
TOSS 5 must have the firewalld package installed.
CM-7 - Medium - CCI-000382 - V-282485 - SV-282485r1200435_rule
RMF Control
CM-7
Severity
M
CCI
CCI-000382
Version
TOSS-05-000192
Vuln IDs
  • V-282485
Rule IDs
  • SV-282485r1200435_rule
"firewalld" provides an easy and effective way to block/limit remote access to the system via ports, services, and protocols. Remote access services, such as those providing remote access to network devices and information systems, which lack automated control capabilities, increase risk and make remote user access management difficult at best. Remote access is access to DOD nonpublic information systems by an authorized user (or an information system) communicating through an external, nonorganization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless. TOSS 5 functionality (e.g., SSH) must be capable of taking enforcement action if the audit reveals unauthorized activity. Automated control of remote access sessions allows organizations to ensure ongoing compliance with remote access policies by enforcing connection rules of remote access applications on a variety of information system components (e.g., servers, workstations, notebook computers, smartphones, and tablets). Satisfies: SRG-OS-000096-GPOS-00050, SRG-OS-000298-GPOS-00116
Checks: C-87046r1200433_chk

Run the following command to determine if the "firewalld" package is installed: $ sudo dnf list --installed firewalld Example output: firewalld.noarch 1.0.0-4.el9 If the "firewalld" package is not installed, this is a finding.

Fix: F-86951r1200434_fix

Install the "firewalld" package using the following command: $ sudo dnf install firewalld

b
The firewalld service on TOSS 5 must be active.
CM-7 - Medium - CCI-000382 - V-282486 - SV-282486r1200438_rule
RMF Control
CM-7
Severity
M
CCI
CCI-000382
Version
TOSS-05-000193
Vuln IDs
  • V-282486
Rule IDs
  • SV-282486r1200438_rule
"firewalld" provides an easy and effective way to block/limit remote access to the system via ports, services, and protocols. Remote access services, such as those providing remote access to network devices and information systems, which lack automated control capabilities, increase risk and make remote user access management difficult at best. Remote access is access to DOD nonpublic information systems by an authorized user (or an information system) communicating through an external, nonorganization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless. TOSS 5 functionality (e.g., RDP) must be capable of taking enforcement action if the audit reveals unauthorized activity. Automated control of remote access sessions allows organizations to ensure ongoing compliance with remote access policies by enforcing connection rules of remote access applications on a variety of information system components (e.g., servers, workstations, notebook computers, smartphones, and tablets). Satisfies: SRG-OS-000096-GPOS-00050, SRG-OS-000297-GPOS-00115
Checks: C-87047r1200436_chk

Verify "firewalld" is active using the following command: $ systemctl is-active firewalld active If the "firewalld" service is not active, this is a finding.

Fix: F-86952r1200437_fix

Enable the "firewalld" service using the following command: $ sudo systemctl enable --now firewalld

b
TOSS 5 must control remote access methods.
CM-7 - Medium - CCI-000382 - V-282487 - SV-282487r1200441_rule
RMF Control
CM-7
Severity
M
CCI
CCI-000382
Version
TOSS-05-000195
Vuln IDs
  • V-282487
Rule IDs
  • SV-282487r1200441_rule
To prevent unauthorized device connection, unauthorized information transfer, or unauthorized tunneling (i.e., embedding of data types within data types), organizations must disable or restrict unused or unnecessary physical and logical ports/protocols on information systems. Operating systems are capable of providing a wide variety of functions and services. Some of the functions and services provided by default may not be necessary to support essential organizational operations. Additionally, it is sometimes convenient to provide multiple services from a single component (e.g., VPN and IPS); however, doing so increases risk over limiting the services provided by one component. To support the requirements and principles of least functionality, the operating system must support the organizational requirements, providing only essential capabilities and limiting the use of ports, protocols, and/or services to only those required, authorized, and approved to conduct official business.
Checks: C-87048r1200439_chk

Inspect the list of enabled firewall ports and verify they are configured correctly using the following command: $ sudo firewall-cmd --list-all Ask the system administrator for the site or program Ports, Protocols, and Services Management Component Local Service Assessment (PPSM CLSA). Verify the services allowed by the firewall match the PPSM CLSA, or other applicable documentation approved by the information system security officer (ISSO). If there are additional ports, protocols, or services that are not in the PPSM CLSA, or there are ports, protocols, or services that are prohibited by the PPSM Category Assurance List (CAL), or there are no firewall rules configured, this is a finding.

Fix: F-86953r1200440_fix

Configure TOSS 5 to allow approved settings and/or running services to comply with the PPSM CLSA for the site or program and the PPSM CAL, or other applicable documentation approved by the ISSO. To open a port for a service, configure "firewalld" using the following command: $ sudo firewall-cmd --permanent --add-port=port_number/tcp or $ sudo firewall-cmd --permanent --add-service=service_name

b
TOSS 5 must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services, as defined in the Ports, Protocols, and Services Management (PPSM) Category Assignments List (CAL) and vulnerability assessments.
CM-7 - Medium - CCI-000382 - V-282488 - SV-282488r1200444_rule
RMF Control
CM-7
Severity
M
CCI
CCI-000382
Version
TOSS-05-000197
Vuln IDs
  • V-282488
Rule IDs
  • SV-282488r1200444_rule
To prevent unauthorized connection of devices, unauthorized transfer of information, or unauthorized tunneling (i.e., embedding of data types within data types), organizations must disable or restrict unused or unnecessary ports, protocols, and services on information systems.
Checks: C-87049r1200442_chk

Inspect the firewall configuration and running services to verify it is configured to prohibit or restrict the use of functions, ports, protocols, and/or services that are unnecessary or prohibited. Check which services are currently active using the following command: $ sudo firewall-cmd --list-all-zones custom (active) target: DROP icmp-block-inversion: no interfaces: ens33 sources: services: dhcpv6-client dns http https ldaps rpc-bind ssh ports: masquerade: no forward-ports: icmp-blocks: rich rules: Ask the system administrator for the site or program PPSM Component Local Service Assessment (CLSA). Verify the services allowed by the firewall match the PPSM CLSA, or other applicable documentation approved by the information system security officer (ISSO). If there are additional ports, protocols, or services that are not in the PPSM CLSA; or there are ports, protocols, or services that are prohibited by the PPSM CAL, this is a finding.

Fix: F-86954r1200443_fix

Update the host's firewall settings and/or running services to comply with the PPSM CLSA for the site or program and the PPSM CAL, or other applicable documentation approved by the ISSO. Run the following command to load the newly created rule(s): $ sudo firewall-cmd --reload

b
TOSS 5 duplicate User IDs (UIDs) must not exist for interactive users.
IA-2 - Medium - CCI-000764 - V-282489 - SV-282489r1200447_rule
RMF Control
IA-2
Severity
M
CCI
CCI-000764
Version
TOSS-05-000295
Vuln IDs
  • V-282489
Rule IDs
  • SV-282489r1200447_rule
To ensure accountability and prevent unauthenticated access, interactive users must be identified and authenticated to prevent potential misuse and compromise of the system. Satisfies: SRG-OS-000104-GPOS-00051, SRG-OS-000121-GPOS-00062
Checks: C-87050r1200445_chk

Verify TOSS 5 contains no duplicate UIDs for interactive users using the following command: $ sudo awk -F ":" 'list[$3]++{print $1, $3}' /etc/passwd If output is produced and the accounts listed are interactive user accounts, this is a finding.

Fix: F-86955r1200446_fix

Edit the file "/etc/passwd" and provide each interactive user account that has a duplicate UID with a unique UID.

b
All TOSS 5 interactive users must have a primary group that exists.
IA-2 - Medium - CCI-000764 - V-282490 - SV-282490r1200450_rule
RMF Control
IA-2
Severity
M
CCI
CCI-000764
Version
TOSS-05-000298
Vuln IDs
  • V-282490
Rule IDs
  • SV-282490r1200450_rule
If a user is assigned the Group Identifier (GID) of a group that does not exist on the system, and a group with the GID is subsequently created, the user may have unintended rights to any files associated with the group.
Checks: C-87051r1200448_chk

Verify all TOSS 5 interactive users have a valid GID using the following command: $ sudo pwck -qr If the system has any interactive users with duplicate GIDs, this is a finding.

Fix: F-86956r1200449_fix

Configure the system so all GIDs referenced in "/etc/passwd" are defined in "/etc/group". Edit the file "/etc/passwd" and ensure every user's GID is a valid GID.

b
TOSS 5 groups must have unique Group ID (GID).
IA-2 - Medium - CCI-000764 - V-282491 - SV-282491r1200453_rule
RMF Control
IA-2
Severity
M
CCI
CCI-000764
Version
TOSS-05-000309
Vuln IDs
  • V-282491
Rule IDs
  • SV-282491r1200453_rule
To ensure accountability and prevent unauthenticated access, groups must be identified uniquely to prevent potential misuse and compromise of the system.
Checks: C-87052r1200451_chk

Verify TOSS 5 contains no duplicate GIDs for interactive users using the following command: $ cut -d : -f 3 /etc/group | uniq -d If the system has duplicate GIDs, this is a finding.

Fix: F-86957r1200452_fix

Edit the file "/etc/group" and provide each group that has a duplicate GID with a unique GID.

b
TOSS 5 must have the openssl-pkcs11 package installed.
IA-2 - Medium - CCI-000765 - V-282492 - SV-282492r1200456_rule
RMF Control
IA-2
Severity
M
CCI
CCI-000765
Version
TOSS-05-000128
Vuln IDs
  • V-282492
Rule IDs
  • SV-282492r1200456_rule
Without the use of multifactor authentication, the ease of access to privileged functions is greatly increased. Multifactor authentication requires using two or more factors to achieve authentication. A privileged account is defined as an information system account with authorizations of a privileged user. The DOD common access card (CAC) with DOD-approved PKI is an example of multifactor authentication. Satisfies: SRG-OS-000105-GPOS-00052, SRG-OS-000106-GPOS-00053, SRG-OS-000046-GPOS-00022, SRG-OS-000107-GPOS-00054, SRG-OS-000108-GPOS-00055
Checks: C-87053r1200454_chk

Verify TOSS 5 has the "openssl-pkcs11" package installed using the following command: $ sudo dnf list --installed openssl-pkcs11 Example output: openssl-pkcs.i686 0.4.11-7.el9 openssl-pkcs.x86_64 0.4.11-7.el9 If the "openssl-pkcs11" package is not installed, this is a finding.

Fix: F-86958r1200455_fix

The "openssl-pkcs11" package can be installed using the following command: $ sudo dnf install openssl-pkcs11

c
TOSS 5 SSHD must not allow blank or null passwords.
IA-2 - High - CCI-000766 - V-282493 - SV-282493r1200459_rule
RMF Control
IA-2
Severity
H
CCI
CCI-000766
Version
TOSS-05-000238
Vuln IDs
  • V-282493
Rule IDs
  • SV-282493r1200459_rule
If an account has an empty password, anyone could log in and run commands with the privileges of that account. Accounts with empty passwords should never be used in operational environments.
Checks: C-87054r1200457_chk

Verify TOSS 5 remote access using SSH prevents logging on with a blank password using the following command: $ sudo /usr/sbin/sshd -dd 2&gt;&amp;1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH '^\s*permitemptypasswords' PermitEmptyPassword no If the "PermitEmptyPassword" keyword is set to "yes", is missing, or is commented out, this is a finding.

Fix: F-86959r1200458_fix

Configure the system to prevent SSH users from logging on with blank passwords by editing the following line in "etc/ssh/sshd_config": PermitEmptyPasswords no Restart the SSH daemon for the settings to take effect: $ sudo systemctl restart sshd.service

b
TOSS 5 must not permit direct logins to the root account using remote access via SSH.
Medium - CCI-004045 - V-282494 - SV-282494r1200462_rule
RMF Control
Severity
M
CCI
CCI-004045
Version
TOSS-05-000239
Vuln IDs
  • V-282494
Rule IDs
  • SV-282494r1200462_rule
Even though the communications channel may be encrypted, an additional layer of security is gained by extending the policy of not logging directly on as root. In addition, logging in with a user-specific account provides individual accountability of actions performed on the system and also helps to minimize direct attack attempts on root's password.
Checks: C-87055r1200460_chk

Verify TOSS 5 remote access using SSH prevents users from logging on directly as "root" using the following command: $ sudo /usr/sbin/sshd -dd 2&gt;&amp;1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH '^\s*permitrootlogin' PermitRootLogin no If the "PermitRootLogin" keyword is set to "yes", is missing, or is commented out, this is a finding.

Fix: F-86960r1200461_fix

Configure the system to prevent SSH users from logging on directly as "root" by adding or modifying the following line in "/etc/ssh/sshd_config": PermitRootLogin no Restart the SSH daemon for the settings to take effect: $ sudo systemctl restart sshd.service

b
TOSS 5 file system automount function must be disabled unless required.
IA-3 - Medium - CCI-000778 - V-282497 - SV-282497r1200471_rule
RMF Control
IA-3
Severity
M
CCI
CCI-000778
Version
TOSS-05-000133
Vuln IDs
  • V-282497
Rule IDs
  • SV-282497r1200471_rule
An authentication process resists replay attacks if it is impractical to achieve a successful authentication by recording and replaying a previous authentication message.
Checks: C-87058r1200469_chk

Verify TOSS 5 file system automount function has been disabled using the following command: $ sudo systemctl is-enabled autofs masked If the returned value is not "masked", "disabled", "Failed to get unit file state for autofs.service for autofs", or "enabled", and is not documented as operational requirement with the information system security officer (ISSO), this is a finding.

Fix: F-86963r1200470_fix

Configure TOSS 5 to disable the ability to automount devices. Disable the "autofs" service using the following command: $ sudo systemctl mask --now autofs.service

b
TOSS 5 must disable the graphical user interface automount function unless required.
IA-3 - Medium - CCI-000778 - V-282498 - SV-282498r1200474_rule
RMF Control
IA-3
Severity
M
CCI
CCI-000778
Version
TOSS-05-000264
Vuln IDs
  • V-282498
Rule IDs
  • SV-282498r1200474_rule
Automatically mounting file systems permits easy introduction of unknown devices, thereby facilitating malicious activity. Satisfies: SRG-OS-000114-GPOS-00059, SRG-OS-000378-GPOS-00163
Checks: C-87059r1200472_chk

Verify TOSS 5 disables the graphical user interface automount function using the following command: Note: This requirement assumes the use of the TOSS 5 default graphical user interface—the GNOME desktop environment. If the system does not have a graphical user interface installed, this requirement is not applicable. $ gsettings get org.gnome.desktop.media-handling automount-open false If "automount-open" is set to "true" and is not documented with the information system security officer (ISSO) as an operational requirement, this is a finding.

Fix: F-86964r1200473_fix

Configure the GNOME desktop to disable automated mounting of removable media. The dconf settings can be edited in the /etc/dconf/db/* location. Update the [org/gnome/desktop/media-handling] section of the "/etc/dconf/db/local.d/00-security-settings" database file and add or update the following lines: [org/gnome/desktop/media-handling] automount-open=false Update the dconf system databases: $ sudo dconf update

b
TOSS 5 must prevent a user from overriding the disabling of the graphical user interface automount function.
IA-3 - Medium - CCI-000778 - V-282499 - SV-282499r1200477_rule
RMF Control
IA-3
Severity
M
CCI
CCI-000778
Version
TOSS-05-000265
Vuln IDs
  • V-282499
Rule IDs
  • SV-282499r1200477_rule
A nonprivileged account is any operating system account with authorizations of a nonprivileged user. Satisfies: SRG-OS-000114-GPOS-00059, SRG-OS-000378-GPOS-00163
Checks: C-87060r1200475_chk

Verify TOSS 5 disables ability of the user to override the graphical user interface automount setting. Note: This requirement assumes the use of the TOSS 5 default graphical user interface—the GNOME desktop environment. If the system does not have a graphical user interface installed, this requirement is not applicable. Determine which profile the system database is using by running the following command: $ sudo grep system-db /etc/dconf/profile/user system-db:local Verify the automount setting is locked from nonprivileged user modification using the following command: Note: The example below is using the database "local" for the system, so the path is "/etc/dconf/db/local.d". Modify this path if using a database other than "local". $ grep 'automount-open' /etc/dconf/db/local.d/locks/* /org/gnome/desktop/media-handling/automount-open If the command does not return at least the example result, this is a finding.

Fix: F-86965r1200476_fix

Configure the GNOME desktop to not allow a user to change the setting that disables automated mounting of removable media. Add the following line to "/etc/dconf/db/local.d/locks/00-security-settings-lock" to prevent user modification: /org/gnome/desktop/media-handling/automount-open Update the dconf system databases: $ sudo dconf update

b
TOSS 5 must prevent a user from overriding the disabling of the graphical user interface autorun function.
IA-3 - Medium - CCI-000778 - V-282500 - SV-282500r1200480_rule
RMF Control
IA-3
Severity
M
CCI
CCI-000778
Version
TOSS-05-000267
Vuln IDs
  • V-282500
Rule IDs
  • SV-282500r1200480_rule
Techniques used to address this include protocols using nonces (e.g., numbers generated for a specific one-time use) or challenges (e.g., TLS, WS_Security). Additional techniques include time-synchronous or challenge-response one-time authenticators. Satisfies: SRG-OS-000114-GPOS-00059, SRG-OS-000378-GPOS-00163
Checks: C-87061r1200478_chk

Verify TOSS 5 disables the user's ability to override the graphical user interface autorun setting. Note: This requirement assumes the use of the TOSS 5 default graphical user interface—the GNOME desktop environment. If the system does not have a graphical user interface installed, this requirement is not applicable. Determine which profile the system database is using by running the following command: $ sudo grep system-db /etc/dconf/profile/user system-db:local Check that the automount setting is locked from nonprivileged user modification using the following command: Note: The example below is using the database "local" for the system, so the path is "/etc/dconf/db/local.d". This path must be modified if a database other than "local" is being used. $ grep 'autorun-never' /etc/dconf/db/local.d/locks/* /org/gnome/desktop/media-handling/autorun-never If the command does not return at least the example result, this is a finding.

Fix: F-86966r1200479_fix

Configure the GNOME desktop to not allow a user to change the setting that disables autorun on removable media. Add the following line to "/etc/dconf/db/local.d/locks/00-security-settings-lock" to prevent user modification: /org/gnome/desktop/media-handling/autorun-never Update the dconf system databases: $ sudo dconf update

b
TOSS 5 must be configured to disable USB mass storage.
IA-3 - Medium - CCI-000778 - V-282501 - SV-282501r1200483_rule
RMF Control
IA-3
Severity
M
CCI
CCI-000778
Version
TOSS-05-000284
Vuln IDs
  • V-282501
Rule IDs
  • SV-282501r1200483_rule
USB mass storage permits easy introduction of unknown devices, thereby facilitating malicious activity. Satisfies: SRG-OS-000114-GPOS-00059, SRG-OS-000378-GPOS-00163, SRG-OS-000690-GPOS-00140
Checks: C-87062r1200481_chk

Verify TOSS 5 disables the ability to load the USB Storage kernel module using the following command: $ sudo grep -r usb-storage /etc/modprobe.conf /etc/modprobe.d/* blacklist usb-storage If the command does not return any output, the line is commented out, and use of USB Storage is not documented with the information system security officer (ISSO) as an operational requirement, this is a finding.

Fix: F-86967r1200482_fix

Configure the system to prevent the usb-storage kernel module from being loaded by adding the following line to the file /etc/modprobe.d/usb-storage.conf (or create usb-storage.conf if it does not exist): install usb-storage /bin/false blacklist usb-storage

b
TOSS 5 must disable account identifiers (individuals, groups, roles, and devices) after 35 days of inactivity.
Medium - CCI-003627 - V-282502 - SV-282502r1200486_rule
RMF Control
Severity
M
CCI
CCI-003627
Version
TOSS-05-000299
Vuln IDs
  • V-282502
Rule IDs
  • SV-282502r1200486_rule
Inactive identifiers pose a risk to systems and applications because attackers may exploit an inactive identifier and potentially obtain undetected access to the system. Disabling inactive accounts ensures that accounts which may not have been responsibly removed are not available to attackers who may have compromised their credentials. Owners of inactive accounts will not notice if unauthorized access to their user account has been obtained. Satisfies: SRG-OS-000118-GPOS-00060, SRG-OS-000590-GPOS-00110
Checks: C-87063r1200484_chk

Verify TOSS 5 account identifiers (individuals, groups, roles, and devices) are disabled after 35 days of inactivity using the following command: Check the account inactivity value by performing the following command: $ sudo grep -i inactive /etc/default/useradd INACTIVE=35 If "INACTIVE" is set to "-1", a value greater than "35", or is commented out, this is a finding.

Fix: F-86968r1200485_fix

Configure TOSS 5 to disable account identifiers after 35 days of inactivity after the password expiration. Run the following command to change the configuration for "useradd": $ sudo useradd -D -f 35 The recommendation is 35 days, but a lower value is acceptable.

b
TOSS 5 must use mechanisms meeting the requirements of applicable federal laws, executive orders, directives, policies, regulations, standards, and guidance for authentication to a cryptographic module.
IA-7 - Medium - CCI-000803 - V-282503 - SV-282503r1200489_rule
RMF Control
IA-7
Severity
M
CCI
CCI-000803
Version
TOSS-05-000471
Vuln IDs
  • V-282503
Rule IDs
  • SV-282503r1200489_rule
Overriding the system crypto policy makes the behavior of Kerberos violate expectations and makes system configuration more fragmented.
Checks: C-87064r1200487_chk

Verify the symlink exists and targets the correct Kerberos crypto policy, using the following command: file /etc/crypto-policies/back-ends/krb5.config If command output shows the following line, Kerberos is configured to use the systemwide crypto policy: /etc/crypto-policies/back-ends/krb5.config: symbolic link to /usr/share/crypto-policies/FIPS/krb5.txt If the symlink does not exist or points to a different target, this is a finding.

Fix: F-86969r1200488_fix

Configure Kerberos to use system crypto policy. Create a symlink pointing to system crypto policy in the Kerberos configuration using the following command: $ sudo ln -s /etc/crypto-policies/back-ends/krb5.config /usr/share/crypto-policies/FIPS/krb5.txt

c
TOSS 5 must enable the Pluggable Authentication Module (PAM) interface for SSHD.
MA-4 - High - CCI-000877 - V-282504 - SV-282504r1200492_rule
RMF Control
MA-4
Severity
H
CCI
CCI-000877
Version
TOSS-05-000240
Vuln IDs
  • V-282504
Rule IDs
  • SV-282504r1200492_rule
When "UsePAM" is set to "yes", PAM runs through account and session types properly. This is important when restricted access to services based off of IP, time, or other factors of the account are needed. Additionally, this ensures users can inherit certain environment variables on login or disallow access to the server.
Checks: C-87065r1200490_chk

Verify the TOSS 5 SSHD is configured to allow for the "UsePAM" interface using the following command: $ sudo /usr/sbin/sshd -dd 2&gt;&amp;1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH '^\s*usepam' UsePAM yes If the "UsePAM" keyword is set to "no", is missing, or is commented out, this is a finding.

Fix: F-86970r1200491_fix

Configure the TOSS 5 SSHD to use the "UsePAM" interface, by adding or modifying the following line in "/etc/ssh/sshd_config": UsePAM yes Restart the SSH daemon for the settings to take effect: $ sudo systemctl restart sshd.service

b
TOSS 5 must restrict access to the kernel message buffer.
SC-2 - Medium - CCI-001082 - V-282505 - SV-282505r1200495_rule
RMF Control
SC-2
Severity
M
CCI
CCI-001082
Version
TOSS-05-000098
Vuln IDs
  • V-282505
Rule IDs
  • SV-282505r1200495_rule
Preventing unauthorized information transfers mitigates the risk of information, including encrypted representations of information, produced by the actions of prior users/roles (or the actions of processes acting on behalf of prior users/roles) from being available to any current users/roles (or current processes) that obtain access to shared system resources (e.g., registers, main memory, hard disks) after those resources have been released back to information systems. The control of information in shared resources is also commonly referred to as object reuse and residual information protection. This requirement generally applies to the design of an information technology product, but it can also apply to the configuration of particular information system components that are, or use, such products. This can be verified by acceptance/validation processes in DOD or other government agencies. There may be shared resources with configurable protections (e.g., files in storage) that may be assessed on specific information system components. Restricting access to the kernel message buffer limits access to only root. This prevents attackers from gaining additional system information as a nonprivileged user. Satisfies: SRG-OS-000132-GPOS-00067, SRG-OS-000138-GPOS-00069
Checks: C-87066r1200493_chk

Verify TOSS 5 is configured to restrict access to the kernel message buffer with the following commands: $ sudo sysctl kernel.dmesg_restrict kernel.dmesg_restrict = 1 If "kernel.dmesg_restrict" is not set to "1" or is missing, this is a finding.

Fix: F-86971r1200494_fix

Configure TOSS 5 to restrict access to the kernel message buffer. Add or edit the following line in a system configuration file, in the "/etc/sysctl.d/" directory: kernel.dmesg_restrict = 1 Load settings from all system configuration files using the following command: $ sudo sysctl --system

b
TOSS 5 must prevent kernel profiling by nonprivileged users.
SC-2 - Medium - CCI-001082 - V-282506 - SV-282506r1200498_rule
RMF Control
SC-2
Severity
M
CCI
CCI-001082
Version
TOSS-05-000099
Vuln IDs
  • V-282506
Rule IDs
  • SV-282506r1200498_rule
Preventing unauthorized information transfers mitigates the risk of information, including encrypted representations of information, produced by the actions of prior users/roles (or the actions of processes acting on behalf of prior users/roles) from being available to any current users/roles (or current processes) that obtain access to shared system resources (e.g., registers, main memory, hard disks) after those resources have been released back to information systems. The control of information in shared resources is also commonly referred to as object reuse and residual information protection. This requirement generally applies to the design of an information technology product, but it can also apply to the configuration of particular information system components that are, or use, such products. This can be verified by acceptance/validation processes in DOD or other government agencies. There may be shared resources with configurable protections (e.g., files in storage) that may be assessed on specific information system components. Setting the kernel.perf_event_paranoid kernel parameter to "2" prevents attackers from gaining additional system information as a nonprivileged user. Satisfies: SRG-OS-000132-GPOS-00067, SRG-OS-000138-GPOS-00069
Checks: C-87067r1200496_chk

Verify TOSS 5 is configured to prevent kernel profiling by nonprivileged users using the following command: $ sudo sysctl kernel.perf_event_paranoid kernel.perf_event_paranoid = 2 If "kernel.perf_event_paranoid" is not set to "2" or is missing, this is a finding.

Fix: F-86972r1200497_fix

Configure TOSS 5 to prevent kernel profiling by nonprivileged users. Add or edit the following line in a system configuration file, in the "/etc/sysctl.d/" directory: kernel.perf_event_paranoid = 2 Load settings from all system configuration files using the following command: $ sudo sysctl --system

b
TOSS 5 must restrict exposed kernel pointer addresses access.
SC-2 - Medium - CCI-001082 - V-282507 - SV-282507r1200501_rule
RMF Control
SC-2
Severity
M
CCI
CCI-001082
Version
TOSS-05-000101
Vuln IDs
  • V-282507
Rule IDs
  • SV-282507r1200501_rule
Exposing kernel pointers (through procfs or "seq_printf()") exposes kernel writeable structures, which may contain functions pointers. If a write vulnerability occurs in the kernel, allowing write access to any of this structure, the kernel can be compromised. This option disallows any program without the CAP_SYSLOG capability to get the addresses of kernel pointers by replacing them with "0". Satisfies: SRG-OS-000132-GPOS-00067, SRG-OS-000433-GPOS-00192, SRG-OS-000433-GPOS-00193
Checks: C-87068r1200499_chk

Verify the runtime status of the "kernel.kptr_restrict" kernel parameter using the following command: $ sudo sysctl kernel.kptr_restrict kernel.kptr_restrict = 1 If "kernel.kptr_restrict" is not set to "1" or is missing, this is a finding.

Fix: F-86973r1200500_fix

Add or edit the following line in a system configuration file in the "/etc/sysctl.d/" directory: kernel.kptr_restrict = 1 Reload settings from all system configuration files using the following command: $ sudo sysctl --system

b
TOSS 5 must disable access to network bpf system call from nonprivileged processes.
SC-2 - Medium - CCI-001082 - V-282508 - SV-282508r1200504_rule
RMF Control
SC-2
Severity
M
CCI
CCI-001082
Version
TOSS-05-000109
Vuln IDs
  • V-282508
Rule IDs
  • SV-282508r1200504_rule
Loading and accessing the packet filters programs and maps using the "bpf()" system call has the potential of revealing sensitive information about the kernel state.
Checks: C-87069r1200502_chk

Verify TOSS 5 prevents privilege escalation through the kernel by disabling access to the bpf system call using the following command: $ sudo sysctl kernel.unprivileged_bpf_disabled kernel.unprivileged_bpf_disabled = 1 If the returned line does not have a value of "1", or a line is not returned, this is a finding.

Fix: F-86974r1200503_fix

Configure TOSS 5 to prevent privilege escalation through the kernel by disabling access to the bpf syscall by adding the following line to a file, in the "/etc/sysctl.d" directory: kernel.unprivileged_bpf_disabled = 1 The system configuration files must be reloaded for the changes to take effect. To reload the contents of the files, run the following command: $ sudo sysctl --system

b
TOSS 5 must restrict usage of ptrace to descendant processes.
SC-2 - Medium - CCI-001082 - V-282509 - SV-282509r1200507_rule
RMF Control
SC-2
Severity
M
CCI
CCI-001082
Version
TOSS-05-000110
Vuln IDs
  • V-282509
Rule IDs
  • SV-282509r1200507_rule
Unrestricted usage of ptrace allows compromised binaries to run ptrace on other processes of the user. This way, the attacker can steal sensitive information from the target processes (e.g., SSH sessions, web browser, etc.) without any additional assistance from the user (i.e., without resorting to phishing).
Checks: C-87070r1200505_chk

Verify TOSS 5 restricts usage of ptrace to descendant processes using the following command: $ sudo sysctl kernel.yama.ptrace_scope kernel.yama.ptrace_scope = 1 If the returned line does not have a value of "1", or a line is not returned, this is a finding.

Fix: F-86975r1200506_fix

Configure TOSS 5 to restrict using ptrace to descendant processes by adding the following line to a file, in the "/etc/sysctl.d" directory: kernel.yama.ptrace_scope = 1 The system configuration files must be reloaded for the changes to take effect. To reload the contents of the files, run the following command: $ sudo sysctl --system

b
TOSS 5 must use a Linux Security Module configured to enforce limits on system services.
SC-3 - Medium - CCI-001084 - V-282510 - SV-282510r1201302_rule
RMF Control
SC-3
Severity
M
CCI
CCI-001084
Version
TOSS-05-000023
Vuln IDs
  • V-282510
Rule IDs
  • SV-282510r1201302_rule
Without verification of the security functions, security functions may not operate correctly and the failure may go unnoticed. Security function is defined as the hardware, software, and/or firmware of the information system responsible for enforcing the system security policy and supporting the isolation of code and data on which the protection is based. Security functionality includes, but is not limited to, establishing system accounts, configuring access authorizations (i.e., permissions, privileges), setting events to be audited, and setting intrusion detection parameters. This requirement applies to operating systems performing security function verification/testing and/or systems and environments that require this functionality.
Checks: C-87071r1200508_chk

Note: At lower classification levels (CUI, Secret) where vast amounts of data are processed and a performance impact is occurring, an authorizing official can consider this requirement not applicable. Confirm that TOSS verifies the correct operation of all security functions. Determine if "SELinux" is active and in "Enforcing" mode using the following command: $ sudo getenforce Enforcing If "SELinux" is not active or not in "Enforcing" mode, this is a finding.

Fix: F-86976r1201301_fix

Configure the operating system to verify correct operation of all security functions. Set the "SELinux" status and the "Enforcing" mode by modifying the "/etc/selinux/config" file to have the following line: SELINUX=enforcing Restart the system for the changes to take effect.

b
A sticky bit must be set on all TOSS 5 public directories.
SC-4 - Medium - CCI-001090 - V-282511 - SV-282511r1200513_rule
RMF Control
SC-4
Severity
M
CCI
CCI-001090
Version
TOSS-05-000186
Vuln IDs
  • V-282511
Rule IDs
  • SV-282511r1200513_rule
Preventing unauthorized information transfers mitigates the risk of information, including encrypted representations of information, produced by the actions of prior users/roles (or the actions of processes acting on behalf of prior users/roles) from being available to any current users/roles (or current processes) that obtain access to shared system resources (e.g., registers, main memory, hard disks) after those resources have been released back to information systems. The control of information in shared resources is also commonly referred to as object reuse and residual information protection. This requirement generally applies to the design of an information technology product, but it can also apply to the configuration of particular information system components that are, or use, such products. This can be verified by acceptance/validation processes in DOD or other government agencies.
Checks: C-87072r1200511_chk

Verify all world-writable directories have the sticky bit set. Determine if all world-writable directories have the sticky bit set using the following command: $ sudo find / -type d \( -perm -0002 -a ! -perm -1000 \) -print 2&gt;/dev/null drwxrwxrwt 7 root root 4096 Jul 26 11:19 /tmp If any of the returned directories are world-writable and do not have the sticky bit set, this is a finding.

Fix: F-86977r1200512_fix

Configure all world-writable directories to have the sticky bit set to prevent unauthorized and unintended information transferred via shared system resources. Set the sticky bit on all world-writable directories using the command, replace "[World-Writable Directory]" with any directory path missing the sticky bit: $ chmod a+t [World-Writable Directory]

b
TOSS 5 must be configured to use TCP syncookies.
SC-5 - Medium - CCI-001095 - V-282512 - SV-282512r1201342_rule
RMF Control
SC-5
Severity
M
CCI
CCI-001095
Version
TOSS-05-000212
Vuln IDs
  • V-282512
Rule IDs
  • SV-282512r1201342_rule
Denial of service (DoS) is a condition when a resource is not available for legitimate users. When this occurs, the organization either cannot accomplish its mission or must operate at degraded capacity. Managing excess capacity ensures that sufficient capacity is available to counter flooding attacks. Employing increased capacity and service redundancy may reduce the susceptibility to some DoS attacks. Managing excess capacity may include, for example, establishing selected usage priorities, quotas, or partitioning. Satisfies: SRG-OS-000142-GPOS-00071, SRG-OS-000420-GPOS-00186
Checks: C-87073r1200514_chk

Verify TOSS 5 is configured to use IPv4 TCP syncookies using the following command: $ sudo sysctl net.ipv4.tcp_syncookies net.ipv4.tcp_syncookies = 1 If the network parameter "ipv4.tcp_syncookies" is not equal to "1" or a line is not returned, this is a finding.

Fix: F-86978r1201341_fix

Configure TOSS 5 to use TCP syncookies. Add or edit the following line in a system configuration file in the "/etc/sysctl.d/" directory: net.ipv4.tcp_syncookies = 1 Load settings from all system configuration files using the following command: $ sudo sysctl --system

c
TOSS 5 local disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at rest protection.
SC-28 - High - CCI-001199 - V-282514 - SV-282514r1201603_rule
RMF Control
SC-28
Severity
H
CCI
CCI-001199
Version
TOSS-05-000137
Vuln IDs
  • V-282514
Rule IDs
  • SV-282514r1201603_rule
TOSS 5 systems handling data requiring data at rest protections must employ cryptographic mechanisms to prevent unauthorized disclosure and modification of the information at rest. Selection of a cryptographic mechanism is based on the need to protect the integrity of organizational information. The strength of the mechanism is commensurate with the security category and/or classification of the information. Organizations have the flexibility to either encrypt all information on storage devices (i.e., full disk encryption) or encrypt specific data structures (e.g., files, records, or fields). Satisfies: SRG-OS-000185-GPOS-00079, SRG-OS-000404-GPOS-00183, SRG-OS-000405-GPOS-00184
Checks: C-87075r1200520_chk

Verify TOSS 5 prevents unauthorized disclosure or modification of all information requiring at-rest protection by using disk encryption. Note: If there is a documented and approved reason for not having data-at-rest encryption, this requirement is not applicable. Verify all system partitions are encrypted using the following command: $ blkid /dev/map per/rhel-root: UUID="67b7d7fe-de60-6fd0-befb-e6748cf97743" TYPE="crypto_LUKS" Every persistent disk partition present must be of type "crypto_LUKS". If any partitions other than the boot partition or pseudo file systems (such as /proc or /sys) or temporary file systems (that are tmpfs) are not type "crypto_LUKS", ask the administrator to indicate how the partitions are encrypted. If there is no evidence that these partitions are encrypted, this is a finding.

Fix: F-86980r1200521_fix

Configure TOSS 5 to prevent unauthorized modification of all information at rest by using disk encryption. Encrypting a partition in an already installed system is more difficult, because existing partitions must be resized and changed. To encrypt an entire partition, dedicate a partition for encryption in the partition layout.

b
TOSS 5 /var/log directory must have mode 0755 or less permissive.
SI-11 - Medium - CCI-001314 - V-282516 - SV-282516r1200528_rule
RMF Control
SI-11
Severity
M
CCI
CCI-001314
Version
TOSS-05-000142
Vuln IDs
  • V-282516
Rule IDs
  • SV-282516r1200528_rule
Only authorized personnel should be aware of errors and the details of the errors. Error messages are an indicator of an organization's operational state or can identify the TOSS 5 system or platform. Additionally, personally identifiable information (PII) and operational information must not be revealed through error messages to unauthorized personnel or their designated representatives. The structure and content of error messages must be carefully considered by the organization and development team. The extent to which the information system is able to identify and handle error conditions is guided by organizational policy and operational requirements.
Checks: C-87077r1200526_chk

Verify the "/var/log" directory has a mode of "0755" or less permissive using the following command: $ ls -ld /var/log drwxr-xr-x. 16 root root 4096 July 11 11:34 /var/log If "/var/log" does not have a mode of "0755" or less permissive, this is a finding.

Fix: F-86982r1200527_fix

Configure the "/var/log" directory to a mode of "0755" using the following command: $ sudo chmod 0755 /var/log

b
TOSS 5 /var/log/messages file must have mode 0640 or less permissive.
SI-11 - Medium - CCI-001314 - V-282517 - SV-282517r1200531_rule
RMF Control
SI-11
Severity
M
CCI
CCI-001314
Version
TOSS-05-000143
Vuln IDs
  • V-282517
Rule IDs
  • SV-282517r1200531_rule
Only authorized personnel should be aware of errors and the details of the errors. Error messages are an indicator of an organization's operational state or can identify the TOSS 5 system or platform. Additionally, personally identifiable information (PII) and operational information must not be revealed through error messages to unauthorized personnel or their designated representatives. The structure and content of error messages must be carefully considered by the organization and development team. The extent to which the information system is able to identify and handle error conditions is guided by organizational policy and operational requirements.
Checks: C-87078r1200529_chk

Verify the "/var/log/messages" file has a mode of "0640" or less permissive using the following command: $ ls -la /var/log/messages rw-------. 1 root root 564223 July 11 11:34 /var/log/messages If "/var/log/messages" does not have a mode of "0640" or less permissive, this is a finding.

Fix: F-86983r1200530_fix

Configure the "/var/log/messages" file to have a mode of "0640" using the following command: $ sudo chmod 0640 /var/log/messages

b
TOSS 5 /var/log directory must be owned by root.
SI-11 - Medium - CCI-001314 - V-282518 - SV-282518r1200534_rule
RMF Control
SI-11
Severity
M
CCI
CCI-001314
Version
TOSS-05-000171
Vuln IDs
  • V-282518
Rule IDs
  • SV-282518r1200534_rule
Only authorized personnel should be aware of errors and the details of the errors. Error messages are an indicator of an organization's operational state or can identify the TOSS 5 system or platform. Additionally, personally identifiable information (PII) and operational information must not be revealed through error messages to unauthorized personnel or their designated representatives. The structure and content of error messages must be carefully considered by the organization and development team. The extent to which the information system is able to identify and handle error conditions is guided by organizational policy and operational requirements.
Checks: C-87079r1200532_chk

Verify the "/var/log" directory is owned by root using the following command: $ ls -ld /var/log drwxr-xr-x. 16 root root 4096 July 11 11:34 /var/log If "/var/log" does not have an owner of "root", this is a finding.

Fix: F-86984r1200533_fix

Configure the owner of the directory "/var/log" to "root" using the following command: $ sudo chown root /var/log

b
TOSS 5 /var/log directory must be group-owned by root.
SI-11 - Medium - CCI-001314 - V-282519 - SV-282519r1200537_rule
RMF Control
SI-11
Severity
M
CCI
CCI-001314
Version
TOSS-05-000172
Vuln IDs
  • V-282519
Rule IDs
  • SV-282519r1200537_rule
Only authorized personnel should be aware of errors and the details of the errors. Error messages are an indicator of an organization's operational state or can identify the TOSS 5 system or platform. Additionally, personally identifiable information (PII) and operational information must not be revealed through error messages to unauthorized personnel or their designated representatives. The structure and content of error messages must be carefully considered by the organization and development team. The extent to which the information system is able to identify and handle error conditions is guided by organizational policy and operational requirements.
Checks: C-87080r1200535_chk

Verify the "/var/log" directory is group-owned by root using the following command: $ ls -ld /var/log drwxr-xr-x. 16 root root 4096 July 11 11:34 /var/log If "/var/log" does not have a group owner of "root", this is a finding.

Fix: F-86985r1200536_fix

Configure the group owner of the directory "/var/log" to "root" using the following command: $ sudo chgrp root /var/log

b
TOSS 5 /var/log/messages file must be owned by root.
SI-11 - Medium - CCI-001314 - V-282520 - SV-282520r1200540_rule
RMF Control
SI-11
Severity
M
CCI
CCI-001314
Version
TOSS-05-000173
Vuln IDs
  • V-282520
Rule IDs
  • SV-282520r1200540_rule
Only authorized personnel should be aware of errors and the details of the errors. Error messages are an indicator of an organization's operational state or can identify the TOSS 5 system or platform. Additionally, personally identifiable information (PII) and operational information must not be revealed through error messages to unauthorized personnel or their designated representatives. The structure and content of error messages must be carefully considered by the organization and development team. The extent to which the information system is able to identify and handle error conditions is guided by organizational policy and operational requirements.
Checks: C-87081r1200538_chk

Verify the "/var/log/messages" file is owned by root using the following command: $ ls -la /var/log/messages rw-------. 1 root root 564223 July 11 11:34 /var/log/messages If "/var/log/messages" does not have an owner of "root", this is a finding.

Fix: F-86986r1200539_fix

Change the owner of the "/var/log/messages" file to "root" using the following command: $ sudo chown root /var/log/messages

b
TOSS 5 /var/log/messages file must be group-owned by root.
SI-11 - Medium - CCI-001314 - V-282521 - SV-282521r1200543_rule
RMF Control
SI-11
Severity
M
CCI
CCI-001314
Version
TOSS-05-000174
Vuln IDs
  • V-282521
Rule IDs
  • SV-282521r1200543_rule
Only authorized personnel should be aware of errors and the details of the errors. Error messages are an indicator of an organization's operational state or can identify the TOSS 5 system or platform. Additionally, personally identifiable information (PII) and operational information must not be revealed through error messages to unauthorized personnel or their designated representatives. The structure and content of error messages must be carefully considered by the organization and development team. The extent to which the information system is able to identify and handle error conditions is guided by organizational policy and operational requirements.
Checks: C-87082r1200541_chk

Verify the "/var/log/messages" file is group-owned by root using the following command: $ ls -la /var/log/messages rw-------. 1 root root 564223 July 11 11:34 /var/log/messages If "/var/log/messages" does not have a group owner of "root" and is not documented with the information system security officer (ISSO) as an operational requirement, this is a finding.

Fix: F-86987r1200542_fix

Change the group owner of the "/var/log/messages" file to "root" using the following command: $ sudo chgrp root /var/log/messages

b
TOSS 5 SSH daemon must be configured to use systemwide crypto policies.
AC-17 - Medium - CCI-001453 - V-282522 - SV-282522r1200546_rule
RMF Control
AC-17
Severity
M
CCI
CCI-001453
Version
TOSS-05-000241
Vuln IDs
  • V-282522
Rule IDs
  • SV-282522r1200546_rule
Without cryptographic integrity protections, information can be altered by unauthorized users without detection. Remote access (e.g., RDP) is access to DOD nonpublic information systems by an authorized user (or an information system) communicating through an external, nonorganization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless. Cryptographic mechanisms used for protecting the integrity of information include, for example, signed hash functions using asymmetric cryptography enabling distribution of the public key to verify the hash information while maintaining the confidentiality of the secret key used to generate the hash.
Checks: C-87083r1200544_chk

Verify systemwide crypto policies are in effect using the following command: $ sudo /usr/sbin/sshd -dd 2&gt;&amp;1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH '^\s*include' /etc/ssh/sshd_config:Include /etc/ssh/sshd_config.d/*.conf /etc/ssh/sshd_config.d/50-redhat.conf:Include /etc/crypto-policies/back-ends/opensshserver.config If "Include /etc/ssh/sshd_config.d/*.conf" or "Include /etc/crypto-policies/back-ends/opensshserver.config" are not included in the system sshd config or the file "/etc/ssh/sshd_config.d/50-redhat.conf" is missing, this is a finding.

Fix: F-86988r1200545_fix

Configure the TOSS 5 SSH daemon to use systemwide crypto policies using the following command: $ sudo dnf reinstall openssh-server

b
TOSS 5 must implement DOD or other applicable U.S. Government agency-approved encryption ciphers to protect the confidentiality of SSH client connections.
AC-17 - Medium - CCI-001453 - V-282523 - SV-282523r1200549_rule
RMF Control
AC-17
Severity
M
CCI
CCI-001453
Version
TOSS-05-000242
Vuln IDs
  • V-282523
Rule IDs
  • SV-282523r1200549_rule
Without cryptographic integrity protections, information can be altered by unauthorized users without detection. Remote access (e.g., RDP) is access to DOD nonpublic information systems by an authorized user (or an information system) communicating through an external, nonorganization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless. Cryptographic mechanisms used for protecting the integrity of information include, for example, signed hash functions using asymmetric cryptography enabling distribution of the public key to verify the hash information while maintaining the confidentiality of the secret key used to generate the hash. TOSS 5 incorporates systemwide crypto policies by default. The SSH configuration file has no effect on the ciphers, MACs, or algorithms unless specifically defined in the /etc/sysconfig/sshd file. The employed algorithms can be viewed in the /etc/crypto-policies/back-ends/opensshserver.config file.
Checks: C-87084r1200547_chk

Verify systemwide crypto policies are in effect using the following command: $ sudo grep Include /etc/ssh/sshd_config /etc/ssh/sshd_config.d/* /etc/ssh/sshd_config:Include /etc/ssh/sshd_config.d/*.conf /etc/ssh/sshd_config.d/50-redhat.conf:Include /etc/crypto-policies/back-ends/opensshserver.config If "Include /etc/ssh/sshd_config.d/*.conf" or "Include /etc/crypto-policies/back-ends/opensshserver.config" are not included in the system sshd config or the file "/etc/ssh/sshd_config.d/50-redhat.conf" is missing, this is a finding.

Fix: F-86989r1200548_fix

Configure the TOSS 5 SSH daemon to use systemwide crypto policies using the following command: $ sudo dnf reinstall openssh-clients

b
TOSS 5 must implement DOD or other applicable U.S. Government agency-approved encryption ciphers to protect the confidentiality of SSH server connections.
AC-17 - Medium - CCI-001453 - V-282524 - SV-282524r1201364_rule
RMF Control
AC-17
Severity
M
CCI
CCI-001453
Version
TOSS-05-000243
Vuln IDs
  • V-282524
Rule IDs
  • SV-282524r1201364_rule
Without cryptographic integrity protections, information can be altered by unauthorized users without detection. Remote access (e.g., RDP) is access to DOD nonpublic information systems by an authorized user (or an information system) communicating through an external, nonorganization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless. Cryptographic mechanisms used for protecting the integrity of information include, for example, signed hash functions using asymmetric cryptography enabling distribution of the public key to verify the hash information while maintaining the confidentiality of the secret key used to generate the hash. TOSS 5 incorporates systemwide crypto policies by default. The SSH configuration file has no effect on the ciphers, MACs, or algorithms unless specifically defined in the "/etc/sysconfig/sshd" file. The employed algorithms can be viewed in the "/etc/crypto-policies/back-ends/opensshserver.config" file.
Checks: C-87085r1200550_chk

Verify the SSH client is configured to use only ciphers employing FIPS 140-3-approved algorithms using the following command: $ sudo grep -i ciphers /etc/crypto-policies/back-ends/openssh.config Ciphers aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes256-ctr,aes128-gcm@openssh.com,aes128-ctr If the cipher entries in the "openssh.config" file have any ciphers other than "aes256-gcm@openssh.com", "chacha20-poly1305@openssh.com", "aes256-ctr,aes128-gcm@openssh.com", "aes128-ctr"; the order differs from the example above; they are missing; or commented out, this is a finding.

Fix: F-86990r1201363_fix

Configure the TOSS 5 SSH client to only use ciphers employing FIPS 140-3-approved algorithms by updating the "/etc/crypto-policies/back-ends/openssh.config" file with the following line: Ciphers aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes256-ctr,aes128-gcm@openssh.com,aes128-ctr Restart the system for the changes to take effect.

b
The TOSS 5 SSH server must be configured to use only Message Authentication Codes (MACs) employing FIPS 140-3-validated cryptographic hash algorithms.
AC-17 - Medium - CCI-001453 - V-282525 - SV-282525r1201367_rule
RMF Control
AC-17
Severity
M
CCI
CCI-001453
Version
TOSS-05-000244
Vuln IDs
  • V-282525
Rule IDs
  • SV-282525r1201367_rule
Without cryptographic integrity protections, information can be altered by unauthorized users without detection. Remote access (e.g., RDP) is access to DOD nonpublic information systems by an authorized user (or an information system) communicating through an external, nonorganization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless. Cryptographic mechanisms used for protecting the integrity of information include, for example, signed hash functions using asymmetric cryptography enabling distribution of the public key to verify the hash information while maintaining the confidentiality of the secret key used to generate the hash. TOSS 5 incorporates systemwide crypto policies by default. The SSH configuration file has no effect on the ciphers, MACs, or algorithms unless specifically defined in the "/etc/sysconfig/sshd" file. The employed algorithms can be viewed in the "/etc/crypto-policies/back-ends/opensshserver.config" file.
Checks: C-87086r1201365_chk

Verify SSH server is configured to use only ciphers employing FIPS 140-3-approved algorithms using the following command: $ sudo grep -i macs /etc/crypto-policies/back-ends/openssh.config MACs hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha1,umac-128@openssh.com,hmac-sha2-512 If the MACs entries in the "openssh.config" file have any hashes other than "hmac-sha2-256-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512-etm@openssh.com", "hmac-sha2-512"; the order differs from the example above; they are missing; or commented out, this is a finding.

Fix: F-86991r1201366_fix

Configure the TOSS 5 SSH server to use only MACs employing FIPS 140-3-approved algorithms by updating the "/etc/crypto-policies/back-ends/openssh.config" file with the following line: MACs hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha1,umac-128@openssh.com,hmac-sha2-512 Restart the system for the changes to take effect.

c
TOSS 5 must implement DOD or other applicable U.S. Government agency-approved TLS encryption in the GnuTLS package.
AC-17 - High - CCI-001453 - V-282526 - SV-282526r1201501_rule
RMF Control
AC-17
Severity
H
CCI
CCI-001453
Version
TOSS-05-000472
Vuln IDs
  • V-282526
Rule IDs
  • SV-282526r1201501_rule
Without cryptographic integrity protections, information can be altered by unauthorized users without detection. Transport Layer Security (TLS) encryption is a required security setting as a number of known vulnerabilities have been reported against Secure Sockets Layer (SSL) and earlier versions of TLS. Encryption of private information is essential to ensuring data confidentiality. If private information is not encrypted, it can be intercepted and easily read by an unauthorized party. SQL Server must use a minimum of FIPS 140-3-approved TLS version 1.2, and all non-FIPS-approved SSL and TLS versions must be disabled. NIST 800-53 specifies the preferred configurations for government systems. Cryptographic mechanisms used for protecting the integrity of information include, for example, signed hash functions using asymmetric cryptography enabling distribution of the public key to verify the hash information while maintaining the confidentiality of the secret key used to generate the hash. Satisfies: SRG-OS-000250-GPOS-00093, SRG-OS-000423-GPOS-00187
Checks: C-87087r1200556_chk

Verify if GnuTLS uses defined DOD-approved TLS Crypto Policy using the following command: $ update-crypto-policies --show FIPS If the systemwide crypto policy is not set to "FIPS", this is a finding.

Fix: F-86992r1200557_fix

Configure the TOSS 5 GnuTLS library to use only NIST-approved encryption by enabling FIPS mode using the following command: $ sudo fips-mode-setup --enable Restart the system for the changes to take effect.

b
TOSS 5 must implement DOD or other applicable U.S. Government agency -approved encryption in the OpenSSL package.
AC-17 - Medium - CCI-001453 - V-282527 - SV-282527r1200561_rule
RMF Control
AC-17
Severity
M
CCI
CCI-001453
Version
TOSS-05-000473
Vuln IDs
  • V-282527
Rule IDs
  • SV-282527r1200561_rule
Without cryptographic integrity protections, information can be altered by unauthorized users without detection. Remote access (e.g., RDP) is access to DOD nonpublic information systems by an authorized user (or an information system) communicating through an external, nonorganization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless. Cryptographic mechanisms used for protecting the integrity of information include, for example, signed hash functions using asymmetric cryptography enabling distribution of the public key to verify the hash information while maintaining the confidentiality of the secret key used to generate the hash. The employed algorithms can be viewed in the "/etc/crypto-policies/back-ends/openssl.config" file.
Checks: C-87088r1200559_chk

Verify TOSS 5 OpenSSL library is configured to use only ciphers employing FIPS 140-3-approved algorithms using the following command: $ sudo grep -i opensslcnf.config /etc/pki/tls/openssl.cnf .include = /etc/crypto-policies/back-ends/opensslcnf.config If the "opensslcnf.config" is not defined in the "/etc/pki/tls/openssl.cnf" file, this is a finding.

Fix: F-86993r1200560_fix

Configure the TOSS 5 OpenSSL library to use the system cryptographic policy. Edit the "/etc/pki/tls/openssl.cnf" and add or modify the following line: .include = /etc/crypto-policies/back-ends/opensslcnf.config

b
TOSS 5 must implement DOD or other applicable U.S. Government agency-approved TLS encryption in the OpenSSL package.
AC-17 - Medium - CCI-001453 - V-282528 - SV-282528r1201630_rule
RMF Control
AC-17
Severity
M
CCI
CCI-001453
Version
TOSS-05-000474
Vuln IDs
  • V-282528
Rule IDs
  • SV-282528r1201630_rule
Without cryptographic integrity protections, information can be altered by unauthorized users without detection. Remote access (e.g., RDP) is access to DOD nonpublic information systems by an authorized user (or an information system) communicating through an external, nonorganization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless. Cryptographic mechanisms used for protecting the integrity of information include, for example, signed hash functions using asymmetric cryptography enabling distribution of the public key to verify the hash information while maintaining the confidentiality of the secret key used to generate the hash. The employed algorithms can be viewed in the /etc/crypto-policies/back-ends/openssl.config file.
Checks: C-87089r1200562_chk

Verify TOSS 5 OpenSSL library is configured to use TLS 1.2 encryption or stronger with following command: $ grep -i minprotocol /etc/crypto-policies/back-ends/opensslcnf.config TLS.MinProtocol = TLSv1.2 DTLS.MinProtocol = DTLSv1.2 If the "TLS.MinProtocol" is set to anything older than "TLSv1.2" or the "DTLS.MinProtocol" is set to anything older than "DTLSv1.2", this is a finding.

Fix: F-86994r1200563_fix

Configure the TOSS 5 OpenSSL library to use only DOD-approved TLS encryption by editing the following line in the "/etc/crypto-policies/back-ends/opensslcnf.config" file: TLS.MinProtocol = TLSv1.2 DTLS.MinProtocol = DTLSv1.2 Restart the system for the changes to take effect.

a
TOSS 5 must allocate an audit_backlog_limit of sufficient size to capture processes that start prior to the audit daemon.
AU-14 - Low - CCI-001464 - V-282529 - SV-282529r1200567_rule
RMF Control
AU-14
Severity
L
CCI
CCI-001464
Version
TOSS-05-000408
Vuln IDs
  • V-282529
Rule IDs
  • SV-282529r1200567_rule
Without the capability to generate audit records, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. If auditing is enabled late in the startup process, the actions of some startup processes may not be audited. Some audit systems also maintain state information only available if auditing is enabled before a given process is created. Audit records can be generated from various components within the information system (e.g., module or policy filter). Allocating an audit_backlog_limit of sufficient size is critical in maintaining a stable boot process. With an insufficient limit allocated, the system is susceptible to boot failures and crashes. Satisfies: SRG-OS-000254-GPOS-00095, SRG-OS-000341-GPOS-00132
Checks: C-87090r1200565_chk

Verify TOSS 5 allocates a sufficient audit_backlog_limit to capture processes that start prior to the audit daemon using the following command: $ sudo grubby --info=ALL | grep args | grep -v 'audit_backlog_limit=8192' If the command returns any outputs, and audit_backlog_limit is less than "8192", this is a finding.

Fix: F-86995r1200566_fix

Configure TOSS 5 to allocate sufficient audit_backlog_limit to capture processes that start prior to the audit daemon using the following command: $ sudo grubby --update-kernel=ALL --args=audit_backlog_limit=8192

b
TOSS 5 must produce audit records containing information to establish the identity of any individual or process associated with the event.
AU-3 - Medium - CCI-001487 - V-282530 - SV-282530r1200570_rule
RMF Control
AU-3
Severity
M
CCI
CCI-001487
Version
TOSS-05-000404
Vuln IDs
  • V-282530
Rule IDs
  • SV-282530r1200570_rule
Without establishing what type of events occurred, the source of events, where events occurred, and the outcome of events, it would be difficult to establish, correlate, and investigate the events leading up to an outage or attack. Audit record content that may be necessary to satisfy this requirement includes, for example, time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, filenames involved, and access control or flow control rules invoked. Enriched logging aids in making sense of who, what, and when events occur on a system. Without this, determining root cause of an event will be much more difficult.
Checks: C-87091r1200568_chk

Verify TOSS 5 audit system is configured to resolve audit information before writing to disk using the following command: $ sudo grep log_format /etc/audit/auditd.conf log_format = ENRICHED If the "log_format" option is not "ENRICHED", or the line is commented out, this is a finding.

Fix: F-86996r1200569_fix

Edit the /etc/audit/auditd.conf file and add or update the "log_format" option: log_format = ENRICHED Restart the audit daemon for the changes to take effect.

b
TOSS 5 audit tools must have a mode of 0755 or less permissive.
AU-9 - Medium - CCI-001493 - V-282531 - SV-282531r1201577_rule
RMF Control
AU-9
Severity
M
CCI
CCI-001493
Version
TOSS-05-000144
Vuln IDs
  • V-282531
Rule IDs
  • SV-282531r1201577_rule
Protecting audit information also includes identifying and protecting the tools used to view and manipulate log data. Therefore, protecting audit tools is necessary to prevent unauthorized operation on audit information. TOSS 5 systems providing tools to interface with audit information leverage user permissions and roles identifying the user accessing the tools, and the corresponding rights the user has, to make access decisions regarding the access to audit tools. Audit tools include, but are not limited to, vendor-provided and open source audit tools needed to successfully view and manipulate audit information system activity and records. Audit tools include custom queries and report generators.
Checks: C-87092r1201575_chk

Verify the audit tools have a mode of "0755" or less using the following command: $ stat -c "%a %n" /sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/autrace /sbin/auditd /sbin/rsyslogd /sbin/augenrules 755 /sbin/auditctl 755 /sbin/aureport 755 /sbin/ausearch 755 /sbin/autrace 755 /sbin/auditd 755 /sbin/rsyslogd 755 /sbin/augenrules If any of the audit tool files have a mode more permissive than "0755", this is a finding.

Fix: F-86997r1201576_fix

Configure the audit tools to have a mode of "0755" using the following command: $ sudo chmod 0755 [audit_tool] Replace "[audit_tool]" with each audit tool that has a more permissive mode than "0755".

b
TOSS 5 audit tools must be owned by root.
AU-9 - Medium - CCI-001493 - V-282532 - SV-282532r1200576_rule
RMF Control
AU-9
Severity
M
CCI
CCI-001493
Version
TOSS-05-000181
Vuln IDs
  • V-282532
Rule IDs
  • SV-282532r1200576_rule
Protecting audit information also includes identifying and protecting the tools used to view and manipulate log data. Therefore, protecting audit tools is necessary to prevent unauthorized operation on audit information. TOSS 5 systems providing tools to interface with audit information will leverage user permissions and roles identifying the user accessing the tools, and the corresponding rights the user has, to make access decisions regarding the access to audit tools. Audit tools include, but are not limited to, vendor-provided and open source audit tools needed to successfully view and manipulate audit information system activity and records. Audit tools include custom queries and report generators.
Checks: C-87093r1200574_chk

Verify the audit tools are owned by "root" using the following command: $ sudo stat -c "%U %n" /sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/autrace /sbin/auditd /sbin/rsyslogd /sbin/augenrules root /sbin/auditctl root /sbin/aureport root /sbin/ausearch root /sbin/autrace root /sbin/auditd root /sbin/rsyslogd root /sbin/augenrules If any audit tools do not have an owner of "root", this is a finding.

Fix: F-86998r1200575_fix

Configure the audit tools to be owned by "root" using the following command: $ sudo chown root [audit_tool] Replace "[audit_tool]" with each audit tool not owned by "root".

b
TOSS 5 audit tools must be group-owned by root.
AU-9 - Medium - CCI-001493 - V-282533 - SV-282533r1201328_rule
RMF Control
AU-9
Severity
M
CCI
CCI-001493
Version
TOSS-05-000182
Vuln IDs
  • V-282533
Rule IDs
  • SV-282533r1201328_rule
Protecting audit information includes identifying and protecting the tools used to view and manipulate log data; therefore, protecting audit tools is necessary to prevent unauthorized operation on audit information. TOSS 5 systems providing tools to interface with audit information will leverage user permissions and roles identifying the user accessing the tools, and the corresponding rights the user has, to make access decisions regarding the access to audit tools. Audit tools include, but are not limited to, vendor-provided and open source audit tools needed to successfully view and manipulate audit information system activity and records. Audit tools include custom queries and report generators.
Checks: C-87094r1200577_chk

Verify the audit tools are group owned by "root" using the following command: $ sudo stat -c "%G %n" /sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/autrace /sbin/auditd /sbin/rsyslogd /sbin/augenrules root /sbin/auditctl root /sbin/aureport root /sbin/ausearch root /sbin/autrace root /sbin/auditd root /sbin/rsyslogd root /sbin/augenrules If any audit tools do not have a group owner of "root", this is a finding.

Fix: F-86999r1200578_fix

Configure the audit tools to be group-owned by "root" using the following command: $ sudo chgrp root [audit_tool] Replace "[audit_tool]" with each audit tool not group-owned by "root".

b
TOSS 5 must use cryptographic mechanisms to protect the integrity of audit tools.
AU-9 - Medium - CCI-001493 - V-282534 - SV-282534r1200582_rule
RMF Control
AU-9
Severity
M
CCI
CCI-001493
Version
TOSS-05-000372
Vuln IDs
  • V-282534
Rule IDs
  • SV-282534r1200582_rule
Protecting the integrity of the tools used for auditing purposes is a critical step toward ensuring the integrity of audit information. Audit information includes all information (e.g., audit records, audit settings, and audit reports) needed to successfully audit information system activity. Audit tools include, but are not limited to, vendor-provided and open-source audit tools needed to successfully view and manipulate audit information system activity and records. Audit tools include custom queries and report generators. It is not uncommon for attackers to replace the audit tools or inject code into the existing tools to provide the capability to hide or erase system activity from the audit logs. To address this risk, audit tools must be cryptographically signed to provide the capability to identify when the audit tools have been modified, manipulated, or replaced. An example is a checksum hash of the file or files. Satisfies: SRG-OS-000256-GPOS-00097, SRG-OS-000257-GPOS-00098, SRG-OS-000258-GPOS-00099, SRG-OS-000278-GPOS-00108
Checks: C-87095r1200580_chk

Check that AIDE is properly configured to protect the integrity of the audit tools using the following command: $ sudo cat /etc/aide.conf | grep /usr/sbin/au /usr/sbin/auditctl p+i+n+u+g+s+b+acl+xattrs+sha512 /usr/sbin/auditd p+i+n+u+g+s+b+acl+xattrs+sha512 /usr/sbin/ausearch p+i+n+u+g+s+b+acl+xattrs+sha512 /usr/sbin/aureport p+i+n+u+g+s+b+acl+xattrs+sha512 /usr/sbin/autrace p+i+n+u+g+s+b+acl+xattrs+sha512 /usr/sbin/augenrules p+i+n+u+g+s+b+acl+xattrs+sha512 If AIDE is not installed, ask the system administrator (SA) how file integrity checks are performed on the system. If any of the audit tools listed above do not have a corresponding line, ask the SA to indicate what cryptographic mechanisms are being used to protect the integrity of the audit tools. If there is no evidence of integrity protection, this is a finding.

Fix: F-87000r1200581_fix

Add or update the following lines to "/etc/aide.conf", to protect the integrity of the audit tools. /usr/sbin/auditctl p+i+n+u+g+s+b+acl+xattrs+sha512 /usr/sbin/auditd p+i+n+u+g+s+b+acl+xattrs+sha512 /usr/sbin/ausearch p+i+n+u+g+s+b+acl+xattrs+sha512 /usr/sbin/aureport p+i+n+u+g+s+b+acl+xattrs+sha512 /usr/sbin/autrace p+i+n+u+g+s+b+acl+xattrs+sha512 /usr/sbin/augenrules p+i+n+u+g+s+b+acl+xattrs+sha512

b
TOSS 5 system commands must have mode 755 or less permissive.
CM-5 - Medium - CCI-001499 - V-282535 - SV-282535r1200585_rule
RMF Control
CM-5
Severity
M
CCI
CCI-001499
Version
TOSS-05-000139
Vuln IDs
  • V-282535
Rule IDs
  • SV-282535r1200585_rule
If TOSS 5 allowed any user to make changes to software libraries, then those changes might be implemented without undergoing the appropriate testing and approvals that are part of a robust change management process. This requirement applies to TOSS 5 with software libraries that are accessible and configurable, as in the case of interpreted languages. Software libraries also include privileged programs that execute with escalated privileges.
Checks: C-87096r1200583_chk

Verify the system commands contained in the following directories have mode "755" or less permissive with the following command: $ sudo find -L /bin /sbin /usr/bin /usr/sbin /usr/libexec /usr/local/bin /usr/local/sbin -perm /022 -exec ls -l {} \; If any system commands are found to be group-writable or world-writable, this is a finding.

Fix: F-87001r1200584_fix

Configure the system commands to be protected from unauthorized access. Run the following command, replacing "[FILE]" with any system command with a mode more permissive than "755". $ sudo chmod 755 [FILE]

b
TOSS 5 library directories must have mode 755 or less permissive.
CM-5 - Medium - CCI-001499 - V-282536 - SV-282536r1201579_rule
RMF Control
CM-5
Severity
M
CCI
CCI-001499
Version
TOSS-05-000140
Vuln IDs
  • V-282536
Rule IDs
  • SV-282536r1201579_rule
If TOSS 5 allowed any user to make changes to software libraries, then those changes might be implemented without undergoing the appropriate testing and approvals that are part of a robust change management process. This requirement applies to TOSS 5 with software libraries that are accessible and configurable, as in the case of interpreted languages. Software libraries also include privileged programs that execute with escalated privileges.
Checks: C-87097r1201311_chk

Verify the systemwide shared library directories have mode "755" or less permissive with the following command: $ sudo find -L /lib /lib64 /usr/lib /usr/lib64 -perm /022 -type d -exec ls -l {} \; If any systemwide shared library directory is found to be group-writable or world-writable, this is a finding.

Fix: F-87002r1201578_fix

Configure the systemwide shared library directories (/lib, /lib64, /usr/lib and /usr/lib64) to be protected from unauthorized access. Run the following command, replacing "[DIRECTORY]" with any library directory with a mode more permissive than "755". $ sudo chmod 755 [DIRECTORY]

b
TOSS 5 library files must have mode 755 or less permissive.
CM-5 - Medium - CCI-001499 - V-282537 - SV-282537r1201581_rule
RMF Control
CM-5
Severity
M
CCI
CCI-001499
Version
TOSS-05-000141
Vuln IDs
  • V-282537
Rule IDs
  • SV-282537r1201581_rule
If TOSS 5 allowed any user to make changes to software libraries, then those changes might be implemented without undergoing the appropriate testing and approvals that are part of a robust change management process. This requirement applies to TOSS 5 with software libraries that are accessible and configurable, as in the case of interpreted languages. Software libraries also include privileged programs that execute with escalated privileges.
Checks: C-87098r1201314_chk

Verify the systemwide shared library files contained in the following directories have mode "755" or less permissive with the following command: $ sudo find -L /lib /lib64 /usr/lib /usr/lib64 -perm /022 -type f -exec ls -l {} \; If any systemwide shared library file is found to be group-writable or world-writable, this is a finding.

Fix: F-87003r1201580_fix

Configure the library files to be protected from unauthorized access. Run the following command, replacing "[FILE]" with any library file with a mode more permissive than "755". $ sudo chmod 755 [FILE]

b
TOSS 5 system commands must be owned by root.
CM-5 - Medium - CCI-001499 - V-282538 - SV-282538r1200594_rule
RMF Control
CM-5
Severity
M
CCI
CCI-001499
Version
TOSS-05-000175
Vuln IDs
  • V-282538
Rule IDs
  • SV-282538r1200594_rule
If TOSS 5 allowed any user to make changes to software libraries, then those changes might be implemented without undergoing the appropriate testing and approvals that are part of a robust change management process. This requirement applies to TOSS 5 with software libraries that are accessible and configurable, as in the case of interpreted languages. Software libraries also include privileged programs that execute with escalated privileges.
Checks: C-87099r1200592_chk

Verify the system commands contained in the following directories are owned by "root" with the following command: $ sudo find -L /bin /sbin /usr/bin /usr/sbin /usr/libexec /usr/local/bin /usr/local/sbin ! -user root -exec ls -l {} \; If any system commands are found to not be owned by root, this is a finding.

Fix: F-87004r1200593_fix

Configure the system commands to be protected from unauthorized access. Run the following command, replacing "[FILE]" with any system command file not owned by "root". $ sudo chown root [FILE]

b
TOSS 5 system commands must be group-owned by root or a system account.
CM-5 - Medium - CCI-001499 - V-282539 - SV-282539r1200597_rule
RMF Control
CM-5
Severity
M
CCI
CCI-001499
Version
TOSS-05-000176
Vuln IDs
  • V-282539
Rule IDs
  • SV-282539r1200597_rule
If TOSS 5 allowed any user to make changes to software libraries, then those changes might be implemented without undergoing the appropriate testing and approvals that are part of a robust change management process. This requirement applies to TOSS 5 with software libraries that are accessible and configurable, as in the case of interpreted languages. Software libraries also include privileged programs that execute with escalated privileges.
Checks: C-87100r1200595_chk

Verify the system commands contained in the following directories are group-owned by "root", or a required system account, with the following command: $ sudo find -L /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin ! -group root -exec ls -l {} \; If any system commands are returned and is not group-owned by a required system account, and is not documented with the information system security officer (ISSO) as an operational requirement, this is a finding.

Fix: F-87005r1200596_fix

Configure the system commands to be protected from unauthorized access. Run the following command, replacing "[FILE]" with any system command file not group-owned by "root" or a required system account. $ sudo chgrp root [FILE]

b
TOSS 5 library files must be owned by root.
CM-5 - Medium - CCI-001499 - V-282540 - SV-282540r1201318_rule
RMF Control
CM-5
Severity
M
CCI
CCI-001499
Version
TOSS-05-000177
Vuln IDs
  • V-282540
Rule IDs
  • SV-282540r1201318_rule
If TOSS 5 allowed any user to make changes to software libraries, then those changes might be implemented without undergoing the appropriate testing and approvals that are part of a robust change management process. This requirement applies to TOSS 5 with software libraries that are accessible and configurable, as in the case of interpreted languages. Software libraries also include privileged programs that execute with escalated privileges.
Checks: C-87101r1201316_chk

Verify the systemwide shared library files are owned by "root" with the following command: $ sudo find -L /lib /lib64 /usr/lib /usr/lib64 ! -user root -exec ls -l {} \; If any systemwide shared library file is not owned by root, this is a finding.

Fix: F-87006r1201317_fix

Configure the systemwide shared library files (/lib, /lib64, /usr/lib and /usr/lib64) to be protected from unauthorized access. Run the following command, replacing "[FILE]" with any library file not owned by "root". $ sudo chown root [FILE]

b
TOSS 5 library files must be group-owned by root or a system account.
CM-5 - Medium - CCI-001499 - V-282541 - SV-282541r1201321_rule
RMF Control
CM-5
Severity
M
CCI
CCI-001499
Version
TOSS-05-000178
Vuln IDs
  • V-282541
Rule IDs
  • SV-282541r1201321_rule
If TOSS 5 allowed any user to make changes to software libraries, then those changes might be implemented without undergoing the appropriate testing and approvals that are part of a robust change management process. This requirement applies to TOSS 5 with software libraries that are accessible and configurable, as in the case of interpreted languages. Software libraries also include privileged programs that execute with escalated privileges.
Checks: C-87102r1201319_chk

Verify the systemwide shared library files are group-owned by "root" with the following command: $ sudo find -L /lib /lib64 /usr/lib /usr/lib64 ! -group root -exec ls -l {} \; If any systemwide shared library file is returned and is not group-owned by a required system account, and is not documented with the information system security officer (ISSO) as an operational requirement, this is a finding.

Fix: F-87007r1201320_fix

Configure the systemwide shared library files (/lib, /lib64, /usr/lib and /usr/lib64) to be protected from unauthorized access. Run the following command, replacing "[FILE]" with any library file not group-owned by "root". $ sudo chgrp root [FILE]

b
TOSS 5 library directories must be owned by root.
CM-5 - Medium - CCI-001499 - V-282542 - SV-282542r1201324_rule
RMF Control
CM-5
Severity
M
CCI
CCI-001499
Version
TOSS-05-000179
Vuln IDs
  • V-282542
Rule IDs
  • SV-282542r1201324_rule
If TOSS 5 allowed any user to make changes to software libraries, then those changes might be implemented without undergoing the appropriate testing and approvals that are part of a robust change management process. This requirement applies to TOSS 5 with software libraries that are accessible and configurable, as in the case of interpreted languages. Software libraries also include privileged programs that execute with escalated privileges.
Checks: C-87103r1201322_chk

Verify the systemwide shared library directories are owned by "root" with the following command: $ sudo find /lib /lib64 /usr/lib /usr/lib64 ! -user root -type d -exec stat -c "%n %U" '{}' \; If any systemwide shared library directory is not owned by root, this is a finding.

Fix: F-87008r1201323_fix

Configure the systemwide shared library directories within (/lib, /lib64, /usr/lib and /usr/lib64) to be protected from unauthorized access. Run the following command, replacing "[DIRECTORY]" with any library directory not owned by "root". $ sudo chown root [DIRECTORY]

b
TOSS 5 library directories must be group-owned by root or a system account.
CM-5 - Medium - CCI-001499 - V-282543 - SV-282543r1201327_rule
RMF Control
CM-5
Severity
M
CCI
CCI-001499
Version
TOSS-05-000180
Vuln IDs
  • V-282543
Rule IDs
  • SV-282543r1201327_rule
If TOSS 5 allowed any user to make changes to software libraries, then those changes might be implemented without undergoing the appropriate testing and approvals that are part of a robust change management process. This requirement applies to TOSS 5 with software libraries that are accessible and configurable, as in the case of interpreted languages. Software libraries also include privileged programs that execute with escalated privileges.
Checks: C-87104r1201325_chk

Verify the systemwide shared library directories are group-owned by "root" with the following command: $ sudo find /lib /lib64 /usr/lib /usr/lib64 ! -group root -type d -exec stat -c "%n %G" '{}' \; If any systemwide shared library directory is returned and is not group-owned by a required system account, and is not documented with the information system security officer (ISSO) as an operational requirement, this is a finding.

Fix: F-87009r1201326_fix

Configure the systemwide shared library directories (/lib, /lib64, /usr/lib and /usr/lib64) to be protected from unauthorized access. Run the following command, replacing "[DIRECTORY]" with any library directory not group-owned by "root". $ sudo chgrp root [DIRECTORY]

b
TOSS 5 must enforce password complexity by requiring at least one special character.
Medium - CCI-004066 - V-282544 - SV-282544r1200612_rule
RMF Control
Severity
M
CCI
CCI-004066
Version
TOSS-05-000346
Vuln IDs
  • V-282544
Rule IDs
  • SV-282544r1200612_rule
Using a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that must be tested before the password is compromised. TOSS 5 uses "pwquality" as a mechanism to enforce password complexity. Note that to require special characters without degrading the "minlen" value, the credit value must be expressed as a negative number in "/etc/security/pwquality.conf".
Checks: C-87105r1200610_chk

Verify TOSS 5 enforces password complexity by requiring at least one special character using the following command: $ sudo grep ocredit /etc/security/pwquality.conf /etc/security/pwquality.conf.d/*.conf ocredit = -1 If the value of "ocredit" is a positive number or is commented out, this is a finding.

Fix: F-87010r1200611_fix

Configure TOSS 5 to enforce password complexity by requiring at least one special character be used by setting the "ocredit" option. Add the following line to "/etc/security/pwquality.conf" (or modify the line to have the required value): ocredit = -1

b
The TOSS 5 systemd-journald service must be enabled.
SC-24 - Medium - CCI-001665 - V-282545 - SV-282545r1200615_rule
RMF Control
SC-24
Severity
M
CCI
CCI-001665
Version
TOSS-05-000089
Vuln IDs
  • V-282545
Rule IDs
  • SV-282545r1200615_rule
In the event of a system failure, TOSS 5 must preserve any information necessary to determine cause of the failure and return to operations with the least disruption to system processes.
Checks: C-87106r1200613_chk

Verify "systemd-journald" is active on TOSS 5 using the following command: $ systemctl is-active systemd-journald active If the "systemd-journald" service is not active, this is a finding.

Fix: F-87011r1200614_fix

Enable the "systemd-journald" service using the following command: $ sudo systemctl enable --now systemd-journald

b
TOSS 5 must securely compare internal information system clocks at least every 24 hours.
AC-17 - Medium - CCI-002322 - V-282549 - SV-282549r1200627_rule
RMF Control
AC-17
Severity
M
CCI
CCI-002322
Version
TOSS-05-000202
Vuln IDs
  • V-282549
Rule IDs
  • SV-282549r1200627_rule
Inaccurate time stamps make it more difficult to correlate events and can lead to an inaccurate analysis. Determining the correct time a particular event occurred on a system is critical when conducting forensic analysis and investigating system events. Sources outside the configured acceptable allowance (drift) may be inaccurate. Synchronizing internal information system clocks provides uniformity of time stamps for information systems with multiple system clocks and systems connected over a network. Depending on the infrastructure being used the "pool" directive may not be supported. Authoritative time sources include the United States Naval Observatory (USNO) time servers, a time server designated for the appropriate DOD network (NIPRNet/SIPRNet), and/or the Global Positioning System (GPS). Satisfies: SRG-OS-000298-GPOS-00116, SRG-OS-000355-GPOS-00143, SRG-OS-000356-GPOS-00144, SRG-OS-000359-GPOS-00146
Checks: C-87110r1200625_chk

Verify TOSS 5 is securely comparing internal information system clocks at least every 24 hours with an NTP server with the following commands: $ sudo grep maxpoll /etc/chrony.conf server 0.us.pool.ntp.mil iburst maxpoll 16 If the "maxpoll" option is set to a number greater than 16 or the line is commented out, this is a finding. Verify the "chrony.conf" file is configured to an authoritative DOD time source using the following command: $ sudo grep -i server /etc/chrony.conf server 0.us.pool.ntp.mil If the parameter "server" is not set or is not set to an authoritative DOD time source, this is a finding.

Fix: F-87015r1200626_fix

Configure TOSS 5 to securely compare internal information system clocks at least every 24 hours with an NTP server by adding/modifying the following line in the /etc/chrony.conf file: server [ntp.server.name] iburst maxpoll 16

b
TOSS 5 must enable kernel parameters to enforce discretionary access control on hardlinks.
AC-3 - Medium - CCI-002165 - V-282553 - SV-282553r1200639_rule
RMF Control
AC-3
Severity
M
CCI
CCI-002165
Version
TOSS-05-000102
Vuln IDs
  • V-282553
Rule IDs
  • SV-282553r1200639_rule
By enabling the "fs.protected_hardlinks" kernel parameter, users can no longer create soft or hard links to files they do not own. Disallowing such hardlinks mitigates vulnerabilities based on insecure file system accessed by privileged programs, avoiding an exploitation vector exploiting unsafe use of open() or creat(). Satisfies: SRG-OS-000312-GPOS-00123, SRG-OS-000324-GPOS-00125
Checks: C-87114r1200637_chk

Verify TOSS 5 is configured to enable DAC on hardlinks using the following command: $ sudo sysctl fs.protected_hardlinks fs.protected_hardlinks = 1 If "fs.protected_hardlinks" is not set to "1" or is missing, this is a finding.

Fix: F-87019r1200638_fix

Configure TOSS 5 to enable DAC on hardlinks with the following: Add or edit the following line in a system configuration file in the "/etc/sysctl.d/" directory: fs.protected_hardlinks = 1 Load settings from all system configuration files using the following command: $ sudo sysctl --system

b
TOSS 5 must enable kernel parameters to enforce discretionary access control (DAC) on symlinks.
AC-3 - Medium - CCI-002165 - V-282554 - SV-282554r1201608_rule
RMF Control
AC-3
Severity
M
CCI
CCI-002165
Version
TOSS-05-000103
Vuln IDs
  • V-282554
Rule IDs
  • SV-282554r1201608_rule
By enabling the "fs.protected_symlinks" kernel parameter, symbolic links are permitted to be followed only when outside a sticky world-writable directory, or when the user identifier (UID) of the link and follower match, or when the directory owner matches the symlink's owner. Disallowing such symlinks helps mitigate vulnerabilities based on insecure file system accessed by privileged programs, avoiding an exploitation vector exploiting unsafe use of open() or creat(). Satisfies: SRG-OS-000312-GPOS-00123, SRG-OS-000324-GPOS-00125
Checks: C-87115r1200640_chk

Verify TOSS 5 is configured to enable DAC on symlinks using the following command: $ sudo sysctl fs.protected_symlinks fs.protected_symlinks = 1 If "fs.protected_symlinks " is not set to "1" or is missing, this is a finding.

Fix: F-87020r1200641_fix

Configure TOSS 5 to enable DAC on symlinks with the following: Add or edit the following line in a system configuration file in the "/etc/sysctl.d/" directory: fs.protected_symlinks = 1 Load settings from all system configuration files using the following command: $ sudo sysctl --system

c
The systemd Ctrl-Alt-Delete burst key sequence in TOSS 5 must be disabled.
AC-6 - High - CCI-002235 - V-282557 - SV-282557r1200651_rule
RMF Control
AC-6
Severity
H
CCI
CCI-002235
Version
TOSS-05-000090
Vuln IDs
  • V-282557
Rule IDs
  • SV-282557r1200651_rule
A locally logged-in user who presses Ctrl-Alt-Delete when at the console can reboot the system. If accidentally pressed, as could happen in the case of a mixed operating system environment, this can create the risk of short-term loss of systems availability due to unintentional reboot. In a graphical user environment, risk of unintentional reboot from the Ctrl-Alt-Delete sequence is reduced because the user will be prompted before any action is taken.
Checks: C-87118r1200649_chk

Verify TOSS 5 is configured to not reboot the system when Ctrl-Alt-Delete is pressed seven times within two seconds using the following command: $ sudo grep -iR CtrlAltDelBurstAction /etc/systemd/system* /etc/systemd/system.conf.d/55-CtrlAltDel-BurstAction:CtrlAltDelBurstAction=none If "CtrlAltDelBurstAction" is not set to "none", is commented out, or is missing, this is a finding.

Fix: F-87023r1200650_fix

Configure TOSS 5 to disable "CtrlAltDelBurstAction" by adding it to a drop file in a "/etc/systemd/system.conf.d/" configuration file: If no drop file exists, create one using the following command: $ sudo mkdir -p /etc/systemd/system.conf.d && sudo vi /etc/systemd/system.conf.d/55-CtrlAltDel-BurstAction Edit the file to contain the setting by adding the following text: CtrlAltDelBurstAction=none Reload the daemon for this change to take effect. $ sudo systemctl daemon-reload

c
The x86 Ctrl-Alt-Delete key sequence must be disabled on TOSS 5.
AC-6 - High - CCI-002235 - V-282558 - SV-282558r1200654_rule
RMF Control
AC-6
Severity
H
CCI
CCI-002235
Version
TOSS-05-000091
Vuln IDs
  • V-282558
Rule IDs
  • SV-282558r1200654_rule
A locally logged-in user who presses Ctrl-Alt-Delete when at the console can reboot the system. If accidentally pressed, as could happen in the case of a mixed operating system environment, this can create the risk of short-term loss of systems availability due to unintentional reboot. In a graphical user environment, risk of unintentional reboot from the Ctrl-Alt-Delete sequence is reduced because the user will be prompted before any action is taken.
Checks: C-87119r1200652_chk

Verify TOSS 5 is not configured to reboot the system when Ctrl-Alt-Delete is pressed using the following command: $ sudo systemctl status ctrl-alt-del.target ctrl-alt-del.target Loaded: masked (Reason: Unit ctrl-alt-del.target is masked.) Active: inactive (dead) If "ctrl-alt-del.target" is loaded and not masked, this is a finding.

Fix: F-87024r1200653_fix

Configure TOSS 5 to disable "ctrl-alt-del.target" using the following command: $ sudo systemctl disable --now ctrl-alt-del.target $ sudo systemctl mask --now ctrl-alt-del.target

b
The TOSS 5 debug-shell systemd service must be disabled.
AC-6 - Medium - CCI-002235 - V-282559 - SV-282559r1200657_rule
RMF Control
AC-6
Severity
M
CCI
CCI-002235
Version
TOSS-05-000092
Vuln IDs
  • V-282559
Rule IDs
  • SV-282559r1200657_rule
The debug-shell requires no authentication and provides root privileges to anyone who has physical access to the machine. While this feature is disabled by default, masking it adds an additional layer of assurance that it will not be enabled via a dependency in systemd. This also prevents attackers with physical access from trivially bypassing security on the machine through valid troubleshooting configurations and gaining root access when the system is rebooted.
Checks: C-87120r1200655_chk

Verify TOSS 5 is configured to mask the "debug-shell systemd" service using the following command: $ sudo systemctl status debug-shell.service debug-shell.service Loaded: masked (Reason: Unit debug-shell.service is masked.) Active: inactive (dead) If the "debug-shell.service" is loaded and not masked, this is a finding.

Fix: F-87025r1200656_fix

Configure TOSS 5 to mask the "debug-shell systemd" service using the following command: $ sudo systemctl disable --now debug-shell.service $ sudo systemctl mask --now debug-shell.service

b
TOSS 5 must have the sudo package installed.
AC-6 - Medium - CCI-002235 - V-282560 - SV-282560r1200660_rule
RMF Control
AC-6
Severity
M
CCI
CCI-002235
Version
TOSS-05-000324
Vuln IDs
  • V-282560
Rule IDs
  • SV-282560r1200660_rule
"sudo" is a program designed to allow a system administrator to give limited root privileges to users and log root activity. The basic philosophy is to give as few privileges as possible but still allow system users to get their work done.
Checks: C-87121r1200658_chk

Verify the TOSS 5 "sudo" package is installed using the following command: $ sudo dnf list --installed sudo Example output: sudo.x86_64 1.9.5p2-7.el9 If the "sudo" package is not installed, this is a finding.

Fix: F-87026r1200659_fix

The "sudo" package can be installed using the following command: $ sudo dnf install sudo

b
TOSS 5 must audit uses of the execve system call.
AC-6 - Medium - CCI-002233 - V-282561 - SV-282561r1200663_rule
RMF Control
AC-6
Severity
M
CCI
CCI-002233
Version
TOSS-05-000411
Vuln IDs
  • V-282561
Rule IDs
  • SV-282561r1200663_rule
Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised information system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider threats and the advanced persistent threat. Satisfies: SRG-OS-000326-GPOS-00126, SRG-OS-000327-GPOS-00127
Checks: C-87122r1200661_chk

Verify TOSS 5 is configured to audit the execution of the "execve" system call using the following command: $ sudo auditctl -l | grep execve -a always,exit -F arch=b32 -S execve -C uid!=euid -F euid=0 -k execpriv -a always,exit -F arch=b64 -S execve -C uid!=euid -F euid=0 -k execpriv -a always,exit -F arch=b32 -S execve -C gid!=egid -F egid=0 -k execpriv -a always,exit -F arch=b64 -S execve -C gid!=egid -F egid=0 -k execpriv If the command does not return all lines, or the lines are commented out, this is a finding.

Fix: F-87027r1200662_fix

Configure TOSS 5 to audit the execution of the "execve" system call. Add or update the following file system rules to "/etc/audit/rules.d/audit.rules": -a always,exit -F arch=b32 -S execve -C uid!=euid -F euid=0 -k execpriv -a always,exit -F arch=b64 -S execve -C uid!=euid -F euid=0 -k execpriv -a always,exit -F arch=b32 -S execve -C gid!=egid -F egid=0 -k execpriv -a always,exit -F arch=b64 -S execve -C gid!=egid -F egid=0 -k execpriv Restart the audit daemon for the changes to take effect.

b
TOSS 5 must allocate audit record storage capacity to store at least one week's worth of audit records.
AU-4 - Medium - CCI-001849 - V-282562 - SV-282562r1201623_rule
RMF Control
AU-4
Severity
M
CCI
CCI-001849
Version
TOSS-05-000390
Vuln IDs
  • V-282562
Rule IDs
  • SV-282562r1201623_rule
To ensure TOSS 5 systems have a sufficient storage capacity in which to write the audit logs, TOSS 5 needs to be able to allocate audit record storage capacity. The task of allocating audit record storage capacity is usually performed during initial installation of TOSS 5.
Checks: C-87123r1201622_chk

Verify TOSS 5 allocates audit record storage capacity to store at least one week of audit records when audit records are not immediately sent to a central audit record storage facility. If the system is configured to immediately off-load audit records to an external system, this requirement is not applicable. Note: The partition size needed to capture a week of audit records is based on the activity level of the system and the total storage capacity available. Typically, 10GB of storage space for audit records should be sufficient. Determine which partition the audit records are being written to using the following command: $ sudo grep log_file /etc/audit/auditd.conf log_file = /var/log/audit/audit.log Check the size of the partition that audit records are written to with the following command to verify whether it is large enough: # df -h /var/log/audit/ /dev/sda2 24G 10.4G 13.6G 43% /var/log/audit If the audit record partition is not allocated for sufficient storage capacity, this is a finding.

Fix: F-87028r1200665_fix

Allocate enough storage capacity for at least one week of audit records when audit records are not immediately sent to a central audit record storage facility. If audit records are stored on a partition made specifically for audit records, resize the partition with sufficient space to contain one week of audit records. If audit records are not stored on a partition made specifically for audit records, a new partition with sufficient space will need be to be created.

b
TOSS 5 must be configured to off-load audit records onto a different system from the system being audited via syslog.
AU-4 - Medium - CCI-001851 - V-282563 - SV-282563r1200669_rule
RMF Control
AU-4
Severity
M
CCI
CCI-001851
Version
TOSS-05-000380
Vuln IDs
  • V-282563
Rule IDs
  • SV-282563r1200669_rule
The auditd service does not include the ability to send audit records to a centralized server for management directly. However, it can use a plug-in for an audit event multiplexor (audispd) to pass audit records to the local syslog server.
Checks: C-87124r1200667_chk

Verify TOSS 5 is configured use the "audisp-remote" syslog service using the following command: $ sudo grep active /etc/audit/plugins.d/syslog.conf active = yes If the "active" keyword does not have a value of "yes", the line is commented out, or the line is missing, this is a finding.

Fix: F-87029r1200668_fix

Edit the "/etc/audit/plugins.d/syslog.conf" file and add or update the "active" option: active = yes Restart the audit daemon for the changes to take effect.

b
TOSS 5 must authenticate the remote logging server for off-loading audit logs via rsyslog.
AU-4 - Medium - CCI-001851 - V-282564 - SV-282564r1201619_rule
RMF Control
AU-4
Severity
M
CCI
CCI-001851
Version
TOSS-05-000381
Vuln IDs
  • V-282564
Rule IDs
  • SV-282564r1201619_rule
Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Off-loading is a common process in information systems with limited audit storage capacity. TOSS 5 installation media provides "rsyslogd", a system utility providing support for message logging. Support for both internet and Unix domain sockets enables this utility to support both local and remote logging. Coupling this utility with "gnutls" (a secure communications library implementing the SSL, TLS, and DTLS protocols) creates a method to securely encrypt and off-load auditing. Rsyslog-supported authentication modes include: anon - anonymous authentication x509/fingerprint - certificate fingerprint authentication x509/certvalid - certificate validation only x509/name - certificate validation and subject name authentication
Checks: C-87125r1200670_chk

Verify TOSS 5 authenticates the remote logging server for off-loading audit logs using the following command: $ sudo grep -i '$ActionSendStreamDriverAuthMode' /etc/rsyslog.conf /etc/rsyslog.d/*.conf /etc/rsyslog.conf:$ActionSendStreamDriverAuthMode x509/name If the value of the "$ActionSendStreamDriverAuthMode" option is not set to "x509/name" or the line is commented out, ask the system administrator (SA) to indicate how the audit logs are off-loaded to a different system or media. If there is no evidence that the transfer of the audit logs being off-loaded to another system or media is encrypted, this is a finding.

Fix: F-87030r1200671_fix

Configure TOSS 5 to authenticate the remote logging server for off-loading audit logs by setting the following option in "/etc/rsyslog.conf" or "/etc/rsyslog.d/[customfile].conf": $ActionSendStreamDriverAuthMode x509/name

b
TOSS 5 must encrypt the transfer of audit records off-loaded onto a different system or media from the system being audited via rsyslog.
AU-4 - Medium - CCI-001851 - V-282565 - SV-282565r1201620_rule
RMF Control
AU-4
Severity
M
CCI
CCI-001851
Version
TOSS-05-000382
Vuln IDs
  • V-282565
Rule IDs
  • SV-282565r1201620_rule
Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Off-loading is a common process in information systems with limited audit storage capacity. TOSS 5 installation media provides "rsyslogd", a system utility providing support for message logging. Support for both internet and Unix domain sockets enables this utility to support both local and remote logging. Coupling this utility with "gnutls" (a secure communications library implementing the SSL, TLS, and DTLS protocols) creates a method to securely encrypt and off-load auditing. Rsyslog-supported authentication modes include: anon - anonymous authentication x509/fingerprint - certificate fingerprint authentication x509/certvalid - certificate validation only x509/name - certificate validation and subject name authentication
Checks: C-87126r1200673_chk

Verify TOSS 5 encrypts audit records off-loaded onto a different system or media from the system being audited via rsyslog using the following command: $ sudo grep -i '$ActionSendStreamDriverMode' /etc/rsyslog.conf /etc/rsyslog.d/*.conf /etc/rsyslog.conf:$ActionSendStreamDriverMode 1 If the value of the "$ActionSendStreamDriverMode" option is not set to "1" or the line is commented out, this is a finding.

Fix: F-87031r1200674_fix

Configure TOSS 5 to encrypt off-loaded audit records via rsyslog by setting the following options in "/etc/rsyslog.conf" or "/etc/rsyslog.d/[customfile].conf": $ActionSendStreamDriverMode 1

b
TOSS 5 must encrypt, via the gtls driver, the transfer of audit records off-loaded onto a different system or media from the system being audited via rsyslog.
AU-4 - Medium - CCI-001851 - V-282566 - SV-282566r1200678_rule
RMF Control
AU-4
Severity
M
CCI
CCI-001851
Version
TOSS-05-000383
Vuln IDs
  • V-282566
Rule IDs
  • SV-282566r1200678_rule
Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Off-loading is a common process in information systems with limited audit storage capacity. TOSS 5 installation media provides "rsyslogd", a system utility providing support for message logging. Support for both internet and Unix domain sockets enables this utility to support both local and remote logging. Coupling this utility with "gnutls" (a secure communications library implementing the SSL, TLS, and DTLS protocols) creates a method to securely encrypt and off-load auditing.
Checks: C-87127r1200676_chk

Verify TOSS 5 uses the gtls driver to encrypt audit records off-loaded onto a different system or media from the system being audited using the following command: $ sudo grep -i '$DefaultNetstreamDriver' /etc/rsyslog.conf /etc/rsyslog.d/*.conf /etc/rsyslog.conf:$DefaultNetstreamDriver gtls If the value of the "$DefaultNetstreamDriver" option is not set to "gtls" or the line is commented out, this is a finding.

Fix: F-87032r1200677_fix

Configure TOSS 5 to use the gtls driver to encrypt off-loaded audit records by setting the following options in "/etc/rsyslog.conf" or "/etc/rsyslog.d/[customfile].conf": $DefaultNetstreamDriver gtls

b
TOSS 5 must take appropriate action when the internal event queue is full.
AU-4 - Medium - CCI-001851 - V-282567 - SV-282567r1200681_rule
RMF Control
AU-4
Severity
M
CCI
CCI-001851
Version
TOSS-05-000397
Vuln IDs
  • V-282567
Rule IDs
  • SV-282567r1200681_rule
The audit system should have an action setup in the event the internal event queue becomes full so that no data is lost. Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Off-loading is a common process in information systems with limited audit storage capacity.
Checks: C-87128r1200679_chk

Verify TOSS 5 audit system is configured to take an appropriate action when the internal event queue is full: $ sudo grep -i overflow_action /etc/audit/auditd.conf overflow_action = syslog If the value of the "overflow_action" option is not set to "syslog", "single", "halt" or the line is commented out, ask the system administrator (SA) to indicate how the audit logs are off-loaded to a different system or media. If there is no evidence that the transfer of the audit logs being off-loaded to another system or media takes appropriate action if the internal event queue becomes full, this is a finding.

Fix: F-87033r1200680_fix

Edit the "/etc/audit/auditd.conf" file and add or update the "overflow_action" option: overflow_action = syslog Restart the audit daemon for changes to take effect.

b
TOSS 5 audispd-plugins package must be installed.
AU-4 - Medium - CCI-001851 - V-282568 - SV-282568r1200684_rule
RMF Control
AU-4
Severity
M
CCI
CCI-001851
Version
TOSS-05-000410
Vuln IDs
  • V-282568
Rule IDs
  • SV-282568r1200684_rule
"audispd-plugins" provides plugins for the real-time interface to the audit subsystem, "audispd". These plugins can relay events to remote machines or analyze events for suspicious behavior.
Checks: C-87129r1200682_chk

Verify TOSS 5 has the "audispd-plugins" package for installed using the following command: $ sudo dnf list --installed audispd-plugins Example output: audispd-plugins.x86_64 3.0.7-101.el9_0.2 If the "audispd-plugins" package is not installed, this is a finding.

Fix: F-87034r1200683_fix

Install the "audispd-plugins" package using the following command: $ sudo dnf install audispd-plugins

b
TOSS 5 must act when allocated audit record storage volume reaches 75 percent of the repository maximum audit record storage capacity.
AU-5 - Medium - CCI-001855 - V-282569 - SV-282569r1200687_rule
RMF Control
AU-5
Severity
M
CCI
CCI-001855
Version
TOSS-05-000391
Vuln IDs
  • V-282569
Rule IDs
  • SV-282569r1200687_rule
If security personnel are not notified immediately when storage volume reaches 75 percent utilization, they are unable to plan for audit record storage capacity expansion.
Checks: C-87130r1200685_chk

Verify TOSS 5 takes action when allocated audit record storage volume reaches 75 percent of the repository maximum audit record storage capacity using the following command: $ sudo grep -w space_left /etc/audit/auditd.conf space_left = 25% If the value of the "space_left" keyword is not set to 25 percent of the storage volume allocated to audit logs, or if the line is commented out, ask the system administrator (SA) to indicate how the system is providing real-time alerts to the SA and information system security officer (ISSO). If the "space_left" value is not configured to the correct value, this is a finding.

Fix: F-87035r1200686_fix

Configure TOSS 5 to initiate an action to notify the SA and ISSO (at a minimum) when allocated audit record storage volume reaches 75 percent of the repository maximum audit record storage capacity by adding/modifying the following line in the /etc/audit/auditd.conf file. space_left = 25%

b
TOSS 5 must notify the system administrator (SA) and information system security officer (ISSO) (at a minimum) when allocated audit record storage volume 75 percent utilization.
AU-5 - Medium - CCI-001855 - V-282570 - SV-282570r1200690_rule
RMF Control
AU-5
Severity
M
CCI
CCI-001855
Version
TOSS-05-000392
Vuln IDs
  • V-282570
Rule IDs
  • SV-282570r1200690_rule
If security personnel are not notified immediately when storage volume reaches 75 percent utilization, they are unable to plan for audit record storage capacity expansion.
Checks: C-87131r1200688_chk

Verify TOSS 5 notifies the SA and ISSO (at a minimum) when allocated audit record storage volume reaches 75 percent of the repository maximum audit record storage capacity using the following command: $ sudo grep -w space_left_action /etc/audit/auditd.conf space_left_action = email If the value of the "space_left_action" is not set to "email", or if the line is commented out, ask the SA to indicate how the system is providing real-time alerts to the SA and ISSO. If there is no evidence that real-time alerts are configured on the system, this is a finding.

Fix: F-87036r1200689_fix

Configure TOSS 5 to initiate an action to notify the SA and ISSO (at a minimum) when allocated audit record storage volume reaches 75 percent of the repository maximum audit record storage capacity by adding/modifying the following line in the /etc/audit/auditd.conf file. space_left_action = email

b
TOSS 5 must act when allocated audit record storage volume reaches 95 percent of the audit record storage capacity.
AU-5 - Medium - CCI-001855 - V-282571 - SV-282571r1200693_rule
RMF Control
AU-5
Severity
M
CCI
CCI-001855
Version
TOSS-05-000393
Vuln IDs
  • V-282571
Rule IDs
  • SV-282571r1200693_rule
If action is not taken when storage volume reaches 95 percent utilization, the auditing system may fail when the storage volume reaches capacity.
Checks: C-87132r1200691_chk

Verify TOSS 5 takes action when allocated audit record storage volume reaches 95 percent of the repository maximum audit record storage capacity using the following command: $ sudo grep -w admin_space_left /etc/audit/auditd.conf admin_space_left = 5% If the value of the "admin_space_left" keyword is not set to 5 percent of the storage volume allocated to audit logs, or if the line is commented out, ask the system administrator (SA) to indicate how the system is taking action if the allocated storage is about to reach capacity. If the "space_left" value is not configured to the correct value, this is a finding.

Fix: F-87037r1200692_fix

Configure TOSS 5 to initiate an action when allocated audit record storage volume reaches 95 percent of the repository maximum audit record storage capacity by adding/modifying the following line in the "/etc/audit/auditd.conf" file. admin_space_left = 5%

b
TOSS 5 must act when allocated audit record storage volume reaches 95 percent of the repository maximum audit record storage capacity.
AU-5 - Medium - CCI-001855 - V-282572 - SV-282572r1200696_rule
RMF Control
AU-5
Severity
M
CCI
CCI-001855
Version
TOSS-05-000394
Vuln IDs
  • V-282572
Rule IDs
  • SV-282572r1200696_rule
If action is not taken when storage volume reaches 95 percent utilization, the auditing system may fail when the storage volume reaches capacity.
Checks: C-87133r1200694_chk

Verify TOSS 5 is configured to take action in the event of allocated audit record storage volume reaches 95 percent of the repository maximum audit record storage capacity using the following command: $ sudo grep admin_space_left_action /etc/audit/auditd.conf admin_space_left_action = single If the value of the "admin_space_left_action" is not set to "single", or if the line is commented out, ask the system administrator (SA) to indicate how the system is providing real-time alerts to the SA and information system security officer (ISSO). If there is no evidence that real-time alerts are configured on the system, this is a finding.

Fix: F-87038r1200695_fix

Configure "auditd" service to act in the event of allocated audit record storage volume reaches 95 percent of the repository maximum audit record storage capacity. Edit the following line in "/etc/audit/auditd.conf" to ensure that the system is forced into single user mode in the event the audit record storage volume is about to reach maximum capacity: admin_space_left_action = single Restart the audit daemon changes to take effect.

b
TOSS 5 must have the chrony package installed.
Medium - CCI-004923 - V-282574 - SV-282574r1200702_rule
RMF Control
Severity
M
CCI
CCI-004923
Version
TOSS-05-000200
Vuln IDs
  • V-282574
Rule IDs
  • SV-282574r1200702_rule
Inaccurate time stamps make it more difficult to correlate events and can lead to an inaccurate analysis. Determining the correct time a particular event occurred on a system is critical when conducting forensic analysis and investigating system events. Sources outside the configured acceptable allowance (drift) may be inaccurate.
Checks: C-87135r1200700_chk

Verify TOSS 5 has the "chrony" package installed using the following command: $ sudo dnf list --installed chrony Example output: chrony.x86_64 4.1-3.el9 If the "chrony" package is not installed, this is a finding.

Fix: F-87040r1200701_fix

The "chrony" package can be installed using the following command: $ sudo dnf install chrony

b
TOSS 5 chronyd service must be enabled.
Medium - CCI-004923 - V-282575 - SV-282575r1200705_rule
RMF Control
Severity
M
CCI
CCI-004923
Version
TOSS-05-000201
Vuln IDs
  • V-282575
Rule IDs
  • SV-282575r1200705_rule
Inaccurate time stamps make it more difficult to correlate events and can lead to an inaccurate analysis. Determining the correct time a particular event occurred on a system is critical when conducting forensic analysis and investigating system events. Sources outside the configured acceptable allowance (drift) may be inaccurate. Synchronizing internal information system clocks provides uniformity of time stamps for information systems with multiple system clocks and systems connected over a network.
Checks: C-87136r1200703_chk

Verify the "chronyd" service is active using the following command: $ systemctl is-active chronyd active If the "chronyd" service is not active, this is a finding.

Fix: F-87041r1200704_fix

Enable the "chronyd" service using the following command: $ sudo systemctl enable --now chronyd

b
TOSS 5 must have the s-nail package installed.
CM-3 - Medium - CCI-001744 - V-282578 - SV-282578r1200714_rule
RMF Control
CM-3
Severity
M
CCI
CCI-001744
Version
TOSS-05-000132
Vuln IDs
  • V-282578
Rule IDs
  • SV-282578r1200714_rule
The "s-nail" package provides the mail command required to allow sending email notifications of unauthorized configuration changes to designated personnel.
Checks: C-87139r1200712_chk

Verify TOSS 5 is configured to allow sending email notifications. Note: The "s-nail" package provides the "mail" command that is used to send email messages. Verify the "s-nail" package is installed on the system: $ sudo dnf list --installed s-nail s-nail.x86_64 14.9.22-6.el9 If "s-nail" package is not installed, this is a finding.

Fix: F-87044r1200713_fix

The "s-nail" package can be installed using the following command: $ sudo dnf install s-nail

b
TOSS 5 must have the Advanced Intrusion Detection Environment (AIDE) package installed.
CM-3 - Medium - CCI-001744 - V-282579 - SV-282579r1201582_rule
RMF Control
CM-3
Severity
M
CCI
CCI-001744
Version
TOSS-05-000369
Vuln IDs
  • V-282579
Rule IDs
  • SV-282579r1201582_rule
Without verifying the security functions, security functions may not operate correctly, and the failure may go unnoticed. Security function is defined as the hardware, software, and/or firmware of the information system responsible for enforcing the system security policy and supporting the isolation of code and data on which the protection is based. Security functionality includes, but is not limited to, establishing system accounts, configuring access authorizations (i.e., permissions, privileges), setting events to be audited, and setting intrusion detection parameters. Satisfies: SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199
Checks: C-87140r1200715_chk

Verify TOSS 5 has the AIDE package installed using the following command: $ sudo dnf list --installed aide Example output: aide.x86_64 0.16.100.el9 If AIDE is not installed, ask the system administrator (SA) how file integrity checks are performed on the system. If there is no application installed to perform integrity checks, this is a finding. If AIDE is installed, check if it has been initialized using the following command: $ sudo /usr/sbin/aide --check If the output is "Couldn't open file /var/lib/aide/aide.db.gz for reading", this is a finding.

Fix: F-87045r1200716_fix

Install AIDE, initialize it, and perform a manual check. Install AIDE: $ sudo dnf install aide Initialize AIDE: $ sudo /usr/sbin/aide --init Example output: Start timestamp: 2023-06-05 10:09:04 -0600 (AIDE 0.16) AIDE initialized database at /var/lib/aide/aide.db.new.gz Number of entries: 86833 --------------------------------------------------- The attributes of the (uncompressed) database(s): --------------------------------------------------- /var/lib/aide/aide.db.new.gz MD5 : coZUtPHhoFoeD7+k54fUvQ== SHA1 : DVpOEMWJwo0uPgrKZAygIUgSxeM= SHA256 : EQiZH0XNEk001tcDmJa+5STFEjDb4MPE TGdBJ/uvZKc= SHA512 : 86KUqw++PZhoPK0SZvT3zuFq9yu9nnPP toei0nENVELJ1LPurjoMlRig6q69VR8l +44EwO9eYyy9nnbzQsfG1g== End timestamp: 2023-06-05 10:09:57 -0600 (run time: 0m 53s) The new database must be renamed to be read by AIDE: $ sudo mv /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz Perform a manual check: $ sudo /usr/sbin/aide --check Example output: 2023-06-05 10:16:08 -0600 (AIDE 0.16) AIDE found NO differences between database and filesystem. Looks okay!!

b
TOSS 5 must routinely check the baseline configuration for unauthorized changes and notify the system administrator (SA) when anomalies in the operation of any security functions are discovered.
CM-3 - Medium - CCI-001744 - V-282580 - SV-282580r1201642_rule
RMF Control
CM-3
Severity
M
CCI
CCI-001744
Version
TOSS-05-000370
Vuln IDs
  • V-282580
Rule IDs
  • SV-282580r1201642_rule
Unauthorized changes to the baseline configuration could make the system vulnerable to various attacks or allow unauthorized access to the operating system. Changes to operating system configurations can have unintended side effects, some of which may be relevant to security. Detecting such changes and providing an automated response can help avoid unintended, negative consequences that could ultimately affect the security state of the operating system. The operating system's information management officer (IMO)/information system security officer (ISSO) and SAs must be notified via email and/or monitoring system trap when there is an unauthorized modification of a configuration item. Notifications provided by information systems include messages to local computer consoles, and/or hardware indications, such as lights. This capability must take into account operational requirements for availability for selecting an appropriate response. The organization may choose to shut down or restart the information system upon security function anomaly detection. Satisfies: SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199, SRG-OS-000205-GPOS-00083, SRG-OS-000447-GPOS-00201
Checks: C-87141r1200718_chk

Verify TOSS 5 routinely executes a file integrity scan for changes to the system baseline. The command used in the example will use a daily occurrence. Check the cron directories for scripts controlling the execution and notification of results of the file integrity application. For example, if AIDE is installed on the system, use the following commands: $ ls -al /etc/cron.* | grep aide -rwxr-xr-x 1 root root 29 Nov 22 2015 aide $ grep aide /etc/crontab /var/spool/cron/root /etc/crontab: 30 04 * * * root usr/sbin/aide /var/spool/cron/root: 30 04 * * * root usr/sbin/aide $ sudo more /etc/cron.daily/aide #!/bin/bash /usr/sbin/aide --check | /bin/mail -s "$HOSTNAME - Daily aide integrity check run" root@sysname.mil If the file integrity application does not exist, or a script file controlling the execution of the file integrity application does not exist, or the file integrity application does not notify designated personnel of changes, this is a finding.

Fix: F-87046r1200719_fix

Configure the file integrity tool to run automatically on the system at least weekly and to notify designated personnel if baseline configurations are changed in an unauthorized manner. The AIDE tool can be configured to email designated personnel with the use of the cron system. The following example output is generic. It will set cron to run AIDE daily and to send email at the completion of the analysis: $ sudo more /etc/cron.daily/aide #!/bin/bash /usr/sbin/aide --check | /bin/mail -s "$HOSTNAME - Daily aide integrity check run" root@sysname.mil

b
TOSS 5 SSH daemon must not allow Kerberos authentication.
CM-5 - Medium - CCI-001813 - V-282581 - SV-282581r1200723_rule
RMF Control
CM-5
Severity
M
CCI
CCI-001813
Version
TOSS-05-000256
Vuln IDs
  • V-282581
Rule IDs
  • SV-282581r1200723_rule
Kerberos authentication for SSH is often implemented using Generic Security Service Application Program Interface (GSSAPI). If Kerberos is enabled through SSH, the SSH daemon provides a means of access to the system's Kerberos implementation. Vulnerabilities in the system's Kerberos implementations may be subject to exploitation.
Checks: C-87142r1200721_chk

Verify the SSH daemon does not allow Kerberos authentication using the following command: $ sudo /usr/sbin/sshd -dd 2&gt;&amp;1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH '^\s*kerberosauthentication' KerberosAuthentication no If the value is returned as "yes", the returned line is commented out, no output is returned, and the use of Kerberos authentication has not been documented with the information system security officer (ISSO), this is a finding.

Fix: F-87047r1200722_fix

Configure the SSH daemon to not allow Kerberos authentication. Add the following line in "/etc/ssh/sshd_config" or uncomment the line and set the value to "no": KerberosAuthentication no Restart the SSH service for changes to take effect: $ sudo systemctl restart sshd.service

c
TOSS 5 must ensure cryptographic verification of vendor software packages.
High - CCI-003992 - V-282582 - SV-282582r1200726_rule
RMF Control
Severity
H
CCI
CCI-003992
Version
TOSS-05-000115
Vuln IDs
  • V-282582
Rule IDs
  • SV-282582r1200726_rule
Cryptographic verification of vendor software packages ensures that all software packages are obtained from a valid source and protects against spoofing that could lead to installation of malware on the system. Red Hat cryptographically signs all software packages, which includes updates, with a GPG key to verify that they are valid.
Checks: C-87143r1200724_chk

Confirm Red Hat package-signing keys are installed on the system and verify their fingerprints match vendor values. Note: For TOSS 5 software packages, Red Hat uses GPG keys labeled "release key 2" and "auxiliary key 3". The keys are defined in key file "/etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release" by default. List Red Hat GPG keys installed on the system: $ sudo rpm -q --queryformat "%{SUMMARY}\n" gpg-pubkey | grep -i "red hat" Red Hat, Inc. (release key 2) &lt;security@redhat.com&gt; public key Red Hat, Inc. (auxiliary key 3) &lt;security@redhat.com&gt; public key If Red Hat GPG keys "release key 2" and "auxiliary key 3" are not installed, this is a finding. List key fingerprints of installed Red Hat GPG keys: $ sudo gpg -q --keyid-format short --with-fingerprint /etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release If key file "/etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release" is missing, this is a finding. Example output: pub rsa4096/FD431D51 2009-10-22 [SC] Key fingerprint = 567E 347A D004 4ADE 55BA 8A5F 199E 2F91 FD43 1D51 uid Red Hat, Inc. (release key 2) &lt;security@redhat.com&gt; pub rsa4096/5A6340B3 2022-03-09 [SC] Key fingerprint = 7E46 2425 8C40 6535 D56D 6F13 5054 E4A4 5A63 40B3 uid Red Hat, Inc. (auxiliary key 3) &lt;security@redhat.com&gt; Compare key fingerprints of installed Red Hat GPG keys with fingerprints listed for TOSS 5 on Red Hat "Product Signing Keys" webpage at https://access.redhat.com/security/team/key. If key fingerprints do not match, this is a finding.

Fix: F-87048r1200725_fix

Install Red Hat package-signing keys on the system and verify their fingerprints match vendor values. Insert TOSS 5 installation disc or attach TOSS 5 installation image to the system. Mount the disc or image to make the contents accessible inside the system. Assuming the mounted location is "/media/cdrom", use the following command to copy Red Hat GPG key file onto the system: $ sudo cp /media/cdrom/RPM-GPG-KEY-redhat-release /etc/pki/rpm-gpg/ Import Red Hat GPG keys from key file into system keyring: $ sudo rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release Using the steps listed in the Check, confirm the newly imported keys show as installed on the system and verify their fingerprints match vendor values.

c
TOSS 5 must check the GPG signature of software packages originating from external software repositories before installation.
High - CCI-003992 - V-282583 - SV-282583r1200729_rule
RMF Control
Severity
H
CCI
CCI-003992
Version
TOSS-05-000116
Vuln IDs
  • V-282583
Rule IDs
  • SV-282583r1200729_rule
Changes to any software components can have significant effects on the overall security of the operating system. This requirement ensures the software has not been tampered with and that it has been provided by a trusted vendor. All software packages must be signed with a cryptographic key recognized and approved by the organization. Verifying the authenticity of software prior to installation validates the integrity of the software package received from a vendor. This verifies the software has not been tampered with and that it has been provided by a trusted vendor.
Checks: C-87144r1200727_chk

Verify dnf always checks the GPG signature of software packages originating from external software repositories before installation: $ grep gpgcheck /etc/dnf/dnf.conf gpgcheck=1 If "gpgcheck" is not set to "1", or if the option is missing or commented out, ask the system administrator how the GPG signatures of software packages are verified. If there is no process to verify GPG signatures that is approved by the organization, this is a finding.

Fix: F-87049r1200728_fix

Configure dnf to always check the GPG signature of software packages originating from external software repositories before installation. Add or update the following line in the [main] section of the /etc/dnf/dnf.conf file: gpgcheck=1

c
TOSS 5 must check the GPG signature of locally installed software packages before installation.
High - CCI-003992 - V-282584 - SV-282584r1200732_rule
RMF Control
Severity
H
CCI
CCI-003992
Version
TOSS-05-000117
Vuln IDs
  • V-282584
Rule IDs
  • SV-282584r1200732_rule
Changes to any software components can have significant effects on the overall security of the operating system. This requirement ensures the software has not been tampered with and that it has been provided by a trusted vendor. All software packages must be signed with a cryptographic key recognized and approved by the organization. Verifying the authenticity of software prior to installation validates the integrity of the software package received from a vendor. This verifies the software has not been tampered with and that it has been provided by a trusted vendor.
Checks: C-87145r1200730_chk

Verify dnf always checks the GPG signature of locally installed software packages before installation: $ grep localpkg_gpgcheck /etc/dnf/dnf.conf localpkg_gpgcheck=1 If "localpkg_gpgcheck" is not set to "1", or if the option is missing or commented out, ask the system administrator how the GPG signatures of local software packages are verified. If there is no process to verify GPG signatures that is approved by the organization, this is a finding.

Fix: F-87050r1200731_fix

Configure dnf to always check the GPG signature of local software packages before installation. Add or update the following line in the [main] section of the /etc/dnf/dnf.conf : localpkg_gpgcheck=1

c
TOSS 5 must have GPG signature verification enabled for all software repositories.
High - CCI-003992 - V-282585 - SV-282585r1200735_rule
RMF Control
Severity
H
CCI
CCI-003992
Version
TOSS-05-000118
Vuln IDs
  • V-282585
Rule IDs
  • SV-282585r1200735_rule
Changes to any software components can have significant effects on the overall security of the operating system. This requirement ensures the software has not been tampered with and that it has been provided by a trusted vendor. All software packages must be signed with a cryptographic key recognized and approved by the organization. Verifying the authenticity of software prior to installation validates the integrity of the software package received from a vendor. This verifies the software has not been tampered with and that it has been provided by a trusted vendor.
Checks: C-87146r1200733_chk

Verify all software repositories defined in "/etc/yum.repos.d/" have been configured with "gpgcheck" enabled: $ grep gpgcheck /etc/yum.repos.d/*.repo | more gpgcheck = 1 If "gpgcheck" is not set to "1" for all returned lines, this is a finding.

Fix: F-87051r1200734_fix

Configure all software repositories defined in "/etc/yum.repos.d/" to have "gpgcheck" enabled: $ sudo sed -i 's/gpgcheck\s*=.*/gpgcheck=1/g' /etc/yum.repos.d/*

b
TOSS 5 subscription-manager package must be installed.
Medium - CCI-003992 - V-282586 - SV-282586r1200738_rule
RMF Control
Severity
M
CCI
CCI-003992
Version
TOSS-05-000121
Vuln IDs
  • V-282586
Rule IDs
  • SV-282586r1200738_rule
The Subscription Manager application manages software subscriptions and software repositories for installed software products on the local system. It communicates with backend servers, such as the Red Hat Customer Portal or an on-premise instance of Subscription Asset Manager, to register the local system and grant access to software resources determined by the subscription entitlement.
Checks: C-87147r1200736_chk

Verify the TOSS 5 "subscription-manager" package is installed using the following command: $ sudo dnf list --installed subscription-manager Example output: subscription-manager.x86_64 1.29.26-3.el9_0 If the "subscription-manager" package is not installed, this is a finding.

Fix: F-87052r1200737_fix

Install the "subscription-manager" package using the following command: $ sudo dnf install subscription-manager

b
TOSS 5 must mount /var/tmp with the nosuid option.
CM-7 - Medium - CCI-001764 - V-282587 - SV-282587r1200741_rule
RMF Control
CM-7
Severity
M
CCI
CCI-001764
Version
TOSS-05-000136
Vuln IDs
  • V-282587
Rule IDs
  • SV-282587r1200741_rule
The "nosuid" mount option causes the system to not execute "setuid" and "setgid" files with owner privileges. This option must be used for mounting any file system not containing approved "setuid" and "setguid" files. Executing files from untrusted file systems increases the opportunity for nonprivileged users to attain unauthorized administrative access.
Checks: C-87148r1200739_chk

Verify "/var/tmp" is mounted with the "nosuid" option: $ mount | grep /var/tmp /dev/mapper/rhel-var-tmp on /var/tmp type xfs (rw,nodev,nosuid,noexec,seclabel) If the "/var/tmp" file system is mounted without the "nosuid" option, this is a finding.

Fix: F-87053r1200740_fix

Modify "/etc/fstab" to use the "nosuid" option on the "/var/tmp" directory.

b
TOSS 5 must disable the graphical user interface autorun function unless required.
CM-7 - Medium - CCI-001764 - V-282588 - SV-282588r1200744_rule
RMF Control
CM-7
Severity
M
CCI
CCI-001764
Version
TOSS-05-000266
Vuln IDs
  • V-282588
Rule IDs
  • SV-282588r1200744_rule
Allowing autorun commands to execute may introduce malicious code to a system. Configuring this setting prevents users from executing autorun commands.
Checks: C-87149r1200742_chk

Verify TOSS 5 disables the graphical user interface autorun function using the following command: Note: This requirement assumes the use of the TOSS 5 default graphical user interface—the GNOME desktop environment. If the system does not have a graphical user interface installed, this requirement is not applicable. $ gsettings get org.gnome.desktop.media-handling autorun-never true If "autorun-never" is set to "false" and is not documented with the information system security officer (ISSO) as an operational requirement, this is a finding.

Fix: F-87054r1200743_fix

Configure the GNOME desktop to disable the autorun function on removable media. The dconf settings can be edited in the /etc/dconf/db/* location. Update the [org/gnome/desktop/media-handling] section of the "/etc/dconf/db/local.d/00-security-settings" database file and add or update the following lines: [org/gnome/desktop/media-handling] autorun-never=true Update the dconf system databases: $ sudo dconf update

b
TOSS 5 fapolicy module must be installed.
CM-7 - Medium - CCI-001764 - V-282589 - SV-282589r1200747_rule
RMF Control
CM-7
Severity
M
CCI
CCI-001764
Version
TOSS-05-000329
Vuln IDs
  • V-282589
Rule IDs
  • SV-282589r1200747_rule
The organization must identify authorized software programs and permit execution of authorized software. The process used to identify software programs that are authorized to execute on organizational information systems is commonly referred to as allowlisting. Using an allowlist provides a configuration management method for allowing the execution of only authorized software. Using only authorized software decreases risk by limiting the number of potential vulnerabilities. Verification of allowlisted software occurs prior to execution or at system startup. User home directories/folders may contain information of a sensitive nature. Nonprivileged users should coordinate any sharing of information with a system administrator (SA) through shared resources. TOSS 5 ships with many optional packages. One such package is a file access policy daemon called "fapolicyd". "fapolicyd" is a userspace daemon that determines access rights to files based on attributes of the process and file. It can be used to either blocklist or allowlist processes or file access. Proceed with caution when using this daemon. Improper configuration may render the system nonfunctional. The "fapolicyd" API is not namespace-aware and can cause issues when launching or running containers. Satisfies: SRG-OS-000368-GPOS-00154, SRG-OS-000370-GPOS-00155
Checks: C-87150r1200745_chk

Verify the TOSS 5 "fapolicyd" package is installed using the following command: $ sudo dnf list --installed fapolicyd Example output: fapolicyd.x86_64 1.1-103.el9_0 If the "fapolicyd" package is not installed, this is a finding.

Fix: F-87055r1200746_fix

Install the "fapolicyd" package using the following command: $ sudo dnf install fapolicyd

b
TOSS 5 must use the invoking user's password for privilege escalation when using sudo.
IA-11 - Medium - CCI-002038 - V-282590 - SV-282590r1200750_rule
RMF Control
IA-11
Severity
M
CCI
CCI-002038
Version
TOSS-05-000326
Vuln IDs
  • V-282590
Rule IDs
  • SV-282590r1200750_rule
If the "rootpw", "targetpw", or "runaspw" flags are defined and not disabled, by default the operating system will prompt the invoking user for the "root" user password. Satisfies: SRG-OS-000373-GPOS-00156, SRG-OS-000373-GPOS-00157, SRG-OS-000373-GPOS-00158
Checks: C-87151r1200748_chk

Verify the sudoers security policy is configured to use the invoking user's password for privilege escalation using the following command: $ sudo egrep -ir '(!rootpw|!targetpw|!runaspw)' /etc/sudoers /etc/sudoers.d/* | grep -v '#' /etc/sudoers:Defaults !targetpw /etc/sudoers:Defaults !rootpw /etc/sudoers:Defaults !runaspw If no results are returned, this is a finding. If results are returned from more than one file location, this is a finding. If "Defaults !targetpw" is not defined, this is a finding. If "Defaults !rootpw" is not defined, this is a finding. If "Defaults !runaspw" is not defined, this is a finding.

Fix: F-87056r1200749_fix

Define the following in the Defaults section of the "/etc/sudoers" file or a single configuration file in the "/etc/sudoers.d/" directory: Defaults !targetpw Defaults !rootpw Defaults !runaspw

b
TOSS 5 must have the pcsc-lite package installed.
Medium - CCI-004046 - V-282591 - SV-282591r1200753_rule
RMF Control
Severity
M
CCI
CCI-004046
Version
TOSS-05-000361
Vuln IDs
  • V-282591
Rule IDs
  • SV-282591r1200753_rule
The "pcsc-lite" package must be installed so it is available for multifactor authentication using smart cards.
Checks: C-87152r1200751_chk

Verify TOSS 5 has the "pcsc-lite" package installed using the following command: $ sudo dnf list --installed pcsc-lite Example output: pcsc-lite.x86_64 1.9.4-1.el9 If the "pcsc-lite" package is not installed, this is a finding.

Fix: F-87057r1200752_fix

Install the "pcsc-lite" package using the following command: $ sudo dnf install pcsc-lite

b
TOSS 5 must have the opensc package installed.
Medium - CCI-004046 - V-282592 - SV-282592r1200756_rule
RMF Control
Severity
M
CCI
CCI-004046
Version
TOSS-05-000363
Vuln IDs
  • V-282592
Rule IDs
  • SV-282592r1200756_rule
The use of PIV credentials facilitates standardization and reduces the risk of unauthorized access. The DOD has mandated the use of the common access card (CAC) to support identity management and personal authentication for systems covered under Homeland Security Presidential Directive (HSPD) 12, as well as making the CAC a primary component of layered protection for national security systems. Satisfies: SRG-OS-000375-GPOS-00160, SRG-OS-000376-GPOS-00161, SRG-OS-000377-GPOS-00162
Checks: C-87153r1200754_chk

Verify TOSS 5 has the "opensc" package installed using the following command: $ sudo dnf list --installed opensc Example output: opensc.x86_64 0.22.0-2.el9 If the "opensc" package is not installed, this is a finding.

Fix: F-87058r1200755_fix

Install the "opensc" package using the following command: $ sudo dnf install opensc

b
TOSS 5 must have the USBGuard package installed.
IA-3 - Medium - CCI-001958 - V-282593 - SV-282593r1200759_rule
RMF Control
IA-3
Severity
M
CCI
CCI-001958
Version
TOSS-05-000285
Vuln IDs
  • V-282593
Rule IDs
  • SV-282593r1200759_rule
The USBguard-daemon is the main component of the USBGuard software framework. It runs as a service in the background and enforces the USB device authorization policy for all USB devices. The policy is defined by a set of rules using a rule language described in the "usbguard-rules.conf" file. The policy and the authorization state of USB devices can be modified during runtime using the usbguard tool. The system administrator (SA) must work with the site information system security officer (ISSO) to determine a list of authorized peripherals and establish rules within the USBGuard software framework to allow only authorized devices. Satisfies: SRG-OS-000378-GPOS-00163, SRG-OS-000690-GPOS-00140
Checks: C-87154r1200757_chk

Verify USBGuard is installed on the operating system using the following command: $ sudo dnf list installed usbguard usbguard.x86_64 1.0.0-10.el9_1.2 @rhel-9-for-x86_64-appstream-rpms If the USBGuard package is not installed, ask the SA to indicate how unauthorized peripherals are blocked. If there is no evidence that unauthorized peripherals are blocked before establishing a connection, this is a finding.

Fix: F-87059r1200758_fix

Install the usbguard package using the following command: $ sudo dnf install usbguard

b
TOSS 5 must have the USBGuard package enabled.
IA-3 - Medium - CCI-001958 - V-282594 - SV-282594r1200762_rule
RMF Control
IA-3
Severity
M
CCI
CCI-001958
Version
TOSS-05-000286
Vuln IDs
  • V-282594
Rule IDs
  • SV-282594r1200762_rule
The USBguard-daemon is the main component of the USBGuard software framework. It runs as a service in the background and enforces the USB device authorization policy for all USB devices. The policy is defined by a set of rules using a rule language described in the usbguard-rules.conf file. The policy and the authorization state of USB devices can be modified during runtime using the usbguard tool. The system administrator (SA) must work with the site information system security officer (ISSO) to determine a list of authorized peripherals and establish rules within the USBGuard software framework to allow only authorized devices. Satisfies: SRG-OS-000378-GPOS-00163, SRG-OS-000690-GPOS-00140
Checks: C-87155r1200760_chk

Verify TOSS 5 has USBGuard enabled using the following command: $ systemctl is-active usbguard active If usbguard is not active, ask the SA to indicate how unauthorized peripherals are blocked. If there is no evidence that unauthorized peripherals are being blocked before establishing a connection, this is a finding.

Fix: F-87060r1200761_fix

Enable the USBGuard service using the following command: $ sudo systemctl enable --now usbguard

b
TOSS 5 must block unauthorized peripherals before establishing a connection.
IA-3 - Medium - CCI-001958 - V-282595 - SV-282595r1200765_rule
RMF Control
IA-3
Severity
M
CCI
CCI-001958
Version
TOSS-05-000288
Vuln IDs
  • V-282595
Rule IDs
  • SV-282595r1200765_rule
The USBguard-daemon is the main component of the USBGuard software framework. It runs as a service in the background and enforces the USB device authorization policy for all USB devices. The policy is defined by a set of rules using a rule language described in the usbguard-rules.conf file. The policy and the authorization state of USB devices can be modified during runtime using the usbguard tool. The system administrator (SA) must work with the site information system security officer (ISSO) to determine a list of authorized peripherals and establish rules within the USBGuard software framework to allow only authorized devices.
Checks: C-87156r1200763_chk

Verify the USBGuard has a policy configured using the following command: $ usbguard list-rules allow id 1d6b:0001 serial If the command does not return results or an error is returned, ask the SA to indicate how unauthorized peripherals are being blocked. If there is no evidence that unauthorized peripherals are being blocked before establishing a connection, this is a finding. If the system is a virtual machine with no virtual or physical USB peripherals attached, this is not a finding.

Fix: F-87061r1200764_fix

Configure the operating system to enable blocking of unauthorized peripherals using the following command: Note: This command must be run from a root shell and will create an allow list for any usb devices currently connect to the system. # usbguard generate-policy --no-hash > /etc/usbguard/rules.conf Note: Enabling and starting usbguard without properly configuring it for an individual system will immediately prevent any access over a usb device such as a keyboard or mouse.

b
TOSS 5 must prohibit the use of cached authenticators after one day.
IA-5 - Medium - CCI-002007 - V-282597 - SV-282597r1200771_rule
RMF Control
IA-5
Severity
M
CCI
CCI-002007
Version
TOSS-05-000368
Vuln IDs
  • V-282597
Rule IDs
  • SV-282597r1200771_rule
If cached authentication information is out of date, the validity of the authentication information may be questionable.
Checks: C-87158r1200769_chk

Verify the System Security Services Daemon (SSSD) prohibits the use of cached authentications after one day. Note: If smart card authentication is not being used on the system, this requirement is not applicable. Check that SSSD allows cached authentications using the following command: $ sudo grep cache_credentials /etc/sssd/sssd.conf cache_credentials = true If "cache_credentials" is set to "false" or missing from the configuration file, this is not a finding and no further checks are required. If "cache_credentials" is set to "true", check that SSSD prohibits the use of cached authentications after one day using the following command: $ sudo grep offline_credentials_expiration /etc/sssd/sssd.conf offline_credentials_expiration = 1 If "offline_credentials_expiration" is not set to a value of "1", this is a finding.

Fix: F-87063r1200770_fix

Configure the SSSD to prohibit the use of cached authentications after one day. Add or change the following line in "/etc/sssd/sssd.conf" just below the line [pam]: offline_credentials_expiration = 1

b
TOSS 5 must generate audit records for all account creations, modifications, disabling, and termination events that affect /var/log/faillock.
MA-4 - Medium - CCI-002884 - V-282598 - SV-282598r1200774_rule
RMF Control
MA-4
Severity
M
CCI
CCI-002884
Version
TOSS-05-000459
Vuln IDs
  • V-282598
Rule IDs
  • SV-282598r1200774_rule
Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Satisfies: SRG-OS-000392-GPOS-00172, SRG-OS-000477-GPOS-00222
Checks: C-87159r1200772_chk

Verify TOSS 5 generates audit records for all account creations, modifications, disabling, and termination events that affect "/var/log/faillock" using the following command: $ sudo auditctl -l | grep /var/log/faillock -w /var/log/faillock -p wa -k logins If the command does not return a line or the line is commented out, this is a finding.

Fix: F-87064r1200773_fix

Configure TOSS 5 to generate audit records for all account creations, modifications, disabling, and termination events that affect "/var/log/faillock". Add or update the following file system rule to "/etc/audit/rules.d/audit.rules": -w /var/log/faillock -p wa -k logins Restart the audit daemon for the changes to take effect.

b
TOSS 5 must generate audit records for all account creations, modifications, disabling, and termination events that affect /var/log/tallylog.
MA-4 - Medium - CCI-002884 - V-282599 - SV-282599r1201494_rule
RMF Control
MA-4
Severity
M
CCI
CCI-002884
Version
TOSS-05-000461
Vuln IDs
  • V-282599
Rule IDs
  • SV-282599r1201494_rule
Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Satisfies: SRG-OS-000392-GPOS-00172, SRG-OS-000477-GPOS-00222
Checks: C-87160r1201493_chk

Verify TOSS 5 generates audit records for all account creations, modifications, disabling, and termination events that affect "/var/log/tallylog" using the following command: $ sudo auditctl -l | grep /var/log/tallylog -w /var/log/tallylog -p wa -k logins If the command does not return a line, or the line is commented out, this is a finding.

Fix: F-87065r1200776_fix

Configure TOSS 5 to generate audit records for all account creations, modifications, disabling, and termination events that affect "/var/log/tallylog". Add or update the following file system rule to "/etc/audit/rules.d/audit.rules": -w /var/log/tallylog -p wa -k logins Restart the audit daemon for the changes to take effect.

c
TOSS 5 must have the crypto-policies package installed.
SC-13 - High - CCI-002450 - V-282601 - SV-282601r1200783_rule
RMF Control
SC-13
Severity
H
CCI
CCI-002450
Version
TOSS-05-000468
Vuln IDs
  • V-282601
Rule IDs
  • SV-282601r1200783_rule
Centralized cryptographic policies simplify applying secure ciphers across an operating system and the applications that run on that operating system. Use of weak or untested encryption algorithms undermines the purposes of using encryption to protect data.
Checks: C-87162r1200781_chk

Verify the TOSS 5 "crypto-policies" package is installed using the following command: $ sudo dnf list --installed crypto-policies Example output: crypto-policies.noarch 20220223-1.git5203b41.el9_0.1 If the "crypto-policies" package is not installed, this is a finding.

Fix: F-87067r1200782_fix

Install the "crypto-policies package" using the following command: $ sudo dnf install crypto-policies

b
TOSS 5 crypto policy must not be overridden.
SC-13 - Medium - CCI-002450 - V-282602 - SV-282602r1200786_rule
RMF Control
SC-13
Severity
M
CCI
CCI-002450
Version
TOSS-05-000470
Vuln IDs
  • V-282602
Rule IDs
  • SV-282602r1200786_rule
Centralized cryptographic policies simplify applying secure ciphers across an operating system and the applications that run on that operating system. Use of weak or untested encryption algorithms undermines the purposes of using encryption to protect data.
Checks: C-87163r1200784_chk

Verify TOSS 5 custom crypto policies are loaded correctly. List all of the crypto backends configured on the system. $ ls -l /etc/crypto-policies/back-ends/ lrwxrwxrwx. 1 root root 40 Oct 7 08:44 bind.config -&gt; /usr/share/crypto-policies/FIPS/bind.txt lrwxrwxrwx. 1 root root 42 Oct 7 08:44 gnutls.config -&gt; /usr/share/crypto-policies/FIPS/gnutls.txt lrwxrwxrwx. 1 root root 40 Oct 7 08:44 java.config -&gt; /usr/share/crypto-policies/FIPS/java.txt lrwxrwxrwx. 1 root root 46 Oct 7 08:44 javasystem.config -&gt; /usr/share/crypto-policies/FIPS/javasystem.txt lrwxrwxrwx. 1 root root 40 Oct 7 08:44 krb5.config -&gt; /usr/share/crypto-policies/FIPS/krb5.txt lrwxrwxrwx. 1 root root 45 Oct 7 08:44 libreswan.config -&gt; /usr/share/crypto-policies/FIPS/libreswan.txt lrwxrwxrwx. 1 root root 42 Oct 7 08:44 libssh.config -&gt; /usr/share/crypto-policies/FIPS/libssh.txt lrwxrwxrwx. 1 root root 39 Oct 7 08:44 nss.config -&gt; /usr/share/crypto-policies/FIPS/nss.txt lrwxrwxrwx. 1 root root 43 Oct 7 08:44 openssh.config -&gt; /usr/share/crypto-policies/FIPS/openssh.txt lrwxrwxrwx. 1 root root 49 Oct 7 08:44 opensshserver.config -&gt; /usr/share/crypto-policies/FIPS/opensshserver.txt lrwxrwxrwx. 1 root root 46 Oct 7 08:44 opensslcnf.config -&gt; /usr/share/crypto-policies/FIPS/opensslcnf.txt lrwxrwxrwx. 1 root root 43 Oct 7 08:44 openssl.config -&gt; /usr/share/crypto-policies/FIPS/openssl.txt If the paths do not point the respective files under "/usr/share/crypto-policies/FIPS" path, this is a finding.

Fix: F-87068r1200785_fix

Configure TOSS 5 to FIPS crypto policy. $ sudo ln -s /usr/share/crypto-policies/FIPS/<service>.txt /etc/crypto-policies/back-ends/<service>.conf Replace <service> with every service that is not set to FIPS. Restart the system for the changes to take effect.

b
TOSS 5 must implement a systemwide encryption policy.
SC-13 - Medium - CCI-002450 - V-282603 - SV-282603r1200789_rule
RMF Control
SC-13
Severity
M
CCI
CCI-002450
Version
TOSS-05-000475
Vuln IDs
  • V-282603
Rule IDs
  • SV-282603r1200789_rule
Centralized cryptographic policies simplify applying secure ciphers across an operating system and the applications that run on that operating system. Use of weak or untested encryption algorithms undermines the purposes of using encryption to protect data.
Checks: C-87164r1200787_chk

Verify the TOSS 5 cryptography policy has been configured correctly with the following commands: $ sudo update-crypto-policies --show FIPS:OSPP If the cryptography base profile is not set to "FIPS" and is not applied, this is a finding. $ sudo update-crypto-policies --check The configured policy matches the generated policy If the command does not return "The configured policy matches the generated policy", this is a finding.

Fix: F-87069r1200788_fix

Configure TOSS 5 to implement FIPS mode with the following command: $ sudo update-crypto-policies --set FIPS:OSPP Reboot the system for the changes to take effect.

b
TOSS 5 must protect against or limit the effects of denial-of-service (DoS) attacks by ensuring rate-limiting measures on impacted network interfaces are implemented.
SC-5 - Medium - CCI-002385 - V-282605 - SV-282605r1200795_rule
RMF Control
SC-5
Severity
M
CCI
CCI-002385
Version
TOSS-05-000196
Vuln IDs
  • V-282605
Rule IDs
  • SV-282605r1200795_rule
DoS is a condition when a resource is not available for legitimate users. When this occurs, the organization either cannot accomplish its mission or must operate at degraded capacity. This requirement addresses the configuration of TOSS 5 to mitigate the impact of DoS attacks that have occurred or are ongoing on system availability. For each system, known and potential DoS attacks must be identified and solutions for each type implemented. A variety of technologies exists to limit or, in some cases, eliminate the effects of DoS attacks (e.g., limiting processes or establishing memory partitions). Employing increased capacity and bandwidth, combined with service redundancy, may reduce the susceptibility to some DoS attacks.
Checks: C-87166r1200793_chk

Verify "nftables" is configured to allow rate limits on any connection to the system using the following command: $ sudo grep -i firewallbackend /etc/firewalld/firewalld.conf # FirewallBackend FirewallBackend=nftables If the "nftables" is not set as the "FirewallBackend" default, this is a finding.

Fix: F-87071r1200794_fix

Configure "nftables" to be the default "firewallbackend" for "firewalld" by adding or editing the following line in "etc/firewalld/firewalld.conf": FirewallBackend=nftables Establish rate-limiting rules based on organization-defined types of DoS attacks on impacted network interfaces.

b
All TOSS 5 networked systems must have SSH installed.
SC-8 - Medium - CCI-002418 - V-282606 - SV-282606r1201360_rule
RMF Control
SC-8
Severity
M
CCI
CCI-002418
Version
TOSS-05-000233
Vuln IDs
  • V-282606
Rule IDs
  • SV-282606r1201360_rule
Without protecting the transmitted information, confidentiality and integrity may be compromised because unprotected communications can be intercepted and either read or altered. This requirement applies to both internal and external networks and all types of information system components from which information can be transmitted (e.g., servers, mobile devices, notebook computers, printers, copiers, scanners, and facsimile machines). Communication paths outside the physical protection of a controlled boundary are exposed to the possibility of interception and modification. Protecting the confidentiality and integrity of organizational information can be accomplished by physical means (e.g., employing physical distribution systems) or by logical means (e.g., employing cryptographic techniques). If physical means of protection are employed, then logical means (cryptography) do not have to be employed, and vice versa. Satisfies: SRG-OS-000423-GPOS-00187, SRG-OS-000424-GPOS-00188, SRG-OS-000425-GPOS-00189, SRG-OS-000426-GPOS-00190
Checks: C-87167r1200796_chk

Verify TOSS 5 has the "openssh-server" package installed using the following command: $ sudo dnf list --installed openssh-server Example output: openssh-server.x86_64 8.7p1-8.el9 If the "openssh-server" package is not installed, this is a finding.

Fix: F-87072r1200797_fix

Install the "openssh-server" package using the following command: $ sudo dnf install openssh-server

b
All TOSS 5 networked systems must have and implement SSH to protect the confidentiality and integrity of transmitted and received information, as well as information during preparation for transmission.
SC-8 - Medium - CCI-002418 - V-282607 - SV-282607r1200801_rule
RMF Control
SC-8
Severity
M
CCI
CCI-002418
Version
TOSS-05-000234
Vuln IDs
  • V-282607
Rule IDs
  • SV-282607r1200801_rule
Without protecting the transmitted information, confidentiality and integrity may be compromised because unprotected communications can be intercepted and either read or altered. This requirement applies to both internal and external networks and all types of information system components from which information can be transmitted (e.g., servers, mobile devices, notebook computers, printers, copiers, scanners, and facsimile machines). Communication paths outside the physical protection of a controlled boundary are exposed to the possibility of interception and modification. Protecting the confidentiality and integrity of organizational information can be accomplished by physical means (e.g., employing physical distribution systems) or by logical means (e.g., employing cryptographic techniques). If physical means of protection are employed, then logical means (cryptography) do not have to be employed, and vice versa. Satisfies: SRG-OS-000423-GPOS-00187, SRG-OS-000424-GPOS-00188, SRG-OS-000425-GPOS-00189, SRG-OS-000426-GPOS-00190
Checks: C-87168r1200799_chk

Verify "sshd" is active using the following command: $ systemctl is-active sshd active If the "sshd" service is not active, this is a finding.

Fix: F-87073r1200800_fix

Enable the "sshd" service using the following command: $ systemctl enable --now sshd

b
TOSS 5 must implement DOD or other applicable U.S. Government agency-approved encryption in the bind package.
SC-8 - Medium - CCI-002418 - V-282608 - SV-282608r1200804_rule
RMF Control
SC-8
Severity
M
CCI
CCI-002418
Version
TOSS-05-000476
Vuln IDs
  • V-282608
Rule IDs
  • SV-282608r1200804_rule
Without cryptographic integrity protections, information can be altered by unauthorized users without detection. Cryptographic mechanisms used for protecting the integrity of information include, for example, signed hash functions using asymmetric cryptography enabling distribution of the public key to verify the hash information while maintaining the confidentiality of the secret key used to generate the hash. TOSS 5 incorporates systemwide crypto policies by default. The employed algorithms can be viewed in the /etc/crypto-policies/back-ends/ directory. Satisfies: SRG-OS-000423-GPOS-00187, SRG-OS-000426-GPOS-00190
Checks: C-87169r1200802_chk

Verify BIND uses the system crypto policy using the following command: Note: If the "bind" package is not installed, this requirement is not applicable. $ sudo grep include /etc/named.conf include "/etc/crypto-policies/back-ends/bind.config";' If BIND is installed and the BIND config file does not include the "/etc/crypto-policies/back-ends/bind.config" directive, or the line is commented out, this is a finding.

Fix: F-87074r1200803_fix

Configure BIND to use the system crypto policy. Add the following line to the "options" section in "/etc/named.conf": include "/etc/crypto-policies/back-ends/bind.config";

b
TOSS 5 must implement nonexecutable data to protect its memory from unauthorized code execution.
SI-16 - Medium - CCI-002824 - V-282610 - SV-282610r1200810_rule
RMF Control
SI-16
Severity
M
CCI
CCI-002824
Version
TOSS-05-000114
Vuln IDs
  • V-282610
Rule IDs
  • SV-282610r1200810_rule
ExecShield uses the segmentation feature on all x86 systems to prevent execution in memory higher than a certain address. It writes an address as a limit in the code segment descriptor, to control where code can be executed, on a per-process basis. When the kernel places a process's memory regions such as the stack and heap higher than this address, the hardware prevents execution in that address range. This is enabled by default on the latest Red Hat and Fedora systems if supported by the hardware.
Checks: C-87171r1200808_chk

Verify ExecShield is enabled on 64-bit TOSS 5 systems using the following command: $ sudo dmesg | grep '[NX|DX]*protection' [ 0.000000] NX (Execute Disable) protection: active If "dmesg" does not show "NX (Execute Disable) protection" active, this is a finding.

Fix: F-87076r1200809_fix

Update the GRUB 2 bootloader configuration. Run the following command: $ sudo grubby --update-kernel=ALL --remove-args=noexec

a
TOSS 5 must remove all software components after updated versions have been installed.
SI-2 - Low - CCI-002617 - V-282611 - SV-282611r1200813_rule
RMF Control
SI-2
Severity
L
CCI
CCI-002617
Version
TOSS-05-000120
Vuln IDs
  • V-282611
Rule IDs
  • SV-282611r1200813_rule
Previous versions of software components that are not removed from the information system after updates have been installed may be exploited by adversaries.
Checks: C-87172r1200811_chk

Verify TOSS 5 removes all software components after updated versions have been installed using the following command: $ grep clean /etc/dnf/dnf.conf clean_requirements_on_remove=1 If "clean_requirements_on_remove" is not set to "1", this is a finding.

Fix: F-87077r1200812_fix

Configure TOSS 5 to remove all software components after updated versions have been installed. Edit the file /etc/dnf/dnf.conf by adding or editing the following line: clean_requirements_on_remove=1

b
TOSS 5 must enable the "SELinux" targeted policy.
SI-6 - Medium - CCI-002696 - V-282613 - SV-282613r1201304_rule
RMF Control
SI-6
Severity
M
CCI
CCI-002696
Version
TOSS-05-000024
Vuln IDs
  • V-282613
Rule IDs
  • SV-282613r1201304_rule
Setting the SELinux policy to "targeted" or a more specialized policy ensures the system will confine processes that are likely to be targeted for exploitation, such as network or system services. Note: During the development or debugging of SELinux modules, it is common to temporarily place nonproduction systems in "permissive" mode. In such temporary cases, SELinux policies should be developed, and once work is completed, the system should be reconfigured to "targeted".
Checks: C-87174r1200817_chk

Note: At lower classification levels (CUI, Secret) where vast amounts of data are processed and a performance impact is occurring, an authorizing official can consider this requirement not applicable. Check that TOSS verifies correct operation of all security functions. Determine if "SELinux" is active and is enforcing the targeted policy using the following command: $ sudo sestatus SELinux status: enabled SELinuxfs mount: /sys/fs/selinux SELinux root directory: /etc/selinux Loaded policy name: targeted Current mode: enforcing Mode from config file: enforcing Policy MLS status: enabled Policy deny_unknown status: allowed Memory protection checking: actual (secure) Max kernel policy version: 33 If the "Loaded policy name" is not set to "targeted", this is a finding. Verify the "/etc/selinux/config" file is configured with the "SELINUXTYPE" of "targeted": $ sudo grep -i "selinuxtype" /etc/selinux/config | grep -v '^#' SELINUXTYPE = targeted If no results are returned, or "SELINUXTYPE" is not set to "targeted", this is a finding.

Fix: F-87079r1201303_fix

Configure the operating system to verify correct operation of all security functions. Set the "SELinuxtype" to the "targeted" policy by modifying the "/etc/selinux/config" file to have the following line: SELINUXTYPE=targeted Restart the system for the changes to take effect.

c
TOSS 5 crypto policy files must match files shipped with the operating system.
SC-13 - High - CCI-002450 - V-282615 - SV-282615r1201495_rule
RMF Control
SC-13
Severity
H
CCI
CCI-002450
Version
TOSS-05-000469
Vuln IDs
  • V-282615
Rule IDs
  • SV-282615r1201495_rule
The TOSS 5 package "crypto-policies" defines the cryptography policies for the system. If the files are changed from those shipped with the operating system, it may be possible for TOSS 5 to use cryptographic functions that are not FIPS 140-3 approved.
Checks: C-87176r1200823_chk

Verify the TOSS 5 package "crypto-policies" has not been modified using the following command: $ rpm -V crypto-policies If the command has any output, this is a finding.

Fix: F-87081r1200824_fix

Reinstall the "crypto-policies" package to remove any modifications. $ sudo dnf reinstall crypto-policies

b
TOSS 5 must have the rsyslog package installed.
AU-4 - Medium - CCI-001851 - V-282616 - SV-282616r1200828_rule
RMF Control
AU-4
Severity
M
CCI
CCI-001851
Version
TOSS-05-000375
Vuln IDs
  • V-282616
Rule IDs
  • SV-282616r1200828_rule
"rsyslogd" is a system utility providing support for message logging. Support for both internet and Unix domain sockets enables this utility to support both local and remote logging. Couple this utility with "gnutls" (which is a secure communications library implementing the SSL, TLS, and DTLS protocols), to create a method to securely encrypt and offload auditing.
Checks: C-87177r1200826_chk

Verify TOSS 5 has the "rsyslogd" package installed using the following command: $ sudo dnf list --installed rsyslog Example output: rsyslog.x86_64 8.2102.0-101.el9_0.1 If the "rsyslogd" package is not installed, this is a finding.

Fix: F-87082r1200827_fix

Install the "rsyslogd" package using the following command: $ sudo dnf install rsyslogd

b
TOSS 5 must be configured to forward audit records via TCP to a different system or media from the system being audited via rsyslog.
AU-4 - Medium - CCI-001851 - V-282617 - SV-282617r1201621_rule
RMF Control
AU-4
Severity
M
CCI
CCI-001851
Version
TOSS-05-000384
Vuln IDs
  • V-282617
Rule IDs
  • SV-282617r1201621_rule
Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Offloading is a common process in information systems with limited audit storage capacity. TOSS 5 installation media provides "rsyslogd", a system utility providing support for message logging. Support for both internet and Unix domain sockets enables this utility to support both local and remote logging. Coupling this utility with "gnutls" (a secure communications library implementing the SSL, TLS, and DTLS protocols) creates a method to securely encrypt and offload auditing. Rsyslog provides three ways to forward message: the traditional UDP transport, which is extremely lossy but standard; the plain TCP based transport, which loses messages only during certain situations but is widely available; and the RELP transport, which does not lose messages but is currently available only as part of the rsyslogd 3.15.0 and above. Examples of each configuration: UDP *.* @remotesystemname TCP *.* @@remotesystemname RELP *.* :omrelp:remotesystemname:2514 Note that a port number was given as there is no standard port for RELP.
Checks: C-87178r1200829_chk

Verify TOSS 5 audit system offloads audit records onto a different system or media from the system being audited via rsyslog using TCP using the following command: $ sudo grep @@ /etc/rsyslog.conf /etc/rsyslog.d/*.conf /etc/rsyslog.conf:*.* @@[remoteloggingserver]:[port] If a remote server is not configured, or the line is commented out, ask the system administrator (SA) to indicate how the audit logs are offloaded to a different system or media. If there is no evidence that the audit logs are being offloaded to another system or media, this is a finding.

Fix: F-87083r1200830_fix

Configure TOSS 5 to offload audit records onto a different system or media from the system being audited via TCP using rsyslog by specifying the remote logging server in "/etc/rsyslog.conf"" or "/etc/rsyslog.d/[customfile].conf" with the name or IP address of the log aggregation server. *.* @@[remoteloggingserver]:[port]"

b
TOSS 5 must prevent the use of dictionary words for passwords.
CM-6 - Medium - CCI-000366 - V-282618 - SV-282618r1200834_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000347
Vuln IDs
  • V-282618
Rule IDs
  • SV-282618r1200834_rule
Using a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. If TOSS 5 allows the user to select passwords based on dictionary words, this increases the chances of password compromise by increasing the opportunity for successful guesses, and brute-force attacks.
Checks: C-87179r1200832_chk

Verify TOSS 5 prevents using dictionary words for passwords using the following command: $ sudo grep dictcheck /etc/security/pwquality.conf /etc/pwquality.conf.d/*.conf /etc/security/pwquality.conf:dictcheck=1 If "dictcheck" does not have a value other than "0" or is commented out, this is a finding.

Fix: F-87084r1200833_fix

Configure TOSS 5 to prevent the use of dictionary words for passwords. Add or update the following line in the "/etc/security/pwquality.conf" file or a configuration file in the /etc/pwquality.conf.d/ directory to contain the "dictcheck" parameter: dictcheck=1

b
TOSS 5 must enforce a delay of at least four seconds between logon prompts following a failed logon attempt.
CM-6 - Medium - CCI-000366 - V-282619 - SV-282619r1200837_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000315
Vuln IDs
  • V-282619
Rule IDs
  • SV-282619r1200837_rule
Increasing the time between a failed authentication attempt and reprompting to enter credentials helps to slow a single-threaded brute force attack.
Checks: C-87180r1200835_chk

Verify TOSS 5 enforces a delay of at least four seconds between console logon prompts following a failed logon attempt using the following command: $ grep -i fail_delay /etc/login.defs FAIL_DELAY 4 If the value of "FAIL_DELAY" is not set to "4" or greater or the line is commented out, this is a finding.

Fix: F-87085r1200836_fix

Configure the TOSS 5 to enforce a delay of at least four seconds between logon prompts following a failed console logon attempt. Modify the "/etc/login.defs" file to set the "FAIL_DELAY" parameter to 4 or greater: FAIL_DELAY 4

b
TOSS 5 must disable virtual system calls.
CM-6 - Medium - CCI-000366 - V-282620 - SV-282620r1200840_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000029
Vuln IDs
  • V-282620
Rule IDs
  • SV-282620r1200840_rule
System calls are special routines in the Linux kernel which userspace applications ask to do privileged tasks. Invoking a system call is an expensive operation because the processor must interrupt the currently executing task, switch context to kernel mode, and then back to userspace after the system call completes. Virtual system calls map into user space a page that contains some variables and the implementation of some system calls. This allows the system calls to be executed in userspace to alleviate the context switching expense. Virtual system calls provide an opportunity of attack for a user who has control of the return instruction pointer. Disabling virtual system calls help to prevent return-oriented programming (ROP) attacks via buffer overflows and overruns. If the system intends to run containers based on RHEL 6 components, then virtual system calls must be enabled for the components to function properly.
Checks: C-87181r1200838_chk

Verify the current GRUB 2 configuration disables virtual system calls using the following command: $ sudo grubby --info=ALL | grep args | grep -v 'vsyscall=none' If any output is returned and is not documented with the information system security officer (ISSO) as an operational requirement, this is a finding.

Fix: F-87086r1200839_fix

Document the use of virtual system calls with the ISSO as an operational requirement or disable them using the following command: $ sudo grubby --update-kernel=ALL --args="vsyscall=none" Add or modify the following line in "/etc/default/grub" to ensure the configuration survives kernel updates: GRUB_CMDLINE_LINUX="vsyscall=none"

b
TOSS 5 must clear the page allocator to prevent use-after-free attacks.
CM-6 - Medium - CCI-000366 - V-282621 - SV-282621r1200843_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000030
Vuln IDs
  • V-282621
Rule IDs
  • SV-282621r1200843_rule
Poisoning writes an arbitrary value to freed pages, so any modification or reference to that page after being freed or before being initialized will be detected and prevented. This prevents many types of use-after-free vulnerabilities at little performance cost. Also prevents leak of data and detection of corrupted memory.
Checks: C-87182r1200841_chk

Verify GRUB 2 is configured to enable page poisoning to mitigate use-after-free vulnerabilities. Check that the current GRUB 2 configuration has page poisoning enabled using the following command: $ sudo grubby --info=ALL | grep args | grep -v 'page_poison=1' If any output is returned, this is a finding.

Fix: F-87087r1200842_fix

Configure TOSS 5 to enable page poisoning with the following commands: $ sudo grubby --update-kernel=ALL --args="page_poison=1" Add or modify the following line in "/etc/default/grub" to ensure the configuration survives kernel updates: GRUB_CMDLINE_LINUX="page_poison=1"

b
TOSS 5 must disable the kernel.core_pattern.
CM-6 - Medium - CCI-000366 - V-282622 - SV-282622r1201309_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000033
Vuln IDs
  • V-282622
Rule IDs
  • SV-282622r1201309_rule
A core dump includes a memory image taken at the time the operating system terminates an application. The memory image could contain sensitive data and is generally useful only for developers trying to debug problems.
Checks: C-87183r1200844_chk

Verify TOSS 5 disables storing core dumps with the following commands: $ sudo sysctl kernel.core_pattern kernel.core_pattern = |/bin/false If the returned line does not have a value of "|/bin/false", or a line is not returned and the need for core dumps is not documented with the information system security officer (ISSO) as an operational requirement, this is a finding.

Fix: F-87088r1201308_fix

Configure TOSS 5 to disable storing core dumps. Add or edit the following line in a system configuration file in the "/etc/sysctl.d/" directory: kernel.core_pattern = |/bin/false Reload the system configuration files for the changes to take effect. $ sudo sysctl --system

c
TOSS 5 must be a vendor-supported release.
CM-6 - High - CCI-000366 - V-282623 - SV-282623r1201600_rule
RMF Control
CM-6
Severity
H
CCI
CCI-000366
Version
TOSS-05-000084
Vuln IDs
  • V-282623
Rule IDs
  • SV-282623r1201600_rule
An operating system release is considered supported if the vendor continues to provide security patches for the product. With an unsupported release, it will not be possible to resolve security issues discovered in the system software. Satisfies: SRG-OS-000480-GPOS-00227, SRG-OS-000830-GPOS-00300
Checks: C-87184r1200847_chk

Verify the version of TOSS 5 is vendor supported using the following command: $ cat /etc/toss-release toss-release-5.1-1 If the installed version of TOSS 5 is not supported, this is a finding.

Fix: F-87089r1200848_fix

Upgrade to a supported version of TOSS 5.

b
TOSS 5 vendor packaged system security patches and updates must be installed and up to date.
CM-6 - Medium - CCI-000366 - V-282624 - SV-282624r1200852_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000085
Vuln IDs
  • V-282624
Rule IDs
  • SV-282624r1200852_rule
Installing software updates is a fundamental mitigation against the exploitation of publicly known vulnerabilities. If the most recent security patches and updates are not installed, unauthorized users may take advantage of weaknesses in the unpatched software. The lack of prompt attention to patching could result in a system compromise.
Checks: C-87185r1200850_chk

Verify TOSS 5 security patches and updates are installed and up to date. Updates are required in a frequency determined by organizational policy. Check the TOSS release notes sent via email for security updates. It is important to note that updates provided by Red Hat/TOSS may not be present on the system if the underlying packages are not installed. Check that the available package security updates have been installed on the system using the following command: $ dnf history list | more ID | Command line | Date and time | Action(s) | Altered ------------------------------------------------------------------------------- 70 | install aide | 2023-03-05 10:58 | Install | 1 69 | update -y | 2023-03-04 14:34 | Update | 18 EE 68 | install vlc | 2023-02-21 17:12 | Install | 21 67 | update -y | 2023-02-21 17:04 | Update | 7 EE Typical update frequency may be overridden by Information Assurance Vulnerability Alert (IAVA) notifications from CYBERCOM. If the system is not compliant with the organizational patching policy, this is a finding.

Fix: F-87090r1200851_fix

Install TOSS 5 security patches and updates at the organizationally defined frequency. If system updates are installed via a centralized repository that is configured on the system, install all updates using the following command: $ sudo dnf update

b
The graphical display manager must not be the default target on TOSS 5 unless approved.
CM-6 - Medium - CCI-000366 - V-282625 - SV-282625r1200855_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000087
Vuln IDs
  • V-282625
Rule IDs
  • SV-282625r1200855_rule
Unnecessary service packages must not be installed to decrease the attack surface of the system. Graphical display managers have a long history of security vulnerabilities and must not be used unless approved and documented.
Checks: C-87186r1200853_chk

Verify TOSS 5 is configured to boot to the command line: $ systemctl get-default multi-user.target If the system default target is not set to "multi-user.target" and the information system security officer (ISSO) lacks a documented requirement for a graphical user interface, this is a finding.

Fix: F-87091r1200854_fix

Document the requirement for a graphical user interface with the ISSO or set the default target to "multi-user" using the following command: $ sudo systemctl set-default multi-user.target

a
TOSS 5 must enable the hardware random number generator entropy gatherer service.
CM-6 - Low - CCI-000366 - V-282626 - SV-282626r1200858_rule
RMF Control
CM-6
Severity
L
CCI
CCI-000366
Version
TOSS-05-000088
Vuln IDs
  • V-282626
Rule IDs
  • SV-282626r1200858_rule
The most important characteristic of a random number generator is its randomness, namely its ability to deliver random numbers that are impossible to predict. Entropy in computer security is associated with the unpredictability of a source of randomness. The random source with high entropy tends to achieve a uniform distribution of random values. Random number generators are one of the most important building blocks of cryptosystems. The "rngd" service feeds random data from hardware device to kernel random device. Quality (nonpredictable) random number generation is important for several security functions (i.e., ciphers).
Checks: C-87187r1200856_chk

Verify TOSS 5 enabled the hardware random number generator entropy gatherer service using the following command: Note: For TOSS 5 systems running with kernel FIPS mode enabled as specified by TOSS-05-000470, this requirement is not applicable. $ systemctl is-active rngd active If the "rngd" service is not active, this is a finding.

Fix: F-87092r1200857_fix

Install the "rng-tools" package using the following command: $ sudo dnf install rng-tools Enable the "rngd" service using the following command: $ sudo systemctl enable --now rngd

b
TOSS 5 must disable the ability of systemd to spawn an interactive boot process.
CM-6 - Medium - CCI-000366 - V-282627 - SV-282627r1200861_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000093
Vuln IDs
  • V-282627
Rule IDs
  • SV-282627r1200861_rule
Using interactive or recovery boot, the console user could disable auditing, firewalls, or other services, thereby weakening system security.
Checks: C-87188r1200859_chk

Verify GRUB 2 is configured to disable interactive boot. Check that the current GRUB 2 configuration disables the ability of systemd to spawn an interactive boot process using the following command: $ sudo grubby --info=ALL | grep args | grep 'systemd.confirm_spawn' If any output is returned, this is a finding.

Fix: F-87093r1200860_fix

Configure TOSS 5 to allocate sufficient audit_backlog_limit to disable the ability of systemd to spawn an interactive boot process using the following command: $ sudo grubby --update-kernel=ALL --remove-args="systemd.confirm_spawn"

b
The TOSS 5 /boot/grub2/grub.cfg file must be group owned by root.
CM-6 - Medium - CCI-000366 - V-282628 - SV-282628r1200864_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000095
Vuln IDs
  • V-282628
Rule IDs
  • SV-282628r1200864_rule
The "root" group is a highly privileged group. Furthermore, the group owner of this file should not have any access privileges.
Checks: C-87189r1200862_chk

Verify the group ownership of the "/boot/grub2/grub.cfg" file using the following command: $ sudo stat -c "%G %n" /boot/grub2/grub.cfg root /boot/grub2/grub.cfg If "/boot/grub2/grub.cfg" file does not have a group owner of "root", this is a finding.

Fix: F-87094r1200863_fix

Change the group of the file /boot/grub2/grub.cfg to root using the following command: $ sudo chgrp root /boot/grub2/grub.cfg

b
The TOSS 5 /boot/grub2/grub.cfg file must be owned by root.
CM-6 - Medium - CCI-000366 - V-282629 - SV-282629r1200867_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000096
Vuln IDs
  • V-282629
Rule IDs
  • SV-282629r1200867_rule
The "/boot/grub2/grub.cfg" file stores sensitive system configurations. Protecting this file is critical for system security.
Checks: C-87190r1200865_chk

Verify the ownership of the "/boot/grub2/grub.cfg" file using the following command: $ sudo stat -c "%U %n" /boot/grub2/grub.cfg root /boot/grub2/grub.cfg If "/boot/grub2/grub.cfg" file does not have an owner of "root", this is a finding.

Fix: F-87095r1200866_fix

Change the owner of the file "/boot/grub2/grub.cfg" to root using the following command: $ sudo chown root /boot/grub2/grub.cfg

b
TOSS 5 must prevent loading a new kernel for later execution.
CM-6 - Medium - CCI-000366 - V-282630 - SV-282630r1200870_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000100
Vuln IDs
  • V-282630
Rule IDs
  • SV-282630r1200870_rule
Changes to any software components can have significant effects on the overall security of the operating system. This requirement ensures the software has not been tampered with and that it has been provided by a trusted vendor. Disabling "kexec_load" prevents an unsigned kernel image (that could be a windows kernel or modified vulnerable kernel) from being loaded. Kexec can be used subvert the entire secureboot process and should be avoided at all costs especially since it can load unsigned kernel images.
Checks: C-87191r1200868_chk

Verify TOSS 5 is configured to disable kernel image loading using the following command: $ sudo sysctl kernel.kexec_load_disabled kernel.kexec_load_disabled = 1 If "kernel.kexec_load_disabled" is not set to "1" or is missing, this is a finding.

Fix: F-87096r1200869_fix

Add or edit the following line in a system configuration file in the "/etc/sysctl.d/" directory: kernel.kexec_load_disabled = 1 Load settings from all system configuration files using the following command: $ sudo sysctl --system

b
TOSS 5 must disable core dump backtraces.
CM-6 - Medium - CCI-000366 - V-282631 - SV-282631r1200873_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000111
Vuln IDs
  • V-282631
Rule IDs
  • SV-282631r1200873_rule
A core dump includes a memory image taken at the time the operating system terminates an application. The memory image could contain sensitive data and is generally useful only for developers or system operators trying to debug problems. Enabling core dumps on production systems is not recommended; however, there may be overriding operational requirements to enable advanced debugging. Permitting temporary enablement of core dumps during such situations must be reviewed through local needs and policy.
Checks: C-87192r1200871_chk

Verify TOSS 5 disables core dump backtraces using the following command: $ grep -i process /etc/systemd/coredump.conf ProcessSizeMax=0 If the "ProcessSizeMax" item is missing, commented out, or the value is anything other than "0" and the need for core dumps is not documented with the information system security officer (ISSO) as an operational requirement for all domains that have the "core" item assigned, this is a finding.

Fix: F-87097r1200872_fix

Configure TOSS 5 to disable core dump backtraces. Add or modify the following line in /etc/systemd/coredump.conf: ProcessSizeMax=0

b
TOSS 5 must disable storing core dumps.
CM-6 - Medium - CCI-000366 - V-282632 - SV-282632r1200876_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000112
Vuln IDs
  • V-282632
Rule IDs
  • SV-282632r1200876_rule
A core dump includes a memory image taken at the time the operating system terminates an application. The memory image could contain sensitive data and is generally useful only for developers or system operators trying to debug problems. Enabling core dumps on production systems is not recommended; however, there may be overriding operational requirements to enable advanced debugging. Permitting temporary enablement of core dumps during such situations must be reviewed through local needs and policy.
Checks: C-87193r1200874_chk

Verify TOSS 5 disables storing core dumps for all users using the following command: $ grep -i storage /etc/systemd/coredump.conf Storage=none If the "Storage" item is missing, commented out, or the value is anything other than "none" and the need for core dumps is not documented with the information system security officer (ISSO) as an operational requirement for all domains that have the "core" item assigned, this is a finding.

Fix: F-87098r1200875_fix

Configure TOSS 5 to disable storing core dumps for all users. Add or modify the following line in /etc/systemd/coredump.conf: Storage=none

b
TOSS 5 must disable acquiring, saving, and processing core dumps.
CM-6 - Medium - CCI-000366 - V-282633 - SV-282633r1200879_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000113
Vuln IDs
  • V-282633
Rule IDs
  • SV-282633r1200879_rule
A core dump includes a memory image taken at the time the operating system terminates an application. The memory image could contain sensitive data and is generally useful only for developers trying to debug problems.
Checks: C-87194r1200877_chk

Verify TOSS 5 is not configured to acquire, save, or process core dumps using the following command: $ sudo systemctl status systemd-coredump.socket systemd-coredump.socket Loaded: masked (Reason: Unit systemd-coredump.socket is masked.) Active: inactive (dead) If the "systemd-coredump.socket" is loaded and not masked and the need for core dumps is not documented with the information system security officer (ISSO) as an operational requirement, this is a finding.

Fix: F-87099r1200878_fix

Configure the system to disable the systemd-coredump.socket using the following command: $ sudo systemctl mask --now systemd-coredump.socket Created symlink /etc/systemd/system/systemd-coredump.socket -> /dev/null Reload the daemon for this change to take effect. $ sudo systemctl daemon-reload

b
TOSS 5 must not have the sendmail package installed.
CM-6 - Medium - CCI-000366 - V-282634 - SV-282634r1200882_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000122
Vuln IDs
  • V-282634
Rule IDs
  • SV-282634r1200882_rule
The "sendmail "software was not developed with security in mind, and its design prevents it from being effectively contained by SELinux. Postfix must be used instead.
Checks: C-87195r1200880_chk

Verify the "sendmail" package is not installed using the following command: $ sudo dnf list --installed sendmail Error: No matching Packages to list If the "sendmail" package is installed, this is a finding.

Fix: F-87100r1200881_fix

Remove the "sendmail" package using the following command: $ sudo dnf remove sendmail

b
TOSS 5 must not have the quagga package installed.
CM-6 - Medium - CCI-000366 - V-282635 - SV-282635r1201602_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000127
Vuln IDs
  • V-282635
Rule IDs
  • SV-282635r1201602_rule
Quagga is a network routing software suite providing implementations of Open Shortest Path First (OSPF), Routing Information Protocol (RIP), and Border Gateway Protocol (BGP) for Unix and Linux platforms. If there is no need to make the router software available, removing it provides a safeguard against its activation.
Checks: C-87196r1200883_chk

Verify the "quagga" package is not installed using the following command: $ sudo dnf list --installed quagga Error: No matching Packages to list If the "quagga" package is installed and is not documented with the information system security officer (ISSO) as an operational requirement, this is a finding.

Fix: F-87101r1200884_fix

Remove the "quagga" package using the following command: $ sudo dnf remove quagga

b
TOSS 5 must have the gnutls-utils package installed.
CM-6 - Medium - CCI-000366 - V-282636 - SV-282636r1201310_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000129
Vuln IDs
  • V-282636
Rule IDs
  • SV-282636r1201310_rule
GnuTLS is a secure communications library implementing the SSL, TLS, and DTLS protocols and technologies around them. It provides a simple C language application programming interface (API) to access the secure communications protocols as well as APIs to parse and write X.509, PKCS #12, OpenPGP, and other required structures. This package contains command line TLS client and server and certificate manipulation tools.
Checks: C-87197r1200886_chk

Verify TOSS 5 has the "gnutls-utils" package installed using the following command: $ dnf list --installed gnutls-utils Example output: gnutls-utils.x86_64 3.7.3-9.el9 If the "gnutls-utils" package is not installed, this is a finding.

Fix: F-87102r1200887_fix

Install the "gnutls-utils" package using the following command: $ sudo dnf install gnutls-utils

b
TOSS 5 must have the nss-tools package installed.
CM-6 - Medium - CCI-000366 - V-282637 - SV-282637r1200891_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000130
Vuln IDs
  • V-282637
Rule IDs
  • SV-282637r1200891_rule
Network Security Services (NSS) is a set of libraries designed to support cross-platform development of security-enabled client and server applications. Installing the "nss-tools" package installs command line tools to manipulate the NSS certificate and key database.
Checks: C-87198r1200889_chk

Verify TOSS 5 has the "nss-tools" package installed using the following command: $ dnf list --installed nss-tools Example output: nss-tools.x86_64 3.71.0-7.el9 If the "nss-tools" package is not installed, this is a finding.

Fix: F-87103r1200890_fix

Install the "nss-tools" package using the following command: $ sudo dnf install nss-tools

b
TOSS 5 must have the rng-tools package installed.
CM-6 - Medium - CCI-000366 - V-282638 - SV-282638r1200894_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000131
Vuln IDs
  • V-282638
Rule IDs
  • SV-282638r1200894_rule
"rng-tools" provides hardware random number generator tools, such as those used in the formation of x509/PKI certificates.
Checks: C-87199r1200892_chk

Verify TOSS 5 has the "rng-tools" package installed using the following command: $ sudo dnf list --installed rng-tools Example output: rng-tools.x86_64 6.14-2.git.b2b7934e.el9 If the "rng-tools" package is not installed, this is a finding.

Fix: F-87104r1200893_fix

Install the "rng-tools" package using the following command: $ sudo dnf install rng-tools

b
TOSS 5 must be configured so that the Network File System (NFS) is configured to use RPCSEC_GSS.
CM-6 - Medium - CCI-000366 - V-282639 - SV-282639r1200897_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000134
Vuln IDs
  • V-282639
Rule IDs
  • SV-282639r1200897_rule
When an NFS server is configured to use RPCSEC_SYS, a selected userid and groupid are used to handle requests from the remote user. The userid and groupid could mistakenly or maliciously be set incorrectly. The RPCSEC_GSS method of authentication uses certificates on the server and client systems to more securely authenticate the remote mount request.
Checks: C-87200r1200895_chk

Verify TOSS 5 has the "sec" option configured for all NFS mounts using the following command: Note: If no NFS mounts are configured, this requirement is not applicable. $ cat /etc/fstab | grep nfs 192.168.22.2:/mnt/export /data nfs4 rw,nosuid,nodev,noexec,sync,soft,sec=krb5p:krb5i:krb5 If the system is mounting file systems via NFS and has the sec option without the "krb5:krb5i:krb5p" settings, the "sec" option has the "sys" setting, or the "sec" option is missing, this is a finding.

Fix: F-87105r1200896_fix

Update the "/etc/fstab" file so the option "sec" is defined for each NFS mounted file system and the "sec" option does not have the "sys" setting. Ensure the "sec" option is defined as "krb5p:krb5i:krb5".

b
TOSS 5 must prevent special devices on file systems that are imported via Network File System (NFS).
CM-6 - Medium - CCI-000366 - V-282640 - SV-282640r1200900_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000135
Vuln IDs
  • V-282640
Rule IDs
  • SV-282640r1200900_rule
The "nodev" mount option causes the system to not interpret character or block special devices. Executing character or block special devices from untrusted file systems increases the opportunity for nonprivileged users to attain unauthorized administrative access.
Checks: C-87201r1200898_chk

Verify TOSS 5 has the "nodev" option configured for all NFS mounts using the following command: Note: If no NFS mounts are configured, this requirement is not applicable. $ cat /etc/fstab | grep nfs 192.168.22.2:/mnt/export /data nfs4 rw,nosuid,nodev,noexec,sync,soft,sec=krb5:krb5i:krb5p If the system is mounting file systems via NFS and the "nodev" option is missing, this is a finding.

Fix: F-87106r1200899_fix

Update each NFS mounted file system to use the "nodev" option on file systems that are being imported via NFS.

b
TOSS 5 cron configuration directories must have a mode of 0700 or less permissive.
CM-6 - Medium - CCI-000366 - V-282641 - SV-282641r1200903_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000145
Vuln IDs
  • V-282641
Rule IDs
  • SV-282641r1200903_rule
Service configuration files enable or disable features of their respective services that if configured incorrectly can lead to insecure and vulnerable configurations. Therefore, service configuration files should have the correct access rights to prevent unauthorized changes.
Checks: C-87202r1200901_chk

Verify the permissions of the cron directories using the following command: $ find /etc/cron* -type d | xargs stat -c "%a %n" 700 /etc/cron.d 700 /etc/cron.daily 700 /etc/cron.hourly 700 /etc/cron.monthly 700 /etc/cron.weekly If any cron configuration directory is more permissive than "700", this is a finding.

Fix: F-87107r1200902_fix

Configure any TOSS 5 cron configuration directory with a mode more permissive than "0700" as follows: $ sudo chmod 0700 [cron configuration directory]

b
All TOSS 5 local initialization files must have mode 0740 or less permissive.
CM-6 - Medium - CCI-000366 - V-282642 - SV-282642r1200906_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000146
Vuln IDs
  • V-282642
Rule IDs
  • SV-282642r1200906_rule
Local initialization files are used to configure the user's shell environment upon logon. Maliciously modifying these files could compromise accounts upon logon.
Checks: C-87203r1200904_chk

Verify all local initialization files have a mode of "0740" or less permissive using the following command: Note: The example will be for the "wadea" user, who has a home directory of "/home/wadea". $ sudo ls -al /home/wadea/.[^.]* | more -rwxr---- 1 wadea users 896 Mar 10 2011 .profile -rwxr---- 1 wadea users 497 Jan 6 2007 .login -rwxr---- 1 wadea users 886 Jan 6 2007 .something If any local initialization files have a mode more permissive than "0740", and is not documented with the information system security officer (ISSO) as an operational requirement, this is a finding.

Fix: F-87108r1200905_fix

Set the mode of the local initialization files to "0740" using the following command: Note: The example will be for the wadea user, who has a home directory of "/home/wadea". $ sudo chmod 0740 /home/wadea/.<INIT_FILE>

b
All TOSS 5 local interactive user home directories must have mode 0770 or less permissive.
CM-6 - Medium - CCI-000366 - V-282643 - SV-282643r1200909_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000147
Vuln IDs
  • V-282643
Rule IDs
  • SV-282643r1200909_rule
Excessive permissions on local interactive user home directories may allow unauthorized access to user files by other users.
Checks: C-87204r1200907_chk

Verify the assigned home directory of all local interactive users has a mode of "0770" or less permissive using the following command: Note: This may miss interactive users that have been assigned a privileged user identifier (UID). Evidence of interactive use may be obtained from a number of log files containing system logon information. $ sudo ls -ld $(awk -F: '($3&gt;=1000)&amp;&amp;($7 !~ /nologin/){print $6}' /etc/passwd) drwxrwx--- 2 wadea admin 4096 Jun 5 12:41 wadea If home directories referenced in "/etc/passwd" do not have a mode of "0770" or less permissive, this is a finding.

Fix: F-87109r1200908_fix

Change the mode of interactive user's home directories to "0770". To change the mode of a local interactive user's home directory, use the following command: Note: The example will be for the user "wadea". $ sudo chmod 0770 /home/wadea

b
The TOSS 5 /etc/group file must have mode 0644 or less permissive to prevent unauthorized access.
CM-6 - Medium - CCI-000366 - V-282644 - SV-282644r1200912_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000148
Vuln IDs
  • V-282644
Rule IDs
  • SV-282644r1200912_rule
The "/etc/group" file contains information regarding groups that are configured on the system. Protecting this file is important for system security.
Checks: C-87205r1200910_chk

Verify the "/etc/group" file has mode "0644" or less permissive using the following command: $ sudo stat -c "%a %n" /etc/group 644 /etc/group If a value of "0644" or less permissive is not returned, this is a finding.

Fix: F-87110r1200911_fix

Change the mode of the file "/etc/group" to "0644" using the following command: $ sudo chmod 0644 /etc/group

b
The TOSS 5 /etc/group- file must have mode 0644 or less permissive to prevent unauthorized access.
CM-6 - Medium - CCI-000366 - V-282645 - SV-282645r1200915_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000149
Vuln IDs
  • V-282645
Rule IDs
  • SV-282645r1200915_rule
The "/etc/group-" file is a backup file of "/etc/group" and thus contains information regarding groups configured on the system. Protecting this file is important for system security.
Checks: C-87206r1200913_chk

Verify the "/etc/group-" file has mode "0644" or less permissive using the following command: $ sudo stat -c "%a %n" /etc/group- 644 /etc/group- If a value of "0644" or less permissive is not returned, this is a finding.

Fix: F-87111r1200914_fix

Change the mode of the file "/etc/group-" to "0644" using the following command: $ sudo chmod 0644 /etc/group-

b
The TOSS 5 /etc/gshadow file must have mode 0000 or less permissive to prevent unauthorized access.
CM-6 - Medium - CCI-000366 - V-282646 - SV-282646r1200918_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000150
Vuln IDs
  • V-282646
Rule IDs
  • SV-282646r1200918_rule
The "/etc/gshadow" file contains group password hashes. Protecting this file is critical for system security.
Checks: C-87207r1200916_chk

Verify the "/etc/gshadow" file has mode "0000" using the following command: $ sudo stat -c "%a %n" /etc/gshadow 0 /etc/gshadow If a value of "0" is not returned, this is a finding.

Fix: F-87112r1200917_fix

Change the mode of the file "/etc/gshadow" to "0000" using the following command: $ sudo chmod 0000 /etc/gshadow

b
The TOSS 5 /etc/gshadow- file must have mode 0000 or less permissive to prevent unauthorized access.
CM-6 - Medium - CCI-000366 - V-282647 - SV-282647r1200921_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000151
Vuln IDs
  • V-282647
Rule IDs
  • SV-282647r1200921_rule
The "/etc/gshadow-" file is a backup of "/etc/gshadow" and contains group password hashes. Protecting this file is critical for system security.
Checks: C-87208r1200919_chk

Verify the "/etc/gshadow-" file has mode "0000" using the following command: $ sudo stat -c "%a %n" /etc/gshadow- 0 /etc/gshadow- If a value of "0" is not returned, this is a finding.

Fix: F-87113r1200920_fix

Change the mode of the file "/etc/gshadow-" to "0000" using the following command: $ sudo chmod 0000 /etc/gshadow-

b
The TOSS 5 /etc/passwd file must have mode 0644 or less permissive to prevent unauthorized access.
CM-6 - Medium - CCI-000366 - V-282648 - SV-282648r1201583_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000152
Vuln IDs
  • V-282648
Rule IDs
  • SV-282648r1201583_rule
If the "/etc/passwd" file is writable by a group owner or the world, it increases the risk of compromise. The file contains the list of accounts on the system and associated information, and protection of this file is critical for system security.
Checks: C-87209r1200922_chk

Verify the "/etc/passwd" file has mode "0644" or less permissive using the following command: $ sudo stat -c "%a %n" /etc/passwd 644 /etc/passwd If a value of "0644" or less permissive is not returned, this is a finding.

Fix: F-87114r1200923_fix

Change the mode of the file "/etc/passwd" to "0644" using the following command: $ sudo chmod 0644 /etc/passwd

b
The TOSS 5 /etc/passwd- file must have mode 0644 or less permissive to prevent unauthorized access.
CM-6 - Medium - CCI-000366 - V-282649 - SV-282649r1200927_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000153
Vuln IDs
  • V-282649
Rule IDs
  • SV-282649r1200927_rule
The "/etc/passwd-" file is a backup file of "/etc/passwd" and contains information about the users configured on the system. Protecting this file is critical for system security.
Checks: C-87210r1200925_chk

Verify the "/etc/passwd-" file has mode "0644" or less permissive using the following command: $ sudo stat -c "%a %n" /etc/passwd- 644 /etc/passwd- If a value of "0644" or less permissive is not returned, this is a finding.

Fix: F-87115r1200926_fix

Change the mode of the file "/etc/passwd-" to "0644" using the following command: $ sudo chmod 0644 /etc/passwd-

b
The TOSS 5 /etc/shadow- file must have mode 0000 or less permissive to prevent unauthorized access.
CM-6 - Medium - CCI-000366 - V-282650 - SV-282650r1200930_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000154
Vuln IDs
  • V-282650
Rule IDs
  • SV-282650r1200930_rule
The "/etc/shadow-" file is a backup file of "/etc/shadow", and as such, contains the list of local system accounts and password hashes. Protecting this file is critical for system security.
Checks: C-87211r1200928_chk

Verify the "/etc/shadow-" file has mode "0000" using the following command: $ sudo stat -c "%a %n" /etc/shadow- 0 /etc/shadow- If a value of "0" is not returned, this is a finding.

Fix: F-87116r1200929_fix

Change the mode of the file "/etc/shadow-" to "0000" using the following command: $ sudo chmod 0000 /etc/shadow-

b
The TOSS 5 /etc/group file must be owned by root.
CM-6 - Medium - CCI-000366 - V-282651 - SV-282651r1200933_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000155
Vuln IDs
  • V-282651
Rule IDs
  • SV-282651r1200933_rule
The "/etc/group" file contains information regarding groups that are configured on the system. Protecting this file is critical for system security.
Checks: C-87212r1200931_chk

Verify the ownership of the "/etc/group" file using the following command: $ sudo stat -c "%U %n" /etc/group root /etc/group If "/etc/group" file does not have an owner of "root", this is a finding.

Fix: F-87117r1200932_fix

Change the owner of the file "/etc/group" to "root" using the following command: $ sudo chown root /etc/group

b
The TOSS 5 /etc/group file must be group-owned by root.
CM-6 - Medium - CCI-000366 - V-282652 - SV-282652r1200936_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000156
Vuln IDs
  • V-282652
Rule IDs
  • SV-282652r1200936_rule
The "/etc/group" file contains information regarding groups configured on the system. Protecting this file is critical for system security.
Checks: C-87213r1200934_chk

Verify the group ownership of the "/etc/group" file using the following command: $ sudo stat -c "%G %n" /etc/group root /etc/group If "/etc/group" file does not have a group owner of "root", this is a finding.

Fix: F-87118r1200935_fix

Change the group of the file "/etc/group" to "root" using the following command: $ sudo chgrp root /etc/group

b
The TOSS 5 /etc/group- file must be owned by root.
CM-6 - Medium - CCI-000366 - V-282653 - SV-282653r1200939_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000157
Vuln IDs
  • V-282653
Rule IDs
  • SV-282653r1200939_rule
The "/etc/group-" file is a backup file of "/etc/group", and as such, contains information regarding groups that are configured on the system. Protecting this file is critical for system security.
Checks: C-87214r1200937_chk

Verify the ownership of the "/etc/group-" file using the following command: $ sudo stat -c "%U %n" /etc/group- root /etc/group- If "/etc/group-" file does not have an owner of "root", this is a finding.

Fix: F-87119r1200938_fix

Change the owner of the file /etc/group- to root using the following command: $ sudo chown root /etc/group-

b
The TOSS 5 /etc/group- file must be group-owned by root.
CM-6 - Medium - CCI-000366 - V-282654 - SV-282654r1200942_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000158
Vuln IDs
  • V-282654
Rule IDs
  • SV-282654r1200942_rule
The "/etc/group-" file is a backup file of "/etc/group", and as such, contains information regarding groups that are configured on the system. Protecting this file is critical for system security.
Checks: C-87215r1200940_chk

Verify the group ownership of the "/etc/group-" file using the following command: $ sudo stat -c "%G %n" /etc/group- root /etc/group- If "/etc/group-" file does not have a group owner of "root", this is a finding.

Fix: F-87120r1200941_fix

Change the group of the file /etc/group- to root using the following command: $ sudo chgrp root /etc/group-

b
The TOSS 5 /etc/gshadow file must be owned by root.
CM-6 - Medium - CCI-000366 - V-282655 - SV-282655r1200945_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000159
Vuln IDs
  • V-282655
Rule IDs
  • SV-282655r1200945_rule
The "/etc/gshadow" file contains group password hashes. Protecting this file is critical for system security.
Checks: C-87216r1200943_chk

Verify the ownership of the "/etc/gshadow" file using the following command: $ sudo stat -c "%U %n" /etc/gshadow root /etc/gshadow If "/etc/gshadow" file does not have an owner of "root", this is a finding.

Fix: F-87121r1200944_fix

Change the owner of the file /etc/gshadow to root using the following command: $ sudo chown root /etc/gshadow

b
The TOSS 5 /etc/gshadow file must be group-owned by root.
CM-6 - Medium - CCI-000366 - V-282656 - SV-282656r1200948_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000160
Vuln IDs
  • V-282656
Rule IDs
  • SV-282656r1200948_rule
The "/etc/gshadow" file contains group password hashes. Protecting this file is critical for system security.
Checks: C-87217r1200946_chk

Verify the group ownership of the "/etc/gshadow" file using the following command: $ sudo stat -c "%G %n" /etc/gshadow root /etc/gshadow If "/etc/gshadow" file does not have a group owner of "root", this is a finding.

Fix: F-87122r1200947_fix

Change the group of the file /etc/gshadow to root using the following command: $ sudo chgrp root /etc/gshadow

b
The TOSS 5 /etc/gshadow- file must be owned by root.
CM-6 - Medium - CCI-000366 - V-282657 - SV-282657r1200951_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000161
Vuln IDs
  • V-282657
Rule IDs
  • SV-282657r1200951_rule
The "/etc/gshadow-" file is a backup of "/etc/gshadow", and as such, contains group password hashes. Protecting this file is critical for system security.
Checks: C-87218r1200949_chk

Verify the ownership of the "/etc/gshadow-" file using the following command: $ sudo stat -c "%U %n" /etc/gshadow- root /etc/gshadow- If "/etc/gshadow-" file does not have an owner of "root", this is a finding.

Fix: F-87123r1200950_fix

Change the owner of the file /etc/gshadow- to root using the following command: $ sudo chown root /etc/gshadow-

b
The TOSS 5 /etc/gshadow- file must be group-owned by root.
CM-6 - Medium - CCI-000366 - V-282658 - SV-282658r1200954_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000162
Vuln IDs
  • V-282658
Rule IDs
  • SV-282658r1200954_rule
The "/etc/gshadow-" file is a backup of "/etc/gshadow", and as such, contains group password hashes. Protecting this file is critical for system security.
Checks: C-87219r1200952_chk

Verify the group ownership of the "/etc/gshadow-" file using the following command: $ sudo stat -c "%G %n" /etc/gshadow- root /etc/gshadow- If "/etc/gshadow-" file does not have a group owner of "root", this is a finding.

Fix: F-87124r1200953_fix

Change the group of the file /etc/gshadow- to root using the following command: $ sudo chgrp root /etc/gshadow-

b
The TOSS 5 /etc/passwd file must be owned by root.
CM-6 - Medium - CCI-000366 - V-282659 - SV-282659r1200957_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000163
Vuln IDs
  • V-282659
Rule IDs
  • SV-282659r1200957_rule
The "/etc/passwd" file contains information about the users that are configured on the system. Protecting this file is critical for system security.
Checks: C-87220r1200955_chk

Verify the ownership of the "/etc/passwd" file using the following command: $ sudo stat -c "%U %n" /etc/passwd root /etc/passwd If "/etc/passwd" file does not have an owner of "root", this is a finding.

Fix: F-87125r1200956_fix

Change the owner of the file /etc/passwd to root using the following command: $ sudo chown root /etc/passwd

b
The TOSS 5 /etc/passwd file must be group-owned by root.
CM-6 - Medium - CCI-000366 - V-282660 - SV-282660r1200960_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000164
Vuln IDs
  • V-282660
Rule IDs
  • SV-282660r1200960_rule
The "/etc/passwd" file contains information about the users that are configured on the system. Protecting this file is critical for system security.
Checks: C-87221r1200958_chk

Verify the group ownership of the "/etc/passwd" file using the following command: $ sudo stat -c "%G %n" /etc/passwd root /etc/passwd If "/etc/passwd" file does not have a group owner of "root", this is a finding.

Fix: F-87126r1200959_fix

Change the group of the file /etc/passwd to root using the following command: $ sudo chgrp root /etc/passwd

b
The TOSS 5 /etc/passwd- file must be owned by root.
CM-6 - Medium - CCI-000366 - V-282661 - SV-282661r1200963_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000165
Vuln IDs
  • V-282661
Rule IDs
  • SV-282661r1200963_rule
The "/etc/passwd-" file is a backup file of "/etc/passwd", and as such, contains information about the users that are configured on the system. Protecting this file is critical for system security.
Checks: C-87222r1200961_chk

Verify the ownership of the "/etc/passwd-" file using the following command: $ sudo stat -c "%U %n" /etc/passwd- root /etc/passwd- If "/etc/passwd-" file does not have an owner of "root", this is a finding.

Fix: F-87127r1200962_fix

Change the owner of the file /etc/passwd- to root using the following command: $ sudo chown root /etc/passwd-

b
The TOSS 5 /etc/passwd- file must be group-owned by root.
CM-6 - Medium - CCI-000366 - V-282662 - SV-282662r1200966_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000166
Vuln IDs
  • V-282662
Rule IDs
  • SV-282662r1200966_rule
The "/etc/passwd-" file is a backup file of "/etc/passwd", and as such, contains information about the users that are configured on the system. Protecting this file is critical for system security.
Checks: C-87223r1200964_chk

Verify the group ownership of the "/etc/passwd-" file using the following command: $ sudo stat -c "%G %n" /etc/passwd- root /etc/passwd- If "/etc/passwd-" file does not have a group owner of "root", this is a finding.

Fix: F-87128r1200965_fix

Change the group of the file /etc/passwd- to root using the following command: $ sudo chgrp root /etc/passwd-

b
The TOSS 5 /etc/shadow file must be owned by root.
CM-6 - Medium - CCI-000366 - V-282663 - SV-282663r1200969_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000167
Vuln IDs
  • V-282663
Rule IDs
  • SV-282663r1200969_rule
The "/etc/shadow" file contains the list of local system accounts and stores password hashes. Protecting this file is critical for system security. Failure to give ownership of this file to root provides the designated owner with access to sensitive information, which could weaken the system security posture.
Checks: C-87224r1200967_chk

Verify the ownership of the "/etc/shadow" file using the following command: $ sudo stat -c "%U %n" /etc/shadow root /etc/shadow If "/etc/shadow" file does not have an owner of "root", this is a finding.

Fix: F-87129r1200968_fix

Change the owner of the file /etc/shadow to root using the following command: $ sudo chown root /etc/shadow

b
The TOSS 5 /etc/shadow file must be group-owned by root.
CM-6 - Medium - CCI-000366 - V-282664 - SV-282664r1200972_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000168
Vuln IDs
  • V-282664
Rule IDs
  • SV-282664r1200972_rule
The "/etc/shadow" file stores password hashes. Protecting this file is critical for system security.
Checks: C-87225r1200970_chk

Verify the group ownership of the "/etc/shadow" file using the following command: $ sudo stat -c "%G %n" /etc/shadow root /etc/shadow If "/etc/shadow" file does not have a group owner of "root", this is a finding.

Fix: F-87130r1200971_fix

Change the group of the file /etc/shadow to root using the following command: $ sudo chgrp root /etc/shadow

b
The TOSS 5 /etc/shadow- file must be owned by root.
CM-6 - Medium - CCI-000366 - V-282665 - SV-282665r1200975_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000169
Vuln IDs
  • V-282665
Rule IDs
  • SV-282665r1200975_rule
The "/etc/shadow-" file is a backup file of "/etc/shadow", and as such, contains the list of local system accounts and password hashes. Protecting this file is critical for system security.
Checks: C-87226r1200973_chk

Verify the ownership of the "/etc/shadow-" file using the following command: $ sudo stat -c "%U %n" /etc/shadow- root /etc/shadow- If "/etc/shadow-" file does not have an owner of "root", this is a finding.

Fix: F-87131r1200974_fix

Change the owner of the file /etc/shadow- to root using the following command: $ sudo chown root /etc/shadow-

b
The TOSS 5 /etc/shadow- file must be group-owned by root.
CM-6 - Medium - CCI-000366 - V-282666 - SV-282666r1200978_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000170
Vuln IDs
  • V-282666
Rule IDs
  • SV-282666r1200978_rule
The "/etc/shadow-" file is a backup file of "/etc/shadow", and as such, contains the list of local system accounts and password hashes. Protecting this file is critical for system security.
Checks: C-87227r1200976_chk

Verify the group ownership of the "/etc/shadow-" file using the following command: $ sudo stat -c "%G %n" /etc/shadow- root /etc/shadow- If "/etc/shadow-" file does not have a group owner of "root", this is a finding.

Fix: F-87132r1200977_fix

Change the group of the file /etc/shadow- to root using the following command: $ sudo chgrp root /etc/shadow-

b
The TOSS 5 cron configuration files directory must be owned by root.
CM-6 - Medium - CCI-000366 - V-282667 - SV-282667r1200981_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000183
Vuln IDs
  • V-282667
Rule IDs
  • SV-282667r1200981_rule
Service configuration files enable or disable features of their respective services that if configured incorrectly can lead to insecure and vulnerable configurations; therefore, service configuration files must be owned by the correct group to prevent unauthorized changes.
Checks: C-87228r1200979_chk

Verify the ownership of all cron configuration files with the command: $ stat -c "%U %n" /etc/cron* root /etc/cron.d root /etc/cron.daily root /etc/cron.deny root /etc/cron.hourly root /etc/cron.monthly root /etc/crontab root /etc/cron.weekly If any crontab is not owned by root, this is a finding.

Fix: F-87133r1200980_fix

Configure any cron configuration not owned by root using the following command: $ sudo chown root [cron config file]

b
The TOSS 5 cron configuration files directory must be group-owned by root.
CM-6 - Medium - CCI-000366 - V-282668 - SV-282668r1200984_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000184
Vuln IDs
  • V-282668
Rule IDs
  • SV-282668r1200984_rule
Service configuration files enable or disable features of their respective services that if configured incorrectly can lead to insecure and vulnerable configurations; therefore, service configuration files should be owned by the correct group to prevent unauthorized changes.
Checks: C-87229r1200982_chk

Verify the group ownership of all cron configuration files using the following command: $ stat -c "%G %n" /etc/cron* root /etc/cron.d root /etc/cron.daily root /etc/cron.deny root /etc/cron.hourly root /etc/cron.monthly root /etc/crontab root /etc/cron.weekly If any crontab is not group owned by root, this is a finding.

Fix: F-87134r1200983_fix

Configure any cron configuration not group-owned by root using the following command: $ sudo chgrp root [cron config file]

b
All TOSS 5 world-writable directories must be owned by root, sys, bin, or an application user.
CM-6 - Medium - CCI-000366 - V-282669 - SV-282669r1200987_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000185
Vuln IDs
  • V-282669
Rule IDs
  • SV-282669r1200987_rule
If a world-writable directory is not owned by root, sys, bin, or an application user identifier (UID), unauthorized users may be able to modify files created by others. The only authorized public directories are those temporary directories supplied with the system or those designed to be temporary file repositories. The setting is normally reserved for directories used by the system and by users for temporary file storage, (e.g., /tmp), and for directories requiring global read/write access.
Checks: C-87230r1200985_chk

Verify world writable directories are owned by root, a system account, or an application account. The following command will discover and print world-writable directories that are not owned by root. Run it once for each local partition [PART]: $ sudo find PART -xdev -type d -perm -0002 -uid +0 -print If there is output, this is a finding.

Fix: F-87135r1200986_fix

Configure all public directories to be owned by root or a system account to prevent unauthorized and unintended information transferred via shared system resources. Set the owner of all public directories as root or a system account using the command, replace "[Public Directory]" with any directory path not owned by root or a system account: $ sudo chown root [Public Directory]

b
All TOSS 5 local files and directories must have a valid group owner.
CM-6 - Medium - CCI-000366 - V-282670 - SV-282670r1200990_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000187
Vuln IDs
  • V-282670
Rule IDs
  • SV-282670r1200990_rule
Files without a valid group owner may be unintentionally inherited if a group is assigned the same Group Identifier (GID) as the GID of the files without a valid group owner.
Checks: C-87231r1200988_chk

Verify all local files and directories on TOSS 5 have a valid group using the following command: $ df --local -P | awk {'if (NR!=1) print $6'} | sudo xargs -I '{}' find '{}' -xdev -nogroup If any files on the system do not have an assigned group, this is a finding.

Fix: F-87136r1200989_fix

Either remove all files and directories from TOSS 5 that do not have a valid group, or assign a valid group to all files and directories on the system with the "chgrp" command: $ sudo chgrp <group> <file>

b
All TOSS 5 local files and directories must have a valid owner.
CM-6 - Medium - CCI-000366 - V-282671 - SV-282671r1200993_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000188
Vuln IDs
  • V-282671
Rule IDs
  • SV-282671r1200993_rule
Unowned files and directories may be unintentionally inherited if a user is assigned the same user identifier "UID" as the UID of the unowned files.
Checks: C-87232r1200991_chk

Verify all local files and directories on TOSS 5 have a valid owner using the following command: $ df --local -P | awk {'if (NR!=1) print $6'} | sudo xargs -I '{}' find '{}' -xdev -nouser If any files on the system do not have an assigned owner, this is a finding.

Fix: F-87137r1200992_fix

Either remove all files and directories from the system that do not have a valid user, or assign a valid user to all unowned files and directories on TOSS 5 with the "chown" command: $ sudo chown <user> <file>

b
TOSS 5 must be configured so that all system device files are correctly labeled to prevent unauthorized modification.
CM-6 - Medium - CCI-000366 - V-282672 - SV-282672r1200996_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000189
Vuln IDs
  • V-282672
Rule IDs
  • SV-282672r1200996_rule
If an unauthorized or modified device is allowed to exist on the system, there is the possibility the system may perform unintended or unauthorized operations.
Checks: C-87233r1200994_chk

Verify all system device files are correctly labeled to prevent unauthorized modification. List all device files on the system that are incorrectly labeled with the following commands: Note: Device files are normally found under "/dev", but applications may place device files in other directories and may necessitate a search of the entire system. # find /dev -context *:device_t:* \( -type c -o -type b \) -printf "%p %Z\n" # find /dev -context *:unlabeled_t:* \( -type c -o -type b \) -printf "%p %Z\n" Note: There are device files, such as "/dev/vmci", that are used when the operating system is a host virtual machine. They will not be owned by a user on the system and require the "device_t" label to operate. These device files are not a finding. If there is output from either of these commands, other than already noted, this is a finding.

Fix: F-87138r1200995_fix

Restore the SELinux policy for the affected device file from the system policy database using the following command: $ sudo restorecon -v <device_path> Substituting "<device_path>" with the path to the affected device file (from the output of the previous commands). An example device file path would be "/dev/ttyUSB0". If the output of the above command does not indicate that the device was relabeled to a more specific SELinux type label, then the SELinux policy of the system must be updated with more specific policy for the device class specified. If a package was used to install support for a device class, that package could be reinstalled using the following command: $ sudo dnf reinstall <package_name> If a package was not used to install the SELinux policy for a given device class, then it must be generated manually and provide specific type labels.

b
TOSS 5 /etc/crontab file must have mode 0600.
CM-6 - Medium - CCI-000366 - V-282673 - SV-282673r1201585_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000190
Vuln IDs
  • V-282673
Rule IDs
  • SV-282673r1201585_rule
Service configuration files enable or disable features of their respective services that if configured incorrectly can lead to insecure and vulnerable configurations; therefore, service configuration files must have the correct access rights to prevent unauthorized changes.
Checks: C-87234r1200997_chk

Verify the permissions of /etc/crontab using the following command: $ stat -c "%a %n" /etc/crontab 0600 If /etc/crontab does not have a mode of "0600", this is a finding.

Fix: F-87139r1201584_fix

Configure the TOSS 5 file /etc/crontab with mode "600". $ sudo chmod 0600 /etc/crontab

b
The TOSS 5 /etc/shadow file must have mode 0000 to prevent unauthorized access.
CM-6 - Medium - CCI-000366 - V-282674 - SV-282674r1201002_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000191
Vuln IDs
  • V-282674
Rule IDs
  • SV-282674r1201002_rule
The "/etc/shadow" file contains the list of local system accounts and stores password hashes. Protecting this file is critical for system security. Failure to give ownership of this file to root provides the designated owner with access to sensitive information, which could weaken the system security posture.
Checks: C-87235r1201000_chk

Verify the "/etc/shadow" file has mode "0000" using the following command: $ sudo stat -c "%a %n" /etc/shadow 0 /etc/shadow If a value of "0" is not returned, this is a finding.

Fix: F-87140r1201001_fix

Change the mode of the file "/etc/shadow" to "0000" using the following command: $ sudo chmod 0000 /etc/shadow

b
A TOSS 5 firewall must employ a deny-all, allow-by-exception policy for allowing connections to other systems.
CM-6 - Medium - CCI-000366 - V-282675 - SV-282675r1201005_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000194
Vuln IDs
  • V-282675
Rule IDs
  • SV-282675r1201005_rule
Failure to restrict network connectivity only to authorized systems permits inbound connections from malicious systems. It also permits outbound connections that may facilitate exfiltration of DOD data. TOSS 5 incorporates the "firewalld" daemon, which allows for many different configurations. One of these configurations is zones. Zones can be used to a deny-all, allow-by-exception approach. The default "drop" zone will drop all incoming network packets unless it is explicitly allowed by the configuration file or is related to an outgoing network connection.
Checks: C-87236r1201003_chk

Verify the TOSS 5 "firewalld" is configured to employ a deny-all, allow-by-exception policy for allowing connections to other systems with the following commands: $ sudo firewall-cmd --state running $ sudo firewall-cmd --get-active-zones public interfaces: ens33 $ sudo firewall-cmd --info-zone=public | grep target target: DROP $ sudo firewall-cmd --permanent --info-zone=public | grep target target: DROP If no zones are active on the TOSS 5 interfaces or if runtime and permanent targets are set to a different option other than "DROP", this is a finding.

Fix: F-87141r1201004_fix

Configure the "firewalld" daemon to employ a deny-all, allow-by-exception with the following commands: Start by adding the exceptions that are required for mission functionality to the "drop" zone. If SSH access on port 22 is needed, for example, run the following: "sudo firewall-cmd --permanent --add-service=ssh --zone=drop" Reload the firewall rules to update the runtime configuration from the "--permanent" changes made above: $ sudo firewall-cmd --reload Set the default zone to the drop zone: $ sudo firewall-cmd --set-default-zone=drop Note: This is a runtime and permanent change. Add any interfaces to the newly modified "drop" zone: $ sudo firewall-cmd --permanent --zone=drop --change-interface=ens33 Reload the firewall rules for changes to take effect: $ sudo firewall-cmd --reload

b
TOSS 5 network interfaces must not be in promiscuous mode.
CM-6 - Medium - CCI-000366 - V-282676 - SV-282676r1201008_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000198
Vuln IDs
  • V-282676
Rule IDs
  • SV-282676r1201008_rule
Network interfaces in promiscuous mode allow for the capture of all network traffic visible to the system. If unauthorized individuals can access these applications, it may allow them to collect information such as logon IDs, passwords, and key exchanges between systems. If the system is being used to perform a network troubleshooting function, the use of these tools must be documented with the information systems security officer (ISSO) and restricted to only authorized personnel.
Checks: C-87237r1201006_chk

Verify network interfaces are not in promiscuous mode using the following command: $ ip link | grep -i promisc If network interfaces are found on the system in promiscuous mode and their use has not been approved by the ISSO and documented, this is a finding.

Fix: F-87142r1201007_fix

Configure network interfaces to turn off promiscuous mode unless approved by the ISSO and documented. Set the promiscuous mode of an interface to off using the following command: $ sudo ip link set dev <devicename> multicast off promisc off

b
TOSS 5 must enable hardening for the Berkeley Packet Filter (BPF) just-in-time (JIT) compiler.
CM-6 - Medium - CCI-000366 - V-282677 - SV-282677r1201330_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000199
Vuln IDs
  • V-282677
Rule IDs
  • SV-282677r1201330_rule
When hardened, the extended BPF JIT compiler will randomize any kernel addresses in the BPF programs and maps and will not expose the JIT addresses in "/proc/kallsyms".
Checks: C-87238r1201009_chk

Verify TOSS 5 enables hardening for the BPF JIT with the following commands: $ sudo sysctl net.core.bpf_jit_harden net.core.bpf_jit_harden = 2 If the returned line does not have a value of "2", or a line is not returned, this is a finding. Check that the configuration files are present to enable this kernel parameter. $ sudo /usr/lib/systemd/systemd-sysctl --cat-config | egrep -v '^(#|;)' | grep -F net.core.bpf_jit_harden | tail -1 net.core.bpf_jit_harden = 2 If the network parameter "net.core.bpf_jit_harden" is not equal to "2" or nothing is returned, this is a finding.

Fix: F-87143r1201329_fix

Configure TOSS 5 to enable hardening for the BPF JIT compiler by adding the following line to a file, in the "/etc/sysctl.d" directory: net.core.bpf_jit_harden = 2 Reload the system configuration files for the changes to take effect. $ sudo sysctl --system

b
TOSS 5 systems using DNS resolution must have at least two name servers configured.
CM-6 - Medium - CCI-000366 - V-282678 - SV-282678r1201587_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000204
Vuln IDs
  • V-282678
Rule IDs
  • SV-282678r1201587_rule
To provide availability for name resolution services, multiple redundant name servers are mandated. A failure in name resolution could lead to the failure of security functions requiring name resolution, which may include time synchronization, centralized authentication, and remote system logging.
Checks: C-87239r1201012_chk

Verify the name servers used by the system using the following command: $ grep nameserver /etc/resolv.conf nameserver 192.168.1.2 nameserver 192.168.1.3 If less than two lines are returned that are not commented out, this is a finding.

Fix: F-87144r1201586_fix

Configure TOSS 5 to use two or more name servers for DNS resolution based on the DNS mode of the system. If the NetworkManager DNS mode is set to "none", then add the following lines to "/etc/resolv.conf": nameserver [name server 1] nameserver [name server 2] Replace [name server 1] and [name server 2] with the IPs of two different DNS resolvers. If the NetworkManager DNS mode is set to "default" then add two DNS servers to a NetworkManager connection using the following commands: $ sudo nmcli connection modify [connection name] ipv4.dns [name server 1] $ sudo nmcli connection modify [connection name] ipv4.dns [name server 2] Replace [name server 1] and [name server 2] with the IPs of two different DNS resolvers. Replace [connection name] with a valid NetworkManager connection name on the system. Replace ipv4 with ipv6 if IPv6 DNS servers are used.

b
TOSS 5 must configure a DNS processing mode set in Network Manager.
CM-6 - Medium - CCI-000366 - V-282679 - SV-282679r1201334_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000205
Vuln IDs
  • V-282679
Rule IDs
  • SV-282679r1201334_rule
In order to ensure that DNS resolver settings are respected, a DNS mode in Network Manager must be configured.
Checks: C-87240r1201015_chk

Verify TOSS 5 has a DNS mode configured in Network Manager. $ NetworkManager --print-config [main] dns=none If the dns key under main does not exist or is not set to "none" or "default", this is a finding.

Fix: F-87145r1201333_fix

Configure NetworkManager in TOSS 5 to use a DNS mode. In "/etc/NetworkManager/NetworkManager.conf" add the following line in the "[main]" section: dns = none Reload NetworkManager for the change to take effect. $ sudo systemctl reload NetworkManager

b
TOSS 5 must not have unauthorized IP tunnels configured.
CM-6 - Medium - CCI-000366 - V-282680 - SV-282680r1201020_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000206
Vuln IDs
  • V-282680
Rule IDs
  • SV-282680r1201020_rule
IP tunneling mechanisms can be used to bypass network filtering. If tunneling is required, it must be documented with the information system security officer (ISSO).
Checks: C-87241r1201018_chk

Verify TOSS 5 does not have unauthorized IP tunnels configured. Determine if the "IPsec" service is active using the following command: $ systemctl status ipsec ipsec.service - Internet Key Exchange (IKE) Protocol Daemon for IPsec Loaded: loaded (/usr/lib/systemd/system/ipsec.service; disabled) Active: inactive (dead) If the "IPsec" service is active, check for configured IPsec connections ("conn"), using the following command: $ grep -rni conn /etc/ipsec.conf /etc/ipsec.d/ Verify any returned results are documented with the ISSO. If the IPsec tunnels are active and not approved, this is a finding.

Fix: F-87146r1201019_fix

Remove all unapproved tunnels from the system or document them with the ISSO.

b
TOSS 5 must be configured to prevent unrestricted mail relaying.
CM-6 - Medium - CCI-000366 - V-282681 - SV-282681r1201023_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000207
Vuln IDs
  • V-282681
Rule IDs
  • SV-282681r1201023_rule
If unrestricted mail relaying is permitted, unauthorized senders could use this host as a mail relay for the purpose of sending spam or other unauthorized activity.
Checks: C-87242r1201021_chk

Verify TOSS 5 is configured to prevent unrestricted mail relaying using the following command: $ postconf -n smtpd_client_restrictions smtpd_client_restrictions = permit_mynetworks,reject If the "smtpd_client_restrictions" parameter contains any entries other than "permit_mynetworks" and "reject", and the additional entries have not been documented with the information system security officer (ISSO), this is a finding.

Fix: F-87147r1201022_fix

Modify the postfix configuration file to restrict client connections to the local network using the following command: $ sudo postconf -e 'smtpd_client_restrictions = permit_mynetworks,reject'

c
If the Trivial File Transfer Protocol (TFTP) server is required, TOSS 5 TFTP daemon must be configured to operate in secure mode.
CM-6 - High - CCI-000366 - V-282682 - SV-282682r1201337_rule
RMF Control
CM-6
Severity
H
CCI
CCI-000366
Version
TOSS-05-000208
Vuln IDs
  • V-282682
Rule IDs
  • SV-282682r1201337_rule
Restricting TFTP to a specific directory prevents remote users from copying, transferring, or overwriting system files. Using the "-s" option causes the TFTP service to only serve files from the given directory.
Checks: C-87243r1201335_chk

Note: If TFTP is not required, it should not be installed. If TFTP is not installed, this is not applicable. Determine if TFTP server is installed using the following command: $ sudo dnf list installed | grep tftp-server tftp-server.x86_64 x.x-x.el8 Verify the TFTP daemon, if tftp.server is installed, is configured to operate in secure mode using the following command: $ grep -i execstart /usr/lib/systemd/system/tftp.service ExecStart=/usr/sbin/in.tftpd -s /var/lib/tftpboot If TFTP is installed and is not documented with the information system security officer (ISSO) as an operational requirement, this is a finding. Note: The "-s" option ensures that the TFTP server only serves files from the specified directory, which is a security measure to prevent unauthorized access to other parts of the file system.

Fix: F-87148r1201336_fix

Configure the TFTP daemon to operate in secure mode using the following command: $ sudo systemctl edit tftp.service In the editor, enter: [Service] ExecStart=/usr/sbin/in.tftpd -s /var/lib/tftpboot After making changes, reload the systemd daemon and restart the TFTP service: $ sudo systemctl daemon-reload $ sudo systemctl restart tftp.service

b
The TOSS 5 libreswan package must be installed.
CM-6 - Medium - CCI-000366 - V-282683 - SV-282683r1201340_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000210
Vuln IDs
  • V-282683
Rule IDs
  • SV-282683r1201340_rule
Providing the ability for remote users or systems to initiate a secure VPN connection protects information when it is transmitted over a wide area network.
Checks: C-87244r1201338_chk

Verify the TOSS 5 "libreswan" service package is installed. Check that the "libreswan" service package is installed using the following command: $ sudo dnf list --installed libreswan Example output: libreswan.x86_64 4.6-3.el9 If the "libreswan" package is not installed, this is a finding.

Fix: F-87149r1201339_fix

Install the "libreswan" service (if it is not already installed) using the following command: $ sudo dnf install libreswan

c
There must be no .shosts files on TOSS 5.
CM-6 - High - CCI-000366 - V-282684 - SV-282684r1201032_rule
RMF Control
CM-6
Severity
H
CCI
CCI-000366
Version
TOSS-05-000211
Vuln IDs
  • V-282684
Rule IDs
  • SV-282684r1201032_rule
The .shosts files are used to configure host-based authentication for individual users or the system via SSH. Host-based authentication is not sufficient for preventing unauthorized access to the system, as it does not require interactive identification and authentication of a connection request, or for the use of two-factor authentication.
Checks: C-87245r1201030_chk

Verify there are no ".shosts" files on TOSS 5 using the following command: $ sudo find / -name .shosts If a ".shosts" file is found, this is a finding.

Fix: F-87150r1201031_fix

Remove any found ".shosts" files from the system. $ sudo rm /[path]/[to]/[file]/.shosts

b
TOSS 5 must ignore Internet Protocol version 4 (IPv4) Internet Control Message Protocol (ICMP) redirect messages.
CM-6 - Medium - CCI-000366 - V-282685 - SV-282685r1201035_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000213
Vuln IDs
  • V-282685
Rule IDs
  • SV-282685r1201035_rule
ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular destination. These messages modify the host's route table and are unauthenticated. An illicit ICMP redirect message could result in a man-in-the-middle attack. This feature of the IPv4 protocol has few legitimate uses. It should be disabled unless absolutely required.
Checks: C-87246r1201033_chk

Verify TOSS 5 will not accept IPv4 ICMP redirect messages using the following command: $ sudo sysctl net.ipv4.conf.all.accept_redirects net.ipv4.conf.all.accept_redirects = 0 If the returned line does not have a value of "0", or a line is not returned, this is a finding.

Fix: F-87151r1201034_fix

Configure TOSS 5 to ignore IPv4 ICMP redirect messages. Add or edit the following line in a single system configuration file, in the "/etc/sysctl.d/" directory: net.ipv4.conf.all.accept_redirects = 0 Load settings from all system configuration files using the following command: $ sudo sysctl --system

b
TOSS 5 must not forward Internet Protocol version 4 (IPv4) source-routed packets.
CM-6 - Medium - CCI-000366 - V-282686 - SV-282686r1201038_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000214
Vuln IDs
  • V-282686
Rule IDs
  • SV-282686r1201038_rule
Source-routed packets allow the source of the packet to suggest routers forward the packet along a different path than configured on the router, which can be used to bypass network security measures. This requirement applies only to the forwarding of source-routed traffic, such as when IPv4 forwarding is enabled and the system is functioning as a router. Accepting source-routed packets in the IPv4 protocol has few legitimate uses. It must be disabled unless it is absolutely required.
Checks: C-87247r1201036_chk

Verify TOSS 5 will not accept IPv4 source-routed packets using the following command: $ sudo sysctl net.ipv4.conf.all.accept_source_route net.ipv4.conf.all.accept_source_route = 0 If "net.ipv4.conf.all.accept_source_route" is not set to "0", or a line is not returned, this is a finding.

Fix: F-87152r1201037_fix

Configure TOSS 5 to ignore IPv4 source-routed packets. Add or edit the following line in a single system configuration file, in the "/etc/sysctl.d/" directory: net.ipv4.conf.all.accept_source_route = 0 Load settings from all system configuration files using the following command: $ sudo sysctl --system

b
TOSS 5 must log IPv4 packets with impossible addresses.
CM-6 - Medium - CCI-000366 - V-282687 - SV-282687r1201041_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000215
Vuln IDs
  • V-282687
Rule IDs
  • SV-282687r1201041_rule
The presence of "martian" packets (which have impossible addresses) as well as spoofed packets, source-routed packets, and redirects could be a sign of nefarious network activity. Logging these packets enables this activity to be detected.
Checks: C-87248r1201039_chk

Verify TOSS 5 logs IPv4 martian packets using the following command: $ sudo sysctl net.ipv4.conf.all.log_martians net.ipv4.conf.all.log_martians = 1 If "net.ipv4.conf.all.log_martians" is not set to "1", or a line is not returned, this is a finding.

Fix: F-87153r1201040_fix

Configure TOSS 5 to log martian packets on IPv4 interfaces. Add or edit the following line in a single system configuration file, in the "/etc/sysctl.d/" directory: net.ipv4.conf.all.log_martians=1 Load settings from all system configuration files using the following command: $ sudo sysctl --system

b
TOSS 5 must log IPv4 packets with impossible addresses by default.
CM-6 - Medium - CCI-000366 - V-282688 - SV-282688r1201044_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000216
Vuln IDs
  • V-282688
Rule IDs
  • SV-282688r1201044_rule
The presence of "martian" packets (which have impossible addresses) as well as spoofed packets, source-routed packets, and redirects could be a sign of nefarious network activity. Logging these packets enables this activity to be detected.
Checks: C-87249r1201042_chk

Verify TOSS 5 logs IPv4 martian packets by default using the following command: $ sudo sysctl net.ipv4.conf.default.log_martians net.ipv4.conf.default.log_martians = 1 If "net.ipv4.conf.default.log_martians" is not set to "1" , or a line is not returned, this is a finding.

Fix: F-87154r1201043_fix

Configure TOSS 5 to log martian packets on IPv4 interfaces by default. Add or edit the following line in a single system configuration file, in the "/etc/sysctl.d/" directory: net.ipv4.conf.default.log_martians=1 Load settings from all system configuration files using the following command: $ sudo sysctl --system

b
TOSS 5 must use reverse path filtering on all IPv4 interfaces.
CM-6 - Medium - CCI-000366 - V-282689 - SV-282689r1201344_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000217
Vuln IDs
  • V-282689
Rule IDs
  • SV-282689r1201344_rule
Enabling reverse path filtering drops packets with source addresses that should not have been able to be received on the interface on which they were received. It must not be used on systems that are routers for complicated networks but is helpful for end hosts and routers serving small networks.
Checks: C-87250r1201045_chk

Verify TOSS 5 uses reverse path filtering on all IPv4 interfaces using the following command: $ sudo sysctl net.ipv4.conf.all.rp_filter net.ipv4.conf.all.rp_filter = 1 If the returned line does not have a value of "1", or a line is not returned, this is a finding.

Fix: F-87155r1201343_fix

Configure TOSS 5 to use reverse path filtering on all IPv4 interfaces. Add or edit the following line in a single system configuration file, in the "/etc/sysctl.d/" directory: net.ipv4.conf.all.rp_filter = 1 Reload the system configuration files for the changes to take effect. $ sudo sysctl --system

b
TOSS 5 must prevent IPv4 Internet Control Message Protocol (ICMP) redirect messages from being accepted.
CM-6 - Medium - CCI-000366 - V-282690 - SV-282690r1201050_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000218
Vuln IDs
  • V-282690
Rule IDs
  • SV-282690r1201050_rule
ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular destination. These messages modify the host's route table and are unauthenticated. An illicit ICMP redirect message could result in a man-in-the-middle attack. This feature of the IPv4 protocol has few legitimate uses. It must be disabled unless absolutely required.
Checks: C-87251r1201048_chk

Verify TOSS 5 will not accept IPv4 ICMP redirect messages using the following command: $ sudo sysctl net.ipv4.conf.default.accept_redirects net.ipv4.conf.default.accept_redirects = 0 If the returned line does not have a value of "0", or a line is not returned, this is a finding.

Fix: F-87156r1201049_fix

Configure TOSS 5 to prevent IPv4 ICMP redirect messages from being accepted. Add or edit the following line in a single system configuration file, in the "/etc/sysctl.d/" directory: net.ipv4.conf.default.accept_redirects = 0 Load settings from all system configuration files using the following command: $ sudo sysctl --system

b
TOSS 5 must not forward IPv4 source-routed packets by default.
CM-6 - Medium - CCI-000366 - V-282691 - SV-282691r1201053_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000219
Vuln IDs
  • V-282691
Rule IDs
  • SV-282691r1201053_rule
Source-routed packets allow the source of the packet to suggest routers forward the packet along a different path than configured on the router, which can be used to bypass network security measures. Accepting source-routed packets in the IPv4 protocol has few legitimate uses. It must be disabled unless it is absolutely required, such as when IPv4 forwarding is enabled and the system is legitimately functioning as a router.
Checks: C-87252r1201051_chk

Verify TOSS 5 does not accept IPv4 source-routed packets by default using the following command: $ sudo sysctl net.ipv4.conf.default.accept_source_route net.ipv4.conf.default.accept_source_route = 0 If the returned line does not have a value of "0", a line is not returned, this is a finding.

Fix: F-87157r1201052_fix

Configure TOSS 5 to not forward IPv4 source-routed packets by default. Add or edit the following line in a single system configuration file, in the "/etc/sysctl.d/" directory: net.ipv4.conf.default.accept_source_route = 0 Load settings from all system configuration files using the following command: $ sudo sysctl --system

b
TOSS 5 must use a reverse-path filter for IPv4 network traffic when possible by default.
CM-6 - Medium - CCI-000366 - V-282692 - SV-282692r1201056_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000220
Vuln IDs
  • V-282692
Rule IDs
  • SV-282692r1201056_rule
Enabling reverse path filtering drops packets with source addresses that should not have been able to be received on the interface on which they were received. It must not be used on systems that are routers for complicated networks but is helpful for end hosts and routers serving small networks.
Checks: C-87253r1201054_chk

Verify TOSS 5 uses reverse path filtering on IPv4 interfaces using the following command: $ sudo sysctl net.ipv4.conf.default.rp_filter net.ipv4.conf.default.rp_filter = 1 If the returned line does not have a value of "1", or a line is not returned, this is a finding.

Fix: F-87158r1201055_fix

Configure TOSS 5 to use reverse path filtering on IPv4 interfaces by default. Add or edit the following line in a single system configuration file, in the "/etc/sysctl.d/" directory: net.ipv4.conf.default.rp_filter = 1 Load settings from all system configuration files using the following command: $ sudo sysctl --system

b
TOSS 5 must not respond to Internet Control Message Protocol (ICMP) echoes sent to a broadcast address.
CM-6 - Medium - CCI-000366 - V-282693 - SV-282693r1201059_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000221
Vuln IDs
  • V-282693
Rule IDs
  • SV-282693r1201059_rule
Responding to broadcast (ICMP) echoes facilitates network mapping and provides a vector for amplification attacks. Ignoring ICMP echo requests (pings) sent to broadcast or multicast addresses makes the system slightly more difficult to enumerate on the network.
Checks: C-87254r1201057_chk

Verify TOSS 5 does not respond to ICMP echoes sent to a broadcast address using the following command: $ sudo sysctl net.ipv4.icmp_echo_ignore_broadcasts net.ipv4.icmp_echo_ignore_broadcasts = 1 If the returned line does not have a value of "1", or a line is not returned, this is a finding. Check that the configuration files are present to enable this network parameter. $ sudo /usr/lib/systemd/systemd-sysctl --cat-config | egrep -v '^(#|$)' | grep -F net.ipv4.icmp_echo_ignore_broadcasts | tail -1 net.ipv4.icmp_echo_ignore_broadcasts = 1 If "net.ipv4.icmp_echo_ignore_broadcasts" is not set to "1" or is missing, this is a finding.

Fix: F-87159r1201058_fix

Configure TOSS 5 to not respond to IPv4 ICMP echoes sent to a broadcast address. Add or edit the following line in a single system configuration file, in the "/etc/sysctl.d/" directory: net.ipv4.icmp_echo_ignore_broadcasts = 1 Load settings from all system configuration files using the following command: $ sudo sysctl --system

b
TOSS 5 must limit the number of bogus Internet Control Message Protocol (ICMP) response errors logs.
CM-6 - Medium - CCI-000366 - V-282694 - SV-282694r1201062_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000222
Vuln IDs
  • V-282694
Rule IDs
  • SV-282694r1201062_rule
Some routers will send responses to broadcast frames that violate RFC-1122, which fills up a log file system with many useless error messages. An attacker may take advantage of this and attempt to flood the logs with bogus error logs. Ignoring bogus ICMP error responses reduces log size, although some activity would not be logged.
Checks: C-87255r1201060_chk

Query the runtime status of the net.ipv4.icmp_ignore_bogus_error_responses kernel parameter using the following command: $ sudo sysctl net.ipv4.icmp_ignore_bogus_error_responses net.ipv4.icmp_ignore_bogus_error_responses = 1 If "net.ipv4.icmp_ignore_bogus_error_responses" is not set to "1", or a line is not returned, this is a finding. Check that the configuration files are present to enable this network parameter. $ sudo /usr/lib/systemd/systemd-sysctl --cat-config | egrep -v '^(#|;)' | grep -F net.ipv4.icmp_ignore_bogus_error_response | tail -1 net.ipv4.icmp_ignore_bogus_error_response = 1 If "net.ipv4.icmp_ignore_bogus_error_response" is not set to "1" or is missing, this is a finding.

Fix: F-87160r1201061_fix

Configure TOSS 5 to not log bogus ICMP errors: Add or edit the following line in a single system configuration file, in the "/etc/sysctl.d/" directory: net.ipv4.icmp_ignore_bogus_error_responses = 1 Load settings from all system configuration files using the following command: $ sudo sysctl --system

b
TOSS 5 must not send Internet Control Message Protocol (ICMP) redirects.
CM-6 - Medium - CCI-000366 - V-282695 - SV-282695r1201065_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000223
Vuln IDs
  • V-282695
Rule IDs
  • SV-282695r1201065_rule
ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular destination. These messages contain information from the system's route table possibly revealing portions of the network topology. The ability to send ICMP redirects is only appropriate for systems acting as routers.
Checks: C-87256r1201063_chk

Verify TOSS 5 does not IPv4 ICMP redirect messages using the following command: $ sudo sysctl net.ipv4.conf.all.send_redirects net.ipv4.conf.all.send_redirects = 0 If the returned line does not have a value of "0", or a line is not returned, this is a finding.

Fix: F-87161r1201064_fix

Configure TOSS 5 to not allow interfaces to perform IPv4 ICMP redirects. Add or edit the following line in a single system configuration file, in the "/etc/sysctl.d/" directory: net.ipv4.conf.all.send_redirects = 0 Load settings from all system configuration files using the following command: $ sudo sysctl --system

b
TOSS 5 must not allow interfaces to perform Internet Control Message Protocol (ICMP) redirects by default.
CM-6 - Medium - CCI-000366 - V-282696 - SV-282696r1201346_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000224
Vuln IDs
  • V-282696
Rule IDs
  • SV-282696r1201346_rule
ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular destination. These messages contain information from the system's route table possibly revealing portions of the network topology. The ability to send ICMP redirects is only appropriate for systems acting as routers.
Checks: C-87257r1201066_chk

Verify TOSS 5 does not allow interfaces to perform Internet Protocol version 4 (IPv4) ICMP redirects by default. Check the value of the "default send_redirects" variables using the following command: $ sudo sysctl net.ipv4.conf.default.send_redirects net.ipv4.conf.default.send_redirects=0 If the returned line does not have a value of "0", or a line is not returned, this is a finding. Check that the configuration files are present to enable this network parameter. $ sudo /usr/lib/systemd/systemd-sysctl --cat-config | egrep -v '^(#|;)' | grep -F net.ipv4.conf.default.send_redirects | tail -1 net.ipv4.conf.default.send_redirects = 0 If "net.ipv4.conf.default.send_redirects" is not set to "0" and is not documented with the information system security officer (ISSO) as an operational requirement or is missing, this is a finding.

Fix: F-87162r1201345_fix

Configure TOSS 5 to not allow interfaces to perform IPv4 ICMP redirects by default. Add or edit the following line in a single system configuration file, in the "/etc/sysctl.d/" directory: net.ipv4.conf.default.send_redirects = 0 Load settings from all system configuration files using the following command: $ sudo sysctl --system

b
TOSS 5 must not enable Internet Protocol version 4 (IPv4) packet forwarding unless the system is a router.
CM-6 - Medium - CCI-000366 - V-282697 - SV-282697r1201349_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000225
Vuln IDs
  • V-282697
Rule IDs
  • SV-282697r1201349_rule
Routing protocol daemons are typically used on routers to exchange network topology information with other routers. If this capability is used when not required, system network information may be unnecessarily transmitted across the network.
Checks: C-87258r1201347_chk

Verify TOSS 5 is not performing IPv4 packet forwarding unless the system is a router using the following command: $ sudo sysctl net.ipv4.conf.all.forwarding net.ipv4.conf.all.forwarding = 0 If the IPv4 forwarding value is not "0" and is not documented with the information system security officer (ISSO) as an operational requirement is missing, this is a finding.

Fix: F-87163r1201348_fix

Configure TOSS 5 to not allow IPv4 packet forwarding unless the system is a router. Add or edit the following line in a single system configuration file, in the "/etc/sysctl.d/" directory: net.ipv4.conf.all.forwarding = 0 Load settings from all system configuration files using the following command: $ sudo sysctl --system

b
TOSS 5 must not accept router advertisements on all Internet Protocol version 6 (IPv6) interfaces.
CM-6 - Medium - CCI-000366 - V-282698 - SV-282698r1201350_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000226
Vuln IDs
  • V-282698
Rule IDs
  • SV-282698r1201350_rule
An illicit router advertisement message could result in a man-in-the-middle attack.
Checks: C-87259r1201072_chk

Verify TOSS 5 does not accept router advertisements on all IPv6 interfaces, unless the system is a router. Note: If IPv6 is disabled on the system, this requirement is not applicable. Determine if router advertisements are not accepted by using the following command: $ sudo sysctl net.ipv6.conf.all.accept_ra net.ipv6.conf.all.accept_ra = 0 If the "accept_ra" value is not "0" and is not documented with the information system security officer (ISSO) as an operational requirement, this is a finding.

Fix: F-87164r1201073_fix

Configure TOSS 5 to not accept router advertisements on all IPv6 interfaces unless the system is a router. Add or edit the following line in a single system configuration file, in the "/etc/sysctl.d/" directory: net.ipv6.conf.all.accept_ra = 0 Load settings from all system configuration files using the following command: $ sudo sysctl --system

b
TOSS 5 must ignore Internet Protocol version 6 (IPv6) Internet Control Message Protocol (ICMP) redirect messages.
CM-6 - Medium - CCI-000366 - V-282699 - SV-282699r1201351_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000227
Vuln IDs
  • V-282699
Rule IDs
  • SV-282699r1201351_rule
An illicit ICMP redirect message could result in a man-in-the-middle attack.
Checks: C-87260r1201075_chk

Verify TOSS 5 ignores IPv6 ICMP redirect messages. Note: If IPv6 is disabled on the system, this requirement is not applicable. Check the value of the "accept_redirects" variables using the following command: $ sysctl net.ipv6.conf.all.accept_redirects net.ipv6.conf.all.accept_redirects = 0 If the returned line does not have a value of "0", or a line is not returned, this is a finding.

Fix: F-87165r1201076_fix

Configure TOSS 5 to ignore IPv6 ICMP redirect messages. Add or edit the following line in a single system configuration file, in the "/etc/sysctl.d/" directory: net.ipv6.conf.all.accept_redirects = 0 Load settings from all system configuration files using the following command: $ sudo sysctl --system

b
TOSS 5 must not forward Internet Protocol version 6 (IPv6) source-routed packets.
CM-6 - Medium - CCI-000366 - V-282700 - SV-282700r1201352_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000228
Vuln IDs
  • V-282700
Rule IDs
  • SV-282700r1201352_rule
Source-routed packets allow the source of the packet to suggest that routers forward the packet along a different path than configured on the router, which can be used to bypass network security measures. This requirement applies only to the forwarding of source-routed traffic, such as when forwarding is enabled and the system is functioning as a router.
Checks: C-87261r1201078_chk

Verify TOSS 5 does not accept IPv6 source-routed packets. Note: If IPv6 is disabled on the system, this requirement is not applicable. Check the value of the accept source route variable using the following command: $ sudo sysctl net.ipv6.conf.all.accept_source_route net.ipv6.conf.all.accept_source_route = 0 If the returned line does not have a value of "0", or a line is not returned, this is a finding.

Fix: F-87166r1201079_fix

Configure TOSS 5 to not forward IPv6 source-routed packets. Add or edit the following line in a single system configuration file, in the "/etc/sysctl.d/" directory: net.ipv6.conf.all.accept_source_route = 0 Load settings from all system configuration files using the following command: $ sudo sysctl --system

b
TOSS 5 must not enable Internet Protocol version 6 (IPv6) packet forwarding unless the system is a router.
CM-6 - Medium - CCI-000366 - V-282701 - SV-282701r1201355_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000229
Vuln IDs
  • V-282701
Rule IDs
  • SV-282701r1201355_rule
IP forwarding permits the kernel to forward packets from one network interface to another. The ability to forward packets between two networks is only appropriate for systems acting as routers.
Checks: C-87262r1201353_chk

Verify TOSS 5 is not performing IPv6 packet forwarding unless the system is a router. Note: If IPv6 is disabled on the system, this requirement is not applicable. Check that IPv6 forwarding is disabled using the following commands: $ sudo sysctl net.ipv6.conf.all.forwarding net.ipv6.conf.all.forwarding = 0 If the IPv6 forwarding value is not "0" and is not documented with the information system security officer (ISSO) as an operational requirement, this is a finding.

Fix: F-87167r1201354_fix

Configure TOSS 5 to not allow IPv6 packet forwarding unless the system is a router. Add or edit the following line in a single system configuration file, in the "/etc/sysctl.d/" directory: net.ipv6.conf.all.forwarding = 0 Load settings from all system configuration files using the following command: $ sudo sysctl --system

b
TOSS 5 must not accept router advertisements on all Internet Protocol version 6 (IPv6) interfaces by default.
CM-6 - Medium - CCI-000366 - V-282702 - SV-282702r1201356_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000230
Vuln IDs
  • V-282702
Rule IDs
  • SV-282702r1201356_rule
An illicit router advertisement message could result in a man-in-the-middle attack.
Checks: C-87263r1201084_chk

Verify TOSS 5 does not accept router advertisements on all IPv6 interfaces by default, unless the system is a router. Note: If IPv6 is disabled on the system, this requirement is not applicable. Determine if router advertisements are not accepted by default by using the following command: $ sudo sysctl net.ipv6.conf.default.accept_ra net.ipv6.conf.default.accept_ra = 0 If the "accept_ra" value is not "0" and is not documented with the information system security officer (ISSO) as an operational requirement, this is a finding.

Fix: F-87168r1201085_fix

Configure TOSS 5 to not accept router advertisements on all IPv6 interfaces by default unless the system is a router. Add or edit the following line in a single system configuration file, in the "/etc/sysctl.d/" directory: net.ipv6.conf.default.accept_ra = 0 Load settings from all system configuration files using the following command: $ sudo sysctl --system

b
TOSS 5 must prevent Internet Protocol version 6 (IPv6) Internet Control Message Protocol (ICMP) redirect messages from being accepted.
CM-6 - Medium - CCI-000366 - V-282703 - SV-282703r1201358_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000231
Vuln IDs
  • V-282703
Rule IDs
  • SV-282703r1201358_rule
ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular destination. These messages modify the host's route table and are unauthenticated. An illicit ICMP redirect message could result in a man-in-the-middle attack.
Checks: C-87264r1201357_chk

Verify TOSS 5 will not accept IPv6 ICMP redirect messages. Note: If IPv6 is disabled on the system, this requirement is not applicable. Check the value of the default "accept_redirects" variables using the following command: $ sudo sysctl net.ipv6.conf.default.accept_redirects net.ipv6.conf.default.accept_redirects = 0 If the returned line does not have a value of "0", or a line is not returned, this is a finding.

Fix: F-87169r1201088_fix

Configure TOSS 5 to prevent IPv6 ICMP redirect messages from being accepted. Add or edit the following line in a single system configuration file, in the "/etc/sysctl.d/" directory: net.ipv6.conf.default.accept_redirects = 0 Load settings from all system configuration files using the following command: $ sudo sysctl --system

b
TOSS 5 must not forward Internet Protocol version 6 (IPv6) source-routed packets by default.
CM-6 - Medium - CCI-000366 - V-282704 - SV-282704r1201359_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000232
Vuln IDs
  • V-282704
Rule IDs
  • SV-282704r1201359_rule
Source-routed packets allow the source of the packet to suggest that routers forward the packet along a different path than configured on the router, which can be used to bypass network security measures. This requirement applies only to the forwarding of source-routed traffic, such as when forwarding is enabled and the system is functioning as a router. Accepting source-routed packets in the IPv6 protocol has few legitimate uses. It must be disabled unless it is absolutely required.
Checks: C-87265r1201090_chk

Verify TOSS 5 does not accept IPv6 source-routed packets by default. Note: If IPv6 is disabled on the system, this requirement is not applicable. Check the value of the accept source route variable using the following command: $ sudo sysctl net.ipv6.conf.default.accept_source_route net.ipv6.conf.default.accept_source_route = 0 If the returned line does not have a value of "0", or a line is not returned, this is a finding.

Fix: F-87170r1201091_fix

Configure TOSS 5 to not forward IPv6 source-routed packets by default. Add or edit the following line in a single system configuration file, in the "/etc/sysctl.d/" directory: net.ipv6.conf.default.accept_source_route = 0 Load settings from all system configuration files using the following command: $ sudo sysctl --system

b
TOSS 5 must have the openssh-clients package installed.
CM-6 - Medium - CCI-000366 - V-282705 - SV-282705r1201362_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000235
Vuln IDs
  • V-282705
Rule IDs
  • SV-282705r1201362_rule
This package includes utilities to make encrypted connections and transfer files securely to SSH servers.
Checks: C-87266r1201361_chk

Verify TOSS 5 has the "openssh-clients" package installed using the following command: $ sudo dnf list --installed openssh-clients Example output: openssh-clients.x86_64 8.7p1-8.el9 If the "openssh-clients" package is not installed, this is a finding.

Fix: F-87171r1201094_fix

Install the openssh-clients package using the following command: $ sudo dnf install openssh-clients

b
The TOSS 5 SSH server configuration file must be group-owned by root.
CM-6 - Medium - CCI-000366 - V-282706 - SV-282706r1201098_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000250
Vuln IDs
  • V-282706
Rule IDs
  • SV-282706r1201098_rule
Service configuration files enable or disable features of their respective services, which if configured incorrectly, can lead to insecure and vulnerable configurations. Therefore, service configuration files must be owned by the correct group to prevent unauthorized changes.
Checks: C-87267r1201096_chk

Verify the group ownership of the "/etc/ssh/sshd_config" file using the following command: $ ls -al /etc/ssh/sshd_config rw-------. 1 root root 3669 Feb 22 11:34 /etc/ssh/sshd_config If the "/etc/ssh/sshd_config" file does not have a group owner of "root", this is a finding.

Fix: F-87172r1201097_fix

Configure the "/etc/ssh/sshd_config" file to be group-owned by root using the following command: $ sudo chgrp root /etc/ssh/sshd_config

b
The TOSS 5 SSH server configuration file must be owned by root.
CM-6 - Medium - CCI-000366 - V-282707 - SV-282707r1201101_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000251
Vuln IDs
  • V-282707
Rule IDs
  • SV-282707r1201101_rule
Service configuration files enable or disable features of their respective services, which if configured incorrectly, can lead to insecure and vulnerable configurations. Therefore, service configuration files must be owned by the correct group to prevent unauthorized changes.
Checks: C-87268r1201099_chk

Verify the ownership of the "/etc/ssh/sshd_config" file using the following command: $ ls -al /etc/ssh/sshd_config rw-------. 1 root root 3669 Feb 22 11:34 /etc/ssh/sshd_config If the "/etc/ssh/sshd_config" file does not have an owner of "root", this is a finding.

Fix: F-87173r1201100_fix

Configure the "/etc/ssh/sshd_config" file to be owned by root using the following command: $ sudo chown root /etc/ssh/sshd_config

b
The TOSS 5 SSH server configuration file must have mode 0600 or less permissive.
CM-6 - Medium - CCI-000366 - V-282708 - SV-282708r1201104_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000252
Vuln IDs
  • V-282708
Rule IDs
  • SV-282708r1201104_rule
Service configuration files enable or disable features of their respective services that if configured incorrectly can lead to insecure and vulnerable configurations. Therefore, service configuration files should be owned by the correct group to prevent unauthorized changes.
Checks: C-87269r1201102_chk

Verify the permissions of the "/etc/ssh/sshd_config" file using the following command: $ ls -al /etc/ssh/sshd_config rw-------. 1 root root 3669 Feb 22 11:34 /etc/ssh/sshd_config If the "/etc/ssh/sshd_config" permissions are not "0600", this is a finding.

Fix: F-87174r1201103_fix

Configure the "/etc/ssh/sshd_config" permissions to be "0600" using the following command: $ sudo chmod 0600 /etc/ssh/sshd_config

b
TOSS 5 SSH private host key files must have mode 0640 or less permissive.
CM-6 - Medium - CCI-000366 - V-282709 - SV-282709r1201369_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000253
Vuln IDs
  • V-282709
Rule IDs
  • SV-282709r1201369_rule
If an unauthorized user obtains the private SSH host key file, the host could be impersonated.
Checks: C-87270r1201105_chk

Verify the SSH private host key files have a mode of "0640" or less permissive using the following command: $ ls -l /etc/ssh/*_key 640 /etc/ssh/ssh_host_dsa_key 640 /etc/ssh/ssh_host_ecdsa_key 640 /etc/ssh/ssh_host_ed25519_key 640 /etc/ssh/ssh_host_rsa_key If any private host key file has a mode more permissive than "0640", this is a finding.

Fix: F-87175r1201368_fix

Configure the mode of SSH private host key files under "/etc/ssh" to "0640" using the following command: $ sudo chmod 0640 /etc/ssh/ssh_host*key Restart the SSH daemon for the changes to take effect. $ sudo systemctl restart sshd.service

b
TOSS 5 SSH public host key files must have mode 0644 or less permissive.
CM-6 - Medium - CCI-000366 - V-282710 - SV-282710r1201371_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000254
Vuln IDs
  • V-282710
Rule IDs
  • SV-282710r1201371_rule
If a public host key file is modified by an unauthorized user, the SSH service may be compromised.
Checks: C-87271r1201108_chk

Verify the SSH public host key files have a mode of "0644" or less permissive using the following command: Note: SSH public key files may be found in other directories on the system depending on the installation. $ sudo stat -c "%a %n" /etc/ssh/*.pub 644 /etc/ssh/ssh_host_dsa_key.pub 644 /etc/ssh/ssh_host_ecdsa_key.pub 644 /etc/ssh/ssh_host_ed25519_key.pub 644 /etc/ssh/ssh_host_rsa_key.pub If any key.pub file has a mode more permissive than "0644", this is a finding.

Fix: F-87176r1201370_fix

Change the mode of public host key files under "/etc/ssh" to "0644" using the following command: $ sudo chmod 0644 /etc/ssh/*key.pub Restart the SSH daemon for the changes to take effect. $ sudo systemctl restart sshd.service

b
The TOSS 5 SSH daemon must not allow rhosts authentication.
CM-6 - Medium - CCI-000366 - V-282711 - SV-282711r1201373_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000257
Vuln IDs
  • V-282711
Rule IDs
  • SV-282711r1201373_rule
SSH trust relationships mean a compromise on one host can allow an attacker to move trivially to other hosts.
Checks: C-87272r1201111_chk

Verify the SSH daemon does not allow rhosts authentication using the following command: $ sudo /usr/sbin/sshd -dd 2&gt;&amp;1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH '^\s*ignorerhosts' IgnoreRhosts yes If the value is returned as "no", the returned line is commented out, or no output is returned, this is a finding.

Fix: F-87177r1201372_fix

Configure the SSH daemon to not allow rhosts authentication. Add the following line in "/etc/ssh/sshd_config" or uncomment the line and set the value to "yes": IgnoreRhosts yes Restart the SSH service for changes to take effect: $ sudo systemctl restart sshd.service

b
The TOSS 5 SSH daemon must not allow known hosts authentication.
CM-6 - Medium - CCI-000366 - V-282712 - SV-282712r1201589_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000258
Vuln IDs
  • V-282712
Rule IDs
  • SV-282712r1201589_rule
Configuring the IgnoreUserKnownHosts setting for the SSH daemon provides additional assurance that remote login via SSH will require a password, even in the event of misconfiguration elsewhere.
Checks: C-87273r1201114_chk

Verify the SSH daemon does not allow known hosts authentication using the following command: $ sudo /usr/sbin/sshd -dd 2&gt;&amp;1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH '^\s*ignoreuserknownhosts' IgnoreUserKnownHosts yes If the value is returned as "no", the returned line is commented out, or no output is returned, this is a finding.

Fix: F-87178r1201588_fix

Configure the SSH daemon to not allow known hosts authentication. Add the following line in "/etc/ssh/sshd_config" or uncomment the line and set the value to "yes": IgnoreUserKnownHosts yes Restart the SSH service for changes to take effect: $ sudo systemctl restart sshd.service

b
The TOSS 5 SSH daemon must perform strict mode checking of home directory configuration files.
CM-6 - Medium - CCI-000366 - V-282713 - SV-282713r1201377_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000259
Vuln IDs
  • V-282713
Rule IDs
  • SV-282713r1201377_rule
If other users have access to modify user-specific SSH configuration files, they may be able to log into the system as another user.
Checks: C-87274r1201117_chk

Verify the SSH daemon performs strict mode checking of home directory configuration files using the following command: $ sudo /usr/sbin/sshd -dd 2&gt;&amp;1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH '^\s*strictmodes' StrictModes yes If the "StrictModes" keyword is set to "no", the returned line is commented out, or no output is returned, this is a finding.

Fix: F-87179r1201376_fix

Configure the SSH daemon to perform strict mode checking of home directory configuration files. Add the following line in "/etc/ssh/sshd_config" or uncomment the line and set the value to "yes": StrictModes yes Restart the SSH service for changes to take effect: $ sudo systemctl restart sshd.service

b
The TOSS 5 SSH daemon must display the date and time of the last successful account logon upon an SSH logon.
CM-6 - Medium - CCI-000366 - V-282714 - SV-282714r1201379_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000260
Vuln IDs
  • V-282714
Rule IDs
  • SV-282714r1201379_rule
Providing users feedback on when account accesses last occurred facilitates user recognition and reporting of unauthorized account use.
Checks: C-87275r1201120_chk

Verify the SSH daemon provides users with feedback on when account accesses last occurred using the following command: $ sudo /usr/sbin/sshd -dd 2&gt;&amp;1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH '^\s*printlastlog' PrintLastLog yes If the "PrintLastLog" keyword is set to "no", the returned line is commented out, or no output is returned, this is a finding.

Fix: F-87180r1201378_fix

Configure the SSH daemon to provide users with feedback on when account accesses last occurred. Add the following line in "/etc/ssh/sshd_config" or uncomment the line and set the value to "yes": PrintLastLog yes Restart the SSH service for changes to take effect: $ sudo systemctl restart sshd.service

b
The TOSS 5 effective dconf policy must match the policy keyfiles.
CM-6 - Medium - CCI-000366 - V-282715 - SV-282715r1201125_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000278
Vuln IDs
  • V-282715
Rule IDs
  • SV-282715r1201125_rule
Unlike text-based keyfiles, the binary database is impossible to check through most automated and all manual means; therefore, to evaluate dconf configuration, both have to be true at the same time—configuration files have to be compliant, and the database needs to be more recent than those keyfiles, which gives confidence that it reflects them.
Checks: C-87276r1201123_chk

Check the last modification time of the local databases, comparing it to the last modification time of the related keyfiles. The following command will check every dconf database and compare its modification time to the related system keyfiles: Note: This requirement assumes the use of the TOSS 5 default graphical user interface, the GNOME desktop environment. If the system does not have any graphical user interface installed, this requirement is not applicable. $ function dconf_needs_update { for db in $(find /etc/dconf/db -maxdepth 1 -type f); do db_mtime=$(stat -c %Y "$db"); keyfile_mtime=$(stat -c %Y "$db".d/* | sort -n | tail -1); if [ -n "$db_mtime" ] &amp;&amp; [ -n "$keyfile_mtime" ] &amp;&amp; [ "$db_mtime" -lt "$keyfile_mtime" ]; then echo "$db needs update"; return 1; fi; done; }; dconf_needs_update If the command has any output, then a dconf database needs to be updated, and this is a finding.

Fix: F-87181r1201124_fix

Update the dconf databases using the following command: $ sudo dconf update

b
TOSS 5 must disable the ability of a user to restart the system from the login screen.
CM-6 - Medium - CCI-000366 - V-282716 - SV-282716r1201128_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000279
Vuln IDs
  • V-282716
Rule IDs
  • SV-282716r1201128_rule
A user who is at the console can reboot the system at the login screen. If restart or shutdown buttons are pressed at the login screen, this can create the risk of short-term loss of availability of systems due to reboot.
Checks: C-87277r1201126_chk

Verify TOSS 5 disables a user's ability to restart the system using the following command: Note: This requirement assumes the use of the TOSS 5 default graphical user interface, Gnome Shell. If the system does not have any graphical user interface installed, this requirement is not applicable. $ grep -R disable-restart-buttons /etc/dconf/db/* /etc/dconf/db/distro.d/20-authselect:disable-restart-buttons='true' If the "disable-restart-button" setting is not set to "true", is missing or commented out from the dconf database files, this is a finding.

Fix: F-87182r1201127_fix

Configure TOSS 5 to disable a user's ability to restart the system. Add or update the [org/gnome/settings-daemon/] section of the /etc/dconf/db/local.d/00-security-settings" database file and add or update the following lines: [org/gnome/login-screen] disable-restart-buttons='true' Then update the dconf system databases: $ sudo dconf update

b
TOSS 5 must prevent a user from overriding the disable-restart-buttons setting for the graphical user interface.
CM-6 - Medium - CCI-000366 - V-282717 - SV-282717r1201644_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000280
Vuln IDs
  • V-282717
Rule IDs
  • SV-282717r1201644_rule
A user who is at the console can reboot the system at the login screen. If restart or shutdown buttons are pressed at the login screen, this can create the risk of short-term loss of availability of systems due to reboot.
Checks: C-87278r1201643_chk

Verify TOSS 5 prevents a user from overriding the disable-restart-buttons setting for graphical user interfaces. Note: This requirement assumes the use of the TOSS 5 default graphical user interface, the GNOME desktop environment. If the system does not have any graphical user interface installed, this requirement is not applicable. Determine which profile the system database is using the following command: $ sudo grep system-db /etc/dconf/profile/user system-db:local Check that graphical settings are locked from nonprivileged user modification using the following command: Note: The example below is using the database "local" for the system, so the path is "/etc/dconf/db/local.d". This path must be modified if a database other than "local" is being used. $ grep disable-restart-buttons /etc/dconf/db/local.d/locks/* /org/gnome/login-screen/disable-restart-buttons If the command does not return at least the example result, this is a finding.

Fix: F-87183r1201130_fix

Configure TOSS 5 to prevent a user from overriding the disable-restart-buttons setting for graphical user interfaces. Create a database to contain the systemwide graphical user logon settings (if it does not already exist) using the following command: $ sudo touch /etc/dconf/db/local.d/locks/session Add the following line to prevent nonprivileged users from modifying it: /org/gnome/login-screen/disable-restart-buttons Run the following command to update the database: $ sudo dconf update

b
TOSS 5 must disable the ability of a user to accidentally press Ctrl-Alt-Del and cause a system to shut down or reboot.
CM-6 - Medium - CCI-000366 - V-282718 - SV-282718r1201134_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000281
Vuln IDs
  • V-282718
Rule IDs
  • SV-282718r1201134_rule
A locally logged-in user who presses Ctrl-Alt-Del, when at the console, can reboot the system. If accidentally pressed, as could happen in the case of mixed OS environment, this can create the risk of short-term loss of availability of systems due to unintentional reboot.
Checks: C-87279r1201132_chk

Verify TOSS 5 is configured to ignore the Ctrl-Alt-Del sequence in the GNOME desktop using the following command: Note: This requirement assumes the use of the TOSS 5 default graphical user interface, the GNOME desktop environment. If the system does not have any graphical user interface installed, this requirement is not applicable. $ gsettings get org.gnome.settings-daemon.plugins.media-keys logout "['']" If the GNOME desktop is configured to shut down when Ctrl-Alt-Del is pressed, this is a finding.

Fix: F-87184r1201133_fix

Configure TOSS 5 to ignore the Ctrl-Alt-Del sequence in the GNOME desktop. Add or update the [org/gnome/settings-daemon/plugins/media-keys] section of the /etc/dconf/db/local.d/00-security-settings database file and add or update the following lines: [org/gnome/settings-daemon/plugins/media-keys] logout=[''] Run the following command to update the database: $ sudo dconf update

b
TOSS 5 must prevent a user from overriding the Ctrl-Alt-Del sequence settings for the graphical user interface.
CM-6 - Medium - CCI-000366 - V-282719 - SV-282719r1201137_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000282
Vuln IDs
  • V-282719
Rule IDs
  • SV-282719r1201137_rule
A locally logged-in user who presses Ctrl-Alt-Del, when at the console, can reboot the system. If accidentally pressed, as could happen in the case of mixed OS environment, this can create the risk of short-term loss of availability of systems due to unintentional reboot.
Checks: C-87280r1201135_chk

Verify users cannot enable the Ctrl-Alt-Del sequence in the GNOME desktop using the following command: Note: This requirement assumes the use of the TOSS 5 default graphical user interface, the GNOME desktop environment. If the system does not have any graphical user interface installed, this requirement is not applicable. $ grep logout /etc/dconf/db/local.d/locks/* /org/gnome/settings-daemon/plugins/media-keys/logout If the output is not "/org/gnome/settings-daemon/plugins/media-keys/logout", the line is commented out, or the line is missing, this is a finding.

Fix: F-87185r1201136_fix

Configure TOSS 5 to disallow the user changing the Ctrl-Alt-Del sequence in the GNOME desktop. Create a database to container systemwide graphical user logon settings (if it does not already exist) using the following command: $ sudo touch /etc/dconf/db/local.d/locks/session Add the following line to the session locks file to prevent nonprivileged users from modifying the Ctrl-Alt-Del setting: /org/gnome/settings-daemon/plugins/media-keys/logout Run the following command to update the database: $ sudo dconf update

b
TOSS 5 must disable the user list at logon for graphical user interfaces.
CM-6 - Medium - CCI-000366 - V-282720 - SV-282720r1201591_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000283
Vuln IDs
  • V-282720
Rule IDs
  • SV-282720r1201591_rule
Leaving the user list enabled is a security risk since it allows anyone with physical access to the system to enumerate known user accounts without authenticated access to the system.
Checks: C-87281r1201138_chk

Verify TOSS 5 disables the user logon list for graphical user interfaces using the following command: Note: This requirement assumes the use of the TOSS 5 default graphical user interface, the GNOME desktop environment. If the system does not have any graphical user interface installed, this requirement is not applicable. $ sudo gsettings get org.gnome.login-screen disable-user-list true If the setting is "false", this is a finding.

Fix: F-87186r1201590_fix

Configure TOSS 5 to disable the user list at logon for graphical user interfaces. Create a database to contain the systemwide screensaver settings (if it does not already exist) using the following command: Note: The example below is using the database "local" for the system, so if the system is using another database in "/etc/dconf/profile/user", the file should be created under the appropriate subdirectory. $ sudo touch /etc/dconf/db/local.d/02-login-screen [org/gnome/login-screen] disable-user-list=true Update the system databases: $ sudo dconf update

b
All TOSS 5 local interactive user accounts must be assigned a home directory upon creation.
CM-6 - Medium - CCI-000366 - V-282721 - SV-282721r1201143_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000293
Vuln IDs
  • V-282721
Rule IDs
  • SV-282721r1201143_rule
If local interactive users are not assigned a valid home directory, there is no place for the storage and control of files they should own.
Checks: C-87282r1201141_chk

Verify all local interactive users on TOSS 5 are assigned a home directory upon creation using the following command: $ grep -i create_home /etc/login.defs CREATE_HOME yes If the value for "CREATE_HOME" parameter is not set to "yes", the line is missing, or the line is commented out, this is a finding.

Fix: F-87187r1201142_fix

Configure TOSS 5 to assign home directories to all new local interactive users by setting the "CREATE_HOME" parameter in "/etc/login.defs" to "yes" as follows. CREATE_HOME yes

b
TOSS 5 must set the umask value to 077 for all local interactive user accounts.
CM-6 - Medium - CCI-000366 - V-282722 - SV-282722r1201146_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000294
Vuln IDs
  • V-282722
Rule IDs
  • SV-282722r1201146_rule
The umask controls the default access mode assigned to newly created files. A umask of 077 limits new files to mode 600 or less permissive. Although umask can be represented as a four-digit number, the first digit representing special access modes is typically ignored or required to be "0". This requirement applies to the globally configured system defaults and the local interactive user defaults for each account on the system.
Checks: C-87283r1201144_chk

Verify the default umask for all local interactive users is "077". Identify the locations of all local interactive user home directories in the "/etc/passwd" file. Check all local interactive user initialization files for interactive users using the following command. Note: The example is for a system that is configured to create users home directories in the "/home" directory. # grep -ri umask /home/ /home/wadea/.bash_history:grep -i umask /etc/bashrc /etc/csh.cshrc /etc/profile /home/wadea/.bash_history:grep -i umask /etc/login.defs If any local interactive user initialization files are found to have a umask statement that sets a value less restrictive than "077", this is a finding.

Fix: F-87188r1201145_fix

Remove the umask statement from all local interactive user's initialization files. If the account is for an application, the requirement for a umask less restrictive than "077" can be documented with the information system security officer, but the user agreement for access to the account must specify that the local interactive user must log on to their account first and then switch the user to the application account with the correct option to gain the account's environment variables.

b
TOSS 5 system accounts must not have an interactive login shell.
CM-6 - Medium - CCI-000366 - V-282723 - SV-282723r1201149_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000296
Vuln IDs
  • V-282723
Rule IDs
  • SV-282723r1201149_rule
Ensuring shells are not given to system accounts upon login makes it more difficult for attackers to make use of system accounts.
Checks: C-87284r1201147_chk

Verify system accounts must not have an interactive login shell using the following command: $ awk -F: '($3&lt;1000){print $1 ":" $3 ":" $7}' /etc/passwd root:0:/bin/bash bin:1:/sbin/nologin daemon:2:/sbin/nologin adm:3:/sbin/nologin lp:4:/sbin/nologin Identify the system accounts from this listing that do not have a nologin or similar noninteractive shell. If any system account (other than the root account) has a login shell and it is not documented with the information system security officer (ISSO), this is a finding.

Fix: F-87189r1201148_fix

Configure TOSS 5 so that all noninteractive accounts on the system do not have an interactive shell assigned to them. If the system account needs a shell assigned for mission operations, document the need with the information system security officer (ISSO). Run the following command to disable the interactive shell for a specific noninteractive user account: Replace <user> with the user that has a login shell. $ sudo usermod --shell /sbin/nologin <user> Do not perform the steps in this section on the root account. Doing so will cause the system to become inaccessible.

b
Executable search paths within the initialization files of all local interactive TOSS 5 users must only contain paths that resolve to the system default or the users home directory.
CM-6 - Medium - CCI-000366 - V-282724 - SV-282724r1201152_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000300
Vuln IDs
  • V-282724
Rule IDs
  • SV-282724r1201152_rule
The executable search path (typically the PATH environment variable) contains a list of directories for the shell to search to find executables. If this path includes the current working directory (other than the user's home directory), executables in these directories may be executed instead of system commands. This variable is formatted as a colon-separated list of directories. If there is an empty entry, such as a leading or trailing colon or two consecutive colons, this is interpreted as the current working directory. If deviations from the default system search path for the local interactive user are required, they must be documented with the information system security officer (ISSO).
Checks: C-87285r1201150_chk

Verify all local interactive user initialization file executable search path statements do not contain statements that will reference a working directory other than user home directories with the following commands: $ sudo grep -i path= /home/*/.* /home/[localinteractiveuser]/.bash_profile:PATH=$PATH:$HOME/.local/bin:$HOME/bin If any local interactive user initialization files have executable search path statements that include directories outside of their home directory and is not documented with the ISSO as an operational requirement, this is a finding.

Fix: F-87190r1201151_fix

Edit the local interactive user initialization files to change any PATH variable statements that reference directories other than their home directory. If a local interactive user requires path variables to reference a directory owned by the application, it must be documented with the ISSO.

b
All TOSS 5 local interactive users must have a home directory assigned in the /etc/passwd file.
CM-6 - Medium - CCI-000366 - V-282725 - SV-282725r1201593_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000301
Vuln IDs
  • V-282725
Rule IDs
  • SV-282725r1201593_rule
If local interactive users are not assigned a valid home directory, there is no place to store and control the files they should own.
Checks: C-87286r1201592_chk

Verify interactive users on the system have a home directory assigned using the following command: $ sudo awk -F: '($3&gt;=1000)&amp;&amp;($7 !~ /nologin/){print $1, $3, $6}' /etc/passwd smithk:x:1000:1000:smithk:/home/smithk:/bin/bash scsaustin:x:1001:1001:scsaustin:/home/scsaustin:/bin/bash djohnson:x:1002:1002:djohnson:/home/djohnson:/bin/bash Inspect the output and verify that all interactive users (normally users with a user identifier [UID] greater than 1000) have a home directory defined. If users home directory is not defined, this is a finding.

Fix: F-87191r1201154_fix

Create and assign home directories to all local interactive users on TOSS 5 that currently do not have a home directory assigned.

b
All TOSS 5 local interactive user home directories defined in the /etc/passwd file must exist.
CM-6 - Medium - CCI-000366 - V-282726 - SV-282726r1201158_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000302
Vuln IDs
  • V-282726
Rule IDs
  • SV-282726r1201158_rule
If a local interactive user has a home directory defined that does not exist, the user may be given access to the / directory as the current working directory upon logon. This could create a denial of service because the user would not be able to access their logon configuration files, and it may give them visibility to system files they normally would not be able to access.
Checks: C-87287r1201156_chk

Verify the assigned home directories of all interactive users on the system exist using the following command: $ sudo pwck -r user 'mailnull': directory 'var/spool/mqueue' does not exist The output should not return any interactive users. If the user's home directory does not exist, this is a finding.

Fix: F-87192r1201157_fix

Create home directories to all local interactive users that currently do not have a home directory assigned. Use the following commands to create the user home directory assigned in "/etc/ passwd": Note: The example will be for the user "wadea", who has a home directory of "/home/wadea", a user identifier (UID) of "wadea", and a Group Identifier (GID) of "users assigned" in "/etc/passwd". $ sudo mkdir /home/wadea $ sudo chown wadea /home/wadea $ sudo chgrp users /home/wadea $ sudo chmod 0750 /home/wadea

b
All TOSS 5 local interactive user home directories must be group-owned by the home directory owner's primary group.
CM-6 - Medium - CCI-000366 - V-282727 - SV-282727r1201161_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000303
Vuln IDs
  • V-282727
Rule IDs
  • SV-282727r1201161_rule
If the Group Identifier (GID) of a local interactive user's home directory is not the same as the primary GID of the user, this would allow unauthorized access to the user's files, and users that share the same group may not be able to access files that they legitimately should.
Checks: C-87288r1201159_chk

Verify the assigned home directory of all local interactive users is group owned by that user's primary GID using the following command. Note: This may miss local interactive users that have been assigned a privileged user identifier (UID). Evidence of interactive use may be obtained from a number of log files containing system logon information. The returned directory "/home/wadea" is used as an example. $ sudo ls -ld $(awk -F: '($3&gt;=1000)&amp;&amp;($7 !~ /nologin/){print $6}' /etc/passwd) drwxr-x--- 2 wadea admin 4096 Jun 5 12:41 wadea Check the user's primary group using the following command: $ sudo grep $(grep wadea /etc/passwd | awk -F: ‘{print $4}') /etc/group admin:x:250:wadea,jonesj,jacksons If the user home directory referenced in "/etc/passwd" is not group-owned by that user's primary GID, this is a finding.

Fix: F-87193r1201160_fix

Change the group owner of a local interactive user's home directory to the group found in "/etc/passwd". To change the group owner of a local interactive user's home directory, use the following command: Note: The example will be for the user "wadea", who has a home directory of "/home/wadea", and has a primary group of users. $ sudo chgrp users /home/wadea

b
TOSS 5 must not have unauthorized accounts.
CM-6 - Medium - CCI-000366 - V-282728 - SV-282728r1201164_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000306
Vuln IDs
  • V-282728
Rule IDs
  • SV-282728r1201164_rule
Accounts providing no operational purpose provide additional opportunities for system compromise. Unnecessary accounts include user accounts for individuals not requiring access to the system and application accounts for applications not installed on the system.
Checks: C-87289r1201162_chk

Verify there are no unauthorized interactive user accounts using the following command: $ less /etc/passwd root:x:0:0:root:/root:/bin/bash ... games:x:12:100:games:/usr/games:/sbin/nologin scsaustin:x:1001:1001:scsaustin:/home/scsaustin:/bin/bash djohnson:x:1002:1002:djohnson:/home/djohnson:/bin/bash Interactive user account, generally will have a user identifier (UID) of 1000 or greater, a home directory in a specific partition, and an interactive shell. Obtain the list of interactive user accounts authorized to be on the system from the system administrator (SA) or information system security officer (ISSO) and compare it to the list of local interactive user accounts on the system. If there are unauthorized local user accounts on the system, this is a finding.

Fix: F-87194r1201163_fix

Remove unauthorized local interactive user accounts with the following command where <unauthorized_user> is the unauthorized account: $ sudo userdel <unauthorized_user>

c
The root account must be the only account with unrestricted access to TOSS 5 system.
CM-6 - High - CCI-000366 - V-282729 - SV-282729r1201167_rule
RMF Control
CM-6
Severity
H
CCI
CCI-000366
Version
TOSS-05-000307
Vuln IDs
  • V-282729
Rule IDs
  • SV-282729r1201167_rule
An account has root authority if it has a user identifier (UID) of "0". Multiple accounts with a UID of "0" afford more opportunity for potential intruders to guess a password for a privileged account. Properly configuring sudo is recommended to afford multiple system administrators (SAs) access to root privileges in an accountable manner.
Checks: C-87290r1201165_chk

Verify only the "root" account has a UID "0" assignment using the following command: $ awk -F: '$3 == 0 {print $1}' /etc/passwd root If any accounts other than "root" have a UID of "0", this is a finding.

Fix: F-87195r1201166_fix

Change the UID of any account on the system, other than root, that has a UID of "0". If the account is associated with system commands or applications, the UID should be changed to one greater than "0" but less than "1000". Otherwise, assign a UID of greater than "1000" that has not already been assigned.

b
Local TOSS 5 initialization files must not execute world-writable programs.
CM-6 - Medium - CCI-000366 - V-282730 - SV-282730r1201170_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000310
Vuln IDs
  • V-282730
Rule IDs
  • SV-282730r1201170_rule
If user start-up files execute world-writable programs, especially in unprotected directories, they could be maliciously modified to destroy user files or otherwise compromise the system at the user level. If the system is compromised at the user level, it is easier to elevate privileges to eventually compromise the system at the root and network level.
Checks: C-87291r1201168_chk

Verify local initialization files do not execute world-writable programs using the following command. Note: The example will be for a system that is configured to create user home directories in the "/home" directory. $ sudo find /home -perm -002 -type f -name ".[^.]*" -exec ls -ld {} \; If any local initialization files are found to reference world-writable files, this is a finding.

Fix: F-87196r1201169_fix

Set the mode on files being executed by the local initialization files using the following command: $ sudo chmod 0755 <file>

a
TOSS 5 must display the date and time of the last successful account logon upon user logon.
CM-6 - Low - CCI-000366 - V-282731 - SV-282731r1201173_rule
RMF Control
CM-6
Severity
L
CCI
CCI-000366
Version
TOSS-05-000320
Vuln IDs
  • V-282731
Rule IDs
  • SV-282731r1201173_rule
Users must be aware of activity that occurs regarding their account. Providing users with information regarding the number of unsuccessful attempts that were made to login to their account allows the user to determine if any unauthorized activity has occurred and gives them an opportunity to notify administrators.
Checks: C-87292r1201171_chk

Verify users are provided with feedback on when account accesses last occurred using the following command: $ sudo grep pam_lastlog /etc/pam.d/postlogin session required pam_lastlog.so showfailed If "pam_lastlog" is missing from "/etc/pam.d/postlogin" file, or the silent option is present, this is a finding.

Fix: F-87197r1201172_fix

Configure TOSS 5 to provide users with feedback on when account accesses last occurred by setting the required configuration options in "/etc/pam.d/postlogin". Add the following line to the top of "/etc/pam.d/postlogin": session required pam_lastlog.so showfailed

b
TOSS 5 must have policycoreutils package installed.
CM-6 - Medium - CCI-000366 - V-282732 - SV-282732r1201176_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000322
Vuln IDs
  • V-282732
Rule IDs
  • SV-282732r1201176_rule
If security functions are not verified, they may not operate correctly and the failure may go unnoticed. Security function is defined as the hardware, software, and/or firmware of the information system responsible for enforcing the system security policy and supporting the isolation of code and data on which the protection is based. Security functionality includes, but is not limited to, establishing system accounts, configuring access authorizations (i.e., permissions, privileges), setting events to be audited, and setting intrusion detection parameters. "policycoreutils" contains the policy core utilities that are required for basic operation of an SELinux-enabled system. These utilities include "load_policy" to load SELinux policies, "setfile" to label filesystems, "newrole" to switch roles, and "run_init" to run "/etc/init.d" scripts in the proper context.
Checks: C-87293r1201174_chk

Verify the TOSS 5 "policycoreutils" package is installed using the following command: $ sudo dnf list --installed policycoreutils Example output: policycoreutils.x86_64 3.3-6.el9_0 If the "policycoreutils" package is not installed, this is a finding.

Fix: F-87198r1201175_fix

Install the "policycoreutils" package using the following command: $ sudo dnf install policycoreutils

b
TOSS 5 policycoreutils-python-utils package must be installed.
CM-6 - Medium - CCI-000366 - V-282733 - SV-282733r1201179_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000323
Vuln IDs
  • V-282733
Rule IDs
  • SV-282733r1201179_rule
The "policycoreutils-python-utils" package is required to operate and manage an SELinux environment and its policies. It provides utilities such as "semanage", "audit2allow", "audit2why", "chcat", and "sandbox".
Checks: C-87294r1201177_chk

Verify the TOSS 5 "policycoreutils-python-utils" service package is installed using the following command: $ sudo dnf list --installed policycoreutils-python-utils Example output: policycoreutils-python-utils.noarch 3.3-6.el9_0 If the "policycoreutils-python-utils" package is not installed, this is a finding.

Fix: F-87199r1201178_fix

Install the "policycoreutils-python-utils" service package using the following command: $ sudo dnf install policycoreutils-python-utils

b
TOSS 5 must require reauthentication when using the sudo command.
CM-6 - Medium - CCI-000366 - V-282734 - SV-282734r1201182_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000325
Vuln IDs
  • V-282734
Rule IDs
  • SV-282734r1201182_rule
Without reauthentication, users may access resources or perform tasks for which they do not have authorization. When operating systems provide the capability to escalate a functional capability, it is critical that the organization requires the user to reauthenticate when using the "sudo" command. If the value is set to an integer less than "0", the user's time stamp will not expire and the user will not have to reauthenticate for privileged actions until the user's session is terminated.
Checks: C-87295r1201180_chk

Verify TOSS 5 requires reauthentication when using the "sudo" command to elevate privileges using the following command: $ sudo grep -ir 'timestamp_timeout' /etc/sudoers /etc/sudoers.d/* /etc/sudoers:Defaults timestamp_timeout=0 If results are returned from more than one file location, this is a finding. If "timestamp_timeout" is set to a negative number, is commented out, or no results are returned, this is a finding.

Fix: F-87200r1201181_fix

Configure TOSS 5 to reauthenticate "sudo" commands after the specified timeout. Add the following line to "/etc/sudoers": Defaults timestamp_timeout=0

b
TOSS 5 must require users to reauthenticate for privilege escalation.
CM-6 - Medium - CCI-000366 - V-282735 - SV-282735r1201185_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000327
Vuln IDs
  • V-282735
Rule IDs
  • SV-282735r1201185_rule
Without reauthentication, users may access resources or perform tasks for which they do not have authorization. When operating systems provide the capability to escalate a functional capability, it is critical that the user reauthenticate.
Checks: C-87296r1201183_chk

Verify "/etc/sudoers" has no occurrences of "!authenticate" using the following command: $ sudo grep -ir '!authenticate' /etc/sudoers /etc/sudoers.d/* If any occurrences of "!authenticate" are returned, this is a finding.

Fix: F-87201r1201184_fix

Configure TOSS 5 to not allow users to execute privileged actions without authenticating. Remove any occurrence of "!authenticate" found in "/etc/sudoers" file or files in the "/etc/sudoers.d" directory: $ sudo sed -i '/\!authenticate/ s/^/# /g' /etc/sudoers /etc/sudoers.d/*

b
TOSS 5 must restrict privilege elevation to authorized personnel.
CM-6 - Medium - CCI-000366 - V-282736 - SV-282736r1201188_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000328
Vuln IDs
  • V-282736
Rule IDs
  • SV-282736r1201188_rule
If the "sudoers" file is not configured correctly, any user defined on the system can initiate privileged actions on the target system.
Checks: C-87297r1201186_chk

Verify TOSS 5 restricts privilege elevation to authorized personnel using the following command: $ sudo sh -c 'grep -iw ALL /etc/sudoers /etc/sudoers.d/*' If the either of the following entries are returned, this is a finding: ALL ALL=(ALL) ALL ALL ALL=(ALL:ALL) ALL

Fix: F-87202r1201187_fix

Remove the following entries from the /etc/sudoers file or configuration file under /etc/sudoers.d/: ALL ALL=(ALL) ALL ALL ALL=(ALL:ALL) ALL

c
TOSS 5 must not allow blank or null passwords.
CM-6 - High - CCI-000366 - V-282737 - SV-282737r1201191_rule
RMF Control
CM-6
Severity
H
CCI
CCI-000366
Version
TOSS-05-000331
Vuln IDs
  • V-282737
Rule IDs
  • SV-282737r1201191_rule
If an account has an empty password, anyone could log in and run commands with the privileges of that account. Accounts with empty passwords should never be used in operational environments.
Checks: C-87298r1201189_chk

Verify null passwords cannot be used by running the following command: $ sudo grep -i nullok /etc/pam.d/system-auth /etc/pam.d/password-auth If an output is produced, this is a finding.

Fix: F-87203r1201190_fix

Remove any instances of the "nullok" option in the "/etc/pam.d/password-auth" and "/etc/pam.d/system-auth" files to prevent logons with empty passwords. Note: Manual changes to the listed file may be overwritten by the "authselect" program.

c
TOSS 5 must ensure the password complexity module is enabled in the system-auth file.
CM-6 - High - CCI-000366 - V-282738 - SV-282738r1201194_rule
RMF Control
CM-6
Severity
H
CCI
CCI-000366
Version
TOSS-05-000335
Vuln IDs
  • V-282738
Rule IDs
  • SV-282738r1201194_rule
Enabling PAM password complexity permits enforcement of strong passwords and consequently makes the system less prone to dictionary attacks.
Checks: C-87299r1201192_chk

Verify TOSS 5 uses "pwquality" to enforce the password complexity rules in the "system-auth" file using the following command: $ cat /etc/pam.d/system-auth | grep pam_pwquality password required pam_pwquality.so If the command does not return a line containing the value "pam_pwquality.so", or the line is commented out, this is a finding.

Fix: F-87204r1201193_fix

Configure TOSS 5 to use "pwquality" to enforce password complexity rules. Add the following line to the "/etc/pam.d/system-auth" file(or modify the line to have the required value): password required pam_pwquality.so

b
TOSS 5 must require users to provide a password for privilege escalation.
CM-6 - Medium - CCI-000366 - V-282739 - SV-282739r1201595_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000343
Vuln IDs
  • V-282739
Rule IDs
  • SV-282739r1201595_rule
Without reauthentication, users may access resources or perform tasks for which they do not have authorization. When operating systems provide the capability to escalate a functional capability, it is critical that the user reauthenticate.
Checks: C-87300r1201594_chk

Verify "/etc/sudoers" has no occurrences of "NOPASSWD" using the following command: $ sudo grep -ri nopasswd /etc/sudoers /etc/sudoers.d/* If any occurrences of "NOPASSWD" are returned and this is not documented with the information system security officer (ISSO) as an operational requirement, this is a finding.

Fix: F-87205r1201196_fix

Configure TOSS 5 to not allow users to execute privileged actions without authenticating with a password. Remove any occurrence of "NOPASSWD" found in "/etc/sudoers" file or files in the "/etc/sudoers.d" directory. $ sudo sed -i '/NOPASSWD/ s/^/# /g' /etc/sudoers /etc/sudoers.d/*

b
TOSS 5 must not be configured to bypass password requirements for privilege escalation.
CM-6 - Medium - CCI-000366 - V-282740 - SV-282740r1201200_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000355
Vuln IDs
  • V-282740
Rule IDs
  • SV-282740r1201200_rule
Without reauthentication, users may access resources or perform tasks for which they do not have authorization. When operating systems provide the capability to escalate a functional capability, it is critical that the user reauthenticate.
Checks: C-87301r1201198_chk

Verify TOSS 5 is not configured to bypass password requirements for privilege escalation using the following command: $ sudo grep pam_succeed_if /etc/pam.d/sudo If any occurrences of " pam_succeed_if " are returned, this is a finding.

Fix: F-87206r1201199_fix

Configure TOSS 5 to require users to supply a password for privilege escalation. Remove any occurrences of " pam_succeed_if " in the "/etc/pam.d/sudo" file.

b
TOSS 5 must not have accounts configured with blank or null passwords.
CM-6 - Medium - CCI-000366 - V-282741 - SV-282741r1201203_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000357
Vuln IDs
  • V-282741
Rule IDs
  • SV-282741r1201203_rule
If an account has an empty password, anyone could log in and run commands with the privileges of that account. Accounts with empty passwords should never be used in operational environments.
Checks: C-87302r1201201_chk

Verify null or blank passwords cannot be used using the following command: $ sudo awk -F: '!$2 {print $1}' /etc/shadow If the command returns any results, this is a finding.

Fix: F-87207r1201202_fix

Configure all accounts on TOSS 5 to have a password or lock the account using the following commands: Perform a password reset: $ sudo passwd [username] To lock an account: $ sudo passwd -l [username]

b
TOSS 5 must use a file integrity tool that is configured to use FIPS 140-3-approved cryptographic hashes for validating file contents and directories.
CM-6 - Medium - CCI-000366 - V-282742 - SV-282742r1201206_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000371
Vuln IDs
  • V-282742
Rule IDs
  • SV-282742r1201206_rule
TOSS 5 installation media ships with an optional file integrity tool called Advanced Intrusion Detection Environment (AIDE). AIDE is highly configurable at install time. This requirement assumes the "aide.conf" file is under the "/etc" directory. File integrity tools use cryptographic hashes for verifying file contents and directories have not been altered. These hashes must be 140-3-approved cryptographic hashes. Satisfies: SRG-OS-000480-GPOS-00227, SRG-OS-000550-GPOS-00100
Checks: C-87303r1201204_chk

Verify AIDE is configured to use FIPS 140-3 file hashing using the following command: $ grep sha512 /etc/aide.conf All=p+i+n+u+g+s+m+S+sha512+acl+xattrs+selinux If the "sha512" rule is not being used on all uncommented selection lines in the "/etc/aide.conf" file, or another file integrity tool is not using 140-3-approved cryptographic hashes for validating file contents and directories, this is a finding.

Fix: F-87208r1201205_fix

Configure the file integrity tool to use FIPS 140-3 cryptographic hashes for validating file and directory contents. If AIDE is installed, ensure the "sha512" rule is present on all uncommented file and directory selection lists. Exclude any log files or files expected to change frequently to reduce unnecessary notifications.

a
TOSS 5 must be configured so that the file integrity tool verifies Access Control Lists (ACLs).
CM-6 - Low - CCI-000366 - V-282743 - SV-282743r1201209_rule
RMF Control
CM-6
Severity
L
CCI
CCI-000366
Version
TOSS-05-000373
Vuln IDs
  • V-282743
Rule IDs
  • SV-282743r1201209_rule
TOSS 5 installation media ships with an optional file integrity tool called Advanced Intrusion Detection Environment (AIDE). AIDE is highly configurable at install time. This requirement assumes the "aide.conf" file is under the "/etc" directory. ACLs can provide permissions beyond those permitted through the file mode and must be verified by the file integrity tools.
Checks: C-87304r1201207_chk

Confirm AIDE is verifying ACLs using the following command: $ grep acl /etc/aide.conf All= p+i+n+u+g+s+m+S+sha512+acl+xattrs+selinux If the "acl" rule is not being used on all uncommented selection lines in the "/etc/aide.conf" file, or ACLs are not being checked by another file integrity tool, this is a finding.

Fix: F-87209r1201208_fix

Configure the file integrity tool to check file and directory ACLs. If AIDE is installed, ensure the "acl" rule is present on all uncommented file and directory selection lists.

a
TOSS 5 must be configured so the file integrity tool verifies extended attributes.
CM-6 - Low - CCI-000366 - V-282744 - SV-282744r1201212_rule
RMF Control
CM-6
Severity
L
CCI
CCI-000366
Version
TOSS-05-000374
Vuln IDs
  • V-282744
Rule IDs
  • SV-282744r1201212_rule
TOSS 5 installation media ships with an optional file integrity tool called Advanced Intrusion Detection Environment (AIDE). AIDE is highly configurable at install time. This requirement assumes the "aide.conf" file is under the "/etc" directory. Extended attributes in file systems are used to contain arbitrary data and file metadata with security implications.
Checks: C-87305r1201210_chk

Verify AIDE is configured to verify extended attributes using the following command: $ grep xattrs /etc/aide.conf All= p+i+n+u+g+s+m+S+sha512+acl+xattrs+selinux If the "xattrs" rule is not being used on all uncommented selection lines in the "/etc/aide.conf" file, or extended attributes are not being checked by another file integrity tool, this is a finding.

Fix: F-87210r1201211_fix

Configure the file integrity tool to check file and directory extended attributes. If AIDE is installed, ensure the "xattrs" rule is present on all uncommented file and directory selection lists.

b
TOSS 5 must have the packages required for encrypting off-loaded audit logs installed.
CM-6 - Medium - CCI-000366 - V-282745 - SV-282745r1201645_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000376
Vuln IDs
  • V-282745
Rule IDs
  • SV-282745r1201645_rule
The "rsyslog-gnutls" package provides Transport Layer Security (TLS) support for the rsyslog daemon, which enables secure remote logging.
Checks: C-87306r1201213_chk

Verify TOSS 5 has the "rsyslog-gnutls" package installed using the following command: $ sudo dnf list --installed rsyslog-gnutls Example output: rsyslog-gnutls.x86_64 8.2102.0-101.el9_0.1 If the "rsyslog-gnutls" package is not installed, this is a finding.

Fix: F-87211r1201214_fix

Install the "rsyslog-gnutls" package using the following command: $ sudo dnf install rsyslog-gnutls

b
The rsyslog service on TOSS 5 must be active.
CM-6 - Medium - CCI-000366 - V-282746 - SV-282746r1201218_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000377
Vuln IDs
  • V-282746
Rule IDs
  • SV-282746r1201218_rule
The "rsyslog" service must be running to provide logging services, which are essential to system administration.
Checks: C-87307r1201216_chk

Verify "rsyslog" is active using the following command: $ systemctl is-active rsyslog active If the "rsyslog" service is not active, this is a finding.

Fix: F-87212r1201217_fix

To enable the rsyslog service, run the following command: $ sudo systemctl enable --now rsyslog

b
TOSS 5 must be configured so the rsyslog daemon does not accept log messages from other servers unless the server is being used for log aggregation.
CM-6 - Medium - CCI-000366 - V-282747 - SV-282747r1201386_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000378
Vuln IDs
  • V-282747
Rule IDs
  • SV-282747r1201386_rule
Unintentionally running an rsyslog server that accepts remote messages puts the system at increased risk. Malicious rsyslog messages sent to the server could exploit vulnerabilities in the server software itself, could introduce misleading information into the system's logs, or could fill the system's storage, leading to a denial of service. If the system is intended to be a log aggregation server, its use must be documented with the information system security officer (ISSO).
Checks: C-87308r1201219_chk

Verify TOSS 5 is not configured to receive remote logs using rsyslog with the following commands: $ grep -i modload /etc/rsyslog.conf /etc/rsyslog.d/* $ModLoad imtcp $ModLoad imrelp $ grep -i serverrun /etc/rsyslog.conf /etc/rsyslog.d/* $InputTCPServerRun 514 $InputRELPServerRun 514 Note: An error about no files or directories may be returned. This is not a finding. If any lines are returned by the command, then rsyslog is configured to receive remote messages, and this is a finding.

Fix: F-87213r1201385_fix

Configure TOSS 5 to not receive remote logs using rsyslog. Remove the lines in "/etc/rsyslog.conf" and any files in the "/etc/rsyslog.d" directory that match any of the following: $ModLoad imtcp $ModLoad imudp $ModLoad imrelp $InputTCPServerRun [0-9]* $UDPServerRun [0-9]* $InputRELPServerRun [0-9]* Restart the rsyslog daemon for the changes to take effect. $ sudo systemctl restart rsyslog.service

b
TOSS 5 must use cron logging.
CM-6 - Medium - CCI-000366 - V-282748 - SV-282748r1201388_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000385
Vuln IDs
  • V-282748
Rule IDs
  • SV-282748r1201388_rule
Cron logging can be used to trace the successful or unsuccessful execution of cron jobs. It can also be used to spot intrusions into the use of the cron facility by unauthorized and malicious users.
Checks: C-87309r1201222_chk

Verify "rsyslog" is configured to log cron events using the following command: Note: If another logging package is used, substitute the utility configuration file for "/etc/rsyslog.conf" or "/etc/rsyslog.d/*.conf" files. $ sudo grep -s cron /etc/rsyslog.conf /etc/rsyslog.d/*.conf /etc/rsyslog.conf:*.info;mail.none;authpriv.none;cron.none /var/log/messages /etc/rsyslog.conf:cron.* /var/log/cron If the command does not return a response, check for cron logging all facilities using the following command: $ sudo grep -s /var/log/messages /etc/rsyslog.conf /etc/rsyslog.d/*.conf /etc/rsyslog.conf:*.info;mail.none;authpriv.none;cron.none /var/log/messages If "rsyslog" is not logging messages for the cron facility or all facilities, this is a finding.

Fix: F-87214r1201387_fix

Configure "rsyslog" to log all cron messages by adding or updating the following line to "/etc/rsyslog.conf" or a configuration file in the /etc/rsyslog.d/ directory: cron.* /var/log/cron Restart the rsyslog daemon for the changes to take effect. $ sudo systemctl restart rsyslog.service

b
The TOSS 5 audit system must take appropriate action when an error writing to the audit storage volume occurs.
CM-6 - Medium - CCI-000366 - V-282749 - SV-282749r1201227_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000388
Vuln IDs
  • V-282749
Rule IDs
  • SV-282749r1201227_rule
It is critical that when the operating system is at risk of failing to process audit logs as required, it takes action to mitigate the failure. Audit processing failures include software/hardware errors; failures in the audit capturing mechanisms; and audit storage capacity being reached or exceeded. Responses to audit failure depend upon the nature of the failure mode.
Checks: C-87310r1201225_chk

Verify TOSS 5 takes the appropriate action when an audit processing failure occurs using the following command: $ sudo grep disk_error_action /etc/audit/auditd.conf disk_error_action = HALT If the value of the "disk_error_action" option is not "SYSLOG", "SINGLE", or "HALT", or the line is commented out, ask the system administrator (SA) to indicate how the system takes appropriate action when an audit process failure occurs. If there is no evidence of appropriate action, this is a finding.

Fix: F-87215r1201226_fix

Configure TOSS 5 to shut down by default upon audit failure (unless availability is an overriding concern). Add or update the following line (depending on the configuration, "disk_error_action" can be set to "SYSLOG" or "SINGLE") in "/etc/audit/auditd.conf" file: disk_error_action = HALT If availability has been determined to be more important, and this decision is documented with the information system security officer (ISSO), configure the operating system to notify the SA and ISSO in the event of an audit processing failure by setting the "disk_error_action" to "SYSLOG".

b
The TOSS 5 audit system must take appropriate action when the audit storage volume is full.
CM-6 - Medium - CCI-000366 - V-282750 - SV-282750r1201230_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000389
Vuln IDs
  • V-282750
Rule IDs
  • SV-282750r1201230_rule
It is critical that when the operating system is at risk of failing to process audit logs as required, it takes action to mitigate the failure. Audit processing failures include software/hardware errors; failures in the audit capturing mechanisms; and audit storage capacity being reached or exceeded. Responses to audit failure depend upon the nature of the failure mode.
Checks: C-87311r1201228_chk

Verify TOSS 5 takes the appropriate action when the audit storage volume is full using the following command: $ sudo grep disk_full_action /etc/audit/auditd.conf disk_full_action = HALT If the value of the "disk_full_action" option is not "SYSLOG", "SINGLE", or "HALT", or the line is commented out, ask the system administrator (SA) to indicate how the system takes appropriate action when an audit storage volume is full. If there is no evidence of appropriate action, this is a finding.

Fix: F-87216r1201229_fix

Configure TOSS 5 to shut down by default upon audit failure (unless availability is an overriding concern). Add or update the following line (depending on the configuration, "disk_full_action" can be set to "SYSLOG" or "SINGLE") in "/etc/audit/auditd.conf" file: disk_full_action = HALT If availability has been determined to be more important, and this decision is documented with the information system security officer (ISSO), configure the operating system to notify the SA and ISSO in the event of an audit processing failure by setting the "disk_full_action" to "SYSLOG".

b
The TOSS 5 audit system must take appropriate action when the audit files have reached maximum size.
CM-6 - Medium - CCI-000366 - V-282751 - SV-282751r1201233_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000395
Vuln IDs
  • V-282751
Rule IDs
  • SV-282751r1201233_rule
It is critical that when the operating system is at risk of failing to process audit logs as required, it takes action to mitigate the failure. Audit processing failures include software/hardware errors; failures in the audit capturing mechanisms; and audit storage capacity being reached or exceeded. Responses to audit failure depend upon the nature of the failure mode.
Checks: C-87312r1201231_chk

Verify TOSS 5 takes the appropriate action when the audit files have reached maximum size using the following command: $ sudo grep max_log_file_action /etc/audit/auditd.conf max_log_file_action = ROTATE If the value of the "max_log_file_action" option is not "ROTATE", "SINGLE", or the line is commented out, ask the system administrator (SA)to indicate how the system takes appropriate action when an audit storage volume is full. If there is no evidence of appropriate action, this is a finding.

Fix: F-87217r1201232_fix

Configure TOSS 5 to rotate the audit log when it reaches maximum size. Add or update the following line in "/etc/audit/auditd.conf" file: max_log_file_action = ROTATE

b
TOSS 5 must write audit records to disk.
CM-6 - Medium - CCI-000366 - V-282752 - SV-282752r1201236_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000405
Vuln IDs
  • V-282752
Rule IDs
  • SV-282752r1201236_rule
Audit data should be synchronously written to disk to ensure log integrity. This setting ensures all audit event data is written to disk.
Checks: C-87313r1201234_chk

If the system is configured to immediately offload audit records to an external system, this requirement is not applicable. Verify the audit system is configured to write logs to the disk using the following command: $ sudo grep write_logs /etc/audit/auditd.conf write_logs = yes If "write_logs" does not have a value of "yes", the line is commented out, or the line is missing, this is a finding.

Fix: F-87218r1201235_fix

Configure the audit system to write log files to the disk. Edit the "/etc/audit/auditd.conf" file and add or update the "write_logs" option to "yes": write_logs = yes Restart the audit daemon for changes to take effect.

b
TOSS 5 must define default permissions for the bash shell.
CM-6 - Medium - CCI-000366 - V-282753 - SV-282753r1201612_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000316
Vuln IDs
  • V-282753
Rule IDs
  • SV-282753r1201612_rule
The "umask "controls the default access mode assigned to newly created files. A umask of 077 limits new files to mode 600 or less permissive. Although "umask" can be represented as a four-digit number, the first digit representing special access modes is typically ignored or required to be "0". This requirement applies to the globally configured system defaults and the local interactive user defaults for each account on the system.
Checks: C-87314r1201611_chk

Verify the "umask" setting is configured correctly in the "/etc/bashrc" file using the following command: Note: If the value of the "umask" parameter is set to "000" "/etc/bashrc" file, the severity is raised to a CAT I. $ grep umask /etc/bashrc umask 077 umask 077 If the value for the "umask" parameter is not "077", or the "umask" parameter is missing or is commented out, this is a finding.

Fix: F-87219r1201238_fix

Configure TOSS 5 to define default permissions for all authenticated users using the bash shell. Add or edit the lines for the "umask" parameter in the "/etc/bashrc" file to "077": umask 077

b
TOSS 5 must define default permissions for the c shell.
CM-6 - Medium - CCI-000366 - V-282754 - SV-282754r1201614_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000317
Vuln IDs
  • V-282754
Rule IDs
  • SV-282754r1201614_rule
The "umask" controls the default access mode assigned to newly created files. A umask of 077 limits new files to mode 600 or less permissive. Although "umask "can be represented as a four-digit number, the first digit representing special access modes is typically ignored or required to be "0". This requirement applies to the globally configured system defaults and the local interactive user defaults for each account on the system.
Checks: C-87315r1201613_chk

Verify the "umask" setting is configured correctly in the "/etc/csh.cshrc" file using the following command: Note: If the value of the "umask" parameter is set to "000" "/etc/csh.cshrc" file, the severity is raised to a CAT I. $ grep umask /etc/csh.cshrc umask 077 umask 077 If the value for the "umask" parameter is not "077", or the "umask" parameter is missing or is commented out, this is a finding.

Fix: F-87220r1201241_fix

Configure TOSS 5 to define default permissions for all authenticated users using the c shell. Add or edit the lines for the "umask" parameter in the "/etc/csh.cshrc" file to "077": umask 077

b
TOSS 5 must define default permissions for all authenticated users in such a way that the user can only read and modify their own files.
CM-6 - Medium - CCI-000366 - V-282755 - SV-282755r1201616_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000318
Vuln IDs
  • V-282755
Rule IDs
  • SV-282755r1201616_rule
Setting the most restrictive default permissions ensures that when new accounts are created, they do not have unnecessary access.
Checks: C-87316r1201615_chk

Note: If the value of the "UMASK" parameter is set to "000" in "/etc/login.defs" file, the severity is raised to a CAT I. Verify TOSS 5 defines default permissions for all authenticated users in such a way that the user can only read and modify their own files using the following command: # grep -i umask /etc/login.defs UMASK 077 If the value for the "UMASK" parameter is not "077", or the "UMASK" parameter is missing or is commented out, this is a finding.

Fix: F-87221r1201244_fix

Configure TOSS 5 to define default permissions for all authenticated users in such a way that the user can only read and modify their own files. Add or edit the lines for the "UMASK" parameter in the "/etc/login.defs" file to "077": UMASK 077

b
TOSS 5 must define default permissions for the system default profile.
CM-6 - Medium - CCI-000366 - V-282756 - SV-282756r1201618_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000319
Vuln IDs
  • V-282756
Rule IDs
  • SV-282756r1201618_rule
The "umask" controls the default access mode assigned to newly created files. A umask of 077 limits new files to mode 600 or less permissive. Although "umask "can be represented as a four-digit number, the first digit representing special access modes is typically ignored or required to be "0". This requirement applies to the globally configured system defaults and the local interactive user defaults for each account on the system.
Checks: C-87317r1201617_chk

Note: If the value of the "umask" parameter is set to "000" "/etc/profile" file, the severity is raised to a CAT I. Verify the "umask" setting is configured correctly in the "/etc/profile" file using the following command: $ grep umask /etc/profile umask 077 If the value for the "umask" parameter is not "077", or the "umask" parameter is missing or is commented out, this is a finding.

Fix: F-87222r1201247_fix

Configure TOSS 5 to define default permissions for all authenticated users in such a way that the user can only read and modify their own files. Add or edit the lines for the "umask" parameter in the "/etc/profile" file to "077": umask 077

c
TOSS 5 must not allow an unattended or automatic logon to the system.
CM-6 - High - CCI-000366 - V-282757 - SV-282757r1201251_rule
RMF Control
CM-6
Severity
H
CCI
CCI-000366
Version
TOSS-05-000245
Vuln IDs
  • V-282757
Rule IDs
  • SV-282757r1201251_rule
Failure to restrict system access to authenticated users negatively impacts operating system security.
Checks: C-87318r1201249_chk

Verify TOSS does not allow an unattended or automatic logon to the system via a graphical user interface. Note: This requirement assumes the use of the TOSS default graphical user interface, Gnome Shell. If the system does not have any graphical user interface installed, this requirement is not applicable. Check for the value of the "AutomaticLoginEnable" in the "/etc/gdm/custom.conf" file using the following command: $ sudo grep -i automaticloginenable /etc/gdm/custom.conf AutomaticLoginEnable=false Automatic logon as an authorized user allows access to any user with physical access to the operating system. If the value of "AutomaticLoginEnable" is missing or is not set to "false", this is a finding.

Fix: F-87223r1201250_fix

Configure TOSS to not allow an unattended or automatic logon to the system via a graphical user interface. Add or edit the line for the "AutomaticLoginEnable" parameter in the [daemon] section of the "/etc/gdm/custom.conf" file to "false": [daemon] AutomaticLoginEnable=false

b
TOSS 5 must not allow users to override SSH environment variables.
CM-6 - Medium - CCI-000366 - V-282758 - SV-282758r1201254_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000246
Vuln IDs
  • V-282758
Rule IDs
  • SV-282758r1201254_rule
SSH environment options potentially allow users to bypass access restriction in some configurations.
Checks: C-87319r1201252_chk

Verify unattended or automatic logon via SSH is disabled using the following command: $ sudo /usr/sbin/sshd -dd 2&gt;&amp;1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH '^\s*permituserenvironment' PermitUserEnvironment no If "PermitUserEnvironment" is set to "yes", is missing completely, or is commented out, this is a finding.

Fix: F-87224r1201253_fix

Configure the TOSS 5 SSH daemon to not allow unattended or automatic logon to the system. Add or edit the following line in the "/etc/ssh/sshd_config" file: PermitUserEnvironment no Restart the SSH daemon for the setting to take effect: $ sudo systemctl restart sshd.service

c
TOSS 5 must not allow unattended or automatic logon via the graphical user interface.
CM-6 - High - CCI-000366 - V-282759 - SV-282759r1201257_rule
RMF Control
CM-6
Severity
H
CCI
CCI-000366
Version
TOSS-05-000268
Vuln IDs
  • V-282759
Rule IDs
  • SV-282759r1201257_rule
Failure to restrict system access to authenticated users negatively impacts operating system security.
Checks: C-87320r1201255_chk

Verify TOSS 5 does not allow an unattended or automatic logon to the system via a graphical user interface. Note: This requirement assumes the use of the TOSS 5 default graphical user interface, the GNOME desktop environment. If the system does not have any graphical user interface installed, this requirement is not applicable. Check for the value of the "AutomaticLoginEnable" in the "/etc/gdm/custom.conf" file using the following command: $ grep -i automaticlogin /etc/gdm/custom.conf [daemon] AutomaticLoginEnable=false If the value of "AutomaticLoginEnable" is not set to "false", this is a finding.

Fix: F-87225r1201256_fix

Configure the GNOME desktop display manager to disable automatic login. Set "AutomaticLoginEnable" to "false" in the [daemon] section in "/etc/gdm/custom.conf". For example: [daemon] AutomaticLoginEnable=false

b
All TOSS local interactive user home directories must have mode 0770 or less permissive.
CM-6 - Medium - CCI-000366 - V-282760 - SV-282760r1201260_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
TOSS-05-000493
Vuln IDs
  • V-282760
Rule IDs
  • SV-282760r1201260_rule
Users' home directories/folders may contain information of a sensitive nature. Nonprivileged users should coordinate any information sharing with a system administrator (SA) through shared resources.
Checks: C-87321r1201258_chk

Verify TOSS 5 limits the ability of nonprivileged users to grant other users direct access to the contents of their home directories/folders. Ensure the user permissions on all user home directories is set to 770 permissions using the following command: $ find $(awk -F: '($3&gt;=1000)&amp;&amp;($7 !~ /nologin/){print $6}' /etc/passwd) -maxdepth 0 -not -perm 770 -ls 2&gt; /dev/null If there is any output, this is a finding.

Fix: F-87226r1201259_fix

Change the mode of interactive user's home directories to "0770." using the following command: Note: The example will be for the user "smithj." $ sudo chmod 0770 /home/smithj

b
TOSS 5 must, for password-based authentication, verify when users create or update passwords the passwords are not found on the list of commonly-used, expected, or compromised passwords in IA-5 (1) (a).
Medium - CCI-004061 - V-282764 - SV-282764r1201597_rule
RMF Control
Severity
M
CCI
CCI-004061
Version
TOSS-05-000079
Vuln IDs
  • V-282764
Rule IDs
  • SV-282764r1201597_rule
Password-based authentication applies to passwords regardless of whether they are used in single-factor or multifactor authentication. Long passwords or passphrases are preferable over shorter passwords. Enforced composition rules provide marginal security benefits while decreasing usability. However, organizations may choose to establish certain rules for password generation (e.g., minimum character length for long passwords) under certain circumstances and can enforce this requirement in IA-5(1)(h). Account recovery can occur, for example, in situations when a password is forgotten. Cryptographically protected passwords include salted one-way cryptographic hashes of passwords. The list of commonly used, compromised, or expected passwords includes passwords obtained from previous breach corpuses, dictionary words, and repetitive or sequential characters. The list includes context-specific words, such as the name of the service, username, and derivatives thereof.
Checks: C-87325r1201270_chk

Verify TOSS 5 is configured not allow users create or update passwords with passwords that are found on the list of commonly-used, expected, or compromised passwords using the following command: $ sudo grep pam_pwquality /etc/pam.d/system-auth or $ sudo grep pam_pwquality /etc/pam.d/password-auth password requisite pam_pwquality.so local_users_only If the parameter "pam_pwquality" is not set and required in at least one of the pam stacks, this is a finding.

Fix: F-87230r1201596_fix

Configure TOSS 5 to verify when users create or update passwords, the passwords are not found on a list of commonly-used, expected, or compromised passwords by adding the following to the /etc/pam.d/password-auth and /etc/pam.d/system-auth files: password requisite pam_pwquality.so local_users_only

b
TOSS 5 must accept only external credentials that are NIST compliant.
Medium - CCI-004083 - V-282768 - SV-282768r1201307_rule
RMF Control
Severity
M
CCI
CCI-004083
Version
TOSS-05-000027
Vuln IDs
  • V-282768
Rule IDs
  • SV-282768r1201307_rule
Acceptance of only NIST-compliant external authenticators applies to organizational systems that are accessible to the public (e.g., public-facing websites). External authenticators are issued by nonfederal government entities and are compliant with [SP 800-63B]. Approved external authenticators meet or exceed the minimum federal governmentwide technical, security, privacy, and organizational maturity requirements. Meeting or exceeding federal requirements allows federal government relying parties to trust external authenticators in connection with an authentication transaction at a specified authenticator assurance level.
Checks: C-87329r1201305_chk

Sites must document external authenticators being used and that they are NIST compliant. The following command will verify that Kerberos is functional and produce the list of signing hosts: $ sudo klist -ekt /etc/krb5.keytab If external authenticators are being use that are not documented and are not NIST compliant, this is a finding.

Fix: F-87234r1201306_fix

Document all NIST-compliant external authenticators in use.

b
TOSS 5 must include only approved trust anchors in trust stores or certificate stores managed by the organization.
Medium - CCI-004909 - V-282770 - SV-282770r1201607_rule
RMF Control
Severity
M
CCI
CCI-004909
Version
TOSS-05-000080
Vuln IDs
  • V-282770
Rule IDs
  • SV-282770r1201607_rule
Public key infrastructure (PKI) certificates are certificates with visibility external to organizational systems and certificates related to the internal operations of systems, such as application-specific time services. In cryptographic systems with a hierarchical structure, a trust anchor is an authoritative source (i.e., a certificate authority) for which trust is assumed and not derived. A root certificate for a PKI system is an example of a trust anchor. A trust store or certificate store maintains a list of trusted root certificates.
Checks: C-87331r1201606_chk

Verify TOSS 5 only uses trusted certificates using the following command: $ sudo trust list --filter=blocklist type: certificate label: Explicitly Distrust DigiNotar Root CA trust: distrusted category: authority If the "label" field is not configured with "Explicitly Distrust DigiNotar Root CA", if any other labels are present, the line is commented out, or the line is missing, this is a finding.

Fix: F-87236r1201289_fix

Configure TOSS 5 to include only approved trust anchors in trust stores or certificate stores by adding certificates using the following command: $ sudo cp /path/to/new-ca-cert.pem /etc/pki/ca-trust/source/anchors/ $ sudo /bin/update-ca-trust

b
TOSS 5 must provide protected storage for cryptographic keys with organization-defined safeguards and/or hardware protected key store.
Medium - CCI-004910 - V-282771 - SV-282771r1201293_rule
RMF Control
Severity
M
CCI
CCI-004910
Version
TOSS-05-000081
Vuln IDs
  • V-282771
Rule IDs
  • SV-282771r1201293_rule
A Trusted Platform Module (TPM) is an example of a hardware-protected data store that can be used to protect cryptographic keys.
Checks: C-87332r1201291_chk

Verify TOSS 5 is using the TPM 2.0 hardware with the following command (if TPM 2.0 hardware is available): $sudo tpm2_pcrread &lt;multiple SHA keys&gt; If the command returns a status of "ERROR", and TPM 2.0 hardware is available, this is a finding.

Fix: F-87237r1201292_fix

Configure TOSS 5 to provide protected storage for cryptographic keys by enabling TPM hardware, if available.

b
TOSS 5 must securely compare internal information system clocks at least every 24 hours.
Medium - CCI-004922 - V-282772 - SV-282772r1201296_rule
RMF Control
Severity
M
CCI
CCI-004922
Version
TOSS-05-000082
Vuln IDs
  • V-282772
Rule IDs
  • SV-282772r1201296_rule
Inaccurate time stamps make it more difficult to correlate events and can lead to an inaccurate analysis. Determining the correct time a particular event occurred on a system is critical when conducting forensic analysis and investigating system events. Sources outside the configured acceptable allowance (drift) may be inaccurate. Synchronizing internal information system clocks provides uniformity of time stamps for information systems with multiple system clocks and systems connected over a network. Depending on the infrastructure being used the "pool" directive may not be supported. Authoritative time sources include the United States Naval Observatory (USNO) time servers, a time server designated for the appropriate DOD network (NIPRNet/SIPRNet), and/or the Global Positioning System (GPS).
Checks: C-87333r1201294_chk

Verify TOSS 5 is securely comparing internal information system clocks at least every 24 hours with an NTP server with the following commands: $ sudo grep maxpoll /etc/chrony.conf server 0.us.pool.ntp.mil iburst maxpoll 16 If the "maxpoll" option is set to a number greater than 16 or the line is commented out, this is a finding. Verify the "chrony.conf" file is configured to an authoritative DOD or other U.S. Government time source using the following command: $ sudo grep -i server /etc/chrony.conf server 0.us.pool.ntp.mil If the parameter "server" is not set or is not set to an authoritative DOD or other U.S. Government time source, this is a finding.

Fix: F-87238r1201295_fix

Configure TOSS 5 to securely compare internal information system clocks at least every 24 hours with an appropriate NTP server by adding/modifying the following line in the "/etc/chrony.conf file": server [ntp.server.name] iburst maxpoll 16