Tri-Lab Operating System Stack (TOSS) 5 Security Technical Implementation Guide
Pick two releases to diff their requirements.
Open a previous version of this STIG.
- RMF Control
- AC-2
- Severity
- M
- CCI
- CCI-000016
- Version
- TOSS-05-000297
- Vuln IDs
-
- V-282352
- Rule IDs
-
- SV-282352r1200036_rule
Checks: C-86913r1200034_chk
Verify temporary accounts have been provisioned with an expiration date of 72 hours. For every existing temporary account, run the following command to obtain its account expiration information: $ sudo chage -l <temporary_account_name> | grep -i "account expires" Verify each of these accounts has an expiration date set within 72 hours. If any temporary accounts have no expiration date or do not expire within 72 hours, this is a finding.
Fix: F-86818r1200035_fix
Configure the operating system to expire temporary accounts after 72 hours using the following command: $ sudo chage -E $(date -d +3days +%Y-%m-%d) <temporary_account_name>
- RMF Control
- AC-2
- Severity
- M
- CCI
- CCI-000018
- Version
- TOSS-05-000452
- Vuln IDs
-
- V-282353
- Rule IDs
-
- SV-282353r1200039_rule
Checks: C-86914r1200037_chk
Verify TOSS 5 generates audit records for all account creations, modifications, disabling, and termination events that affect "/etc/sudoers" using the following command: $ sudo auditctl -l | grep /etc/sudoers -w /etc/sudoers -p wa -k identity If the command does not return a line or the line is commented out, this is a finding.
Fix: F-86819r1200038_fix
Configure TOSS 5 to generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/sudoers". Add or update the following file system rule to "/etc/audit/rules.d/audit.rules": -w /etc/sudoers -p wa -k identity Restart the audit daemon for the changes to take effect.
- RMF Control
- AC-2
- Severity
- M
- CCI
- CCI-000018
- Version
- TOSS-05-000453
- Vuln IDs
-
- V-282354
- Rule IDs
-
- SV-282354r1201500_rule
Checks: C-86915r1200040_chk
Verify TOSS 5 generates audit records for all account creations, modifications, disabling, and termination events that affect "/etc/sudoers.d/" using the following command: $ sudo auditctl -l | grep /etc/sudoers.d -w /etc/sudoers.d/ -p wa -k identity If the command does not return a line or the line is commented out, this is a finding.
Fix: F-86820r1200041_fix
Configure TOSS 5 to generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/sudoers.d/". Add or update the following file system rule to "/etc/audit/rules.d/audit.rules": -w /etc/sudoers.d/ -p wa -k identity Restart the audit daemon for the changes to take effect.
- RMF Control
- AC-2
- Severity
- M
- CCI
- CCI-000018
- Version
- TOSS-05-000454
- Vuln IDs
-
- V-282355
- Rule IDs
-
- SV-282355r1200045_rule
Checks: C-86916r1200043_chk
Verify TOSS 5 generates audit records for all account creations, modifications, disabling, and termination events that affect "/etc/group" using the following command: $ sudo auditctl -l | egrep '(/etc/group)' -w /etc/group -p wa -k identity If the command does not return a line or the line is commented out, this is a finding.
Fix: F-86821r1200044_fix
Configure TOSS 5 to generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/group". Add or update the following file system rule to "/etc/audit/rules.d/audit.rules": -w /etc/group -p wa -k identity Restart the audit daemon for the changes to take effect.
- RMF Control
- AC-2
- Severity
- M
- CCI
- CCI-000018
- Version
- TOSS-05-000455
- Vuln IDs
-
- V-282356
- Rule IDs
-
- SV-282356r1200048_rule
Checks: C-86917r1200046_chk
Verify TOSS 5 generates audit records for all account creations, modifications, disabling, and termination events that affect "/etc/gshadow" using the following command: $ sudo auditctl -l | egrep '(/etc/gshadow)' -w /etc/gshadow -p wa -k identity If the command does not return a line or the line is commented out, this is a finding.
Fix: F-86822r1200047_fix
Configure TOSS 5 to generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/gshadow". Add or update the following file system rule to "/etc/audit/rules.d/audit.rules": -w /etc/gshadow -p wa -k identity Restart the audit daemon for the changes to take effect.
- RMF Control
- AC-2
- Severity
- M
- CCI
- CCI-000018
- Version
- TOSS-05-000456
- Vuln IDs
-
- V-282357
- Rule IDs
-
- SV-282357r1200051_rule
Checks: C-86918r1200049_chk
Verify TOSS 5 generates audit records for all account creations, modifications, disabling, and termination events that affect "/etc/security/opasswd" using the following command: $ sudo auditctl -l | egrep '(/etc/security/opasswd)' -w /etc/security/opasswd -p wa -k identity If the command does not return a line or the line is commented out, this is a finding.
Fix: F-86823r1200050_fix
Configure TOSS 5 to generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/security/opasswd". Add or update the following file system rule to "/etc/audit/rules.d/audit.rules": -w /etc/security/opasswd -p wa -k identity Restart the audit daemon for the changes to take effect.
- RMF Control
- AC-2
- Severity
- M
- CCI
- CCI-000018
- Version
- TOSS-05-000457
- Vuln IDs
-
- V-282358
- Rule IDs
-
- SV-282358r1200054_rule
Checks: C-86919r1200052_chk
Verify TOSS 5 generates audit records for all account creations, modifications, disabling, and termination events that affect "/etc/passwd" using the following command: $ sudo auditctl -l | egrep '(/etc/passwd)' -w /etc/passwd -p wa -k identity If the command does not return a line or the line is commented out, this is a finding.
Fix: F-86824r1200053_fix
Configure TOSS 5 to generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/passwd". Add or update the following file system rule to "/etc/audit/rules.d/audit.rules": -w /etc/passwd -p wa -k identity Restart the audit daemon for the changes to take effect.
- RMF Control
- AC-2
- Severity
- M
- CCI
- CCI-000018
- Version
- TOSS-05-000458
- Vuln IDs
-
- V-282359
- Rule IDs
-
- SV-282359r1200057_rule
Checks: C-86920r1200055_chk
Verify TOSS 5 generates audit records for all account creations, modifications, disabling, and termination events that affect "/etc/passwd using the following command: $ sudo auditctl -l | egrep '(/etc/shadow)' -w /etc/shadow -p wa -k identity If the command does not return a line or the line is commented out, this is a finding.
Fix: F-86825r1200056_fix
Configure TOSS 5 to generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/shadow". Add or update the following file system rule to "/etc/audit/rules.d/audit.rules": -w /etc/shadow -p wa -k identity Restart the audit daemon for the changes to take effect.
- RMF Control
- AC-7
- Severity
- M
- CCI
- CCI-000044
- Version
- TOSS-05-000304
- Vuln IDs
-
- V-282360
- Rule IDs
-
- SV-282360r1200060_rule
Checks: C-86921r1200058_chk
Verify TOSS 5 is configured to lock an account after three unsuccessful login attempts using the command: $ grep 'deny =' /etc/security/faillock.conf deny = 3 If the "deny" option is not set to "3" or less (but not "0"), is missing or commented out, this is a finding.
Fix: F-86826r1200059_fix
Configure TOSS 5 to lock an account when three unsuccessful login attempts occur. Add or modify the "/etc/security/faillock.conf" file to match the following line: deny = 3
- RMF Control
- AC-7
- Severity
- M
- CCI
- CCI-000044
- Version
- TOSS-05-000305
- Vuln IDs
-
- V-282361
- Rule IDs
-
- SV-282361r1200063_rule
Checks: C-86922r1200061_chk
Note: If the system administrator (SA) demonstrates the use of an approved centralized account management method that locks an account after three unsuccessful login attempts within a period of 15 minutes, this requirement is not applicable. Verify TOSS 5 locks an account after three unsuccessful login attempts within a period of 15 minutes using the following command: $ grep fail_interval /etc/security/faillock.conf fail_interval = 900 If the "fail_interval" option is not set to "900" or less (but not "0"), the line is commented out, or the line is missing, this is a finding.
Fix: F-86827r1200062_fix
Configure TOSS 5 to lock out the "root" account after a number of incorrect login attempts within 15 minutes. Enable "pam_faillock.so" using the following command: $ authselect enable-feature with-faillock Edit the "/etc/security/faillock.conf" file as follows: fail_interval = 900
- RMF Control
- AC-7
- Severity
- M
- CCI
- CCI-000044
- Version
- TOSS-05-000308
- Vuln IDs
-
- V-282362
- Rule IDs
-
- SV-282362r1200066_rule
Checks: C-86923r1200064_chk
Verify the "/etc/security/faillock.conf" file is configured use a nondefault faillock directory to ensure contents persist after reboot using the following command: $ grep 'dir =' /etc/security/faillock.conf dir = /var/log/faillock If the "dir" option is not set to a nondefault documented tally log directory, is missing or commented out, this is a finding.
Fix: F-86828r1200065_fix
Configure TOSS 5 to maintain the contents of the faillock directory after a reboot. Add or modify the "/etc/security/faillock.conf" file to match the following line: dir = /var/log/faillock
- RMF Control
- AC-7
- Severity
- M
- CCI
- CCI-000044
- Version
- TOSS-05-000314
- Vuln IDs
-
- V-282363
- Rule IDs
-
- SV-282363r1200069_rule
Checks: C-86924r1200067_chk
Verify the "/etc/security/faillock.conf" file is configured to log username information when unsuccessful login attempts occur using the following command: $ grep audit /etc/security/faillock.conf audit If the "audit" option is not set, is missing, or is commented out, this is a finding.
Fix: F-86829r1200068_fix
Configure TOSS 5 to log username information when unsuccessful login attempts occur. Add or modify the "/etc/security/faillock.conf" file to match the following line: audit
- RMF Control
- AC-7
- Severity
- M
- CCI
- CCI-000044
- Version
- TOSS-05-000332
- Vuln IDs
-
- V-282364
- Rule IDs
-
- SV-282364r1200072_rule
Checks: C-86925r1200070_chk
Verify the "pam_faillock.so" module is present in the "/etc/pam.d/system-auth" file: $ grep pam_faillock.so /etc/pam.d/system-auth auth required pam_faillock.so preauth auth required pam_faillock.so authfail account required pam_faillock.so If the "pam_faillock.so" module is not present in the "/etc/pam.d/system-auth" file with the "preauth" line listed before "pam_unix.so", this is a finding.
Fix: F-86830r1200071_fix
Configure TOSS 5 to include the use of the "pam_faillock.so" module in the /etc/pam.d/system-auth file. Add/modify the appropriate sections of the "/etc/pam.d/system-auth" file to match the following lines: Note: The "preauth" line must be listed before "pam_unix.so". auth required pam_faillock.so preauth auth required pam_faillock.so authfail account required pam_faillock.so
- RMF Control
- AC-7
- Severity
- M
- CCI
- CCI-000044
- Version
- TOSS-05-000333
- Vuln IDs
-
- V-282365
- Rule IDs
-
- SV-282365r1200075_rule
Checks: C-86926r1200073_chk
Verify the "pam_faillock.so" module is present in the "/etc/pam.d/password-auth" file: $ grep pam_faillock.so /etc/pam.d/password-auth auth required pam_faillock.so preauth auth required pam_faillock.so authfail account required pam_faillock.so If the "pam_faillock.so" module is not present in the "/etc/pam.d/password-auth" file with the "preauth" line listed before pam_unix.so, this is a finding.
Fix: F-86831r1200074_fix
Configure TOSS 5 to include the use of the "pam_faillock.so" module in the "/etc/pam.d/password-auth" file. Add/modify the appropriate sections of the "/etc/pam.d/password-auth" file to match the following lines: Note: The "preauth" line must be listed before pam_unix.so. auth required pam_faillock.so preauth auth required pam_faillock.so authfail account required pam_faillock.so
- RMF Control
- AC-8
- Severity
- M
- CCI
- CCI-000048
- Version
- TOSS-05-000086
- Vuln IDs
-
- V-282366
- Rule IDs
-
- SV-282366r1200078_rule
Checks: C-86927r1200076_chk
For nodes of the cluster that are only privately (within the cluster) accessible, this requirement is not applicable. Verify TOSS 5 displays the Standard Mandatory DOD or other applicable U.S. Government Notice and Consent Banner before granting access to the operating system via a command line user login. Check that a banner is displayed at the command line login screen using the following command: $ sudo cat /etc/issue If the banner is set correctly, it will return the following text: "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." If the banner text does not match the Standard Mandatory DOD or other applicable U.S. Government Notice and Consent Banner exactly, or the line is commented out, this is a finding.
Fix: F-86832r1200077_fix
Configure TOSS 5 to display the Standard Mandatory DOD or other applicable U.S. Government Notice and Consent Banner before granting access to the system via command line login. Edit the "/etc/issue" file to replace the default text with the Standard Mandatory DOD or other applicable U.S. Government Notice and Consent Banner. The DOD-required text is: "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests -- not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details."
- RMF Control
- AC-8
- Severity
- M
- CCI
- CCI-000048
- Version
- TOSS-05-000236
- Vuln IDs
-
- V-282367
- Rule IDs
-
- SV-282367r1201610_rule
Checks: C-86928r1200079_chk
Verify any SSH connection to the operating system displays the Standard Mandatory DOD or other applicable U.S. Government agency Notice and Consent Banner before granting access to the system. For nodes of the cluster that are only privately (within the cluster) accessible, this requirement is not applicable. Check for the location of the banner file being used using the following command: $ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH '^\s*banner' banner /etc/issue This command will return the banner keyword and the name of the file that contains the SSH banner (in this case "/etc/issue"). If the line is commented out, this is a finding.
Fix: F-86833r1201609_fix
Configure TOSS 5 to display the Standard Mandatory DOD or other applicable U.S. Government agency Notice and Consent Banner before granting access to the system via SSH. Edit the "/etc/ssh/sshd_config" file to uncomment the banner keyword and configure it to point to a file that contains the login banner (this file may be named differently or be in a different location if using a version of SSH that is provided by a third-party vendor). An example configuration line is: Banner /etc/issue
- RMF Control
- AC-8
- Severity
- M
- CCI
- CCI-000048
- Version
- TOSS-05-000262
- Vuln IDs
-
- V-282368
- Rule IDs
-
- SV-282368r1200084_rule
Checks: C-86929r1200082_chk
Verify TOSS 5 displays a banner before granting access to the operating system via a graphical user login. Note: This requirement assumes the use of the TOSS 5 default graphical user interface—the GNOME desktop environment. If the system does not have a graphical user interface installed, this requirement is not applicable. Determine if the operating system displays a banner at the login screen using the following command: $ sudo grep banner-message-enable /etc/dconf/db/local.d/* banner-message-enable=true If "banner-message-enable" is set to "false", is commented out, or is missing, this is a finding.
Fix: F-86834r1200083_fix
Configure TOSS 5 to display the Standard Mandatory DOD or other applicable U.S. Government agency Notice and Consent Banner before granting access to the system via a graphical user login. Create a database to contain the systemwide graphical user login settings (if it does not already exist) using the following command: $ sudo touch /etc/dconf/db/local.d/01-banner-message Add the following lines to the [org/gnome/login-screen] section of the "/etc/dconf/db/local.d/01-banner-message": [org/gnome/login-screen] banner-message-enable=true Run the following command to update the database: $ sudo dconf update
- RMF Control
- AC-8
- Severity
- M
- CCI
- CCI-000048
- Version
- TOSS-05-000263
- Vuln IDs
-
- V-282369
- Rule IDs
-
- SV-282369r1200087_rule
Checks: C-86930r1200085_chk
Verify TOSS 5 prevents a user from overriding settings for graphical user interfaces. Note: This requirement assumes the use of the TOSS 5 default graphical user interface—the GNOME desktop environment. If the system does not have a graphical user interface installed, this requirement is not applicable. Determine which profile the system database is using by running the following command: $ sudo grep system-db /etc/dconf/profile/user system-db:local Verify the graphical settings are locked from nonprivileged user modification using the following command: Note: The example below is using the database "local" for the system, so the path is "/etc/dconf/db/local.d". This path must be modified if a database other than "local" is being used. $ sudo grep banner-message-enable /etc/dconf/db/local.d/* /org/gnome/login-screen/banner-message-enable If the output is not "/org/gnome/login-screen/banner-message-enable", the line is commented out, or the line is missing, this is a finding.
Fix: F-86835r1200086_fix
Configure TOSS 5 to prevent a user from overriding the banner setting for graphical user interfaces. Create a database to contain the systemwide graphical user login settings (if it does not already exist) using the following command: $ sudo touch /etc/dconf/db/local.d/locks/session Add the following setting to prevent nonprivileged users from modifying it: banner-message-enable Update the database with the following command: $ sudo dconf update
- RMF Control
- AC-10
- Severity
- L
- CCI
- CCI-000054
- Version
- TOSS-05-000313
- Vuln IDs
-
- V-282371
- Rule IDs
-
- SV-282371r1200093_rule
Checks: C-86932r1200091_chk
Verify TOSS limits the number of concurrent sessions to 256 or less for all accounts and/or account types using the following command: $ sudo grep -r -s '^[^#].*maxlogins' /etc/security/limits.conf /etc/security/limits.d/*.conf * hard maxlogins 256 This can be set as a global domain (with the * wildcard) but may be set differently for multiple domains. If the "maxlogins" item is missing, commented out, or the value is set greater than "256" and is not documented with the information system security officer (ISSO) as an operational requirement for all domains that have the "maxlogins" item assigned, this is a finding.
Fix: F-86837r1200092_fix
Configure TOSS to limit the number of concurrent sessions to 256 or less for all accounts and/or account types. Add the following line to the top of the "/etc/security/limits.conf" or in a ."conf" file defined in "/etc/security/limits.d/": * hard maxlogins 256
- RMF Control
- AC-11
- Severity
- M
- CCI
- CCI-000056
- Version
- TOSS-05-000269
- Vuln IDs
-
- V-282372
- Rule IDs
-
- SV-282372r1201380_rule
Checks: C-86933r1200094_chk
Verify TOSS 5 enables a user's session lock until that user reestablishes access using established identification and authentication procedures using the following command: Note: This requirement assumes the use of the TOSS 5 default graphical user interface—the GNOME desktop environment. If the system does not have a graphical user interface installed, this requirement is not applicable. $ grep -R removal-action /etc/dconf/db/* /etc/dconf/db/distro.d/20-authselect:removal-action='lock-screen' If the "removal-action='lock-screen'" setting is missing or commented out from the dconf database files, and is not documented with the information system security officer (ISSO) as an operational requirement, this is a finding.
Fix: F-86838r1200095_fix
Configure TOSS 5 to enable a user's session lock until that user reestablishes access using established identification and authentication procedures. Select or create an authselect profile and incorporate the "with-smartcard-lock-on-removal" feature with the following example: $ sudo authselect select sssd with-smartcard with-smartcard-lock-on-removal Alternatively, edit the dconf settings in the /etc/dconf/db/* location. Add or update the [org/gnome/settings-daemon/peripherals/smartcard] section of the /etc/dconf/db/local.d/00-security-settings" database file and add or update the following lines: [org/gnome/settings-daemon/peripherals/smartcard] removal-action='lock-screen' Update the dconf system databases: $ sudo dconf update
- RMF Control
- AC-11
- Severity
- M
- CCI
- CCI-000056
- Version
- TOSS-05-000270
- Vuln IDs
-
- V-282373
- Rule IDs
-
- SV-282373r1200099_rule
Checks: C-86934r1200097_chk
Verify TOSS 5 disables the user's ability to override the smart card removal action setting. Note: This requirement assumes the use of the TOSS 5 default graphical user interface—the GNOME desktop environment. If the system does not have a graphical user interface installed, this requirement is not applicable. Determine which profile the system database is using by running the following command: $ sudo grep system-db /etc/dconf/profile/user system-db:local Verify the removal action setting is locked from nonprivileged user modification using the following command: Note: The example below is using the database "local" for the system, so the path is "/etc/dconf/db/local.d". This path must be modified if a database other than "local" is being used. $ grep 'removal-action' /etc/dconf/db/local.d/locks/* /org/gnome/settings-daemon/peripherals/smartcard/removal-action If the command does not return at least the example result, this is a finding.
Fix: F-86839r1200098_fix
Add the following line to "/etc/dconf/db/local.d/locks/00-security-settings-lock" to prevent user override of the smart card removal action: /org/gnome/settings-daemon/peripherals/smartcard/removal-action Update the dconf system databases: $ sudo dconf update
- RMF Control
- AC-11
- Severity
- M
- CCI
- CCI-000056
- Version
- TOSS-05-000271
- Vuln IDs
-
- V-282374
- Rule IDs
-
- SV-282374r1201498_rule
Checks: C-86935r1200100_chk
Verify TOSS 5 enables a user's session lock until that user reestablishes access using established identification and authentication procedures using the following command: Note: This requirement assumes the use of the TOSS 5 default graphical user interface—the GNOME desktop environment. If the system does not have a graphical user interface installed, this requirement is not applicable. $ gsettings get org.gnome.desktop.screensaver lock-enabled true If the setting is "false", this is a finding.
Fix: F-86840r1201498_fix
Configure TOSS 5 to enable a user's session lock until that user reestablishes access using established identification and authentication procedures. Create a database to contain the systemwide screensaver settings (if it does not already exist) with the following example: $ sudo vi /etc/dconf/db/local.d/00-screensaver Edit the "[org/gnome/desktop/screensaver]" section of the database file and add or update the following lines: # Set this to true to lock the screen when the screensaver activates lock-enabled=true Update the system databases: $ sudo dconf update
- RMF Control
- AC-11
- Severity
- M
- CCI
- CCI-000056
- Version
- TOSS-05-000272
- Vuln IDs
-
- V-282375
- Rule IDs
-
- SV-282375r1200105_rule
Checks: C-86936r1200103_chk
Verify TOSS 5 prevents a user from overriding settings for graphical user interfaces. Note: This requirement assumes the use of the TOSS 5 default graphical user interface—Gnome Shell. If the system does not have a graphical user interface installed, this requirement is not applicable. Determine which profile the system database is using by running the following command: $ sudo grep system-db /etc/dconf/profile/user system-db:local Check that graphical settings are locked from nonprivileged user modification using the following command: Note: The example below is using the database "local" for the system, so the path is "/etc/dconf/db/local.d". This path must be modified if a database other than "local" is being used. $ sudo grep -i lock-enabled /etc/dconf/db/local.d/locks/* /org/gnome/desktop/screensaver/lock-enabled If the command does not return at least the example result, this is a finding.
Fix: F-86841r1200104_fix
Configure TOSS 5 to prevent a user from overriding settings for graphical user interfaces. Create a database to contain the systemwide screensaver settings (if it does not already exist) using the following command: Note: The example below is using the database "local" for the system, so if the system is using another database in "/etc/dconf/profile/user", the file should be created under the appropriate subdirectory. $ sudo touch /etc/dconf/db/local.d/locks/session Add the following setting to prevent nonprivileged users from modifying it: /org/gnome/desktop/screensaver/lock-enabled
- RMF Control
- AC-11
- Severity
- M
- CCI
- CCI-000056
- Version
- TOSS-05-000311
- Vuln IDs
-
- V-282376
- Rule IDs
-
- SV-282376r1200108_rule
Checks: C-86937r1200106_chk
Verify TOSS 5 has the "tmux" package installed using the following command: $ sudo dnf list --installed tmux Example output: tmux.x86_64 3.2a-4.el9 If the "tmux" package is not installed, this is a finding.
Fix: F-86842r1200107_fix
Install the "tmux" package using the following command: $ sudo dnf install tmux
- RMF Control
- AC-11
- Severity
- M
- CCI
- CCI-000057
- Version
- TOSS-05-000273
- Vuln IDs
-
- V-282377
- Rule IDs
-
- SV-282377r1200111_rule
Checks: C-86938r1200109_chk
Verify TOSS 5 initiates a session lock after at most a 10-minute period of inactivity for graphical user interfaces with the following commands: Note: This requirement assumes the use of the TOSS default graphical user interface—Gnome Shell. If the system does not have a graphical user interface installed, this requirement is not applicable. $ sudo gsettings get org.gnome.desktop.session idle-delay uint32 600 If "idle-delay" is set to "0" or a value greater than "600", this is a finding.
Fix: F-86843r1200110_fix
Configure the operating system to initiate a screensaver after a 10-minute period of inactivity for graphical user interfaces. Create a database to contain the systemwide screensaver settings (if it does not already exist) using the following command: $ sudo touch /etc/dconf/db/local.d/00-screensaver Edit "/etc/dconf/db/local.d/00-screensaver" and add or update the following lines: [org/gnome/desktop/session] # Set the lock time out to 600 seconds before the session is considered idle idle-delay=uint32 600 Update the system databases: $ sudo dconf update
- RMF Control
- AC-11
- Severity
- M
- CCI
- CCI-000057
- Version
- TOSS-05-000274
- Vuln IDs
-
- V-282378
- Rule IDs
-
- SV-282378r1200114_rule
Checks: C-86939r1200112_chk
Verify TOSS 5 prevents a user from overriding settings for graphical user interfaces. Note: This requirement assumes the use of the TOSS 5 default graphical user interface—the GNOME desktop environment. If the system does not have a graphical user interface installed, this requirement is not applicable. Determine which profile the system database is using by running the following command: $ sudo grep system-db /etc/dconf/profile/user system-db:local Verify the graphical settings are locked from nonprivileged user modification using the following command: Note: The example below is using the database "local" for the system, so the path is "/etc/dconf/db/local.d". This path must be modified if a database other than "local" is being used. $ sudo grep -i idle /etc/dconf/db/local.d/locks/* /org/gnome/desktop/session/idle-delay If the command does not return at least the example result, this is a finding.
Fix: F-86844r1200113_fix
Configure TOSS 5 to prevent a user from overriding settings for graphical user interfaces. Create a database to contain the systemwide screensaver settings (if it does not already exist) using the following command: Note: The example below is using the database "local" for the system, so if the system is using another database in "/etc/dconf/profile/user", the file should be created under the appropriate subdirectory. $ sudo touch /etc/dconf/db/local.d/locks/session Add the following setting to prevent nonprivileged users from modifying it: /org/gnome/desktop/session/idle-delay
- RMF Control
- AC-11
- Severity
- M
- CCI
- CCI-000057
- Version
- TOSS-05-000275
- Vuln IDs
-
- V-282379
- Rule IDs
-
- SV-282379r1200117_rule
Checks: C-86940r1200115_chk
Verify TOSS 5 initiates a session lock for graphical user interfaces when the screensaver is activated using the following command: Note: This requirement assumes the use of the TOSS 5 default graphical user interface—the GNOME desktop environment. If the system does not have a graphical user interface installed, this requirement is not applicable. $ gsettings get org.gnome.desktop.screensaver lock-delay uint32 5 If the "uint32" setting is not "5" or less or is missing, this is a finding.
Fix: F-86845r1200116_fix
Configure TOSS 5 to initiate a session lock for graphical user interfaces when a screensaver is activated. Create a database to contain the systemwide screensaver settings (if it does not already exist) using the following command: Note: The example below is using the database "local" for the system, so if the system is using another database in "/etc/dconf/profile/user", the file should be created under the appropriate subdirectory. $ sudo touch /etc/dconf/db/local.d/00-screensaver [org/gnome/desktop/screensaver] lock-delay=uint32 5 The "uint32" must be included along with the integer key values as shown. Update the system databases: $ sudo dconf update
- RMF Control
- AC-11
- Severity
- M
- CCI
- CCI-000057
- Version
- TOSS-05-000276
- Vuln IDs
-
- V-282380
- Rule IDs
-
- SV-282380r1200120_rule
Checks: C-86941r1200118_chk
Verify TOSS 5 prevents a user from overriding settings for graphical user interfaces. Note: This requirement assumes the use of the TOSS 5 default graphical user interface—the GNOME desktop environment. If the system does not have a graphical user interface installed, this requirement is not applicable. Determine which profile the system database is using by running the following command: $ sudo grep system-db /etc/dconf/profile/user system-db:local Check that graphical settings are locked from nonprivileged user modification using the following command: Note: The example below is using the database "local" for the system, so the path is "/etc/dconf/db/local.d". This path must be modified if a database other than "local" is being used. $ sudo grep -i lock-delay /etc/dconf/db/local.d/locks/* /org/gnome/desktop/screensaver/lock-delay If the command does not return at least the example result, this is a finding.
Fix: F-86846r1200119_fix
Configure TOSS 5 to prevent a user from overriding settings for graphical user interfaces. Create a database to contain the systemwide screensaver settings (if it does not already exist) using the following command: Note: The example below is using the database "local" for the system, so if the system is using another database in "/etc/dconf/profile/user", the file should be created under the appropriate subdirectory. $ sudo touch /etc/dconf/db/local.d/locks/session Add the following setting to prevent nonprivileged users from modifying it: /org/gnome/desktop/screensaver/lock-delay
- RMF Control
- AC-11
- Severity
- M
- CCI
- CCI-000057
- Version
- TOSS-05-000312
- Vuln IDs
-
- V-282381
- Rule IDs
-
- SV-282381r1200123_rule
Checks: C-86942r1200121_chk
Verify TOSS 5 is configured to exit interactive command shell user sessions after 15 minutes of inactivity or less using the following command: $ sudo grep -i tmout /etc/profile /etc/profile.d/*.sh /etc/profile.d/tmout.sh:declare -xr TMOUT=900 If "TMOUT" is not set to "900" or less in a script located in the "/etc/'profile.d/" directory, is missing or is commented out, this is a finding.
Fix: F-86847r1200122_fix
Configure TOSS 5 to exit interactive command shell user sessions after 15 minutes of inactivity. Add or edit the following line in "/etc/profile.d/tmout.sh": #!/bin/bash declare -xr TMOUT=900
- RMF Control
- AC-11
- Severity
- M
- CCI
- CCI-000060
- Version
- TOSS-05-000277
- Vuln IDs
-
- V-282382
- Rule IDs
-
- SV-282382r1200126_rule
Checks: C-86943r1200124_chk
To ensure the screensaver is configured to be blank, run the following command: Note: This requirement assumes the use of the TOSS 5 default graphical user interface—the GNOME desktop environment. If the system does not have a graphical user interface installed, this requirement is not applicable. $ gsettings get org.gnome.desktop.screensaver picture-uri If properly configured, the output should be "''". To ensure that users cannot set the screensaver background, run the following: $ grep picture-uri /etc/dconf/db/local.d/locks/* If properly configured, the output should be "/org/gnome/desktop/screensaver/picture-uri". If it is not set or configured properly, this is a finding.
Fix: F-86848r1200125_fix
Edit the "dconf" settings in the /etc/dconf/db/* location. First, add or update the [org/gnome/desktop/screensaver] section of the "/etc/dconf/db/local.d/00-security-settings" database file and add or update the following lines: [org/gnome/desktop/screensaver] picture-uri='' Add the following line to "/etc/dconf/db/local.d/locks/00-security-settings-lock" to prevent user modification: /org/gnome/desktop/screensaver/picture-uri Update the dconf system databases: $ sudo dconf update
- RMF Control
- AC-17
- Severity
- M
- CCI
- CCI-000067
- Version
- TOSS-05-000237
- Vuln IDs
-
- V-282383
- Rule IDs
-
- SV-282383r1200129_rule
Checks: C-86944r1200127_chk
Verify TOSS 5 logs SSH connection attempts and failures to the server. Verify what the SSH daemon's "LogLevel" option is set to using the following command: $ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH '^\s*loglevel' LogLevel VERBOSE If a value of "VERBOSE" is not returned or the line is commented out or missing, this is a finding.
Fix: F-86849r1200128_fix
Configure TOSS 5 to log connection attempts add or modify the following line in "/etc/ssh/sshd_config": LogLevel VERBOSE Restart the SSH daemon for the settings to take effect: $ sudo systemctl restart sshd.service
- RMF Control
- AC-17
- Severity
- M
- CCI
- CCI-000067
- Version
- TOSS-05-000379
- Vuln IDs
-
- V-282384
- Rule IDs
-
- SV-282384r1200132_rule
Checks: C-86945r1200130_chk
Verify TOSS 5 monitors all remote access methods. Check that remote access methods are being logged using the following command: $ grep -rE '(auth.\*|authpriv.\*|daemon.\*)' /etc/rsyslog.conf /etc/rsyslog.conf:authpriv.* If "auth.*", "authpriv.*" or "daemon.*" are not configured to be logged, this is a finding.
Fix: F-86850r1200131_fix
Add or update the following lines to the "/etc/rsyslog.conf" file: auth.*;authpriv.*;daemon.* /var/log/secure Restart the "rsyslog" service for the changes to take effect using the following command: $ sudo systemctl restart rsyslog.service
- RMF Control
- AC-17
- Severity
- M
- CCI
- CCI-000068
- Version
- TOSS-05-000247
- Vuln IDs
-
- V-282385
- Rule IDs
-
- SV-282385r1200135_rule
Checks: C-86946r1200133_chk
Verify the SSH server is configured to force frequent session key renegotiation using the following command: $ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH '^\s*rekeylimit' RekeyLimit 1G 1h If "RekeyLimit" does not have a maximum data amount and maximum time defined, is missing, or is commented out, this is a finding.
Fix: F-86851r1200134_fix
Configure TOSS 5 to force a frequent session key renegotiation for SSH connections to the server by adding or modifying the following line in the "/etc/ssh/sshd_config" file: RekeyLimit 1G 1h Restart the SSH daemon for the settings to take effect. $ sudo systemctl restart sshd.service
- RMF Control
- AC-17
- Severity
- H
- CCI
- CCI-000068
- Version
- TOSS-05-000466
- Vuln IDs
-
- V-282386
- Rule IDs
-
- SV-282386r1200138_rule
Checks: C-86947r1200136_chk
Verify the IPsec service uses the system crypto policy using the following command: Note: If the IPsec service is not installed, this requirement is not applicable. $ sudo grep include /etc/ipsec.conf /etc/ipsec.d/*.conf /etc/ipsec.conf:include /etc/crypto-policies/back-ends/libreswan.config If the ipsec configuration file does not contain "include /etc/crypto-policies/back-ends/libreswan.config", this is a finding.
Fix: F-86852r1200137_fix
Configure Libreswan to use the system cryptographic policy. Add the following line to "/etc/ipsec.conf": include /etc/crypto-policies/back-ends/libreswan.config
- RMF Control
- AU-3
- Severity
- L
- CCI
- CCI-000130
- Version
- TOSS-05-000097
- Vuln IDs
-
- V-282387
- Rule IDs
-
- SV-282387r1200141_rule
Checks: C-86948r1200139_chk
Verify that GRUB 2 is configured to enable auditing of processes that start prior to the audit daemon with the following command: $ sudo grubby --info=ALL | grep audit args="ro crashkernel=auto resume=/dev/mapper/rhel-swap rd.lvm.lv=rhel/root rd.lvm.lv=rhel/swap rhgb quiet fips=1 audit=1 audit_backlog_limit=8192 pti=on If "audit" is not set to "1" or is missing, this is a finding.
Fix: F-86853r1200140_fix
Enable auditing of processes that start prior to the audit daemon with the following command: $ sudo grubby --update-kernel=ALL --args="audit=1" Add or modify the following line in "/etc/default/grub" to ensure the configuration survives kernel updates: GRUB_CMDLINE_LINUX="audit=1"
- RMF Control
- AU-3
- Severity
- M
- CCI
- CCI-000130
- Version
- TOSS-05-000412
- Vuln IDs
-
- V-282388
- Rule IDs
-
- SV-282388r1201627_rule
Checks: C-86949r1200142_chk
Verify that TOSS 5 is configured to audit the execution of the "chmod", "fchmod", and "fchmodat" system calls with the following command: $ sudo auditctl -l | grep chmod -a always,exit -F arch=b32 -S chmod,fchmod,fchmodat -F auid>=1000 -F auid!=unset -k perm_mod -a always,exit -F arch=b64 -S chmod,fchmod,fchmodat -F auid>=1000 -F auid!=unset -k perm_mod If both the "b32" and "b64" audit rules are not defined for the "chmod", "fchmod", and "fchmodat" system calls, this is a finding.
Fix: F-86854r1201626_fix
Configure TOSS 5 to generate audit records upon successful/unsuccessful attempts to use the "chmod", "fchmod", and "fchmodat" syscalls. Add or update the following rules in "/etc/audit/rules.d/audit.rules": -a always,exit -F arch=b32 -S chmod,fchmod,fchmodat -F auid>=1000 -F auid!=unset -k perm_mod -a always,exit -F arch=b64 -S chmod,fchmod,fchmodat -F auid>=1000 -F auid!=unset -k perm_mod Restart the audit daemon for changes to take effect.
- RMF Control
- AU-3
- Severity
- M
- CCI
- CCI-000130
- Version
- TOSS-05-000413
- Vuln IDs
-
- V-282389
- Rule IDs
-
- SV-282389r1201629_rule
Checks: C-86950r1200145_chk
Verify that TOSS 5 is configured to audit the execution of the "chown", "fchown", "fchownat", and "lchown" system calls with the following command: $ sudo auditctl -l | grep chown -a always,exit -F arch=b32 -S chown,fchown,fchownat,lchown -F auid>=1000 -F auid!=unset -k perm_mod -a always,exit -F arch=b64 -S chown,fchown,fchownat,lchown -F auid>=1000 -F auid!=unset -k perm_mod If both the "b32" and "b64" audit rules are not defined for the "chown", "fchown", "fchownat", and "lchown" system calls, this is a finding.
Fix: F-86855r1201628_fix
Configure TOSS 5 to generate audit records upon successful/unsuccessful attempts to use the "chown", "fchown", "fchownat", and "lchown"" system calls. Add or update the following rules in "/etc/audit/rules.d/audit.rules": -a always,exit -F arch=b32 -S chown,fchown,fchownat,lchown -F auid>=1000 -F auid!=unset -k perm_mod -a always,exit -F arch=b64 -S chown,fchown,fchownat,lchown -F auid>=1000 -F auid!=unset -k perm_mod Restart the audit daemon for changes to take effect.
- RMF Control
- AU-3
- Severity
- M
- CCI
- CCI-000130
- Version
- TOSS-05-000414
- Vuln IDs
-
- V-282390
- Rule IDs
-
- SV-282390r1201503_rule
Checks: C-86951r1200148_chk
Verify that TOSS 5 is configured to audit the execution of the "setxattr", "fsetxattr", "lsetxattr", "removexattr", "fremovexattr", and "lremovexattr" system calls with the following command: $ sudo auditctl -l | grep xattr -a always,exit -F arch=b32 -S setxattr,fsetxattr,lsetxattr,removexattr,fremovexattr,lremovexattr -F auid>=1000 -F auid!=unset -k perm_mod -a always,exit -F arch=b64 -S setxattr,fsetxattr,lsetxattr,removexattr,fremovexattr,lremovexattr -F auid>=1000 -F auid!=unset -k perm_mod -a always,exit -F arch=b32 -S setxattr,fsetxattr,lsetxattr,removexattr,fremovexattr,lremovexattr -F auid=0 -k perm_mod -a always,exit -F arch=b64 -S setxattr,fsetxattr,lsetxattr,removexattr,fremovexattr,lremovexattr -F auid=0 -k perm_mod If both the "b32" and "b64" audit rules are not defined for the "chmod", "fchmod", and "fchmodat" system calls "setxattr", "fsetxattr", "lsetxattr", "removexattr", "fremovexattr", and "lremovexattr" system calls, or any of the lines returned are commented out, this is a finding.
Fix: F-86856r1201502_fix
Configure TOSS 5 to audit the execution of the "setxattr", "fsetxattr", "lsetxattr", "removexattr", "fremovexattr", and "lremovexattr" system calls by adding or updating the following lines to "/etc/audit/rules.d/audit.rules": -a always,exit -F arch=b32 -S setxattr,fsetxattr,lsetxattr,removexattr,fremovexattr,lremovexattr -F auid>=1000 -F auid!=unset -k perm_mod -a always,exit -F arch=b64 -S setxattr,fsetxattr,lsetxattr,removexattr,fremovexattr,lremovexattr -F auid>=1000 -F auid!=unset -k perm_mod -a always,exit -F arch=b32 -S setxattr,fsetxattr,lsetxattr,removexattr,fremovexattr,lremovexattr -F auid=0 -k perm_mod -a always,exit -F arch=b64 -S setxattr,fsetxattr,lsetxattr,removexattr,fremovexattr,lremovexattr -F auid=0 -k perm_mod Restart the audit daemon for changes to take effect.
- RMF Control
- AU-3
- Severity
- M
- CCI
- CCI-000130
- Version
- TOSS-05-000415
- Vuln IDs
-
- V-282391
- Rule IDs
-
- SV-282391r1201505_rule
Checks: C-86952r1200151_chk
Verify that TOSS 5 is configured to audit the execution of the "umount" command with the following command: $ sudo auditctl -l | grep umount -a always,exit -F path=/usr/bin/umount -F perm=x -F auid>=1000 -F auid!=unset -k privileged-mount If the command does not return an audit rule for "umount" or any of the lines returned are commented out, this is a finding.
Fix: F-86857r1201504_fix
Configure TOSS 5 to generate audit records upon successful/unsuccessful attempts to use the "umount" command by adding or updating the following rules in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/bin/umount -F perm=x -F auid>=1000 -F auid!=unset -k privileged-mount Restart the audit daemon for changes to take effect.
- RMF Control
- AU-3
- Severity
- M
- CCI
- CCI-000130
- Version
- TOSS-05-000416
- Vuln IDs
-
- V-282392
- Rule IDs
-
- SV-282392r1201507_rule
Checks: C-86953r1201399_chk
Verify that TOSS 5 is configured to audit the execution of the "chacl" command with the following command: $ sudo auditctl -l | grep chacl -a always,exit -F path=/usr/bin/chacl -F perm=x -F auid>=1000 -F auid!=unset -k perm_mod If the command does not return a line or the line is commented out, this is a finding.
Fix: F-86858r1201506_fix
Configure TOSS 5 to generate audit records upon successful/unsuccessful attempts to use the "chacl" command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/bin/chacl -F perm=x -F auid>=1000 -F auid!=unset -k perm_mod Restart the audit daemon for changes to take effect.
- RMF Control
- AU-3
- Severity
- M
- CCI
- CCI-000130
- Version
- TOSS-05-000417
- Vuln IDs
-
- V-282393
- Rule IDs
-
- SV-282393r1201509_rule
Checks: C-86954r1201402_chk
Verify that TOSS 5 is configured to audit the execution of the "setfacl" command with the following command: $ sudo auditctl -l | grep setfacl -a always,exit -F path=/usr/bin/setfacl -F perm=x -F auid>=1000 -F auid!=unset -k perm_mod If the command does not return a line or the line is commented out, this is a finding.
Fix: F-86859r1201508_fix
Configure TOSS 5 to generate audit records upon successful/unsuccessful attempts to use the "setfacl" command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/bin/setfacl -F perm=x -F auid>=1000 -F auid!=unset -k perm_mod Restart the audit daemon for changes to take effect.
- RMF Control
- AU-3
- Severity
- M
- CCI
- CCI-000130
- Version
- TOSS-05-000418
- Vuln IDs
-
- V-282394
- Rule IDs
-
- SV-282394r1201511_rule
Checks: C-86955r1201405_chk
Verify that TOSS 5 is configured to audit the execution of the "chcon" command with the following command: $ sudo auditctl -l | grep chcon -a always,exit -F path=/usr/bin/chcon -F perm=x -F auid>=1000 -F auid!=unset -k perm_mod If the command does not return a line or the line is commented out, this is a finding.
Fix: F-86860r1201510_fix
Configure TOSS 5 to generate audit records upon successful/unsuccessful attempts to use the "chcon" command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/bin/chcon -F perm=x -F auid>=1000 -F auid!=unset -k perm_mod Restart the audit daemon for changes to take effect.
- RMF Control
- AU-3
- Severity
- M
- CCI
- CCI-000130
- Version
- TOSS-05-000419
- Vuln IDs
-
- V-282395
- Rule IDs
-
- SV-282395r1201513_rule
Checks: C-86956r1201408_chk
Verify that TOSS 5 is configured to audit the execution of the "semanage" command with the following command: $ sudo auditctl -l | grep semanage -a always,exit -F path=/usr/sbin/semanage -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update If the command does not return a line or the line is commented out, this is a finding.
Fix: F-86861r1201512_fix
Configure TOSS 5 to generate audit records upon successful/unsuccessful attempts to use the "semanage" command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/sbin/semanage -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update Restart the audit daemon for changes to take effect.
- RMF Control
- AU-3
- Severity
- M
- CCI
- CCI-000130
- Version
- TOSS-05-000420
- Vuln IDs
-
- V-282396
- Rule IDs
-
- SV-282396r1201515_rule
Checks: C-86957r1201411_chk
Verify that TOSS 5 is configured to audit the execution of the "setfiles" command with the following command: $ sudo auditctl -l | grep setfiles -a always,exit -F path=/usr/sbin/setfiles -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update If the command does not return a line or the line is commented out, this is a finding.
Fix: F-86862r1201514_fix
Configure TOSS 5 to generate audit records upon successful/unsuccessful attempts to use the "setfiles" command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/sbin/setfiles -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update Restart the audit daemon for changes to take effect.
- RMF Control
- AU-3
- Severity
- M
- CCI
- CCI-000130
- Version
- TOSS-05-000421
- Vuln IDs
-
- V-282397
- Rule IDs
-
- SV-282397r1201517_rule
Checks: C-86958r1201414_chk
Verify that TOSS 5 is configured to audit the execution of the "setsebool" command with the following command: $ sudo auditctl -l | grep setsebool -a always,exit -F path=/usr/sbin/setsebool -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged If the command does not return a line or the line is commented out, this is a finding.
Fix: F-86863r1201516_fix
Configure TOSS 5 to generate an audit event for any successful/unsuccessful use of the "setsebool " command by adding or updating the following rules in the "/etc/audit/rules.d/audit.rules" file: -a always,exit -F path=/usr/sbin/setsebool -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged Restart the audit daemon for changes to take effect.
- RMF Control
- AU-3
- Severity
- M
- CCI
- CCI-000130
- Version
- TOSS-05-000422
- Vuln IDs
-
- V-282398
- Rule IDs
-
- SV-282398r1201519_rule
Checks: C-86959r1200172_chk
Verify that TOSS 5 is configured to audit successful/unsuccessful attempts to use the "rename", "unlink", "rmdir", "renameat", and "unlinkat" system calls with the following command: $ sudo auditctl -l | grep 'rename\|unlink\|rmdir' -a always,exit -F arch=b32 -S rename,unlink,rmdir,renameat,unlinkat -F auid>=1000 -F auid!=unset -k delete -a always,exit -F arch=b64 -S rename,unlink,rmdir,renameat,unlinkat -F auid>=1000 -F auid!=unset -k delete If the command does not return an audit rule for "rename", "unlink", "rmdir", "renameat", and "unlinkat" or any of the lines returned are commented out, this is a finding.
Fix: F-86864r1201518_fix
Configure TOSS 5 to generate an audit event for any successful/unsuccessful use of the "rename", "unlink", "rmdir", "renameat", and "unlinkat" system calls by adding or updating the following rules in the "/etc/audit/rules.d/audit.rules" file: -a always,exit -F arch=b32 -S rename,unlink,rmdir,renameat,unlinkat -F auid>=1000 -F auid!=unset -k delete -a always,exit -F arch=b64 -S rename,unlink,rmdir,renameat,unlinkat -F auid>=1000 -F auid!=unset -k delete Restart the audit daemon for changes to take effect.
- RMF Control
- AU-3
- Severity
- M
- CCI
- CCI-000130
- Version
- TOSS-05-000423
- Vuln IDs
-
- V-282399
- Rule IDs
-
- SV-282399r1201521_rule
Checks: C-86960r1200175_chk
Verify that TOSS 5 is configured to audit successful/unsuccessful attempts to use the "truncate", "ftruncate", "creat", "open", "openat", and "open_by_handle_at" system calls with the following command: $ sudo auditctl -l | grep 'open\|truncate\|creat' -a always,exit -F arch=b32 -S truncate,ftruncate,creat,open,openat,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -k perm_access -a always,exit -F arch=b64 -S truncate,ftruncate,creat,open,openat,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -k perm_access -a always,exit -F arch=b32 -S truncate,ftruncate,creat,open,openat,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -k perm_access -a always,exit -F arch=b64 -S truncate,ftruncate,creat,open,openat,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -k perm_access If the output does not produce rules containing "-F exit=-EPERM", this is a finding. If the output does not produce rules containing "-F exit=-EACCES", this is a finding. If the command does not return an audit rule for "truncate", "ftruncate", "creat", "open", "openat", and "open_by_handle_at" or any of the lines returned are commented out, this is a finding.
Fix: F-86865r1201520_fix
Configure TOSS 5 to generate an audit event for any successful/unsuccessful use of the "truncate", "ftruncate", "creat", "open", "openat", and "open_by_handle_at" system calls by adding or updating the following rules in the "/etc/audit/rules.d/audit.rules" file: -a always,exit -F arch=b32 -S truncate,ftruncate,creat,open,openat,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -k perm_access -a always,exit -F arch=b64 -S truncate,ftruncate,creat,open,openat,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -k perm_access -a always,exit -F arch=b32 -S truncate,ftruncate,creat,open,openat,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -k perm_access -a always,exit -F arch=b64 -S truncate,ftruncate,creat,open,openat,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -k perm_access Restart the audit daemon for changes to take effect.
- RMF Control
- AU-3
- Severity
- M
- CCI
- CCI-000130
- Version
- TOSS-05-000424
- Vuln IDs
-
- V-282400
- Rule IDs
-
- SV-282400r1201523_rule
Checks: C-86961r1200178_chk
Verify that TOSS 5 is configured to audit the execution of the "delete_module" system call with the following command: $ sudo auditctl -l | grep delete_module -a always,exit -F arch=b32 -S delete_module -F auid>=1000 -F auid!=unset -k module_chng -a always,exit -F arch=b64 -S delete_module -F auid>=1000 -F auid!=unset -k module_chng If both the "b32" and "b64" audit rules are not defined for the "delete_module" system call, or any of the lines returned are commented out, this is a finding.
Fix: F-86866r1201522_fix
Configure TOSS 5 to generate an audit event for any successful/unsuccessful use of the "delete_module" system call by adding or updating the following rules in the "/etc/audit/rules.d/audit.rules" file: -a always,exit -F arch=b32 -S delete_module -F auid>=1000 -F auid!=unset -k module_chng -a always,exit -F arch=b64 -S delete_module -F auid>=1000 -F auid!=unset -k module_chng Restart the audit daemon for changes to take effect.
- RMF Control
- AU-3
- Severity
- M
- CCI
- CCI-000130
- Version
- TOSS-05-000425
- Vuln IDs
-
- V-282401
- Rule IDs
-
- SV-282401r1201525_rule
Checks: C-86962r1200181_chk
Verify that TOSS 5 is configured to audit the execution of the "init_module" and "finit_module" system calls with the following command: $ sudo auditctl -l | grep init_module -a always,exit -F arch=b32 -S init_module,finit_module -F auid>=1000 -F auid!=unset -k module_chng -a always,exit -F arch=b64 -S init_module,finit_module -F auid>=1000 -F auid!=unset -k module_chng If both the "b32" and "b64" audit rules are not defined for the "delete_module" system call, or any of the lines returned are commented out, this is a finding.
Fix: F-86867r1201524_fix
Configure TOSS 5 to generate an audit event for any successful/unsuccessful use of the "init_module" and "finit_module" system calls by adding or updating the following rules in the "/etc/audit/rules.d/audit.rules" file: -a always,exit -F arch=b32 -S init_module,finit_module -F auid>=1000 -F auid!=unset -k module_chng -a always,exit -F arch=b64 -S init_module,finit_module -F auid>=1000 -F auid!=unset -k module_chng Restart the audit daemon for changes to take effect.
- RMF Control
- AU-3
- Severity
- M
- CCI
- CCI-000130
- Version
- TOSS-05-000426
- Vuln IDs
-
- V-282402
- Rule IDs
-
- SV-282402r1201527_rule
Checks: C-86963r1201425_chk
Verify that TOSS 5 is configured to audit the execution of the "chage" command with the following command: $ sudo auditctl -l | grep chage -a always,exit -F path=/usr/bin/chage -F perm=x -F auid>=1000 -F auid!=unset -k privileged-chage If the command does not return a line or the line is commented out, this is a finding.
Fix: F-86868r1201526_fix
Configure TOSS 5 to generate audit records upon successful/unsuccessful attempts to use the "chage" command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/bin/chage -F perm=x -F auid>=1000 -F auid!=unset -k privileged-chage Restart the audit daemon for changes to take effect.
- RMF Control
- AU-3
- Severity
- M
- CCI
- CCI-000130
- Version
- TOSS-05-000427
- Vuln IDs
-
- V-282403
- Rule IDs
-
- SV-282403r1201529_rule
Checks: C-86964r1201428_chk
Verify that TOSS 5 is configured to audit the execution of the "chsh" command with the following command: $ sudo auditctl -l | grep chsh -a always,exit -F path=/usr/bin/chsh -F perm=x -F auid>=1000 -F auid!=unset -k priv_cmd If the command does not return a line or the line is commented out, this is a finding.
Fix: F-86869r1201528_fix
Configure TOSS 5 to generate audit records upon successful/unsuccessful attempts to use the "chsh" command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/bin/chsh -F perm=x -F auid>=1000 -F auid!=unset -k priv_cmd Restart the audit daemon for changes to take effect.
- RMF Control
- AU-3
- Severity
- M
- CCI
- CCI-000130
- Version
- TOSS-05-000428
- Vuln IDs
-
- V-282404
- Rule IDs
-
- SV-282404r1201531_rule
Checks: C-86965r1201431_chk
Verify that TOSS 5 is configured to audit the execution of the "crontab" command with the following command: $ sudo auditctl -l | grep crontab -a always,exit -F path=/usr/bin/crontab -F perm=x -F auid>=1000 -F auid!=unset -k privileged-crontab If the command does not return a line or the line is commented out, this is a finding.
Fix: F-86870r1201530_fix
Configure TOSS 5 to generate audit records upon successful/unsuccessful attempts to use the "crontab" command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/bin/crontab -F perm=x -F auid>=1000 -F auid!=unset -k privileged-crontab Restart the audit daemon for changes to take effect.
- RMF Control
- AU-3
- Severity
- M
- CCI
- CCI-000130
- Version
- TOSS-05-000429
- Vuln IDs
-
- V-282405
- Rule IDs
-
- SV-282405r1201533_rule
Checks: C-86966r1201434_chk
Verify that TOSS 5 is configured to audit the execution of the "gpasswd" command with the following command: $ sudo auditctl -l | grep gpasswd -a always,exit -F path=/usr/bin/gpasswd -F perm=x -F auid>=1000 -F auid!=unset -k privileged-gpasswd If the command does not return a line or the line is commented out, this is a finding.
Fix: F-86871r1201532_fix
Configure TOSS 5 to generate audit records upon successful/unsuccessful attempts to use the "gpasswd" command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/bin/gpasswd -F perm=x -F auid>=1000 -F auid!=unset -k privileged-gpasswd Restart the audit daemon for changes to take effect.
- RMF Control
- AU-3
- Severity
- M
- CCI
- CCI-000130
- Version
- TOSS-05-000430
- Vuln IDs
-
- V-282406
- Rule IDs
-
- SV-282406r1201535_rule
Checks: C-86967r1201437_chk
Verify that TOSS 5 is configured to audit the execution of the "kmod" command with the following command: $ sudo auditctl -l | grep kmod -a always,exit -F path=/usr/bin/kmod -F perm=x -F auid>=1000 -F auid!=unset -k modules If the command does not return a line or the line is commented out, this is a finding.
Fix: F-86872r1201534_fix
Configure TOSS 5 to generate audit records upon successful/unsuccessful attempts to use the "kmod" command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/bin/kmod -F perm=x -F auid>=1000 -F auid!=unset -k modules Restart the audit daemon for changes to take effect.
- RMF Control
- AU-3
- Severity
- M
- CCI
- CCI-000130
- Version
- TOSS-05-000431
- Vuln IDs
-
- V-282407
- Rule IDs
-
- SV-282407r1201537_rule
Checks: C-86968r1201440_chk
Verify that TOSS 5 is configured to audit the execution of the "newgrp" command with the following command: $ sudo auditctl -l | grep newgrp -a always,exit -F path=/usr/bin/newgrp -F perm=x -F auid>=1000 -F auid!=unset -k priv_cmd If the command does not return a line or the line is commented out, this is a finding.
Fix: F-86873r1201536_fix
Configure TOSS 5 to generate audit records upon successful/unsuccessful attempts to use the "newgrp" command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/bin/newgrp -F perm=x -F auid>=1000 -F auid!=unset -k priv_cmd Restart the audit daemon for changes to take effect.
- RMF Control
- AU-3
- Severity
- M
- CCI
- CCI-000130
- Version
- TOSS-05-000432
- Vuln IDs
-
- V-282408
- Rule IDs
-
- SV-282408r1201539_rule
Checks: C-86969r1201443_chk
Verify that TOSS 5 is configured to audit the execution of the "pam_timestamp_check" command with the following command: $ sudo auditctl -l | grep timestamp -a always,exit -F path=/usr/sbin/pam_timestamp_check -F perm=x -F auid>=1000 -F auid!=unset -k privileged-pam_timestamp_check If the command does not return a line or the line is commented out, this is a finding.
Fix: F-86874r1201538_fix
Configure TOSS 5 to generate audit records upon successful/unsuccessful attempts to use the "pam_timestamp_check" command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/sbin/pam_timestamp_check -F perm=x -F auid>=1000 -F auid!=unset -k privileged-pam_timestamp_check Restart the audit daemon for changes to take effect.
- RMF Control
- AU-3
- Severity
- M
- CCI
- CCI-000130
- Version
- TOSS-05-000433
- Vuln IDs
-
- V-282409
- Rule IDs
-
- SV-282409r1201541_rule
Checks: C-86970r1201446_chk
Verify TOSS 5 generates audit records for all account creations, modifications, disabling, and termination events that affect "/etc/gshadow" with the following command: $ sudo auditctl -l | egrep '(/usr/bin/passwd)' -a always,exit -F path=/usr/bin/passwd -F perm=x -F auid>=1000 -F auid!=unset -k privileged-passwd If the command does not return a line or the line is commented out, this is a finding.
Fix: F-86875r1201540_fix
Configure TOSS 5 to generate audit records upon successful/unsuccessful attempts to use the "passwd" command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/bin/passwd -F perm=x -F auid>=1000 -F auid!=unset -k privileged-passwd Restart the audit daemon for changes to take effect.
- RMF Control
- AU-3
- Severity
- M
- CCI
- CCI-000130
- Version
- TOSS-05-000434
- Vuln IDs
-
- V-282410
- Rule IDs
-
- SV-282410r1201543_rule
Checks: C-86971r1201449_chk
Verify that TOSS 5 is configured to audit the execution of the "postdrop" command with the following command: $ sudo auditctl -l | grep postdrop -a always,exit -F path=/usr/sbin/postdrop -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update If the command does not return a line or the line is commented out, this is a finding.
Fix: F-86876r1201542_fix
Configure TOSS 5 to generate audit records upon successful/unsuccessful attempts to use the "postdrop" command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/sbin/postdrop -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update Restart the audit daemon for changes to take effect.
- RMF Control
- AU-3
- Severity
- M
- CCI
- CCI-000130
- Version
- TOSS-05-000435
- Vuln IDs
-
- V-282411
- Rule IDs
-
- SV-282411r1201545_rule
Checks: C-86972r1201452_chk
Verify that TOSS 5 is configured to audit the execution of the "postqueue" command with the following command: $ sudo auditctl -l | grep postqueue -a always,exit -F path=/usr/sbin/postqueue -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update If the command does not return a line or the line is commented out, this is a finding.
Fix: F-86877r1201544_fix
Configure TOSS 5 to generate audit records upon successful/unsuccessful attempts to use the "postqueue" command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/sbin/postqueue -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update Restart the audit daemon for changes to take effect.
- RMF Control
- AU-3
- Severity
- M
- CCI
- CCI-000130
- Version
- TOSS-05-000436
- Vuln IDs
-
- V-282412
- Rule IDs
-
- SV-282412r1201547_rule
Checks: C-86973r1201455_chk
Verify that TOSS 5 is configured to audit the execution of the "ssh-agent" command with the following command: $ sudo auditctl -l | grep ssh-agent -a always,exit -F path=/usr/bin/ssh-agent -F perm=x -F auid>=1000 -F auid!=unset -k privileged-ssh If the command does not return a line or the line is commented out, this is a finding.
Fix: F-86878r1201546_fix
Configure TOSS 5 to generate audit records upon successful/unsuccessful attempts to use the "ssh-agent" command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/bin/ssh-agent -F perm=x -F auid>=1000 -F auid!=unset -k privileged-ssh Restart the audit daemon for changes to take effect.
- RMF Control
- AU-3
- Severity
- M
- CCI
- CCI-000130
- Version
- TOSS-05-000437
- Vuln IDs
-
- V-282413
- Rule IDs
-
- SV-282413r1201549_rule
Checks: C-86974r1201458_chk
Verify that TOSS 5 is configured to audit the execution of the "ssh-keysign" command with the following command: $ sudo auditctl -l | grep ssh-keysign -a always,exit -F path=/usr/libexec/openssh/ssh-keysign -F perm=x -F auid>=1000 -F auid!=unset -k privileged-ssh If the command does not return a line or the line is commented out, this is a finding.
Fix: F-86879r1201548_fix
Configure TOSS 5 to generate audit records upon successful/unsuccessful attempts to use the "ssh-keysign" command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/libexec/openssh/ssh-keysign -F perm=x -F auid>=1000 -F auid!=unset -k privileged-ssh Restart the audit daemon for changes to take effect.
- RMF Control
- AU-3
- Severity
- M
- CCI
- CCI-000130
- Version
- TOSS-05-000438
- Vuln IDs
-
- V-282414
- Rule IDs
-
- SV-282414r1201551_rule
Checks: C-86975r1201461_chk
Verify that TOSS 5 is configured to audit the execution of the "su" command with the following command: $ sudo auditctl -l | grep /usr/bin/su -a always,exit -F path=/usr/bin/su -F perm=x -F auid>=1000 -F auid!=unset -k privileged-priv_change If the command does not return a line or the line is commented out, this is a finding.
Fix: F-86880r1201550_fix
Configure TOSS 5 to generate audit records upon successful/unsuccessful attempts to use the "su" command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/bin/su -F perm=x -F auid>=1000 -F auid!=unset -k privileged-priv_change Restart the audit daemon for changes to take effect.
- RMF Control
- AU-3
- Severity
- M
- CCI
- CCI-000130
- Version
- TOSS-05-000439
- Vuln IDs
-
- V-282415
- Rule IDs
-
- SV-282415r1201553_rule
Checks: C-86976r1201464_chk
Verify that TOSS 5 is configured to audit the execution of the "sudo" command with the following command: $ sudo auditctl -l | grep /usr/bin/sudo -a always,exit -F path=/usr/bin/sudo -F perm=x -F auid>=1000 -F auid!=unset -k priv_cmd If the command does not return a line or the line is commented out, this is a finding.
Fix: F-86881r1201552_fix
Configure TOSS 5 to generate audit records upon successful/unsuccessful attempts to use the "sudo" command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/bin/sudo -F perm=x -F auid>=1000 -F auid!=unset -k priv_cmd Restart the audit daemon for changes to take effect.
- RMF Control
- AU-3
- Severity
- M
- CCI
- CCI-000130
- Version
- TOSS-05-000440
- Vuln IDs
-
- V-282416
- Rule IDs
-
- SV-282416r1201555_rule
Checks: C-86977r1201467_chk
Verify that TOSS 5 is configured to audit the execution of the "sudoedit" command with the following command: $ sudo auditctl -l | grep /usr/bin/sudoedit -a always,exit -F path=/usr/bin/sudoedit -F perm=x -F auid>=1000 -F auid!=unset -k priv_cmd If the command does not return a line or the line is commented out, this is a finding.
Fix: F-86882r1201554_fix
Configure TOSS 5 to generate audit records upon successful/unsuccessful attempts to use the "sudoedit" command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/bin/sudoedit -F perm=x -F auid>=1000 -F auid!=unset -k priv_cmd Restart the audit daemon for changes to take effect.
- RMF Control
- AU-3
- Severity
- M
- CCI
- CCI-000130
- Version
- TOSS-05-000441
- Vuln IDs
-
- V-282417
- Rule IDs
-
- SV-282417r1201557_rule
Checks: C-86978r1201470_chk
Verify that TOSS 5 is configured to audit the execution of the "unix_chkpwd" command with the following command: $ sudo auditctl -l | grep unix_chkpwd -a always,exit -F path=/usr/sbin/unix_chkpwd -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update If the command does not return a line or the line is commented out, this is a finding.
Fix: F-86883r1201556_fix
Configure TOSS 5 to generate audit records upon successful/unsuccessful attempts to use the "unix_chkpwd" command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/sbin/unix_chkpwd -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update Restart the audit daemon for changes to take effect.
- RMF Control
- AU-3
- Severity
- M
- CCI
- CCI-000130
- Version
- TOSS-05-000442
- Vuln IDs
-
- V-282418
- Rule IDs
-
- SV-282418r1201559_rule
Checks: C-86979r1201473_chk
Verify that TOSS 5 is configured to audit the execution of the "unix_update" command with the following command: $ sudo auditctl -l | grep unix_update -a always,exit -F path=/usr/sbin/unix_update -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update If the command does not return a line or the line is commented out, this is a finding.
Fix: F-86884r1201558_fix
Configure TOSS 5 to generate audit records upon successful/unsuccessful attempts to use the "unix_update" command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/sbin/unix_update -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update Restart the audit daemon for changes to take effect.
- RMF Control
- AU-3
- Severity
- M
- CCI
- CCI-000130
- Version
- TOSS-05-000443
- Vuln IDs
-
- V-282419
- Rule IDs
-
- SV-282419r1201561_rule
Checks: C-86980r1201476_chk
Verify that TOSS 5 is configured to audit the execution of the "userhelper" command with the following command: $ sudo auditctl -l | grep userhelper -a always,exit -F path=/usr/sbin/userhelper -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update If the command does not return a line or the line is commented out, this is a finding.
Fix: F-86885r1201560_fix
Configure TOSS 5 to generate audit records upon successful/unsuccessful attempts to use the "userhelper" command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/sbin/userhelper -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update Restart the audit daemon for changes to take effect.
- RMF Control
- AU-3
- Severity
- M
- CCI
- CCI-000130
- Version
- TOSS-05-000444
- Vuln IDs
-
- V-282420
- Rule IDs
-
- SV-282420r1201563_rule
Checks: C-86981r1201479_chk
Verify that TOSS 5 is configured to audit the execution of the "usermod" command with the following command: $ sudo auditctl -l | grep usermod -a always,exit -F path=/usr/sbin/usermod -F perm=x -F auid>=1000 -F auid!=unset -k privileged-usermod If the command does not return a line or the line is commented out, this is a finding.
Fix: F-86886r1201562_fix
Configure TOSS 5 to generate audit records upon successful/unsuccessful attempts to use the "usermod " command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/sbin/usermod -F perm=x -F auid>=1000 -F auid!=unset -k privileged-usermod Restart the audit daemon for changes to take effect.
- RMF Control
- AU-3
- Severity
- M
- CCI
- CCI-000130
- Version
- TOSS-05-000445
- Vuln IDs
-
- V-282421
- Rule IDs
-
- SV-282421r1201565_rule
Checks: C-86982r1201482_chk
Verify that TOSS 5 is configured to audit the execution of the "mount" command with the following command: $ sudo auditctl -l | grep /usr/bin/mount -a always,exit -F path=/usr/bin/mount -F perm=x -F auid>=1000 -F auid!=unset -k privileged-mount If the command does not return a line or the line is commented out, this is a finding.
Fix: F-86887r1201564_fix
Configure TOSS 5 to generate audit records upon successful/unsuccessful attempts to use the "mount" command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F path=/usr/bin/mount -F perm=x -F auid>=1000 -F auid!=unset -k privileged-mount Restart the audit daemon for changes to take effect.
- RMF Control
- AU-3
- Severity
- M
- CCI
- CCI-000130
- Version
- TOSS-05-000450
- Vuln IDs
-
- V-282422
- Rule IDs
-
- SV-282422r1201567_rule
Checks: C-86983r1201485_chk
Verify that TOSS 5 generates an audit record for all uses of the "umount" and system call with the following command: $ sudo grep "umount" /etc/audit/audit.* -a always,exit -F arch=b32 -S umount -F auid>=1000 -F auid!=unset -k privileged-umount If the command does not return a line or the line is commented out, this is a finding.
Fix: F-86888r1201566_fix
Configure the audit system to generate an audit event for any successful/unsuccessful use of the "umount" system call by adding or updating the following rules in "/etc/audit/audit.rules" and adding the following rules to "/etc/audit/rules.d/perm_mod.rules" or updating the existing rules in files in the "/etc/audit/rules.d/" directory: -a always,exit -F arch=b32 -S umount -F auid>=1000 -F auid!=unset -k privileged-umount Restart the audit daemon for changes to take effect.
- RMF Control
- AU-3
- Severity
- M
- CCI
- CCI-000130
- Version
- TOSS-05-000451
- Vuln IDs
-
- V-282423
- Rule IDs
-
- SV-282423r1201569_rule
Checks: C-86984r1200247_chk
To determine if the system is configured to audit calls to the umount2 system call, run the following command: $ sudo grep "umount2" /etc/audit/audit.* If no line is returned, this is a finding.
Fix: F-86889r1201568_fix
Configure the audit system to generate an audit event for any successful/unsuccessful use of the "umount2" system call by adding or updating the following rules in "/etc/audit/audit.rules" and adding the following rules to "/etc/audit/rules.d/perm_mod.rules" or updating the existing rules in files in the "/etc/audit/rules.d/" directory: -a always,exit -F arch=b32 -S umount2 -F auid>=1000 -F auid!=unset -k perm_mod -a always,exit -F arch=b64 -S umount2 -F auid>=1000 -F auid!=unset -k perm_mod Restart the audit daemon for changes to take effect.
- RMF Control
- AU-3
- Severity
- M
- CCI
- CCI-000130
- Version
- TOSS-05-000460
- Vuln IDs
-
- V-282424
- Rule IDs
-
- SV-282424r1201571_rule
Checks: C-86985r1201490_chk
Verify TOSS 5 generates audit records for all account creations, modifications, disabling, and termination events that affect "/var/log/lastlog" with the following command: $ sudo auditctl -l | grep /var/log/lastlog -w /var/log/lastlog -p wa -k logins If the command does not return a line or the line is commented out, this is a finding.
Fix: F-86890r1201570_fix
Configure TOSS 5 to generate audit records for all account creations, modifications, disabling, and termination events that affect "/var/log/lastlog". Add or update the following file system rule to "/etc/audit/rules.d/audit.rules": -w /var/log/lastlog -p wa -k logins Restart the audit daemon for changes to take effect.
- RMF Control
- AU-3
- Severity
- M
- CCI
- CCI-000132
- Version
- TOSS-05-000396
- Vuln IDs
-
- V-282425
- Rule IDs
-
- SV-282425r1201625_rule
Checks: C-86986r1200253_chk
Verify that TOSS 5 Audit Daemon is configured to label all offloaded audit logs, with the following command: $ sudo grep name_format /etc/audit/auditd.conf name_format = hostname If the "name_format" option is not "hostname", "fqd", or "numeric", or the line is commented out, this is a finding.
Fix: F-86891r1201624_fix
Edit the /etc/audit/auditd.conf file and add or update the "name_format" option: name_format = hostname Restart the audit daemon for changes to take effect.
- RMF Control
- AU-5
- Severity
- M
- CCI
- CCI-000139
- Version
- TOSS-05-000209
- Vuln IDs
-
- V-282426
- Rule IDs
-
- SV-282426r1200258_rule
Checks: C-86987r1200256_chk
Verify the administrators are notified in the event of an audit processing failure. Verify the "/etc/aliases" file has a defined value for "root". $ sudo grep "postmaster:\s*root$" /etc/aliases If the command does not return a line, or the line is commented out, ask the system administrator to indicate how they and the information systems security officer (ISSO) are notified of an audit process failure. If there is no evidence of the proper personnel being notified of an audit processing failure, this is a finding.
Fix: F-86892r1200257_fix
Configure a valid email address as an alias for the root account. Append the following line to "/etc/aliases": postmaster: root Run the following command: $ sudo newaliases
- RMF Control
- AU-5
- Severity
- M
- CCI
- CCI-000139
- Version
- TOSS-05-000398
- Vuln IDs
-
- V-282427
- Rule IDs
-
- SV-282427r1200261_rule
Checks: C-86988r1200259_chk
Verify TOSS 5 is configured to notify the SA and/or ISSO (at a minimum) in the event of an audit processing failure using the following command: $ sudo grep action_mail_acct /etc/audit/auditd.conf action_mail_acct = root If the value of the "action_mail_acct" keyword is not set to "root" and/or other accounts for security personnel, the "action_mail_acct" keyword is missing, or the retuned line is commented out, ask the SA to indicate how they and the ISSO are notified of an audit process failure. If there is no evidence of the proper personnel being notified of an audit processing failure, this is a finding.
Fix: F-86893r1200260_fix
Configure "auditd" service to notify the SA and ISSO in the event of an audit processing failure. Edit the following line in "/etc/audit/auditd.conf" to ensure that administrators are notified via email for those situations: action_mail_acct = root Restart the audit daemon for changes to take effect.
- RMF Control
- AU-5
- Severity
- M
- CCI
- CCI-000139
- Version
- TOSS-05-000409
- Vuln IDs
-
- V-282428
- Rule IDs
-
- SV-282428r1200264_rule
Checks: C-86989r1200262_chk
Verify TOSS 5 is configured to notify the appropriate interactive users in the event of an audit processing failure. Find the alias maps in use with the following command: $ postconf alias_maps alias_maps = hash:/etc/aliases Query the Postfix alias maps for an alias for the root user with the following command: $ postmap -q root hash:/etc/aliases isso If an alias is not set, this is a finding.
Fix: F-86894r1200263_fix
Edit the aliases map file (by default, /etc/aliases) used by Postfix and configure a root alias (using the user ISSO as an example): root: ISSO Update the aliases database with the command: $ sudo newaliases
- RMF Control
- AU-5
- Severity
- M
- CCI
- CCI-000139
- Version
- TOSS-05-000462
- Vuln IDs
-
- V-282429
- Rule IDs
-
- SV-282429r1200267_rule
Checks: C-86990r1200265_chk
Verify the audit service is configured to panic on a critical error using the following command: $ sudo grep "\-f" /etc/audit/audit.rules -f 2 If the value for "-f" is not "2", and availability is not documented as an overriding concern, this is a finding.
Fix: F-86895r1200266_fix
Configure TOSS 5 to shut down when auditing failures occur. Add the following line to the bottom of the "/etc/audit/audit.rules" file: -f 2
- RMF Control
- AU-6
- Severity
- M
- CCI
- CCI-000154
- Version
- TOSS-05-000403
- Vuln IDs
-
- V-282430
- Rule IDs
-
- SV-282430r1200270_rule
Checks: C-86991r1200268_chk
Verify the audit system is configured to flush to disk after every 100 records using the following command: $ sudo grep freq /etc/audit/auditd.conf freq = 100 If "freq" isn't set to a value between "1" and "100", the value is missing, or the line is commented out, this is a finding.
Fix: F-86896r1200269_fix
Configure TOSS 5 to flush audit to disk by adding or updating the following rule in "/etc/audit/auditd.conf": freq = 100 Restart the audit daemon for the changes to take effect.
- RMF Control
- AU-9
- Severity
- M
- CCI
- CCI-000162
- Version
- TOSS-05-000400
- Vuln IDs
-
- V-282431
- Rule IDs
-
- SV-282431r1200273_rule
Checks: C-86992r1200271_chk
Verify the audit logs are group-owned by "root" or a restricted logging group. First determine if a group other than "root" has been assigned to the audit logs using the following command: $ sudo grep log_group /etc/audit/auditd.conf Determine where the audit logs are stored using the following command: $ sudo grep -iw log_file /etc/audit/auditd.conf log_file = /var/log/audit/audit.log Using the location of the audit log file, determine if the audit log is group-owned by "root" using the following command: $ sudo stat -c "%G %n" /var/log/audit/audit.log root /var/log/audit/audit.log If the audit log is not group-owned by "root" or the configured alternative logging group, this is a finding.
Fix: F-86897r1200272_fix
Change the group of the directory of "/var/log/audit" to be owned by a correct group. Identify the group that is configured to own audit log: $ sudo grep -P '^[ ]*log_group[ ]+=.*$' /etc/audit/auditd.conf Change the ownership to that group: $ sudo chgrp ${GROUP} /var/log/audit
- RMF Control
- AU-9
- Severity
- M
- CCI
- CCI-000162
- Version
- TOSS-05-000401
- Vuln IDs
-
- V-282432
- Rule IDs
-
- SV-282432r1200276_rule
Checks: C-86993r1200274_chk
Verify the audit logs directory is owned by "root". Determine where the audit logs are stored using the following command: $ sudo grep -iw log_file /etc/audit/auditd.conf log_file = /var/log/audit/audit.log Using the location of the audit log file, determine if the audit log directory is owned by "root" using the following command: $ sudo ls -ld /var/log/audit drwx------ 2 root root 23 Jun 11 11:56 /var/log/audit If the audit log directory is not owned by "root", this is a finding.
Fix: F-86898r1200275_fix
Configure the audit log to be protected from unauthorized read access by setting the correct owner as "root" using the following command: $ sudo chown root /var/log/audit
- RMF Control
- AU-9
- Severity
- M
- CCI
- CCI-000162
- Version
- TOSS-05-000402
- Vuln IDs
-
- V-282433
- Rule IDs
-
- SV-282433r1200279_rule
Checks: C-86994r1200277_chk
Verify the audit logs have a mode of "0600". Determine where the audit logs are stored using the following command: $ sudo grep -iw log_file /etc/audit/auditd.conf log_file = /var/log/audit/audit.log Using the location of the audit log file, determine if the audit log files as a mode of "0640" using the following command: $ sudo ls -la /var/log/audit/*.log rw-------. 2 root root 237923 Jun 11 11:56 /var/log/audit/audit.log If the audit logs have a mode more permissive than "0600", this is a finding.
Fix: F-86899r1200278_fix
Configure the audit logs to have a mode of "0600" using the following command: Replace "[audit_log_file]" to the correct audit log path, by default this location is "/var/log/audit/audit.log". $ sudo chmod 0600 /var/log/audit/[audit_log_file] Check the group that owns the system audit logs: $ sudo grep -m 1 -q ^log_group /etc/audit/auditd.conf If the "log_group" is not defined or it is set to "root", configure the permissions as follows: $ sudo chmod 0640 $log_file $ sudo chmod 0440 $log_file.* Otherwise, configure the permissions as follows: $ sudo chmod 0600 $log_file $ sudo chmod 0400 $log_file.*
- RMF Control
- AU-9
- Severity
- M
- CCI
- CCI-000162
- Version
- TOSS-05-000463
- Vuln IDs
-
- V-282434
- Rule IDs
-
- SV-282434r1200282_rule
Checks: C-86995r1200280_chk
Verify the audit system prevents unauthorized changes to login UIDs using the following command: $ sudo grep -i immutable /etc/audit/audit.rules --loginuid-immutable If the "--loginuid-immutable" option is not returned in the "/etc/audit/audit.rules", or the line is commented out, this is a finding.
Fix: F-86900r1200281_fix
Configure TOSS 5 auditing to prevent modification of login UIDs once they are set by adding the following line to "/etc/audit/rules.d/audit.rules": --loginuid-immutable Restart the audit daemon for the changes to take effect.
- RMF Control
- AU-9
- Severity
- M
- CCI
- CCI-000162
- Version
- TOSS-05-000464
- Vuln IDs
-
- V-282435
- Rule IDs
-
- SV-282435r1200285_rule
Checks: C-86996r1200283_chk
Verify the audit system prevents unauthorized changes using the following command: $ sudo grep "^\s*[^#]" /etc/audit/audit.rules | tail -1 -e 2 If the audit system is not set to be immutable by adding the "-e 2" option to the end of "/etc/audit/audit.rules", this is a finding.
Fix: F-86901r1200284_fix
Configure the audit system to set the audit rules to be immutable by adding the following line to end of "/etc/audit/rules.d/audit.rules": -e 2 Restart the audit daemon for the changes to take effect.
- RMF Control
- AU-12
- Severity
- L
- CCI
- CCI-000169
- Version
- TOSS-05-000287
- Vuln IDs
-
- V-282436
- Rule IDs
-
- SV-282436r1200288_rule
Checks: C-86997r1200286_chk
Verify Linux Audit logging is enabled for the USBGuard daemon using the following command: $ sudo grep AuditBackend /etc/usbguard/usbguard-daemon.conf AuditBackend=LinuxAudit If "AuditBackend" is not set to "LinuxAudit", this is a finding.
Fix: F-86902r1200287_fix
Configure TOSS 5 USBGuard AuditBackend to use the audit system. Add or edit the following line in "/etc/usbguard/usbguard-daemon.conf": AuditBackend=LinuxAudit
- RMF Control
- AU-12
- Severity
- M
- CCI
- CCI-000169
- Version
- TOSS-05-000386
- Vuln IDs
-
- V-282437
- Rule IDs
-
- SV-282437r1200291_rule
Checks: C-86998r1200289_chk
Verify the TOSS 5 audit service package is installed. Check that the audit service package is installed using the following command: $ sudo dnf list --installed audit Example output: audit-3.0.7-101.el9_0.2.x86_64 If the "audit" package is not installed, this is a finding.
Fix: F-86903r1200290_fix
Install the audit service package (if the audit service is not already installed) using the following command: $ sudo dnf install audit
- RMF Control
- AU-12
- Severity
- M
- CCI
- CCI-000169
- Version
- TOSS-05-000387
- Vuln IDs
-
- V-282438
- Rule IDs
-
- SV-282438r1200294_rule
Checks: C-86999r1200292_chk
Verify the audit service is configured to produce audit records using the following command: $ systemctl status auditd.service auditd.service - Security Auditing Service Loaded:loaded (/usr/lib/systemd/system/auditd.service; enabled; vendor preset: enabled) Active: active (running) since Tues 2022-05-24 12:56:56 EST; 4 weeks 0 days ago If the audit service is not "active" and "running", this is a finding.
Fix: F-86904r1200293_fix
To enable the audit service, run the following command: $ sudo systemctl enable --now auditd
- RMF Control
- AU-12
- Severity
- M
- CCI
- CCI-000169
- Version
- TOSS-05-000399
- Vuln IDs
-
- V-282439
- Rule IDs
-
- SV-282439r1200297_rule
Checks: C-87000r1200295_chk
Verify the TOSS 5 audit system is configured to audit local events using the following command: $ sudo grep local_events /etc/audit/auditd.conf local_events = yes If "local_events" is not set to "yes", if the command does not return a line, or the line is commented out, this is a finding.
Fix: F-86905r1200296_fix
Configure TOSS 5 to generate audit records for local events by adding or updating the following line in "/etc/audit/auditd.conf": local_events = yes Restart the audit daemon for the changes to take effect.
- RMF Control
- AU-12
- Severity
- M
- CCI
- CCI-000171
- Version
- TOSS-05-000406
- Vuln IDs
-
- V-282440
- Rule IDs
-
- SV-282440r1200300_rule
Checks: C-87001r1200298_chk
Verify the files in directory "/etc/audit/rules.d/" and "/etc/audit/auditd.conf" file have a mode of "0640" or less permissive using the following command: # stat -c "%a %n" /etc/audit/rules.d/*.rules 640 /etc/audit/rules.d/audit.rules If the files in the "/etc/audit/rules.d/" directory or the "/etc/audit/auditd.conf" file have a mode more permissive than "0640", this is a finding.
Fix: F-86906r1200299_fix
Configure the files in directory "/etc/audit/rules.d/" and the "/etc/audit/auditd.conf" file to have a mode of "0640" with the following commands: $ sudo chmod 0640 /etc/audit/rules.d/audit.rules $ sudo chmod 0640 /etc/audit/rules.d/[customrulesfile].rules $ sudo chmod 0640 /etc/audit/auditd.conf
- RMF Control
- AU-12
- Severity
- M
- CCI
- CCI-000171
- Version
- TOSS-05-000407
- Vuln IDs
-
- V-282441
- Rule IDs
-
- SV-282441r1200303_rule
Checks: C-87002r1200301_chk
Verify the mode of the "/etc/audit/auditd.conf" file with the command: $ sudo stat -c "%a %n" /etc/audit/auditd.conf 640 /etc/audit/auditd.conf If "/etc/audit/auditd.conf" does not have a mode of "0640", this is a finding.
Fix: F-86907r1200302_fix
Set the mode of the "/etc/audit/auditd.conf" file to "0640" with the command: $ sudo chmod 0640 /etc/audit/auditd.conf
- RMF Control
- IA-5
- Severity
- M
- CCI
- CCI-000185
- Version
- TOSS-05-000366
- Vuln IDs
-
- V-282442
- Rule IDs
-
- SV-282442r1200306_rule
Checks: C-87003r1200304_chk
If PKI-based authentication is used, verify TOSS 5 has valid certificates by constructing a certification path (which includes status information) to an accepted trust anchor. Check that the system has a valid DOD root CA installed using the following command: Note: If the system does not support PKI authentication, this requirement is not applicable. $ sudo openssl x509 -text -in /etc/sssd/pki/sssd_auth_ca_db.pem Certificate: Data: Version: 3 (0x2) Serial Number: 1 (0x1) Signature Algorithm: sha256WithRSAEncryption Issuer: C = US, O = U.S. Government, OU = DOD, OU = PKI, CN = DOD Root CA 3 Validity Not Before: Mar 20 18:46:41 2012 GMT Not After : Dec 30 18:46:41 2029 GMT Subject: C = US, O = U.S. Government, OU = DOD, OU = PKI, CN = DOD Root CA 3 Subject Public Key Info: Public Key Algorithm: rsaEncryption If the root CA file is not a DOD-issued certificate with a valid date and installed in the "/etc/sssd/pki/sssd_auth_ca_db.pem" location, this is a finding.
Fix: F-86908r1200305_fix
If PKI-based authentication is used, configure TOSS 5 to validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor. Obtain a valid copy of the DOD root CA file from the PKI CA certificate bundle from cyber.mil and copy it into the following file: /etc/sssd/pki/sssd_auth_ca_db.pem
- RMF Control
- IA-5
- Severity
- M
- CCI
- CCI-000186
- Version
- TOSS-05-000074
- Vuln IDs
-
- V-282443
- Rule IDs
-
- SV-282443r1200309_rule
Checks: C-87004r1200307_chk
If the system does not allow PKI authentication, this requirement is not applicable. Verify the operating system, for PKI-based authentication, enforces authorized access to the corresponding private key. Verify the SSH private key files have a passphrase. For each private key stored on the system, use the following command: $ sudo ssh-keygen -y -f /path/to/file If the contents of the key are displayed, and use of un-passphrased Secure Shell (SSH) keys is not documented with the information system security officer, this is a finding.
Fix: F-86909r1200308_fix
Create a new private and public key pair that uses a passcode using the following command: $ sudo ssh-keygen -n [passphrase]
- RMF Control
- IA-5
- Severity
- M
- CCI
- CCI-000187
- Version
- TOSS-05-000367
- Vuln IDs
-
- V-282444
- Rule IDs
-
- SV-282444r1200312_rule
Checks: C-87005r1200310_chk
Verify the certificate of the user or group is mapped to the corresponding user or group in the "sssd.conf" file using the following command: $ sudo cat /etc/sssd/sssd.conf [certmap/testing.test/rule_name] matchrule =<SAN>.*EDIPI@mil maprule = (userCertificate;binary={cert!bin}) domains = testing.test If the certmap section does not exist, ask the system administrator (SA) to indicate how certificates are mapped to accounts. If there is no evidence of certificate mapping, this is a finding.
Fix: F-86910r1200311_fix
Configure TOSS 5 to map the authenticated identity to the user or group account by adding or modifying the certmap section of the "/etc/sssd/sssd.conf" file based on the following example: [certmap/testing.test/rule_name] matchrule = .*EDIPI@mil maprule = (userCertificate;binary={cert!bin}) dmains = testing.test Restart the "sssd" service for the changes to take effect. To restart the "sssd" service, run the following command: $ sudo systemctl restart sssd.service
- RMF Control
- Severity
- M
- CCI
- CCI-004066
- Version
- TOSS-05-000330
- Vuln IDs
-
- V-282445
- Rule IDs
-
- SV-282445r1200315_rule
Checks: C-87006r1200313_chk
Verify TOSS 5 is configured to limit the "pwquality" retry option to "3". Verify the use of the "pwquality" retry option in the "system-auth file" using the following command: $ cat /etc/pam.d/system-auth | grep pam_pwquality password required pam_pwquality.so retry=3 If the value of "retry" is set to "0" or greater than "3", or is missing, this is a finding.
Fix: F-86911r1200314_fix
Configure TOSS 5 to limit the "pwquality" retry option to "3". Add the following line to the "/etc/pam.d/system-auth" file (or modify the line to have the required value): password required pam_pwquality.so retry=3
- RMF Control
- Severity
- H
- CCI
- CCI-004066
- Version
- TOSS-05-000334
- Vuln IDs
-
- V-282446
- Rule IDs
-
- SV-282446r1200318_rule
Checks: C-87007r1200316_chk
Verify TOSS 5 uses "pwquality" to enforce the password complexity rules in the "password-auth" file using the following command: $ cat /etc/pam.d/password-auth | grep pam_pwquality password required pam_pwquality.so If the command does not return a line containing the value "pam_pwquality.so", or the line is commented out, this is a finding.
Fix: F-86912r1200317_fix
Configure TOSS 5 to use "pwquality" to enforce password complexity rules. Add the following line to the "/etc/pam.d/password-auth" file (or modify the line to have the required value): password required pam_pwquality.so
- RMF Control
- Severity
- M
- CCI
- CCI-004066
- Version
- TOSS-05-000348
- Vuln IDs
-
- V-282447
- Rule IDs
-
- SV-282447r1200321_rule
Checks: C-87008r1200319_chk
Verify TOSS 5 enforces password complexity by requiring at least one uppercase character. Check the value for "ucredit" using the following command: $ sudo grep ucredit /etc/security/pwquality.conf /etc/security/pwquality.conf/*.conf ucredit = -1 If the value of "ucredit" is a positive number or is commented out, this is a finding.
Fix: F-86913r1200320_fix
Configure TOSS 5 to enforce password complexity by requiring that at least one uppercase character be used by setting the "ucredit" option. Add the following line to /etc/security/pwquality.conf (or modify the line to have the required value): ucredit = -1
- RMF Control
- Severity
- M
- CCI
- CCI-004066
- Version
- TOSS-05-000339
- Vuln IDs
-
- V-282448
- Rule IDs
-
- SV-282448r1200324_rule
Checks: C-87009r1200322_chk
Verify TOSS 5 enforces password complexity by requiring at least one lowercase character. Check the value for "lcredit" using the following command: $ sudo grep lcredit /etc/security/pwquality.conf /etc/security/pwquality.conf/*.conf /etc/security/pwquality.conf:lcredit = -1 If the value of "lcredit" is a positive number or is commented out, this is a finding.
Fix: F-86914r1200323_fix
Configure TOSS 5 to enforce password complexity by requiring at least one lowercase character be used by setting the "lcredit" option. Add the following line to "/etc/security/pwquality.conf" (or modify the line to have the required value): lcredit = -1
- RMF Control
- Severity
- M
- CCI
- CCI-004066
- Version
- TOSS-05-000340
- Vuln IDs
-
- V-282449
- Rule IDs
-
- SV-282449r1200327_rule
Checks: C-87010r1200325_chk
Verify TOSS 5 enforces password complexity by requiring at least one numeric character. Check the value for "dcredit" using the following command: $ sudo grep dcredit /etc/security/pwquality.conf /etc/security/pwquality.conf/*.conf /etc/security/pwquality.conf:dcredit = -1 If the value of "dcredit" is a positive number or is commented out, this is a finding.
Fix: F-86915r1200326_fix
Configure TOSS 5 to enforce password complexity by requiring at least one numeric character be used by setting the "dcredit" option. Add the following line to "/etc/security/pwquality.conf" (or modify the line to have the required value): dcredit = -1
- RMF Control
- Severity
- M
- CCI
- CCI-004066
- Version
- TOSS-05-000338
- Vuln IDs
-
- V-282450
- Rule IDs
-
- SV-282450r1200330_rule
Checks: C-87011r1200328_chk
Verify TOSS 5 enforces password complexity rules for the root account. Check if root user is required to use complex passwords using the following command: $ grep enforce_for_root /etc/security/pwquality.conf /etc/security/pwquality.conf/*.conf /etc/security/pwquality.conf:enforce_for_root If "enforce_for_root" is commented or missing, this is a finding.
Fix: F-86916r1200329_fix
Configure TOSS 5 to enforce password complexity on the root account. Add or update the following line in "/etc/security/pwquality.conf": enforce_for_root
- RMF Control
- Severity
- M
- CCI
- CCI-004066
- Version
- TOSS-05-000349
- Vuln IDs
-
- V-282451
- Rule IDs
-
- SV-282451r1200333_rule
Checks: C-87012r1200331_chk
Verify the value of the "difok" option in "/etc/security/pwquality.conf" using the following command: $ sudo grep difok /etc/security/pwquality.conf difok = 8 If the value of "difok" is set to less than "8", or is commented out, this is a finding.
Fix: F-86917r1200332_fix
Configure TOSS 5 to require the change of at least eight of the total number of characters when passwords are changed by setting the "difok" option. Add the following line to "/etc/security/pwquality.conf" (or modify the line to have the required value): difok = 8
- RMF Control
- Severity
- M
- CCI
- CCI-004066
- Version
- TOSS-05-000350
- Vuln IDs
-
- V-282452
- Rule IDs
-
- SV-282452r1200336_rule
Checks: C-87013r1200334_chk
Verify the value of the "maxclassrepeat" option in "/etc/security/pwquality.conf" using the following command: $ grep maxclassrepeat /etc/security/pwquality.conf maxclassrepeat = 4 If the value of "maxclassrepeat" is set to "0", more than "4", or is commented out, this is a finding.
Fix: F-86918r1200335_fix
Configure TOSS 5 to require the change of the number of repeating characters of the same character class when passwords are changed by setting the "maxclassrepeat" option. Add the following line to "/etc/security/pwquality.conf" conf (or modify the line to have the required value): maxclassrepeat = 4
- RMF Control
- Severity
- M
- CCI
- CCI-004066
- Version
- TOSS-05-000351
- Vuln IDs
-
- V-282453
- Rule IDs
-
- SV-282453r1200339_rule
Checks: C-87014r1200337_chk
Verify the value of the "maxrepeat" option in "/etc/security/pwquality.conf" using the following command: $ grep maxrepeat /etc/security/pwquality.conf maxrepeat = 3 If the value of "maxrepeat" is set to more than "3", or is commented out, this is a finding.
Fix: F-86919r1200338_fix
Configure TOSS 5 to require changing the number of repeating consecutive characters when passwords are changed by setting the "maxrepeat" option. Add the following line to "/etc/security/pwquality.conf" (or modify the line to have the required value): maxrepeat = 3
- RMF Control
- Severity
- M
- CCI
- CCI-004066
- Version
- TOSS-05-000352
- Vuln IDs
-
- V-282454
- Rule IDs
-
- SV-282454r1200342_rule
Checks: C-87015r1200340_chk
Verify the value of the "minclass" option in "/etc/security/pwquality.conf" using the following command: $ grep minclass /etc/security/pwquality.conf minclass = 4 If the value of "minclass" is set to less than "4", or is commented out, this is a finding.
Fix: F-86920r1200341_fix
Configure TOSS 5 to require the change of at least four character classes when passwords are changed by setting the "minclass" option. Add the following line to "/etc/security/pwquality.conf" (or modify the line to have the required value): minclass = 4
- RMF Control
- Severity
- M
- CCI
- CCI-004062
- Version
- TOSS-05-000336
- Vuln IDs
-
- V-282455
- Rule IDs
-
- SV-282455r1201382_rule
Checks: C-87016r1201381_chk
Verify the number of rounds for the password hashing algorithm is configured using the following command: $ sudo grep rounds /etc/pam.d/password-auth password sufficient pam_unix.so sha512 rounds=5000 If a matching line is not returned or "rounds" is less than "5000", this is a finding.
Fix: F-86921r1200344_fix
Configure Red Hat Enterprise Linux 9 to use 5000 hashing rounds for hashing passwords. Add or modify the following line in "/etc/pam.d/password-auth" and set "rounds" to "5000". password sufficient pam_unix.so sha512 rounds=5000
- RMF Control
- Severity
- M
- CCI
- CCI-004062
- Version
- TOSS-05-000337
- Vuln IDs
-
- V-282456
- Rule IDs
-
- SV-282456r1201574_rule
Checks: C-87017r1201572_chk
Verify the number of rounds for the password hashing algorithm is configured using the following command: $ sudo grep rounds /etc/pam.d/system-auth password sufficient pam_unix.so sha512 rounds=5000 If a matching line is not returned or "rounds" is less than "5000", this is a finding.
Fix: F-86922r1201573_fix
Configure Red Hat Enterprise Linux 9 to use 5000 hashing rounds for hashing passwords. Add or modify the following line in "/etc/pam.d/system-auth" and set "rounds" to "5000". password sufficient pam_unix.so sha512 rounds=5000'
- RMF Control
- Severity
- M
- CCI
- CCI-004062
- Version
- TOSS-05-000353
- Vuln IDs
-
- V-282457
- Rule IDs
-
- SV-282457r1200351_rule
Checks: C-87018r1200349_chk
Verify the user and group account administration utilities are configured to store only encrypted representations of passwords using the following command: # grep crypt /etc/libuser.conf crypt_style = sha512 If the "crypt_style" variable is not set to "sha512", is not in the defaults section, is commented out, or does not exist, this is a finding.
Fix: F-86923r1200350_fix
Configure TOSS 5 to use the SHA-512 algorithm for password hashing. Add or change the following line in the "[default]" section of "/etc/libuser.conf" file: crypt_style = sha512
- RMF Control
- Severity
- M
- CCI
- CCI-004062
- Version
- TOSS-05-000354
- Vuln IDs
-
- V-282458
- Rule IDs
-
- SV-282458r1200354_rule
Checks: C-87019r1200352_chk
Verify the system's shadow file is configured to store only encrypted representations of passwords with a hash value of "SHA512" using the following command: # grep -i encrypt_method /etc/login.defs ENCRYPT_METHOD SHA512 If "ENCRYPT_METHOD" does not have a value of "SHA512", or the line is commented out, this is a finding.
Fix: F-86924r1200353_fix
Configure TOSS 5 to store only SHA-512 encrypted representations of passwords. Add or update the following line in the "/etc/login.defs" file: ENCRYPT_METHOD SHA512
- RMF Control
- Severity
- M
- CCI
- CCI-004062
- Version
- TOSS-05-000356
- Vuln IDs
-
- V-282459
- Rule IDs
-
- SV-282459r1200357_rule
Checks: C-87020r1200355_chk
Verify TOSS 5 has a minimum number of hash rounds configured using the following command: $ grep -i sha_crypt /etc/login.defs If "SHA_CRYPT_MIN_ROUNDS" or "SHA_CRYPT_MAX_ROUNDS" is less than "5000", this is a finding.
Fix: F-86925r1200356_fix
Configure TOSS 5 to encrypt all stored passwords with a strong cryptographic hash. Edit/modify the following line in the "/etc/login.defs" file and set "SHA_CRYPT_MIN_ROUNDS" to a value no lower than "5000": SHA_CRYPT_MIN_ROUNDS 5000
- RMF Control
- Severity
- M
- CCI
- CCI-004062
- Version
- TOSS-05-000465
- Vuln IDs
-
- V-282460
- Rule IDs
-
- SV-282460r1200360_rule
Checks: C-87021r1200358_chk
Verify the interactive user account passwords are using a strong password hash using the following command: $ sudo cut -d: -f2 /etc/shadow $6$kcOnRq/5$NUEYPuyL.wghQwWssXRcLRFiiru7f5JPV6GaJhNC2aK5F3PZpE/BCCtwrxRc/AInKMNX3CdMw11m9STiql12f/ Password hashes "!" or "*" indicate inactive accounts not available for login and are not evaluated. If any interactive user password hash does not begin with "$6", this is a finding.
Fix: F-86926r1200359_fix
Lock all interactive user accounts not using SHA-512 hashing until the passwords can be regenerated with SHA-512.
- RMF Control
- Severity
- M
- CCI
- CCI-004062
- Version
- TOSS-05-000467
- Vuln IDs
-
- V-282461
- Rule IDs
-
- SV-282461r1200363_rule
Checks: C-87022r1200361_chk
Verify the pam_unix.so module is configured to use sha512 in /etc/pam.d/password-auth using the following command: $ grep "^password.*pam_unix.so.*sha512" /etc/pam.d/password-auth password sufficient pam_unix.so sha512 If "sha512" is missing, or the line is commented out, this is a finding.
Fix: F-86927r1200362_fix
Configure TOSS 5 to use a FIPS 140-3-approved cryptographic hashing algorithm for system authentication. Edit or modify the following line in the "/etc/pam.d/password-auth" file to include the sha512 option for pam_unix.so: password sufficient pam_unix.so sha512
- RMF Control
- IA-5
- Severity
- M
- CCI
- CCI-000197
- Version
- TOSS-05-000038
- Vuln IDs
-
- V-282462
- Rule IDs
-
- SV-282462r1200366_rule
Checks: C-87023r1200364_chk
Determine if the rsh-server package is installed using the following command: $ sudo yum list installed rsh-server If the rsh-server package is installed, this is a finding.
Fix: F-86928r1200365_fix
Configure the operating system to disable nonessential capabilities by removing the rsh-server package from the system using the following command: $ sudo yum remove rsh-server
- RMF Control
- Severity
- M
- CCI
- CCI-004066
- Version
- TOSS-05-000341
- Vuln IDs
-
- V-282463
- Rule IDs
-
- SV-282463r1200369_rule
Checks: C-87024r1200367_chk
Verify TOSS 5 enforces 24 hours as the minimum password lifetime for new user accounts. Check for the value of "PASS_MIN_DAYS" in "/etc/login.defs" using the following command: $ grep -i pass_min_days /etc/login.defs PASS_MIN_DAYS 1 If the "PASS_MIN_DAYS" parameter value is not "1" or greater, or is commented out, this is a finding.
Fix: F-86929r1200368_fix
Configure TOSS 5 to enforce 24 hours as the minimum password lifetime. Add the following line in "/etc/login.defs" (or modify the line to have the required value): PASS_MIN_DAYS 1
- RMF Control
- Severity
- M
- CCI
- CCI-004066
- Version
- TOSS-05-000342
- Vuln IDs
-
- V-282464
- Rule IDs
-
- SV-282464r1200372_rule
Checks: C-87025r1200370_chk
Verify TOSS 5 has configured the minimum time period between password changes for each user account as one day or greater using the following command: $ sudo awk -F: '$4 < 1 {print $1 " " $4}' /etc/shadow If any results are returned that are not associated with a system account, this is a finding.
Fix: F-86930r1200371_fix
Configure noncompliant accounts to enforce a 24 hour minimum password lifetime: $ sudo passwd -n 1 [user]
- RMF Control
- Severity
- M
- CCI
- CCI-004066
- Version
- TOSS-05-000291
- Vuln IDs
-
- V-282465
- Rule IDs
-
- SV-282465r1200375_rule
Checks: C-87026r1200373_chk
Verify TOSS 5 enforces a 60-day maximum password lifetime for new user accounts using the following command: $ grep -i pass_max_days /etc/login.defs PASS_MAX_DAYS 60 If the "PASS_MAX_DAYS" parameter value is greater than "60" or commented out, this is a finding.
Fix: F-86931r1200374_fix
Configure TOSS 5 to enforce a 60-day maximum password lifetime. Add or modify the following line in the "/etc/login.defs" file: PASS_MAX_DAYS 60
- RMF Control
- Severity
- M
- CCI
- CCI-004066
- Version
- TOSS-05-000292
- Vuln IDs
-
- V-282466
- Rule IDs
-
- SV-282466r1200378_rule
Checks: C-87027r1200376_chk
Check whether the maximum time period for existing passwords is restricted to 60 days with the following commands: $ sudo awk -F: '$5 > 60 {print $1 "" "" $5}' /etc/shadow $ sudo awk -F: '$5 <= 0 {print $1 "" "" $5}' /etc/shadow If any results are returned that are not associated with a system account, this is a finding.
Fix: F-86932r1200377_fix
Configure noncompliant accounts to enforce a 60-day maximum password lifetime restriction. passwd -x 60 [user]
- RMF Control
- Severity
- M
- CCI
- CCI-004066
- Version
- TOSS-05-000344
- Vuln IDs
-
- V-282467
- Rule IDs
-
- SV-282467r1200381_rule
Checks: C-87028r1200379_chk
Verify TOSS 5 enforces a minimum 15-character password length using the following command: $ grep minlen /etc/security/pwquality.conf minlen = 15 If the command does not return a "minlen" value of "15" or greater, does not return a line, or the line is commented out, this is a finding.
Fix: F-86933r1200380_fix
Configure TOSS 5 to enforce a minimum 15-character password length. Add the following line to "/etc/security/pwquality.conf" (or modify the line to have the required value): minlen = 15
- RMF Control
- Severity
- M
- CCI
- CCI-004066
- Version
- TOSS-05-000345
- Vuln IDs
-
- V-282468
- Rule IDs
-
- SV-282468r1200384_rule
Checks: C-87029r1200382_chk
Verify TOSS 5 enforces a minimum 15-character password length for new user accounts using the following command: $ sudo grep -i pass_min_len /etc/login.defs PASS_MIN_LEN 15 If the command does not return a "PASS_MIN_LEN" value of "15" or greater, does not return a line, or the line is commented out, this is a finding.
Fix: F-86934r1200383_fix
Configure TOSS 5 to enforce a minimum 15-character password length for new user accounts. Add or modify the following line in the "/etc/login.defs" file: PASS_MIN_LEN 15
- RMF Control
- AC-3
- Severity
- H
- CCI
- CCI-000213
- Version
- TOSS-05-000094
- Vuln IDs
-
- V-282470
- Rule IDs
-
- SV-282470r1201601_rule
Checks: C-87031r1200388_chk
Verify the boot loader superuser account has been set using the following command: $ sudo grep -A1 "superusers" /etc/grub2.cfg set superusers="<superusers-account>" export superusers The <superusers-account> is the actual account name, which is different from common names like "root", "admin", or "administrator". If superusers contains easily guessable usernames, this is a finding.
Fix: F-86936r1200389_fix
Configure TOSS 5 to have a unique username for the grub superuser account. Edit the "/etc/grub.d/01_users" file and add or modify the following lines in the "### BEGIN /etc/grub.d/01_users ###" section: set superusers="superusers-account" export superusers Once the superuser account has been added, update the grub.cfg file using the following command: $ sudo grubby --update-kernel=ALL
- RMF Control
- AC-3
- Severity
- M
- CCI
- CCI-000213
- Version
- TOSS-05-000364
- Vuln IDs
-
- V-282471
- Rule IDs
-
- SV-282471r1200393_rule
Checks: C-87032r1200391_chk
Verify TOSS 5 requires authentication for emergency mode using the following command: $ grep sulogin /usr/lib/systemd/system/emergency.service ExecStart=-/usr/lib/systemd/systemd-sulogin-shell emergency If this line is not returned, or is commented out, this is a finding. If the output is different, this is a finding.
Fix: F-86937r1200392_fix
Configure TOSS 5 to require authentication for emergency mode. Add or modify the following line in the "/usr/lib/systemd/system/emergency.service" file: ExecStart=-/usr/lib/systemd/systemd-sulogin-shell emergency
- RMF Control
- AC-3
- Severity
- M
- CCI
- CCI-000213
- Version
- TOSS-05-000365
- Vuln IDs
-
- V-282472
- Rule IDs
-
- SV-282472r1200396_rule
Checks: C-87033r1200394_chk
Verify TOSS 5 requires authentication for single-user mode using the following command: $ grep sulogin /usr/lib/systemd/system/rescue.service ExecStart=-/usr/lib/systemd/systemd-sulogin-shell rescue If this line is not returned, or is commented out, this is a finding.
Fix: F-86938r1200395_fix
Configure TOSS 5 to require authentication for single-user mode. Add or modify the following line in the "/usr/lib/systemd/system/rescue.service" file: ExecStart=-/usr/lib/systemd/systemd-sulogin-shell rescue
- RMF Control
- CM-7
- Severity
- L
- CCI
- CCI-000381
- Version
- TOSS-05-000032
- Vuln IDs
-
- V-282473
- Rule IDs
-
- SV-282473r1200399_rule
Checks: C-87034r1200397_chk
Verify TOSS 5 enables kernel page-table isolation using the following command: $ sudo grubby --info=ALL | grep pti args="ro crashkernel=auto resume=/dev/mapper/rhel-swap rd.lvm.lv=rhel/root rd.lvm.lv=rhel/swap rhgb quiet fips=1 audit=1 audit_backlog_limit=8192 pti=on If the "pti" entry does not equal "on" or is missing, this is a finding.
Fix: F-86939r1200398_fix
Configure TOSS 5 to enable kernel page-table isolation using the following command: $ sudo grubby --update-kernel=ALL --args="pti=on" Add or modify the following line in "/etc/default/grub" to ensure the configuration survives kernel updates: GRUB_CMDLINE_LINUX="pti=on"
- RMF Control
- CM-7
- Severity
- M
- CCI
- CCI-000381
- Version
- TOSS-05-000104
- Vuln IDs
-
- V-282474
- Rule IDs
-
- SV-282474r1200402_rule
Checks: C-87035r1200400_chk
Verify TOSS 5 disables the ability to load the ATM kernel module using the following command: $ sudo grep -r atm /etc/modprobe.conf /etc/modprobe.d/* blacklist atm If the command does not return any output, or the line is commented out, and use of ATM is not documented with the information system security officer (ISSO) as an operational requirement, this is a finding.
Fix: F-86940r1200401_fix
Configure the system to prevent the atm kernel module from being loaded by adding the following line to the file /etc/modprobe.d/atm.conf (or create atm.conf if it does not exist): install atm /bin/false blacklist atm
- RMF Control
- CM-7
- Severity
- M
- CCI
- CCI-000381
- Version
- TOSS-05-000105
- Vuln IDs
-
- V-282475
- Rule IDs
-
- SV-282475r1200405_rule
Checks: C-87036r1200403_chk
Verify TOSS 5 disables the ability to load the "CAN" kernel module using the following command: $ sudo grep -r can /etc/modprobe.conf /etc/modprobe.d/* blacklist can If the command does not return any output, or the line is commented out, and use of CAN is not documented with the information system security officer (ISSO) as an operational requirement, this is a finding.
Fix: F-86941r1200404_fix
Configure the system to prevent the "CAN" kernel module from being loaded by adding the following line to the file /etc/modprobe.d/can.conf (or create atm.conf if it does not exist): install can /bin/false blacklist can
- RMF Control
- CM-7
- Severity
- M
- CCI
- CCI-000381
- Version
- TOSS-05-000106
- Vuln IDs
-
- V-282476
- Rule IDs
-
- SV-282476r1200408_rule
Checks: C-87037r1200406_chk
Verify TOSS 5 disables the ability to load the "firewire-core" kernel module using the following command: $ sudo grep -r firewire-core /etc/modprobe.conf /etc/modprobe.d/* blacklist firewire-core If the command does not return any output, or the line is commented out, and use of firewire-core is not documented with the information system security officer (ISSO) as an operational requirement, this is a finding.
Fix: F-86942r1200407_fix
To configure the system to prevent the "firewire-core" kernel module from being loaded, add the following line to the file /etc/modprobe.d/firewire-core.conf (or create firewire-core.conf if it does not exist): install firewire-core /bin/false blacklist firewire-core
- RMF Control
- CM-7
- Severity
- M
- CCI
- CCI-000381
- Version
- TOSS-05-000107
- Vuln IDs
-
- V-282477
- Rule IDs
-
- SV-282477r1200411_rule
Checks: C-87038r1200409_chk
Verify TOSS 5 disables the ability to load the "sctp" kernel module using the following command: $ sudo grep -r sctp /etc/modprobe.conf /etc/modprobe.d/* blacklist sctp If the command does not return any output, or the line is commented out, and use of sctp is not documented with the information system security officer (ISSO) as an operational requirement, this is a finding.
Fix: F-86943r1200410_fix
To configure the system to prevent the "sctp" kernel module from being loaded, add the following line to the file /etc/modprobe.d/sctp.conf (or create sctp.conf if it does not exist): install sctp /bin/false blacklist sctp
- RMF Control
- CM-7
- Severity
- M
- CCI
- CCI-000381
- Version
- TOSS-05-000108
- Vuln IDs
-
- V-282478
- Rule IDs
-
- SV-282478r1200414_rule
Checks: C-87039r1200412_chk
Verify TOSS 5 disables the ability to load the "tipc" kernel module using the following command: $ sudo grep -r tipc /etc/modprobe.conf /etc/modprobe.d/* blacklist tipc If the command does not return any output, or the line is commented out, and use of TIPC is not documented with the information system security officer (ISSO) as an operational requirement, this is a finding.
Fix: F-86944r1200413_fix
To configure the system to prevent the "tipc" kernel module from being loaded, add the following line to the file /etc/modprobe.d/tipc.conf (or create tipc.conf if it does not exist): install tipc /bin/false blacklist tipc
- RMF Control
- CM-7
- Severity
- M
- CCI
- CCI-000381
- Version
- TOSS-05-000123
- Vuln IDs
-
- V-282479
- Rule IDs
-
- SV-282479r1200417_rule
Checks: C-87040r1200415_chk
Verify the "ypserv" package is not installed using the following command: $ sudo dnf list --installed ypserv Error: No matching Packages to list If the "ypserv" package is installed, this is a finding.
Fix: F-86945r1200416_fix
Remove the "ypserv" package using the following command: $ sudo dnf remove ypserv
- RMF Control
- CM-7
- Severity
- M
- CCI
- CCI-000381
- Version
- TOSS-05-000124
- Vuln IDs
-
- V-282480
- Rule IDs
-
- SV-282480r1200420_rule
Checks: C-87041r1200418_chk
Verify the "rsh-server" package is not installed using the following command: $ sudo dnf list --installed rsh-server Error: No matching Packages to list If the "rsh-server" package is installed, this is a finding.
Fix: F-86946r1200419_fix
Remove the "rsh-server" package using the following command: $ sudo dnf remove rsh-server
- RMF Control
- CM-7
- Severity
- M
- CCI
- CCI-000381
- Version
- TOSS-05-000125
- Vuln IDs
-
- V-282481
- Rule IDs
-
- SV-282481r1200423_rule
Checks: C-87042r1200421_chk
Verify the "telnet-server" package is not installed using the following command: $ sudo dnf list --installed telnet-server Error: No matching Packages to list If the "telnet-server" package is installed, this is a finding.
Fix: F-86947r1200422_fix
Remove the "telnet-server" package using the following command: $ sudo dnf remove telnet-server
- RMF Control
- CM-7
- Severity
- M
- CCI
- CCI-000381
- Version
- TOSS-05-000126
- Vuln IDs
-
- V-282482
- Rule IDs
-
- SV-282482r1200426_rule
Checks: C-87043r1200424_chk
Verify the "iprutils" package is not installed using the following command: $ sudo dnf list --installed iprutils Error: No matching Packages to list If the "iprutils" package is installed and is not documented with the information system security officer (ISSO) as an operational requirement, this is a finding.
Fix: F-86948r1200425_fix
Remove the "iprutils" package using the following command: $ sudo dnf remove iprutils
- RMF Control
- CM-7
- Severity
- L
- CCI
- CCI-000381
- Version
- TOSS-05-000138
- Vuln IDs
-
- V-282483
- Rule IDs
-
- SV-282483r1200429_rule
Checks: C-87044r1200427_chk
Verify TOSS 5 disables the ability to load the "cramfs" kernel module using the following command: $ sudo grep -r cramfs /etc/modprobe.conf /etc/modprobe.d/* blacklist cramfs If the command does not return any output, or the line is commented out, and use of "cramfs" is not documented with the information system security officer (ISSO) as an operational requirement, this is a finding.
Fix: F-86949r1200428_fix
To configure the system to prevent the "cramfs" kernel module from being loaded, add the following line to the file "/etc/modprobe.d/blacklist.conf" (or create blacklist.conf if it does not exist): install cramfs /bin/false blacklist cramfs
- RMF Control
- CM-7
- Severity
- L
- CCI
- CCI-000381
- Version
- TOSS-05-000203
- Vuln IDs
-
- V-282484
- Rule IDs
-
- SV-282484r1201332_rule
Checks: C-87045r1200430_chk
Verify TOSS 5 disables network management of the chrony daemon using the following command: $ grep -w cmdport /etc/chrony.conf cmdport 0 If the "cmdport" option is not set to "0", is commented out, or is missing, this is a finding.
Fix: F-86950r1201331_fix
Configure TOSS 5 to disable network management of the chrony daemon by adding/modifying the following line in the "/etc/chrony.conf" file: cmdport 0
- RMF Control
- CM-7
- Severity
- M
- CCI
- CCI-000382
- Version
- TOSS-05-000192
- Vuln IDs
-
- V-282485
- Rule IDs
-
- SV-282485r1200435_rule
Checks: C-87046r1200433_chk
Run the following command to determine if the "firewalld" package is installed: $ sudo dnf list --installed firewalld Example output: firewalld.noarch 1.0.0-4.el9 If the "firewalld" package is not installed, this is a finding.
Fix: F-86951r1200434_fix
Install the "firewalld" package using the following command: $ sudo dnf install firewalld
- RMF Control
- CM-7
- Severity
- M
- CCI
- CCI-000382
- Version
- TOSS-05-000193
- Vuln IDs
-
- V-282486
- Rule IDs
-
- SV-282486r1200438_rule
Checks: C-87047r1200436_chk
Verify "firewalld" is active using the following command: $ systemctl is-active firewalld active If the "firewalld" service is not active, this is a finding.
Fix: F-86952r1200437_fix
Enable the "firewalld" service using the following command: $ sudo systemctl enable --now firewalld
- RMF Control
- CM-7
- Severity
- M
- CCI
- CCI-000382
- Version
- TOSS-05-000195
- Vuln IDs
-
- V-282487
- Rule IDs
-
- SV-282487r1200441_rule
Checks: C-87048r1200439_chk
Inspect the list of enabled firewall ports and verify they are configured correctly using the following command: $ sudo firewall-cmd --list-all Ask the system administrator for the site or program Ports, Protocols, and Services Management Component Local Service Assessment (PPSM CLSA). Verify the services allowed by the firewall match the PPSM CLSA, or other applicable documentation approved by the information system security officer (ISSO). If there are additional ports, protocols, or services that are not in the PPSM CLSA, or there are ports, protocols, or services that are prohibited by the PPSM Category Assurance List (CAL), or there are no firewall rules configured, this is a finding.
Fix: F-86953r1200440_fix
Configure TOSS 5 to allow approved settings and/or running services to comply with the PPSM CLSA for the site or program and the PPSM CAL, or other applicable documentation approved by the ISSO. To open a port for a service, configure "firewalld" using the following command: $ sudo firewall-cmd --permanent --add-port=port_number/tcp or $ sudo firewall-cmd --permanent --add-service=service_name
- RMF Control
- CM-7
- Severity
- M
- CCI
- CCI-000382
- Version
- TOSS-05-000197
- Vuln IDs
-
- V-282488
- Rule IDs
-
- SV-282488r1200444_rule
Checks: C-87049r1200442_chk
Inspect the firewall configuration and running services to verify it is configured to prohibit or restrict the use of functions, ports, protocols, and/or services that are unnecessary or prohibited. Check which services are currently active using the following command: $ sudo firewall-cmd --list-all-zones custom (active) target: DROP icmp-block-inversion: no interfaces: ens33 sources: services: dhcpv6-client dns http https ldaps rpc-bind ssh ports: masquerade: no forward-ports: icmp-blocks: rich rules: Ask the system administrator for the site or program PPSM Component Local Service Assessment (CLSA). Verify the services allowed by the firewall match the PPSM CLSA, or other applicable documentation approved by the information system security officer (ISSO). If there are additional ports, protocols, or services that are not in the PPSM CLSA; or there are ports, protocols, or services that are prohibited by the PPSM CAL, this is a finding.
Fix: F-86954r1200443_fix
Update the host's firewall settings and/or running services to comply with the PPSM CLSA for the site or program and the PPSM CAL, or other applicable documentation approved by the ISSO. Run the following command to load the newly created rule(s): $ sudo firewall-cmd --reload
- RMF Control
- IA-2
- Severity
- M
- CCI
- CCI-000764
- Version
- TOSS-05-000295
- Vuln IDs
-
- V-282489
- Rule IDs
-
- SV-282489r1200447_rule
Checks: C-87050r1200445_chk
Verify TOSS 5 contains no duplicate UIDs for interactive users using the following command: $ sudo awk -F ":" 'list[$3]++{print $1, $3}' /etc/passwd If output is produced and the accounts listed are interactive user accounts, this is a finding.
Fix: F-86955r1200446_fix
Edit the file "/etc/passwd" and provide each interactive user account that has a duplicate UID with a unique UID.
- RMF Control
- IA-2
- Severity
- M
- CCI
- CCI-000764
- Version
- TOSS-05-000298
- Vuln IDs
-
- V-282490
- Rule IDs
-
- SV-282490r1200450_rule
Checks: C-87051r1200448_chk
Verify all TOSS 5 interactive users have a valid GID using the following command: $ sudo pwck -qr If the system has any interactive users with duplicate GIDs, this is a finding.
Fix: F-86956r1200449_fix
Configure the system so all GIDs referenced in "/etc/passwd" are defined in "/etc/group". Edit the file "/etc/passwd" and ensure every user's GID is a valid GID.
- RMF Control
- IA-2
- Severity
- M
- CCI
- CCI-000764
- Version
- TOSS-05-000309
- Vuln IDs
-
- V-282491
- Rule IDs
-
- SV-282491r1200453_rule
Checks: C-87052r1200451_chk
Verify TOSS 5 contains no duplicate GIDs for interactive users using the following command: $ cut -d : -f 3 /etc/group | uniq -d If the system has duplicate GIDs, this is a finding.
Fix: F-86957r1200452_fix
Edit the file "/etc/group" and provide each group that has a duplicate GID with a unique GID.
- RMF Control
- IA-2
- Severity
- M
- CCI
- CCI-000765
- Version
- TOSS-05-000128
- Vuln IDs
-
- V-282492
- Rule IDs
-
- SV-282492r1200456_rule
Checks: C-87053r1200454_chk
Verify TOSS 5 has the "openssl-pkcs11" package installed using the following command: $ sudo dnf list --installed openssl-pkcs11 Example output: openssl-pkcs.i686 0.4.11-7.el9 openssl-pkcs.x86_64 0.4.11-7.el9 If the "openssl-pkcs11" package is not installed, this is a finding.
Fix: F-86958r1200455_fix
The "openssl-pkcs11" package can be installed using the following command: $ sudo dnf install openssl-pkcs11
- RMF Control
- IA-2
- Severity
- H
- CCI
- CCI-000766
- Version
- TOSS-05-000238
- Vuln IDs
-
- V-282493
- Rule IDs
-
- SV-282493r1200459_rule
Checks: C-87054r1200457_chk
Verify TOSS 5 remote access using SSH prevents logging on with a blank password using the following command: $ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH '^\s*permitemptypasswords' PermitEmptyPassword no If the "PermitEmptyPassword" keyword is set to "yes", is missing, or is commented out, this is a finding.
Fix: F-86959r1200458_fix
Configure the system to prevent SSH users from logging on with blank passwords by editing the following line in "etc/ssh/sshd_config": PermitEmptyPasswords no Restart the SSH daemon for the settings to take effect: $ sudo systemctl restart sshd.service
- RMF Control
- Severity
- M
- CCI
- CCI-004045
- Version
- TOSS-05-000239
- Vuln IDs
-
- V-282494
- Rule IDs
-
- SV-282494r1200462_rule
Checks: C-87055r1200460_chk
Verify TOSS 5 remote access using SSH prevents users from logging on directly as "root" using the following command: $ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH '^\s*permitrootlogin' PermitRootLogin no If the "PermitRootLogin" keyword is set to "yes", is missing, or is commented out, this is a finding.
Fix: F-86960r1200461_fix
Configure the system to prevent SSH users from logging on directly as "root" by adding or modifying the following line in "/etc/ssh/sshd_config": PermitRootLogin no Restart the SSH daemon for the settings to take effect: $ sudo systemctl restart sshd.service
- RMF Control
- IA-3
- Severity
- M
- CCI
- CCI-000778
- Version
- TOSS-05-000133
- Vuln IDs
-
- V-282497
- Rule IDs
-
- SV-282497r1200471_rule
Checks: C-87058r1200469_chk
Verify TOSS 5 file system automount function has been disabled using the following command: $ sudo systemctl is-enabled autofs masked If the returned value is not "masked", "disabled", "Failed to get unit file state for autofs.service for autofs", or "enabled", and is not documented as operational requirement with the information system security officer (ISSO), this is a finding.
Fix: F-86963r1200470_fix
Configure TOSS 5 to disable the ability to automount devices. Disable the "autofs" service using the following command: $ sudo systemctl mask --now autofs.service
- RMF Control
- IA-3
- Severity
- M
- CCI
- CCI-000778
- Version
- TOSS-05-000264
- Vuln IDs
-
- V-282498
- Rule IDs
-
- SV-282498r1200474_rule
Checks: C-87059r1200472_chk
Verify TOSS 5 disables the graphical user interface automount function using the following command: Note: This requirement assumes the use of the TOSS 5 default graphical user interface—the GNOME desktop environment. If the system does not have a graphical user interface installed, this requirement is not applicable. $ gsettings get org.gnome.desktop.media-handling automount-open false If "automount-open" is set to "true" and is not documented with the information system security officer (ISSO) as an operational requirement, this is a finding.
Fix: F-86964r1200473_fix
Configure the GNOME desktop to disable automated mounting of removable media. The dconf settings can be edited in the /etc/dconf/db/* location. Update the [org/gnome/desktop/media-handling] section of the "/etc/dconf/db/local.d/00-security-settings" database file and add or update the following lines: [org/gnome/desktop/media-handling] automount-open=false Update the dconf system databases: $ sudo dconf update
- RMF Control
- IA-3
- Severity
- M
- CCI
- CCI-000778
- Version
- TOSS-05-000265
- Vuln IDs
-
- V-282499
- Rule IDs
-
- SV-282499r1200477_rule
Checks: C-87060r1200475_chk
Verify TOSS 5 disables ability of the user to override the graphical user interface automount setting. Note: This requirement assumes the use of the TOSS 5 default graphical user interface—the GNOME desktop environment. If the system does not have a graphical user interface installed, this requirement is not applicable. Determine which profile the system database is using by running the following command: $ sudo grep system-db /etc/dconf/profile/user system-db:local Verify the automount setting is locked from nonprivileged user modification using the following command: Note: The example below is using the database "local" for the system, so the path is "/etc/dconf/db/local.d". Modify this path if using a database other than "local". $ grep 'automount-open' /etc/dconf/db/local.d/locks/* /org/gnome/desktop/media-handling/automount-open If the command does not return at least the example result, this is a finding.
Fix: F-86965r1200476_fix
Configure the GNOME desktop to not allow a user to change the setting that disables automated mounting of removable media. Add the following line to "/etc/dconf/db/local.d/locks/00-security-settings-lock" to prevent user modification: /org/gnome/desktop/media-handling/automount-open Update the dconf system databases: $ sudo dconf update
- RMF Control
- IA-3
- Severity
- M
- CCI
- CCI-000778
- Version
- TOSS-05-000267
- Vuln IDs
-
- V-282500
- Rule IDs
-
- SV-282500r1200480_rule
Checks: C-87061r1200478_chk
Verify TOSS 5 disables the user's ability to override the graphical user interface autorun setting. Note: This requirement assumes the use of the TOSS 5 default graphical user interface—the GNOME desktop environment. If the system does not have a graphical user interface installed, this requirement is not applicable. Determine which profile the system database is using by running the following command: $ sudo grep system-db /etc/dconf/profile/user system-db:local Check that the automount setting is locked from nonprivileged user modification using the following command: Note: The example below is using the database "local" for the system, so the path is "/etc/dconf/db/local.d". This path must be modified if a database other than "local" is being used. $ grep 'autorun-never' /etc/dconf/db/local.d/locks/* /org/gnome/desktop/media-handling/autorun-never If the command does not return at least the example result, this is a finding.
Fix: F-86966r1200479_fix
Configure the GNOME desktop to not allow a user to change the setting that disables autorun on removable media. Add the following line to "/etc/dconf/db/local.d/locks/00-security-settings-lock" to prevent user modification: /org/gnome/desktop/media-handling/autorun-never Update the dconf system databases: $ sudo dconf update
- RMF Control
- IA-3
- Severity
- M
- CCI
- CCI-000778
- Version
- TOSS-05-000284
- Vuln IDs
-
- V-282501
- Rule IDs
-
- SV-282501r1200483_rule
Checks: C-87062r1200481_chk
Verify TOSS 5 disables the ability to load the USB Storage kernel module using the following command: $ sudo grep -r usb-storage /etc/modprobe.conf /etc/modprobe.d/* blacklist usb-storage If the command does not return any output, the line is commented out, and use of USB Storage is not documented with the information system security officer (ISSO) as an operational requirement, this is a finding.
Fix: F-86967r1200482_fix
Configure the system to prevent the usb-storage kernel module from being loaded by adding the following line to the file /etc/modprobe.d/usb-storage.conf (or create usb-storage.conf if it does not exist): install usb-storage /bin/false blacklist usb-storage
- RMF Control
- Severity
- M
- CCI
- CCI-003627
- Version
- TOSS-05-000299
- Vuln IDs
-
- V-282502
- Rule IDs
-
- SV-282502r1200486_rule
Checks: C-87063r1200484_chk
Verify TOSS 5 account identifiers (individuals, groups, roles, and devices) are disabled after 35 days of inactivity using the following command: Check the account inactivity value by performing the following command: $ sudo grep -i inactive /etc/default/useradd INACTIVE=35 If "INACTIVE" is set to "-1", a value greater than "35", or is commented out, this is a finding.
Fix: F-86968r1200485_fix
Configure TOSS 5 to disable account identifiers after 35 days of inactivity after the password expiration. Run the following command to change the configuration for "useradd": $ sudo useradd -D -f 35 The recommendation is 35 days, but a lower value is acceptable.
- RMF Control
- IA-7
- Severity
- M
- CCI
- CCI-000803
- Version
- TOSS-05-000471
- Vuln IDs
-
- V-282503
- Rule IDs
-
- SV-282503r1200489_rule
Checks: C-87064r1200487_chk
Verify the symlink exists and targets the correct Kerberos crypto policy, using the following command: file /etc/crypto-policies/back-ends/krb5.config If command output shows the following line, Kerberos is configured to use the systemwide crypto policy: /etc/crypto-policies/back-ends/krb5.config: symbolic link to /usr/share/crypto-policies/FIPS/krb5.txt If the symlink does not exist or points to a different target, this is a finding.
Fix: F-86969r1200488_fix
Configure Kerberos to use system crypto policy. Create a symlink pointing to system crypto policy in the Kerberos configuration using the following command: $ sudo ln -s /etc/crypto-policies/back-ends/krb5.config /usr/share/crypto-policies/FIPS/krb5.txt
- RMF Control
- MA-4
- Severity
- H
- CCI
- CCI-000877
- Version
- TOSS-05-000240
- Vuln IDs
-
- V-282504
- Rule IDs
-
- SV-282504r1200492_rule
Checks: C-87065r1200490_chk
Verify the TOSS 5 SSHD is configured to allow for the "UsePAM" interface using the following command: $ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH '^\s*usepam' UsePAM yes If the "UsePAM" keyword is set to "no", is missing, or is commented out, this is a finding.
Fix: F-86970r1200491_fix
Configure the TOSS 5 SSHD to use the "UsePAM" interface, by adding or modifying the following line in "/etc/ssh/sshd_config": UsePAM yes Restart the SSH daemon for the settings to take effect: $ sudo systemctl restart sshd.service
- RMF Control
- SC-2
- Severity
- M
- CCI
- CCI-001082
- Version
- TOSS-05-000098
- Vuln IDs
-
- V-282505
- Rule IDs
-
- SV-282505r1200495_rule
Checks: C-87066r1200493_chk
Verify TOSS 5 is configured to restrict access to the kernel message buffer with the following commands: $ sudo sysctl kernel.dmesg_restrict kernel.dmesg_restrict = 1 If "kernel.dmesg_restrict" is not set to "1" or is missing, this is a finding.
Fix: F-86971r1200494_fix
Configure TOSS 5 to restrict access to the kernel message buffer. Add or edit the following line in a system configuration file, in the "/etc/sysctl.d/" directory: kernel.dmesg_restrict = 1 Load settings from all system configuration files using the following command: $ sudo sysctl --system
- RMF Control
- SC-2
- Severity
- M
- CCI
- CCI-001082
- Version
- TOSS-05-000099
- Vuln IDs
-
- V-282506
- Rule IDs
-
- SV-282506r1200498_rule
Checks: C-87067r1200496_chk
Verify TOSS 5 is configured to prevent kernel profiling by nonprivileged users using the following command: $ sudo sysctl kernel.perf_event_paranoid kernel.perf_event_paranoid = 2 If "kernel.perf_event_paranoid" is not set to "2" or is missing, this is a finding.
Fix: F-86972r1200497_fix
Configure TOSS 5 to prevent kernel profiling by nonprivileged users. Add or edit the following line in a system configuration file, in the "/etc/sysctl.d/" directory: kernel.perf_event_paranoid = 2 Load settings from all system configuration files using the following command: $ sudo sysctl --system
- RMF Control
- SC-2
- Severity
- M
- CCI
- CCI-001082
- Version
- TOSS-05-000101
- Vuln IDs
-
- V-282507
- Rule IDs
-
- SV-282507r1200501_rule
Checks: C-87068r1200499_chk
Verify the runtime status of the "kernel.kptr_restrict" kernel parameter using the following command: $ sudo sysctl kernel.kptr_restrict kernel.kptr_restrict = 1 If "kernel.kptr_restrict" is not set to "1" or is missing, this is a finding.
Fix: F-86973r1200500_fix
Add or edit the following line in a system configuration file in the "/etc/sysctl.d/" directory: kernel.kptr_restrict = 1 Reload settings from all system configuration files using the following command: $ sudo sysctl --system
- RMF Control
- SC-2
- Severity
- M
- CCI
- CCI-001082
- Version
- TOSS-05-000109
- Vuln IDs
-
- V-282508
- Rule IDs
-
- SV-282508r1200504_rule
Checks: C-87069r1200502_chk
Verify TOSS 5 prevents privilege escalation through the kernel by disabling access to the bpf system call using the following command: $ sudo sysctl kernel.unprivileged_bpf_disabled kernel.unprivileged_bpf_disabled = 1 If the returned line does not have a value of "1", or a line is not returned, this is a finding.
Fix: F-86974r1200503_fix
Configure TOSS 5 to prevent privilege escalation through the kernel by disabling access to the bpf syscall by adding the following line to a file, in the "/etc/sysctl.d" directory: kernel.unprivileged_bpf_disabled = 1 The system configuration files must be reloaded for the changes to take effect. To reload the contents of the files, run the following command: $ sudo sysctl --system
- RMF Control
- SC-2
- Severity
- M
- CCI
- CCI-001082
- Version
- TOSS-05-000110
- Vuln IDs
-
- V-282509
- Rule IDs
-
- SV-282509r1200507_rule
Checks: C-87070r1200505_chk
Verify TOSS 5 restricts usage of ptrace to descendant processes using the following command: $ sudo sysctl kernel.yama.ptrace_scope kernel.yama.ptrace_scope = 1 If the returned line does not have a value of "1", or a line is not returned, this is a finding.
Fix: F-86975r1200506_fix
Configure TOSS 5 to restrict using ptrace to descendant processes by adding the following line to a file, in the "/etc/sysctl.d" directory: kernel.yama.ptrace_scope = 1 The system configuration files must be reloaded for the changes to take effect. To reload the contents of the files, run the following command: $ sudo sysctl --system
- RMF Control
- SC-3
- Severity
- M
- CCI
- CCI-001084
- Version
- TOSS-05-000023
- Vuln IDs
-
- V-282510
- Rule IDs
-
- SV-282510r1201302_rule
Checks: C-87071r1200508_chk
Note: At lower classification levels (CUI, Secret) where vast amounts of data are processed and a performance impact is occurring, an authorizing official can consider this requirement not applicable. Confirm that TOSS verifies the correct operation of all security functions. Determine if "SELinux" is active and in "Enforcing" mode using the following command: $ sudo getenforce Enforcing If "SELinux" is not active or not in "Enforcing" mode, this is a finding.
Fix: F-86976r1201301_fix
Configure the operating system to verify correct operation of all security functions. Set the "SELinux" status and the "Enforcing" mode by modifying the "/etc/selinux/config" file to have the following line: SELINUX=enforcing Restart the system for the changes to take effect.
- RMF Control
- SC-4
- Severity
- M
- CCI
- CCI-001090
- Version
- TOSS-05-000186
- Vuln IDs
-
- V-282511
- Rule IDs
-
- SV-282511r1200513_rule
Checks: C-87072r1200511_chk
Verify all world-writable directories have the sticky bit set. Determine if all world-writable directories have the sticky bit set using the following command: $ sudo find / -type d \( -perm -0002 -a ! -perm -1000 \) -print 2>/dev/null drwxrwxrwt 7 root root 4096 Jul 26 11:19 /tmp If any of the returned directories are world-writable and do not have the sticky bit set, this is a finding.
Fix: F-86977r1200512_fix
Configure all world-writable directories to have the sticky bit set to prevent unauthorized and unintended information transferred via shared system resources. Set the sticky bit on all world-writable directories using the command, replace "[World-Writable Directory]" with any directory path missing the sticky bit: $ chmod a+t [World-Writable Directory]
- RMF Control
- SC-5
- Severity
- M
- CCI
- CCI-001095
- Version
- TOSS-05-000212
- Vuln IDs
-
- V-282512
- Rule IDs
-
- SV-282512r1201342_rule
Checks: C-87073r1200514_chk
Verify TOSS 5 is configured to use IPv4 TCP syncookies using the following command: $ sudo sysctl net.ipv4.tcp_syncookies net.ipv4.tcp_syncookies = 1 If the network parameter "ipv4.tcp_syncookies" is not equal to "1" or a line is not returned, this is a finding.
Fix: F-86978r1201341_fix
Configure TOSS 5 to use TCP syncookies. Add or edit the following line in a system configuration file in the "/etc/sysctl.d/" directory: net.ipv4.tcp_syncookies = 1 Load settings from all system configuration files using the following command: $ sudo sysctl --system
- RMF Control
- SC-28
- Severity
- H
- CCI
- CCI-001199
- Version
- TOSS-05-000137
- Vuln IDs
-
- V-282514
- Rule IDs
-
- SV-282514r1201603_rule
Checks: C-87075r1200520_chk
Verify TOSS 5 prevents unauthorized disclosure or modification of all information requiring at-rest protection by using disk encryption. Note: If there is a documented and approved reason for not having data-at-rest encryption, this requirement is not applicable. Verify all system partitions are encrypted using the following command: $ blkid /dev/map per/rhel-root: UUID="67b7d7fe-de60-6fd0-befb-e6748cf97743" TYPE="crypto_LUKS" Every persistent disk partition present must be of type "crypto_LUKS". If any partitions other than the boot partition or pseudo file systems (such as /proc or /sys) or temporary file systems (that are tmpfs) are not type "crypto_LUKS", ask the administrator to indicate how the partitions are encrypted. If there is no evidence that these partitions are encrypted, this is a finding.
Fix: F-86980r1200521_fix
Configure TOSS 5 to prevent unauthorized modification of all information at rest by using disk encryption. Encrypting a partition in an already installed system is more difficult, because existing partitions must be resized and changed. To encrypt an entire partition, dedicate a partition for encryption in the partition layout.
- RMF Control
- SI-11
- Severity
- M
- CCI
- CCI-001314
- Version
- TOSS-05-000142
- Vuln IDs
-
- V-282516
- Rule IDs
-
- SV-282516r1200528_rule
Checks: C-87077r1200526_chk
Verify the "/var/log" directory has a mode of "0755" or less permissive using the following command: $ ls -ld /var/log drwxr-xr-x. 16 root root 4096 July 11 11:34 /var/log If "/var/log" does not have a mode of "0755" or less permissive, this is a finding.
Fix: F-86982r1200527_fix
Configure the "/var/log" directory to a mode of "0755" using the following command: $ sudo chmod 0755 /var/log
- RMF Control
- SI-11
- Severity
- M
- CCI
- CCI-001314
- Version
- TOSS-05-000143
- Vuln IDs
-
- V-282517
- Rule IDs
-
- SV-282517r1200531_rule
Checks: C-87078r1200529_chk
Verify the "/var/log/messages" file has a mode of "0640" or less permissive using the following command: $ ls -la /var/log/messages rw-------. 1 root root 564223 July 11 11:34 /var/log/messages If "/var/log/messages" does not have a mode of "0640" or less permissive, this is a finding.
Fix: F-86983r1200530_fix
Configure the "/var/log/messages" file to have a mode of "0640" using the following command: $ sudo chmod 0640 /var/log/messages
- RMF Control
- SI-11
- Severity
- M
- CCI
- CCI-001314
- Version
- TOSS-05-000171
- Vuln IDs
-
- V-282518
- Rule IDs
-
- SV-282518r1200534_rule
Checks: C-87079r1200532_chk
Verify the "/var/log" directory is owned by root using the following command: $ ls -ld /var/log drwxr-xr-x. 16 root root 4096 July 11 11:34 /var/log If "/var/log" does not have an owner of "root", this is a finding.
Fix: F-86984r1200533_fix
Configure the owner of the directory "/var/log" to "root" using the following command: $ sudo chown root /var/log
- RMF Control
- SI-11
- Severity
- M
- CCI
- CCI-001314
- Version
- TOSS-05-000172
- Vuln IDs
-
- V-282519
- Rule IDs
-
- SV-282519r1200537_rule
Checks: C-87080r1200535_chk
Verify the "/var/log" directory is group-owned by root using the following command: $ ls -ld /var/log drwxr-xr-x. 16 root root 4096 July 11 11:34 /var/log If "/var/log" does not have a group owner of "root", this is a finding.
Fix: F-86985r1200536_fix
Configure the group owner of the directory "/var/log" to "root" using the following command: $ sudo chgrp root /var/log
- RMF Control
- SI-11
- Severity
- M
- CCI
- CCI-001314
- Version
- TOSS-05-000173
- Vuln IDs
-
- V-282520
- Rule IDs
-
- SV-282520r1200540_rule
Checks: C-87081r1200538_chk
Verify the "/var/log/messages" file is owned by root using the following command: $ ls -la /var/log/messages rw-------. 1 root root 564223 July 11 11:34 /var/log/messages If "/var/log/messages" does not have an owner of "root", this is a finding.
Fix: F-86986r1200539_fix
Change the owner of the "/var/log/messages" file to "root" using the following command: $ sudo chown root /var/log/messages
- RMF Control
- SI-11
- Severity
- M
- CCI
- CCI-001314
- Version
- TOSS-05-000174
- Vuln IDs
-
- V-282521
- Rule IDs
-
- SV-282521r1200543_rule
Checks: C-87082r1200541_chk
Verify the "/var/log/messages" file is group-owned by root using the following command: $ ls -la /var/log/messages rw-------. 1 root root 564223 July 11 11:34 /var/log/messages If "/var/log/messages" does not have a group owner of "root" and is not documented with the information system security officer (ISSO) as an operational requirement, this is a finding.
Fix: F-86987r1200542_fix
Change the group owner of the "/var/log/messages" file to "root" using the following command: $ sudo chgrp root /var/log/messages
- RMF Control
- AC-17
- Severity
- M
- CCI
- CCI-001453
- Version
- TOSS-05-000241
- Vuln IDs
-
- V-282522
- Rule IDs
-
- SV-282522r1200546_rule
Checks: C-87083r1200544_chk
Verify systemwide crypto policies are in effect using the following command: $ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH '^\s*include' /etc/ssh/sshd_config:Include /etc/ssh/sshd_config.d/*.conf /etc/ssh/sshd_config.d/50-redhat.conf:Include /etc/crypto-policies/back-ends/opensshserver.config If "Include /etc/ssh/sshd_config.d/*.conf" or "Include /etc/crypto-policies/back-ends/opensshserver.config" are not included in the system sshd config or the file "/etc/ssh/sshd_config.d/50-redhat.conf" is missing, this is a finding.
Fix: F-86988r1200545_fix
Configure the TOSS 5 SSH daemon to use systemwide crypto policies using the following command: $ sudo dnf reinstall openssh-server
- RMF Control
- AC-17
- Severity
- M
- CCI
- CCI-001453
- Version
- TOSS-05-000242
- Vuln IDs
-
- V-282523
- Rule IDs
-
- SV-282523r1200549_rule
Checks: C-87084r1200547_chk
Verify systemwide crypto policies are in effect using the following command: $ sudo grep Include /etc/ssh/sshd_config /etc/ssh/sshd_config.d/* /etc/ssh/sshd_config:Include /etc/ssh/sshd_config.d/*.conf /etc/ssh/sshd_config.d/50-redhat.conf:Include /etc/crypto-policies/back-ends/opensshserver.config If "Include /etc/ssh/sshd_config.d/*.conf" or "Include /etc/crypto-policies/back-ends/opensshserver.config" are not included in the system sshd config or the file "/etc/ssh/sshd_config.d/50-redhat.conf" is missing, this is a finding.
Fix: F-86989r1200548_fix
Configure the TOSS 5 SSH daemon to use systemwide crypto policies using the following command: $ sudo dnf reinstall openssh-clients
- RMF Control
- AC-17
- Severity
- M
- CCI
- CCI-001453
- Version
- TOSS-05-000243
- Vuln IDs
-
- V-282524
- Rule IDs
-
- SV-282524r1201364_rule
Checks: C-87085r1200550_chk
Verify the SSH client is configured to use only ciphers employing FIPS 140-3-approved algorithms using the following command: $ sudo grep -i ciphers /etc/crypto-policies/back-ends/openssh.config Ciphers aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes256-ctr,aes128-gcm@openssh.com,aes128-ctr If the cipher entries in the "openssh.config" file have any ciphers other than "aes256-gcm@openssh.com", "chacha20-poly1305@openssh.com", "aes256-ctr,aes128-gcm@openssh.com", "aes128-ctr"; the order differs from the example above; they are missing; or commented out, this is a finding.
Fix: F-86990r1201363_fix
Configure the TOSS 5 SSH client to only use ciphers employing FIPS 140-3-approved algorithms by updating the "/etc/crypto-policies/back-ends/openssh.config" file with the following line: Ciphers aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes256-ctr,aes128-gcm@openssh.com,aes128-ctr Restart the system for the changes to take effect.
- RMF Control
- AC-17
- Severity
- M
- CCI
- CCI-001453
- Version
- TOSS-05-000244
- Vuln IDs
-
- V-282525
- Rule IDs
-
- SV-282525r1201367_rule
Checks: C-87086r1201365_chk
Verify SSH server is configured to use only ciphers employing FIPS 140-3-approved algorithms using the following command: $ sudo grep -i macs /etc/crypto-policies/back-ends/openssh.config MACs hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha1,umac-128@openssh.com,hmac-sha2-512 If the MACs entries in the "openssh.config" file have any hashes other than "hmac-sha2-256-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512-etm@openssh.com", "hmac-sha2-512"; the order differs from the example above; they are missing; or commented out, this is a finding.
Fix: F-86991r1201366_fix
Configure the TOSS 5 SSH server to use only MACs employing FIPS 140-3-approved algorithms by updating the "/etc/crypto-policies/back-ends/openssh.config" file with the following line: MACs hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha1,umac-128@openssh.com,hmac-sha2-512 Restart the system for the changes to take effect.
- RMF Control
- AC-17
- Severity
- H
- CCI
- CCI-001453
- Version
- TOSS-05-000472
- Vuln IDs
-
- V-282526
- Rule IDs
-
- SV-282526r1201501_rule
Checks: C-87087r1200556_chk
Verify if GnuTLS uses defined DOD-approved TLS Crypto Policy using the following command: $ update-crypto-policies --show FIPS If the systemwide crypto policy is not set to "FIPS", this is a finding.
Fix: F-86992r1200557_fix
Configure the TOSS 5 GnuTLS library to use only NIST-approved encryption by enabling FIPS mode using the following command: $ sudo fips-mode-setup --enable Restart the system for the changes to take effect.
- RMF Control
- AC-17
- Severity
- M
- CCI
- CCI-001453
- Version
- TOSS-05-000473
- Vuln IDs
-
- V-282527
- Rule IDs
-
- SV-282527r1200561_rule
Checks: C-87088r1200559_chk
Verify TOSS 5 OpenSSL library is configured to use only ciphers employing FIPS 140-3-approved algorithms using the following command: $ sudo grep -i opensslcnf.config /etc/pki/tls/openssl.cnf .include = /etc/crypto-policies/back-ends/opensslcnf.config If the "opensslcnf.config" is not defined in the "/etc/pki/tls/openssl.cnf" file, this is a finding.
Fix: F-86993r1200560_fix
Configure the TOSS 5 OpenSSL library to use the system cryptographic policy. Edit the "/etc/pki/tls/openssl.cnf" and add or modify the following line: .include = /etc/crypto-policies/back-ends/opensslcnf.config
- RMF Control
- AC-17
- Severity
- M
- CCI
- CCI-001453
- Version
- TOSS-05-000474
- Vuln IDs
-
- V-282528
- Rule IDs
-
- SV-282528r1201630_rule
Checks: C-87089r1200562_chk
Verify TOSS 5 OpenSSL library is configured to use TLS 1.2 encryption or stronger with following command: $ grep -i minprotocol /etc/crypto-policies/back-ends/opensslcnf.config TLS.MinProtocol = TLSv1.2 DTLS.MinProtocol = DTLSv1.2 If the "TLS.MinProtocol" is set to anything older than "TLSv1.2" or the "DTLS.MinProtocol" is set to anything older than "DTLSv1.2", this is a finding.
Fix: F-86994r1200563_fix
Configure the TOSS 5 OpenSSL library to use only DOD-approved TLS encryption by editing the following line in the "/etc/crypto-policies/back-ends/opensslcnf.config" file: TLS.MinProtocol = TLSv1.2 DTLS.MinProtocol = DTLSv1.2 Restart the system for the changes to take effect.
- RMF Control
- AU-14
- Severity
- L
- CCI
- CCI-001464
- Version
- TOSS-05-000408
- Vuln IDs
-
- V-282529
- Rule IDs
-
- SV-282529r1200567_rule
Checks: C-87090r1200565_chk
Verify TOSS 5 allocates a sufficient audit_backlog_limit to capture processes that start prior to the audit daemon using the following command: $ sudo grubby --info=ALL | grep args | grep -v 'audit_backlog_limit=8192' If the command returns any outputs, and audit_backlog_limit is less than "8192", this is a finding.
Fix: F-86995r1200566_fix
Configure TOSS 5 to allocate sufficient audit_backlog_limit to capture processes that start prior to the audit daemon using the following command: $ sudo grubby --update-kernel=ALL --args=audit_backlog_limit=8192
- RMF Control
- AU-3
- Severity
- M
- CCI
- CCI-001487
- Version
- TOSS-05-000404
- Vuln IDs
-
- V-282530
- Rule IDs
-
- SV-282530r1200570_rule
Checks: C-87091r1200568_chk
Verify TOSS 5 audit system is configured to resolve audit information before writing to disk using the following command: $ sudo grep log_format /etc/audit/auditd.conf log_format = ENRICHED If the "log_format" option is not "ENRICHED", or the line is commented out, this is a finding.
Fix: F-86996r1200569_fix
Edit the /etc/audit/auditd.conf file and add or update the "log_format" option: log_format = ENRICHED Restart the audit daemon for the changes to take effect.
- RMF Control
- AU-9
- Severity
- M
- CCI
- CCI-001493
- Version
- TOSS-05-000144
- Vuln IDs
-
- V-282531
- Rule IDs
-
- SV-282531r1201577_rule
Checks: C-87092r1201575_chk
Verify the audit tools have a mode of "0755" or less using the following command: $ stat -c "%a %n" /sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/autrace /sbin/auditd /sbin/rsyslogd /sbin/augenrules 755 /sbin/auditctl 755 /sbin/aureport 755 /sbin/ausearch 755 /sbin/autrace 755 /sbin/auditd 755 /sbin/rsyslogd 755 /sbin/augenrules If any of the audit tool files have a mode more permissive than "0755", this is a finding.
Fix: F-86997r1201576_fix
Configure the audit tools to have a mode of "0755" using the following command: $ sudo chmod 0755 [audit_tool] Replace "[audit_tool]" with each audit tool that has a more permissive mode than "0755".
- RMF Control
- AU-9
- Severity
- M
- CCI
- CCI-001493
- Version
- TOSS-05-000181
- Vuln IDs
-
- V-282532
- Rule IDs
-
- SV-282532r1200576_rule
Checks: C-87093r1200574_chk
Verify the audit tools are owned by "root" using the following command: $ sudo stat -c "%U %n" /sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/autrace /sbin/auditd /sbin/rsyslogd /sbin/augenrules root /sbin/auditctl root /sbin/aureport root /sbin/ausearch root /sbin/autrace root /sbin/auditd root /sbin/rsyslogd root /sbin/augenrules If any audit tools do not have an owner of "root", this is a finding.
Fix: F-86998r1200575_fix
Configure the audit tools to be owned by "root" using the following command: $ sudo chown root [audit_tool] Replace "[audit_tool]" with each audit tool not owned by "root".
- RMF Control
- AU-9
- Severity
- M
- CCI
- CCI-001493
- Version
- TOSS-05-000182
- Vuln IDs
-
- V-282533
- Rule IDs
-
- SV-282533r1201328_rule
Checks: C-87094r1200577_chk
Verify the audit tools are group owned by "root" using the following command: $ sudo stat -c "%G %n" /sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/autrace /sbin/auditd /sbin/rsyslogd /sbin/augenrules root /sbin/auditctl root /sbin/aureport root /sbin/ausearch root /sbin/autrace root /sbin/auditd root /sbin/rsyslogd root /sbin/augenrules If any audit tools do not have a group owner of "root", this is a finding.
Fix: F-86999r1200578_fix
Configure the audit tools to be group-owned by "root" using the following command: $ sudo chgrp root [audit_tool] Replace "[audit_tool]" with each audit tool not group-owned by "root".
- RMF Control
- AU-9
- Severity
- M
- CCI
- CCI-001493
- Version
- TOSS-05-000372
- Vuln IDs
-
- V-282534
- Rule IDs
-
- SV-282534r1200582_rule
Checks: C-87095r1200580_chk
Check that AIDE is properly configured to protect the integrity of the audit tools using the following command: $ sudo cat /etc/aide.conf | grep /usr/sbin/au /usr/sbin/auditctl p+i+n+u+g+s+b+acl+xattrs+sha512 /usr/sbin/auditd p+i+n+u+g+s+b+acl+xattrs+sha512 /usr/sbin/ausearch p+i+n+u+g+s+b+acl+xattrs+sha512 /usr/sbin/aureport p+i+n+u+g+s+b+acl+xattrs+sha512 /usr/sbin/autrace p+i+n+u+g+s+b+acl+xattrs+sha512 /usr/sbin/augenrules p+i+n+u+g+s+b+acl+xattrs+sha512 If AIDE is not installed, ask the system administrator (SA) how file integrity checks are performed on the system. If any of the audit tools listed above do not have a corresponding line, ask the SA to indicate what cryptographic mechanisms are being used to protect the integrity of the audit tools. If there is no evidence of integrity protection, this is a finding.
Fix: F-87000r1200581_fix
Add or update the following lines to "/etc/aide.conf", to protect the integrity of the audit tools. /usr/sbin/auditctl p+i+n+u+g+s+b+acl+xattrs+sha512 /usr/sbin/auditd p+i+n+u+g+s+b+acl+xattrs+sha512 /usr/sbin/ausearch p+i+n+u+g+s+b+acl+xattrs+sha512 /usr/sbin/aureport p+i+n+u+g+s+b+acl+xattrs+sha512 /usr/sbin/autrace p+i+n+u+g+s+b+acl+xattrs+sha512 /usr/sbin/augenrules p+i+n+u+g+s+b+acl+xattrs+sha512
- RMF Control
- CM-5
- Severity
- M
- CCI
- CCI-001499
- Version
- TOSS-05-000139
- Vuln IDs
-
- V-282535
- Rule IDs
-
- SV-282535r1200585_rule
Checks: C-87096r1200583_chk
Verify the system commands contained in the following directories have mode "755" or less permissive with the following command: $ sudo find -L /bin /sbin /usr/bin /usr/sbin /usr/libexec /usr/local/bin /usr/local/sbin -perm /022 -exec ls -l {} \; If any system commands are found to be group-writable or world-writable, this is a finding.
Fix: F-87001r1200584_fix
Configure the system commands to be protected from unauthorized access. Run the following command, replacing "[FILE]" with any system command with a mode more permissive than "755". $ sudo chmod 755 [FILE]
- RMF Control
- CM-5
- Severity
- M
- CCI
- CCI-001499
- Version
- TOSS-05-000140
- Vuln IDs
-
- V-282536
- Rule IDs
-
- SV-282536r1201579_rule
Checks: C-87097r1201311_chk
Verify the systemwide shared library directories have mode "755" or less permissive with the following command: $ sudo find -L /lib /lib64 /usr/lib /usr/lib64 -perm /022 -type d -exec ls -l {} \; If any systemwide shared library directory is found to be group-writable or world-writable, this is a finding.
Fix: F-87002r1201578_fix
Configure the systemwide shared library directories (/lib, /lib64, /usr/lib and /usr/lib64) to be protected from unauthorized access. Run the following command, replacing "[DIRECTORY]" with any library directory with a mode more permissive than "755". $ sudo chmod 755 [DIRECTORY]
- RMF Control
- CM-5
- Severity
- M
- CCI
- CCI-001499
- Version
- TOSS-05-000141
- Vuln IDs
-
- V-282537
- Rule IDs
-
- SV-282537r1201581_rule
Checks: C-87098r1201314_chk
Verify the systemwide shared library files contained in the following directories have mode "755" or less permissive with the following command: $ sudo find -L /lib /lib64 /usr/lib /usr/lib64 -perm /022 -type f -exec ls -l {} \; If any systemwide shared library file is found to be group-writable or world-writable, this is a finding.
Fix: F-87003r1201580_fix
Configure the library files to be protected from unauthorized access. Run the following command, replacing "[FILE]" with any library file with a mode more permissive than "755". $ sudo chmod 755 [FILE]
- RMF Control
- CM-5
- Severity
- M
- CCI
- CCI-001499
- Version
- TOSS-05-000175
- Vuln IDs
-
- V-282538
- Rule IDs
-
- SV-282538r1200594_rule
Checks: C-87099r1200592_chk
Verify the system commands contained in the following directories are owned by "root" with the following command: $ sudo find -L /bin /sbin /usr/bin /usr/sbin /usr/libexec /usr/local/bin /usr/local/sbin ! -user root -exec ls -l {} \; If any system commands are found to not be owned by root, this is a finding.
Fix: F-87004r1200593_fix
Configure the system commands to be protected from unauthorized access. Run the following command, replacing "[FILE]" with any system command file not owned by "root". $ sudo chown root [FILE]
- RMF Control
- CM-5
- Severity
- M
- CCI
- CCI-001499
- Version
- TOSS-05-000176
- Vuln IDs
-
- V-282539
- Rule IDs
-
- SV-282539r1200597_rule
Checks: C-87100r1200595_chk
Verify the system commands contained in the following directories are group-owned by "root", or a required system account, with the following command: $ sudo find -L /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin ! -group root -exec ls -l {} \; If any system commands are returned and is not group-owned by a required system account, and is not documented with the information system security officer (ISSO) as an operational requirement, this is a finding.
Fix: F-87005r1200596_fix
Configure the system commands to be protected from unauthorized access. Run the following command, replacing "[FILE]" with any system command file not group-owned by "root" or a required system account. $ sudo chgrp root [FILE]
- RMF Control
- CM-5
- Severity
- M
- CCI
- CCI-001499
- Version
- TOSS-05-000177
- Vuln IDs
-
- V-282540
- Rule IDs
-
- SV-282540r1201318_rule
Checks: C-87101r1201316_chk
Verify the systemwide shared library files are owned by "root" with the following command: $ sudo find -L /lib /lib64 /usr/lib /usr/lib64 ! -user root -exec ls -l {} \; If any systemwide shared library file is not owned by root, this is a finding.
Fix: F-87006r1201317_fix
Configure the systemwide shared library files (/lib, /lib64, /usr/lib and /usr/lib64) to be protected from unauthorized access. Run the following command, replacing "[FILE]" with any library file not owned by "root". $ sudo chown root [FILE]
- RMF Control
- CM-5
- Severity
- M
- CCI
- CCI-001499
- Version
- TOSS-05-000178
- Vuln IDs
-
- V-282541
- Rule IDs
-
- SV-282541r1201321_rule
Checks: C-87102r1201319_chk
Verify the systemwide shared library files are group-owned by "root" with the following command: $ sudo find -L /lib /lib64 /usr/lib /usr/lib64 ! -group root -exec ls -l {} \; If any systemwide shared library file is returned and is not group-owned by a required system account, and is not documented with the information system security officer (ISSO) as an operational requirement, this is a finding.
Fix: F-87007r1201320_fix
Configure the systemwide shared library files (/lib, /lib64, /usr/lib and /usr/lib64) to be protected from unauthorized access. Run the following command, replacing "[FILE]" with any library file not group-owned by "root". $ sudo chgrp root [FILE]
- RMF Control
- CM-5
- Severity
- M
- CCI
- CCI-001499
- Version
- TOSS-05-000179
- Vuln IDs
-
- V-282542
- Rule IDs
-
- SV-282542r1201324_rule
Checks: C-87103r1201322_chk
Verify the systemwide shared library directories are owned by "root" with the following command: $ sudo find /lib /lib64 /usr/lib /usr/lib64 ! -user root -type d -exec stat -c "%n %U" '{}' \; If any systemwide shared library directory is not owned by root, this is a finding.
Fix: F-87008r1201323_fix
Configure the systemwide shared library directories within (/lib, /lib64, /usr/lib and /usr/lib64) to be protected from unauthorized access. Run the following command, replacing "[DIRECTORY]" with any library directory not owned by "root". $ sudo chown root [DIRECTORY]
- RMF Control
- CM-5
- Severity
- M
- CCI
- CCI-001499
- Version
- TOSS-05-000180
- Vuln IDs
-
- V-282543
- Rule IDs
-
- SV-282543r1201327_rule
Checks: C-87104r1201325_chk
Verify the systemwide shared library directories are group-owned by "root" with the following command: $ sudo find /lib /lib64 /usr/lib /usr/lib64 ! -group root -type d -exec stat -c "%n %G" '{}' \; If any systemwide shared library directory is returned and is not group-owned by a required system account, and is not documented with the information system security officer (ISSO) as an operational requirement, this is a finding.
Fix: F-87009r1201326_fix
Configure the systemwide shared library directories (/lib, /lib64, /usr/lib and /usr/lib64) to be protected from unauthorized access. Run the following command, replacing "[DIRECTORY]" with any library directory not group-owned by "root". $ sudo chgrp root [DIRECTORY]
- RMF Control
- Severity
- M
- CCI
- CCI-004066
- Version
- TOSS-05-000346
- Vuln IDs
-
- V-282544
- Rule IDs
-
- SV-282544r1200612_rule
Checks: C-87105r1200610_chk
Verify TOSS 5 enforces password complexity by requiring at least one special character using the following command: $ sudo grep ocredit /etc/security/pwquality.conf /etc/security/pwquality.conf.d/*.conf ocredit = -1 If the value of "ocredit" is a positive number or is commented out, this is a finding.
Fix: F-87010r1200611_fix
Configure TOSS 5 to enforce password complexity by requiring at least one special character be used by setting the "ocredit" option. Add the following line to "/etc/security/pwquality.conf" (or modify the line to have the required value): ocredit = -1
- RMF Control
- SC-24
- Severity
- M
- CCI
- CCI-001665
- Version
- TOSS-05-000089
- Vuln IDs
-
- V-282545
- Rule IDs
-
- SV-282545r1200615_rule
Checks: C-87106r1200613_chk
Verify "systemd-journald" is active on TOSS 5 using the following command: $ systemctl is-active systemd-journald active If the "systemd-journald" service is not active, this is a finding.
Fix: F-87011r1200614_fix
Enable the "systemd-journald" service using the following command: $ sudo systemctl enable --now systemd-journald
- RMF Control
- AC-17
- Severity
- M
- CCI
- CCI-002322
- Version
- TOSS-05-000202
- Vuln IDs
-
- V-282549
- Rule IDs
-
- SV-282549r1200627_rule
Checks: C-87110r1200625_chk
Verify TOSS 5 is securely comparing internal information system clocks at least every 24 hours with an NTP server with the following commands: $ sudo grep maxpoll /etc/chrony.conf server 0.us.pool.ntp.mil iburst maxpoll 16 If the "maxpoll" option is set to a number greater than 16 or the line is commented out, this is a finding. Verify the "chrony.conf" file is configured to an authoritative DOD time source using the following command: $ sudo grep -i server /etc/chrony.conf server 0.us.pool.ntp.mil If the parameter "server" is not set or is not set to an authoritative DOD time source, this is a finding.
Fix: F-87015r1200626_fix
Configure TOSS 5 to securely compare internal information system clocks at least every 24 hours with an NTP server by adding/modifying the following line in the /etc/chrony.conf file: server [ntp.server.name] iburst maxpoll 16
- RMF Control
- AC-3
- Severity
- M
- CCI
- CCI-002165
- Version
- TOSS-05-000102
- Vuln IDs
-
- V-282553
- Rule IDs
-
- SV-282553r1200639_rule
Checks: C-87114r1200637_chk
Verify TOSS 5 is configured to enable DAC on hardlinks using the following command: $ sudo sysctl fs.protected_hardlinks fs.protected_hardlinks = 1 If "fs.protected_hardlinks" is not set to "1" or is missing, this is a finding.
Fix: F-87019r1200638_fix
Configure TOSS 5 to enable DAC on hardlinks with the following: Add or edit the following line in a system configuration file in the "/etc/sysctl.d/" directory: fs.protected_hardlinks = 1 Load settings from all system configuration files using the following command: $ sudo sysctl --system
- RMF Control
- AC-3
- Severity
- M
- CCI
- CCI-002165
- Version
- TOSS-05-000103
- Vuln IDs
-
- V-282554
- Rule IDs
-
- SV-282554r1201608_rule
Checks: C-87115r1200640_chk
Verify TOSS 5 is configured to enable DAC on symlinks using the following command: $ sudo sysctl fs.protected_symlinks fs.protected_symlinks = 1 If "fs.protected_symlinks " is not set to "1" or is missing, this is a finding.
Fix: F-87020r1200641_fix
Configure TOSS 5 to enable DAC on symlinks with the following: Add or edit the following line in a system configuration file in the "/etc/sysctl.d/" directory: fs.protected_symlinks = 1 Load settings from all system configuration files using the following command: $ sudo sysctl --system
- RMF Control
- AC-6
- Severity
- H
- CCI
- CCI-002235
- Version
- TOSS-05-000090
- Vuln IDs
-
- V-282557
- Rule IDs
-
- SV-282557r1200651_rule
Checks: C-87118r1200649_chk
Verify TOSS 5 is configured to not reboot the system when Ctrl-Alt-Delete is pressed seven times within two seconds using the following command: $ sudo grep -iR CtrlAltDelBurstAction /etc/systemd/system* /etc/systemd/system.conf.d/55-CtrlAltDel-BurstAction:CtrlAltDelBurstAction=none If "CtrlAltDelBurstAction" is not set to "none", is commented out, or is missing, this is a finding.
Fix: F-87023r1200650_fix
Configure TOSS 5 to disable "CtrlAltDelBurstAction" by adding it to a drop file in a "/etc/systemd/system.conf.d/" configuration file: If no drop file exists, create one using the following command: $ sudo mkdir -p /etc/systemd/system.conf.d && sudo vi /etc/systemd/system.conf.d/55-CtrlAltDel-BurstAction Edit the file to contain the setting by adding the following text: CtrlAltDelBurstAction=none Reload the daemon for this change to take effect. $ sudo systemctl daemon-reload
- RMF Control
- AC-6
- Severity
- H
- CCI
- CCI-002235
- Version
- TOSS-05-000091
- Vuln IDs
-
- V-282558
- Rule IDs
-
- SV-282558r1200654_rule
Checks: C-87119r1200652_chk
Verify TOSS 5 is not configured to reboot the system when Ctrl-Alt-Delete is pressed using the following command: $ sudo systemctl status ctrl-alt-del.target ctrl-alt-del.target Loaded: masked (Reason: Unit ctrl-alt-del.target is masked.) Active: inactive (dead) If "ctrl-alt-del.target" is loaded and not masked, this is a finding.
Fix: F-87024r1200653_fix
Configure TOSS 5 to disable "ctrl-alt-del.target" using the following command: $ sudo systemctl disable --now ctrl-alt-del.target $ sudo systemctl mask --now ctrl-alt-del.target
- RMF Control
- AC-6
- Severity
- M
- CCI
- CCI-002235
- Version
- TOSS-05-000092
- Vuln IDs
-
- V-282559
- Rule IDs
-
- SV-282559r1200657_rule
Checks: C-87120r1200655_chk
Verify TOSS 5 is configured to mask the "debug-shell systemd" service using the following command: $ sudo systemctl status debug-shell.service debug-shell.service Loaded: masked (Reason: Unit debug-shell.service is masked.) Active: inactive (dead) If the "debug-shell.service" is loaded and not masked, this is a finding.
Fix: F-87025r1200656_fix
Configure TOSS 5 to mask the "debug-shell systemd" service using the following command: $ sudo systemctl disable --now debug-shell.service $ sudo systemctl mask --now debug-shell.service
- RMF Control
- AC-6
- Severity
- M
- CCI
- CCI-002235
- Version
- TOSS-05-000324
- Vuln IDs
-
- V-282560
- Rule IDs
-
- SV-282560r1200660_rule
Checks: C-87121r1200658_chk
Verify the TOSS 5 "sudo" package is installed using the following command: $ sudo dnf list --installed sudo Example output: sudo.x86_64 1.9.5p2-7.el9 If the "sudo" package is not installed, this is a finding.
Fix: F-87026r1200659_fix
The "sudo" package can be installed using the following command: $ sudo dnf install sudo
- RMF Control
- AC-6
- Severity
- M
- CCI
- CCI-002233
- Version
- TOSS-05-000411
- Vuln IDs
-
- V-282561
- Rule IDs
-
- SV-282561r1200663_rule
Checks: C-87122r1200661_chk
Verify TOSS 5 is configured to audit the execution of the "execve" system call using the following command: $ sudo auditctl -l | grep execve -a always,exit -F arch=b32 -S execve -C uid!=euid -F euid=0 -k execpriv -a always,exit -F arch=b64 -S execve -C uid!=euid -F euid=0 -k execpriv -a always,exit -F arch=b32 -S execve -C gid!=egid -F egid=0 -k execpriv -a always,exit -F arch=b64 -S execve -C gid!=egid -F egid=0 -k execpriv If the command does not return all lines, or the lines are commented out, this is a finding.
Fix: F-87027r1200662_fix
Configure TOSS 5 to audit the execution of the "execve" system call. Add or update the following file system rules to "/etc/audit/rules.d/audit.rules": -a always,exit -F arch=b32 -S execve -C uid!=euid -F euid=0 -k execpriv -a always,exit -F arch=b64 -S execve -C uid!=euid -F euid=0 -k execpriv -a always,exit -F arch=b32 -S execve -C gid!=egid -F egid=0 -k execpriv -a always,exit -F arch=b64 -S execve -C gid!=egid -F egid=0 -k execpriv Restart the audit daemon for the changes to take effect.
- RMF Control
- AU-4
- Severity
- M
- CCI
- CCI-001849
- Version
- TOSS-05-000390
- Vuln IDs
-
- V-282562
- Rule IDs
-
- SV-282562r1201623_rule
Checks: C-87123r1201622_chk
Verify TOSS 5 allocates audit record storage capacity to store at least one week of audit records when audit records are not immediately sent to a central audit record storage facility. If the system is configured to immediately off-load audit records to an external system, this requirement is not applicable. Note: The partition size needed to capture a week of audit records is based on the activity level of the system and the total storage capacity available. Typically, 10GB of storage space for audit records should be sufficient. Determine which partition the audit records are being written to using the following command: $ sudo grep log_file /etc/audit/auditd.conf log_file = /var/log/audit/audit.log Check the size of the partition that audit records are written to with the following command to verify whether it is large enough: # df -h /var/log/audit/ /dev/sda2 24G 10.4G 13.6G 43% /var/log/audit If the audit record partition is not allocated for sufficient storage capacity, this is a finding.
Fix: F-87028r1200665_fix
Allocate enough storage capacity for at least one week of audit records when audit records are not immediately sent to a central audit record storage facility. If audit records are stored on a partition made specifically for audit records, resize the partition with sufficient space to contain one week of audit records. If audit records are not stored on a partition made specifically for audit records, a new partition with sufficient space will need be to be created.
- RMF Control
- AU-4
- Severity
- M
- CCI
- CCI-001851
- Version
- TOSS-05-000380
- Vuln IDs
-
- V-282563
- Rule IDs
-
- SV-282563r1200669_rule
Checks: C-87124r1200667_chk
Verify TOSS 5 is configured use the "audisp-remote" syslog service using the following command: $ sudo grep active /etc/audit/plugins.d/syslog.conf active = yes If the "active" keyword does not have a value of "yes", the line is commented out, or the line is missing, this is a finding.
Fix: F-87029r1200668_fix
Edit the "/etc/audit/plugins.d/syslog.conf" file and add or update the "active" option: active = yes Restart the audit daemon for the changes to take effect.
- RMF Control
- AU-4
- Severity
- M
- CCI
- CCI-001851
- Version
- TOSS-05-000381
- Vuln IDs
-
- V-282564
- Rule IDs
-
- SV-282564r1201619_rule
Checks: C-87125r1200670_chk
Verify TOSS 5 authenticates the remote logging server for off-loading audit logs using the following command: $ sudo grep -i '$ActionSendStreamDriverAuthMode' /etc/rsyslog.conf /etc/rsyslog.d/*.conf /etc/rsyslog.conf:$ActionSendStreamDriverAuthMode x509/name If the value of the "$ActionSendStreamDriverAuthMode" option is not set to "x509/name" or the line is commented out, ask the system administrator (SA) to indicate how the audit logs are off-loaded to a different system or media. If there is no evidence that the transfer of the audit logs being off-loaded to another system or media is encrypted, this is a finding.
Fix: F-87030r1200671_fix
Configure TOSS 5 to authenticate the remote logging server for off-loading audit logs by setting the following option in "/etc/rsyslog.conf" or "/etc/rsyslog.d/[customfile].conf": $ActionSendStreamDriverAuthMode x509/name
- RMF Control
- AU-4
- Severity
- M
- CCI
- CCI-001851
- Version
- TOSS-05-000382
- Vuln IDs
-
- V-282565
- Rule IDs
-
- SV-282565r1201620_rule
Checks: C-87126r1200673_chk
Verify TOSS 5 encrypts audit records off-loaded onto a different system or media from the system being audited via rsyslog using the following command: $ sudo grep -i '$ActionSendStreamDriverMode' /etc/rsyslog.conf /etc/rsyslog.d/*.conf /etc/rsyslog.conf:$ActionSendStreamDriverMode 1 If the value of the "$ActionSendStreamDriverMode" option is not set to "1" or the line is commented out, this is a finding.
Fix: F-87031r1200674_fix
Configure TOSS 5 to encrypt off-loaded audit records via rsyslog by setting the following options in "/etc/rsyslog.conf" or "/etc/rsyslog.d/[customfile].conf": $ActionSendStreamDriverMode 1
- RMF Control
- AU-4
- Severity
- M
- CCI
- CCI-001851
- Version
- TOSS-05-000383
- Vuln IDs
-
- V-282566
- Rule IDs
-
- SV-282566r1200678_rule
Checks: C-87127r1200676_chk
Verify TOSS 5 uses the gtls driver to encrypt audit records off-loaded onto a different system or media from the system being audited using the following command: $ sudo grep -i '$DefaultNetstreamDriver' /etc/rsyslog.conf /etc/rsyslog.d/*.conf /etc/rsyslog.conf:$DefaultNetstreamDriver gtls If the value of the "$DefaultNetstreamDriver" option is not set to "gtls" or the line is commented out, this is a finding.
Fix: F-87032r1200677_fix
Configure TOSS 5 to use the gtls driver to encrypt off-loaded audit records by setting the following options in "/etc/rsyslog.conf" or "/etc/rsyslog.d/[customfile].conf": $DefaultNetstreamDriver gtls
- RMF Control
- AU-4
- Severity
- M
- CCI
- CCI-001851
- Version
- TOSS-05-000397
- Vuln IDs
-
- V-282567
- Rule IDs
-
- SV-282567r1200681_rule
Checks: C-87128r1200679_chk
Verify TOSS 5 audit system is configured to take an appropriate action when the internal event queue is full: $ sudo grep -i overflow_action /etc/audit/auditd.conf overflow_action = syslog If the value of the "overflow_action" option is not set to "syslog", "single", "halt" or the line is commented out, ask the system administrator (SA) to indicate how the audit logs are off-loaded to a different system or media. If there is no evidence that the transfer of the audit logs being off-loaded to another system or media takes appropriate action if the internal event queue becomes full, this is a finding.
Fix: F-87033r1200680_fix
Edit the "/etc/audit/auditd.conf" file and add or update the "overflow_action" option: overflow_action = syslog Restart the audit daemon for changes to take effect.
- RMF Control
- AU-4
- Severity
- M
- CCI
- CCI-001851
- Version
- TOSS-05-000410
- Vuln IDs
-
- V-282568
- Rule IDs
-
- SV-282568r1200684_rule
Checks: C-87129r1200682_chk
Verify TOSS 5 has the "audispd-plugins" package for installed using the following command: $ sudo dnf list --installed audispd-plugins Example output: audispd-plugins.x86_64 3.0.7-101.el9_0.2 If the "audispd-plugins" package is not installed, this is a finding.
Fix: F-87034r1200683_fix
Install the "audispd-plugins" package using the following command: $ sudo dnf install audispd-plugins
- RMF Control
- AU-5
- Severity
- M
- CCI
- CCI-001855
- Version
- TOSS-05-000391
- Vuln IDs
-
- V-282569
- Rule IDs
-
- SV-282569r1200687_rule
Checks: C-87130r1200685_chk
Verify TOSS 5 takes action when allocated audit record storage volume reaches 75 percent of the repository maximum audit record storage capacity using the following command: $ sudo grep -w space_left /etc/audit/auditd.conf space_left = 25% If the value of the "space_left" keyword is not set to 25 percent of the storage volume allocated to audit logs, or if the line is commented out, ask the system administrator (SA) to indicate how the system is providing real-time alerts to the SA and information system security officer (ISSO). If the "space_left" value is not configured to the correct value, this is a finding.
Fix: F-87035r1200686_fix
Configure TOSS 5 to initiate an action to notify the SA and ISSO (at a minimum) when allocated audit record storage volume reaches 75 percent of the repository maximum audit record storage capacity by adding/modifying the following line in the /etc/audit/auditd.conf file. space_left = 25%
- RMF Control
- AU-5
- Severity
- M
- CCI
- CCI-001855
- Version
- TOSS-05-000392
- Vuln IDs
-
- V-282570
- Rule IDs
-
- SV-282570r1200690_rule
Checks: C-87131r1200688_chk
Verify TOSS 5 notifies the SA and ISSO (at a minimum) when allocated audit record storage volume reaches 75 percent of the repository maximum audit record storage capacity using the following command: $ sudo grep -w space_left_action /etc/audit/auditd.conf space_left_action = email If the value of the "space_left_action" is not set to "email", or if the line is commented out, ask the SA to indicate how the system is providing real-time alerts to the SA and ISSO. If there is no evidence that real-time alerts are configured on the system, this is a finding.
Fix: F-87036r1200689_fix
Configure TOSS 5 to initiate an action to notify the SA and ISSO (at a minimum) when allocated audit record storage volume reaches 75 percent of the repository maximum audit record storage capacity by adding/modifying the following line in the /etc/audit/auditd.conf file. space_left_action = email
- RMF Control
- AU-5
- Severity
- M
- CCI
- CCI-001855
- Version
- TOSS-05-000393
- Vuln IDs
-
- V-282571
- Rule IDs
-
- SV-282571r1200693_rule
Checks: C-87132r1200691_chk
Verify TOSS 5 takes action when allocated audit record storage volume reaches 95 percent of the repository maximum audit record storage capacity using the following command: $ sudo grep -w admin_space_left /etc/audit/auditd.conf admin_space_left = 5% If the value of the "admin_space_left" keyword is not set to 5 percent of the storage volume allocated to audit logs, or if the line is commented out, ask the system administrator (SA) to indicate how the system is taking action if the allocated storage is about to reach capacity. If the "space_left" value is not configured to the correct value, this is a finding.
Fix: F-87037r1200692_fix
Configure TOSS 5 to initiate an action when allocated audit record storage volume reaches 95 percent of the repository maximum audit record storage capacity by adding/modifying the following line in the "/etc/audit/auditd.conf" file. admin_space_left = 5%
- RMF Control
- AU-5
- Severity
- M
- CCI
- CCI-001855
- Version
- TOSS-05-000394
- Vuln IDs
-
- V-282572
- Rule IDs
-
- SV-282572r1200696_rule
Checks: C-87133r1200694_chk
Verify TOSS 5 is configured to take action in the event of allocated audit record storage volume reaches 95 percent of the repository maximum audit record storage capacity using the following command: $ sudo grep admin_space_left_action /etc/audit/auditd.conf admin_space_left_action = single If the value of the "admin_space_left_action" is not set to "single", or if the line is commented out, ask the system administrator (SA) to indicate how the system is providing real-time alerts to the SA and information system security officer (ISSO). If there is no evidence that real-time alerts are configured on the system, this is a finding.
Fix: F-87038r1200695_fix
Configure "auditd" service to act in the event of allocated audit record storage volume reaches 95 percent of the repository maximum audit record storage capacity. Edit the following line in "/etc/audit/auditd.conf" to ensure that the system is forced into single user mode in the event the audit record storage volume is about to reach maximum capacity: admin_space_left_action = single Restart the audit daemon changes to take effect.
- RMF Control
- Severity
- M
- CCI
- CCI-004923
- Version
- TOSS-05-000200
- Vuln IDs
-
- V-282574
- Rule IDs
-
- SV-282574r1200702_rule
Checks: C-87135r1200700_chk
Verify TOSS 5 has the "chrony" package installed using the following command: $ sudo dnf list --installed chrony Example output: chrony.x86_64 4.1-3.el9 If the "chrony" package is not installed, this is a finding.
Fix: F-87040r1200701_fix
The "chrony" package can be installed using the following command: $ sudo dnf install chrony
- RMF Control
- Severity
- M
- CCI
- CCI-004923
- Version
- TOSS-05-000201
- Vuln IDs
-
- V-282575
- Rule IDs
-
- SV-282575r1200705_rule
Checks: C-87136r1200703_chk
Verify the "chronyd" service is active using the following command: $ systemctl is-active chronyd active If the "chronyd" service is not active, this is a finding.
Fix: F-87041r1200704_fix
Enable the "chronyd" service using the following command: $ sudo systemctl enable --now chronyd
- RMF Control
- CM-3
- Severity
- M
- CCI
- CCI-001744
- Version
- TOSS-05-000132
- Vuln IDs
-
- V-282578
- Rule IDs
-
- SV-282578r1200714_rule
Checks: C-87139r1200712_chk
Verify TOSS 5 is configured to allow sending email notifications. Note: The "s-nail" package provides the "mail" command that is used to send email messages. Verify the "s-nail" package is installed on the system: $ sudo dnf list --installed s-nail s-nail.x86_64 14.9.22-6.el9 If "s-nail" package is not installed, this is a finding.
Fix: F-87044r1200713_fix
The "s-nail" package can be installed using the following command: $ sudo dnf install s-nail
- RMF Control
- CM-3
- Severity
- M
- CCI
- CCI-001744
- Version
- TOSS-05-000369
- Vuln IDs
-
- V-282579
- Rule IDs
-
- SV-282579r1201582_rule
Checks: C-87140r1200715_chk
Verify TOSS 5 has the AIDE package installed using the following command: $ sudo dnf list --installed aide Example output: aide.x86_64 0.16.100.el9 If AIDE is not installed, ask the system administrator (SA) how file integrity checks are performed on the system. If there is no application installed to perform integrity checks, this is a finding. If AIDE is installed, check if it has been initialized using the following command: $ sudo /usr/sbin/aide --check If the output is "Couldn't open file /var/lib/aide/aide.db.gz for reading", this is a finding.
Fix: F-87045r1200716_fix
Install AIDE, initialize it, and perform a manual check. Install AIDE: $ sudo dnf install aide Initialize AIDE: $ sudo /usr/sbin/aide --init Example output: Start timestamp: 2023-06-05 10:09:04 -0600 (AIDE 0.16) AIDE initialized database at /var/lib/aide/aide.db.new.gz Number of entries: 86833 --------------------------------------------------- The attributes of the (uncompressed) database(s): --------------------------------------------------- /var/lib/aide/aide.db.new.gz MD5 : coZUtPHhoFoeD7+k54fUvQ== SHA1 : DVpOEMWJwo0uPgrKZAygIUgSxeM= SHA256 : EQiZH0XNEk001tcDmJa+5STFEjDb4MPE TGdBJ/uvZKc= SHA512 : 86KUqw++PZhoPK0SZvT3zuFq9yu9nnPP toei0nENVELJ1LPurjoMlRig6q69VR8l +44EwO9eYyy9nnbzQsfG1g== End timestamp: 2023-06-05 10:09:57 -0600 (run time: 0m 53s) The new database must be renamed to be read by AIDE: $ sudo mv /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz Perform a manual check: $ sudo /usr/sbin/aide --check Example output: 2023-06-05 10:16:08 -0600 (AIDE 0.16) AIDE found NO differences between database and filesystem. Looks okay!!
- RMF Control
- CM-3
- Severity
- M
- CCI
- CCI-001744
- Version
- TOSS-05-000370
- Vuln IDs
-
- V-282580
- Rule IDs
-
- SV-282580r1201642_rule
Checks: C-87141r1200718_chk
Verify TOSS 5 routinely executes a file integrity scan for changes to the system baseline. The command used in the example will use a daily occurrence. Check the cron directories for scripts controlling the execution and notification of results of the file integrity application. For example, if AIDE is installed on the system, use the following commands: $ ls -al /etc/cron.* | grep aide -rwxr-xr-x 1 root root 29 Nov 22 2015 aide $ grep aide /etc/crontab /var/spool/cron/root /etc/crontab: 30 04 * * * root usr/sbin/aide /var/spool/cron/root: 30 04 * * * root usr/sbin/aide $ sudo more /etc/cron.daily/aide #!/bin/bash /usr/sbin/aide --check | /bin/mail -s "$HOSTNAME - Daily aide integrity check run" root@sysname.mil If the file integrity application does not exist, or a script file controlling the execution of the file integrity application does not exist, or the file integrity application does not notify designated personnel of changes, this is a finding.
Fix: F-87046r1200719_fix
Configure the file integrity tool to run automatically on the system at least weekly and to notify designated personnel if baseline configurations are changed in an unauthorized manner. The AIDE tool can be configured to email designated personnel with the use of the cron system. The following example output is generic. It will set cron to run AIDE daily and to send email at the completion of the analysis: $ sudo more /etc/cron.daily/aide #!/bin/bash /usr/sbin/aide --check | /bin/mail -s "$HOSTNAME - Daily aide integrity check run" root@sysname.mil
- RMF Control
- CM-5
- Severity
- M
- CCI
- CCI-001813
- Version
- TOSS-05-000256
- Vuln IDs
-
- V-282581
- Rule IDs
-
- SV-282581r1200723_rule
Checks: C-87142r1200721_chk
Verify the SSH daemon does not allow Kerberos authentication using the following command: $ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH '^\s*kerberosauthentication' KerberosAuthentication no If the value is returned as "yes", the returned line is commented out, no output is returned, and the use of Kerberos authentication has not been documented with the information system security officer (ISSO), this is a finding.
Fix: F-87047r1200722_fix
Configure the SSH daemon to not allow Kerberos authentication. Add the following line in "/etc/ssh/sshd_config" or uncomment the line and set the value to "no": KerberosAuthentication no Restart the SSH service for changes to take effect: $ sudo systemctl restart sshd.service
- RMF Control
- Severity
- H
- CCI
- CCI-003992
- Version
- TOSS-05-000115
- Vuln IDs
-
- V-282582
- Rule IDs
-
- SV-282582r1200726_rule
Checks: C-87143r1200724_chk
Confirm Red Hat package-signing keys are installed on the system and verify their fingerprints match vendor values. Note: For TOSS 5 software packages, Red Hat uses GPG keys labeled "release key 2" and "auxiliary key 3". The keys are defined in key file "/etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release" by default. List Red Hat GPG keys installed on the system: $ sudo rpm -q --queryformat "%{SUMMARY}\n" gpg-pubkey | grep -i "red hat" Red Hat, Inc. (release key 2) <security@redhat.com> public key Red Hat, Inc. (auxiliary key 3) <security@redhat.com> public key If Red Hat GPG keys "release key 2" and "auxiliary key 3" are not installed, this is a finding. List key fingerprints of installed Red Hat GPG keys: $ sudo gpg -q --keyid-format short --with-fingerprint /etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release If key file "/etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release" is missing, this is a finding. Example output: pub rsa4096/FD431D51 2009-10-22 [SC] Key fingerprint = 567E 347A D004 4ADE 55BA 8A5F 199E 2F91 FD43 1D51 uid Red Hat, Inc. (release key 2) <security@redhat.com> pub rsa4096/5A6340B3 2022-03-09 [SC] Key fingerprint = 7E46 2425 8C40 6535 D56D 6F13 5054 E4A4 5A63 40B3 uid Red Hat, Inc. (auxiliary key 3) <security@redhat.com> Compare key fingerprints of installed Red Hat GPG keys with fingerprints listed for TOSS 5 on Red Hat "Product Signing Keys" webpage at https://access.redhat.com/security/team/key. If key fingerprints do not match, this is a finding.
Fix: F-87048r1200725_fix
Install Red Hat package-signing keys on the system and verify their fingerprints match vendor values. Insert TOSS 5 installation disc or attach TOSS 5 installation image to the system. Mount the disc or image to make the contents accessible inside the system. Assuming the mounted location is "/media/cdrom", use the following command to copy Red Hat GPG key file onto the system: $ sudo cp /media/cdrom/RPM-GPG-KEY-redhat-release /etc/pki/rpm-gpg/ Import Red Hat GPG keys from key file into system keyring: $ sudo rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release Using the steps listed in the Check, confirm the newly imported keys show as installed on the system and verify their fingerprints match vendor values.
- RMF Control
- Severity
- H
- CCI
- CCI-003992
- Version
- TOSS-05-000116
- Vuln IDs
-
- V-282583
- Rule IDs
-
- SV-282583r1200729_rule
Checks: C-87144r1200727_chk
Verify dnf always checks the GPG signature of software packages originating from external software repositories before installation: $ grep gpgcheck /etc/dnf/dnf.conf gpgcheck=1 If "gpgcheck" is not set to "1", or if the option is missing or commented out, ask the system administrator how the GPG signatures of software packages are verified. If there is no process to verify GPG signatures that is approved by the organization, this is a finding.
Fix: F-87049r1200728_fix
Configure dnf to always check the GPG signature of software packages originating from external software repositories before installation. Add or update the following line in the [main] section of the /etc/dnf/dnf.conf file: gpgcheck=1
- RMF Control
- Severity
- H
- CCI
- CCI-003992
- Version
- TOSS-05-000117
- Vuln IDs
-
- V-282584
- Rule IDs
-
- SV-282584r1200732_rule
Checks: C-87145r1200730_chk
Verify dnf always checks the GPG signature of locally installed software packages before installation: $ grep localpkg_gpgcheck /etc/dnf/dnf.conf localpkg_gpgcheck=1 If "localpkg_gpgcheck" is not set to "1", or if the option is missing or commented out, ask the system administrator how the GPG signatures of local software packages are verified. If there is no process to verify GPG signatures that is approved by the organization, this is a finding.
Fix: F-87050r1200731_fix
Configure dnf to always check the GPG signature of local software packages before installation. Add or update the following line in the [main] section of the /etc/dnf/dnf.conf : localpkg_gpgcheck=1
- RMF Control
- Severity
- H
- CCI
- CCI-003992
- Version
- TOSS-05-000118
- Vuln IDs
-
- V-282585
- Rule IDs
-
- SV-282585r1200735_rule
Checks: C-87146r1200733_chk
Verify all software repositories defined in "/etc/yum.repos.d/" have been configured with "gpgcheck" enabled: $ grep gpgcheck /etc/yum.repos.d/*.repo | more gpgcheck = 1 If "gpgcheck" is not set to "1" for all returned lines, this is a finding.
Fix: F-87051r1200734_fix
Configure all software repositories defined in "/etc/yum.repos.d/" to have "gpgcheck" enabled: $ sudo sed -i 's/gpgcheck\s*=.*/gpgcheck=1/g' /etc/yum.repos.d/*
- RMF Control
- Severity
- M
- CCI
- CCI-003992
- Version
- TOSS-05-000121
- Vuln IDs
-
- V-282586
- Rule IDs
-
- SV-282586r1200738_rule
Checks: C-87147r1200736_chk
Verify the TOSS 5 "subscription-manager" package is installed using the following command: $ sudo dnf list --installed subscription-manager Example output: subscription-manager.x86_64 1.29.26-3.el9_0 If the "subscription-manager" package is not installed, this is a finding.
Fix: F-87052r1200737_fix
Install the "subscription-manager" package using the following command: $ sudo dnf install subscription-manager
- RMF Control
- CM-7
- Severity
- M
- CCI
- CCI-001764
- Version
- TOSS-05-000136
- Vuln IDs
-
- V-282587
- Rule IDs
-
- SV-282587r1200741_rule
Checks: C-87148r1200739_chk
Verify "/var/tmp" is mounted with the "nosuid" option: $ mount | grep /var/tmp /dev/mapper/rhel-var-tmp on /var/tmp type xfs (rw,nodev,nosuid,noexec,seclabel) If the "/var/tmp" file system is mounted without the "nosuid" option, this is a finding.
Fix: F-87053r1200740_fix
Modify "/etc/fstab" to use the "nosuid" option on the "/var/tmp" directory.
- RMF Control
- CM-7
- Severity
- M
- CCI
- CCI-001764
- Version
- TOSS-05-000266
- Vuln IDs
-
- V-282588
- Rule IDs
-
- SV-282588r1200744_rule
Checks: C-87149r1200742_chk
Verify TOSS 5 disables the graphical user interface autorun function using the following command: Note: This requirement assumes the use of the TOSS 5 default graphical user interface—the GNOME desktop environment. If the system does not have a graphical user interface installed, this requirement is not applicable. $ gsettings get org.gnome.desktop.media-handling autorun-never true If "autorun-never" is set to "false" and is not documented with the information system security officer (ISSO) as an operational requirement, this is a finding.
Fix: F-87054r1200743_fix
Configure the GNOME desktop to disable the autorun function on removable media. The dconf settings can be edited in the /etc/dconf/db/* location. Update the [org/gnome/desktop/media-handling] section of the "/etc/dconf/db/local.d/00-security-settings" database file and add or update the following lines: [org/gnome/desktop/media-handling] autorun-never=true Update the dconf system databases: $ sudo dconf update
- RMF Control
- CM-7
- Severity
- M
- CCI
- CCI-001764
- Version
- TOSS-05-000329
- Vuln IDs
-
- V-282589
- Rule IDs
-
- SV-282589r1200747_rule
Checks: C-87150r1200745_chk
Verify the TOSS 5 "fapolicyd" package is installed using the following command: $ sudo dnf list --installed fapolicyd Example output: fapolicyd.x86_64 1.1-103.el9_0 If the "fapolicyd" package is not installed, this is a finding.
Fix: F-87055r1200746_fix
Install the "fapolicyd" package using the following command: $ sudo dnf install fapolicyd
- RMF Control
- IA-11
- Severity
- M
- CCI
- CCI-002038
- Version
- TOSS-05-000326
- Vuln IDs
-
- V-282590
- Rule IDs
-
- SV-282590r1200750_rule
Checks: C-87151r1200748_chk
Verify the sudoers security policy is configured to use the invoking user's password for privilege escalation using the following command: $ sudo egrep -ir '(!rootpw|!targetpw|!runaspw)' /etc/sudoers /etc/sudoers.d/* | grep -v '#' /etc/sudoers:Defaults !targetpw /etc/sudoers:Defaults !rootpw /etc/sudoers:Defaults !runaspw If no results are returned, this is a finding. If results are returned from more than one file location, this is a finding. If "Defaults !targetpw" is not defined, this is a finding. If "Defaults !rootpw" is not defined, this is a finding. If "Defaults !runaspw" is not defined, this is a finding.
Fix: F-87056r1200749_fix
Define the following in the Defaults section of the "/etc/sudoers" file or a single configuration file in the "/etc/sudoers.d/" directory: Defaults !targetpw Defaults !rootpw Defaults !runaspw
- RMF Control
- Severity
- M
- CCI
- CCI-004046
- Version
- TOSS-05-000361
- Vuln IDs
-
- V-282591
- Rule IDs
-
- SV-282591r1200753_rule
Checks: C-87152r1200751_chk
Verify TOSS 5 has the "pcsc-lite" package installed using the following command: $ sudo dnf list --installed pcsc-lite Example output: pcsc-lite.x86_64 1.9.4-1.el9 If the "pcsc-lite" package is not installed, this is a finding.
Fix: F-87057r1200752_fix
Install the "pcsc-lite" package using the following command: $ sudo dnf install pcsc-lite
- RMF Control
- Severity
- M
- CCI
- CCI-004046
- Version
- TOSS-05-000363
- Vuln IDs
-
- V-282592
- Rule IDs
-
- SV-282592r1200756_rule
Checks: C-87153r1200754_chk
Verify TOSS 5 has the "opensc" package installed using the following command: $ sudo dnf list --installed opensc Example output: opensc.x86_64 0.22.0-2.el9 If the "opensc" package is not installed, this is a finding.
Fix: F-87058r1200755_fix
Install the "opensc" package using the following command: $ sudo dnf install opensc
- RMF Control
- IA-3
- Severity
- M
- CCI
- CCI-001958
- Version
- TOSS-05-000285
- Vuln IDs
-
- V-282593
- Rule IDs
-
- SV-282593r1200759_rule
Checks: C-87154r1200757_chk
Verify USBGuard is installed on the operating system using the following command: $ sudo dnf list installed usbguard usbguard.x86_64 1.0.0-10.el9_1.2 @rhel-9-for-x86_64-appstream-rpms If the USBGuard package is not installed, ask the SA to indicate how unauthorized peripherals are blocked. If there is no evidence that unauthorized peripherals are blocked before establishing a connection, this is a finding.
Fix: F-87059r1200758_fix
Install the usbguard package using the following command: $ sudo dnf install usbguard
- RMF Control
- IA-3
- Severity
- M
- CCI
- CCI-001958
- Version
- TOSS-05-000286
- Vuln IDs
-
- V-282594
- Rule IDs
-
- SV-282594r1200762_rule
Checks: C-87155r1200760_chk
Verify TOSS 5 has USBGuard enabled using the following command: $ systemctl is-active usbguard active If usbguard is not active, ask the SA to indicate how unauthorized peripherals are blocked. If there is no evidence that unauthorized peripherals are being blocked before establishing a connection, this is a finding.
Fix: F-87060r1200761_fix
Enable the USBGuard service using the following command: $ sudo systemctl enable --now usbguard
- RMF Control
- IA-3
- Severity
- M
- CCI
- CCI-001958
- Version
- TOSS-05-000288
- Vuln IDs
-
- V-282595
- Rule IDs
-
- SV-282595r1200765_rule
Checks: C-87156r1200763_chk
Verify the USBGuard has a policy configured using the following command: $ usbguard list-rules allow id 1d6b:0001 serial If the command does not return results or an error is returned, ask the SA to indicate how unauthorized peripherals are being blocked. If there is no evidence that unauthorized peripherals are being blocked before establishing a connection, this is a finding. If the system is a virtual machine with no virtual or physical USB peripherals attached, this is not a finding.
Fix: F-87061r1200764_fix
Configure the operating system to enable blocking of unauthorized peripherals using the following command: Note: This command must be run from a root shell and will create an allow list for any usb devices currently connect to the system. # usbguard generate-policy --no-hash > /etc/usbguard/rules.conf Note: Enabling and starting usbguard without properly configuring it for an individual system will immediately prevent any access over a usb device such as a keyboard or mouse.
- RMF Control
- IA-5
- Severity
- M
- CCI
- CCI-002007
- Version
- TOSS-05-000368
- Vuln IDs
-
- V-282597
- Rule IDs
-
- SV-282597r1200771_rule
Checks: C-87158r1200769_chk
Verify the System Security Services Daemon (SSSD) prohibits the use of cached authentications after one day. Note: If smart card authentication is not being used on the system, this requirement is not applicable. Check that SSSD allows cached authentications using the following command: $ sudo grep cache_credentials /etc/sssd/sssd.conf cache_credentials = true If "cache_credentials" is set to "false" or missing from the configuration file, this is not a finding and no further checks are required. If "cache_credentials" is set to "true", check that SSSD prohibits the use of cached authentications after one day using the following command: $ sudo grep offline_credentials_expiration /etc/sssd/sssd.conf offline_credentials_expiration = 1 If "offline_credentials_expiration" is not set to a value of "1", this is a finding.
Fix: F-87063r1200770_fix
Configure the SSSD to prohibit the use of cached authentications after one day. Add or change the following line in "/etc/sssd/sssd.conf" just below the line [pam]: offline_credentials_expiration = 1
- RMF Control
- MA-4
- Severity
- M
- CCI
- CCI-002884
- Version
- TOSS-05-000459
- Vuln IDs
-
- V-282598
- Rule IDs
-
- SV-282598r1200774_rule
Checks: C-87159r1200772_chk
Verify TOSS 5 generates audit records for all account creations, modifications, disabling, and termination events that affect "/var/log/faillock" using the following command: $ sudo auditctl -l | grep /var/log/faillock -w /var/log/faillock -p wa -k logins If the command does not return a line or the line is commented out, this is a finding.
Fix: F-87064r1200773_fix
Configure TOSS 5 to generate audit records for all account creations, modifications, disabling, and termination events that affect "/var/log/faillock". Add or update the following file system rule to "/etc/audit/rules.d/audit.rules": -w /var/log/faillock -p wa -k logins Restart the audit daemon for the changes to take effect.
- RMF Control
- MA-4
- Severity
- M
- CCI
- CCI-002884
- Version
- TOSS-05-000461
- Vuln IDs
-
- V-282599
- Rule IDs
-
- SV-282599r1201494_rule
Checks: C-87160r1201493_chk
Verify TOSS 5 generates audit records for all account creations, modifications, disabling, and termination events that affect "/var/log/tallylog" using the following command: $ sudo auditctl -l | grep /var/log/tallylog -w /var/log/tallylog -p wa -k logins If the command does not return a line, or the line is commented out, this is a finding.
Fix: F-87065r1200776_fix
Configure TOSS 5 to generate audit records for all account creations, modifications, disabling, and termination events that affect "/var/log/tallylog". Add or update the following file system rule to "/etc/audit/rules.d/audit.rules": -w /var/log/tallylog -p wa -k logins Restart the audit daemon for the changes to take effect.
- RMF Control
- SC-13
- Severity
- H
- CCI
- CCI-002450
- Version
- TOSS-05-000468
- Vuln IDs
-
- V-282601
- Rule IDs
-
- SV-282601r1200783_rule
Checks: C-87162r1200781_chk
Verify the TOSS 5 "crypto-policies" package is installed using the following command: $ sudo dnf list --installed crypto-policies Example output: crypto-policies.noarch 20220223-1.git5203b41.el9_0.1 If the "crypto-policies" package is not installed, this is a finding.
Fix: F-87067r1200782_fix
Install the "crypto-policies package" using the following command: $ sudo dnf install crypto-policies
- RMF Control
- SC-13
- Severity
- M
- CCI
- CCI-002450
- Version
- TOSS-05-000470
- Vuln IDs
-
- V-282602
- Rule IDs
-
- SV-282602r1200786_rule
Checks: C-87163r1200784_chk
Verify TOSS 5 custom crypto policies are loaded correctly. List all of the crypto backends configured on the system. $ ls -l /etc/crypto-policies/back-ends/ lrwxrwxrwx. 1 root root 40 Oct 7 08:44 bind.config -> /usr/share/crypto-policies/FIPS/bind.txt lrwxrwxrwx. 1 root root 42 Oct 7 08:44 gnutls.config -> /usr/share/crypto-policies/FIPS/gnutls.txt lrwxrwxrwx. 1 root root 40 Oct 7 08:44 java.config -> /usr/share/crypto-policies/FIPS/java.txt lrwxrwxrwx. 1 root root 46 Oct 7 08:44 javasystem.config -> /usr/share/crypto-policies/FIPS/javasystem.txt lrwxrwxrwx. 1 root root 40 Oct 7 08:44 krb5.config -> /usr/share/crypto-policies/FIPS/krb5.txt lrwxrwxrwx. 1 root root 45 Oct 7 08:44 libreswan.config -> /usr/share/crypto-policies/FIPS/libreswan.txt lrwxrwxrwx. 1 root root 42 Oct 7 08:44 libssh.config -> /usr/share/crypto-policies/FIPS/libssh.txt lrwxrwxrwx. 1 root root 39 Oct 7 08:44 nss.config -> /usr/share/crypto-policies/FIPS/nss.txt lrwxrwxrwx. 1 root root 43 Oct 7 08:44 openssh.config -> /usr/share/crypto-policies/FIPS/openssh.txt lrwxrwxrwx. 1 root root 49 Oct 7 08:44 opensshserver.config -> /usr/share/crypto-policies/FIPS/opensshserver.txt lrwxrwxrwx. 1 root root 46 Oct 7 08:44 opensslcnf.config -> /usr/share/crypto-policies/FIPS/opensslcnf.txt lrwxrwxrwx. 1 root root 43 Oct 7 08:44 openssl.config -> /usr/share/crypto-policies/FIPS/openssl.txt If the paths do not point the respective files under "/usr/share/crypto-policies/FIPS" path, this is a finding.
Fix: F-87068r1200785_fix
Configure TOSS 5 to FIPS crypto policy. $ sudo ln -s /usr/share/crypto-policies/FIPS/<service>.txt /etc/crypto-policies/back-ends/<service>.conf Replace <service> with every service that is not set to FIPS. Restart the system for the changes to take effect.
- RMF Control
- SC-13
- Severity
- M
- CCI
- CCI-002450
- Version
- TOSS-05-000475
- Vuln IDs
-
- V-282603
- Rule IDs
-
- SV-282603r1200789_rule
Checks: C-87164r1200787_chk
Verify the TOSS 5 cryptography policy has been configured correctly with the following commands: $ sudo update-crypto-policies --show FIPS:OSPP If the cryptography base profile is not set to "FIPS" and is not applied, this is a finding. $ sudo update-crypto-policies --check The configured policy matches the generated policy If the command does not return "The configured policy matches the generated policy", this is a finding.
Fix: F-87069r1200788_fix
Configure TOSS 5 to implement FIPS mode with the following command: $ sudo update-crypto-policies --set FIPS:OSPP Reboot the system for the changes to take effect.
- RMF Control
- SC-5
- Severity
- M
- CCI
- CCI-002385
- Version
- TOSS-05-000196
- Vuln IDs
-
- V-282605
- Rule IDs
-
- SV-282605r1200795_rule
Checks: C-87166r1200793_chk
Verify "nftables" is configured to allow rate limits on any connection to the system using the following command: $ sudo grep -i firewallbackend /etc/firewalld/firewalld.conf # FirewallBackend FirewallBackend=nftables If the "nftables" is not set as the "FirewallBackend" default, this is a finding.
Fix: F-87071r1200794_fix
Configure "nftables" to be the default "firewallbackend" for "firewalld" by adding or editing the following line in "etc/firewalld/firewalld.conf": FirewallBackend=nftables Establish rate-limiting rules based on organization-defined types of DoS attacks on impacted network interfaces.
- RMF Control
- SC-8
- Severity
- M
- CCI
- CCI-002418
- Version
- TOSS-05-000233
- Vuln IDs
-
- V-282606
- Rule IDs
-
- SV-282606r1201360_rule
Checks: C-87167r1200796_chk
Verify TOSS 5 has the "openssh-server" package installed using the following command: $ sudo dnf list --installed openssh-server Example output: openssh-server.x86_64 8.7p1-8.el9 If the "openssh-server" package is not installed, this is a finding.
Fix: F-87072r1200797_fix
Install the "openssh-server" package using the following command: $ sudo dnf install openssh-server
- RMF Control
- SC-8
- Severity
- M
- CCI
- CCI-002418
- Version
- TOSS-05-000234
- Vuln IDs
-
- V-282607
- Rule IDs
-
- SV-282607r1200801_rule
Checks: C-87168r1200799_chk
Verify "sshd" is active using the following command: $ systemctl is-active sshd active If the "sshd" service is not active, this is a finding.
Fix: F-87073r1200800_fix
Enable the "sshd" service using the following command: $ systemctl enable --now sshd
- RMF Control
- SC-8
- Severity
- M
- CCI
- CCI-002418
- Version
- TOSS-05-000476
- Vuln IDs
-
- V-282608
- Rule IDs
-
- SV-282608r1200804_rule
Checks: C-87169r1200802_chk
Verify BIND uses the system crypto policy using the following command: Note: If the "bind" package is not installed, this requirement is not applicable. $ sudo grep include /etc/named.conf include "/etc/crypto-policies/back-ends/bind.config";' If BIND is installed and the BIND config file does not include the "/etc/crypto-policies/back-ends/bind.config" directive, or the line is commented out, this is a finding.
Fix: F-87074r1200803_fix
Configure BIND to use the system crypto policy. Add the following line to the "options" section in "/etc/named.conf": include "/etc/crypto-policies/back-ends/bind.config";
- RMF Control
- SI-16
- Severity
- M
- CCI
- CCI-002824
- Version
- TOSS-05-000114
- Vuln IDs
-
- V-282610
- Rule IDs
-
- SV-282610r1200810_rule
Checks: C-87171r1200808_chk
Verify ExecShield is enabled on 64-bit TOSS 5 systems using the following command: $ sudo dmesg | grep '[NX|DX]*protection' [ 0.000000] NX (Execute Disable) protection: active If "dmesg" does not show "NX (Execute Disable) protection" active, this is a finding.
Fix: F-87076r1200809_fix
Update the GRUB 2 bootloader configuration. Run the following command: $ sudo grubby --update-kernel=ALL --remove-args=noexec
- RMF Control
- SI-2
- Severity
- L
- CCI
- CCI-002617
- Version
- TOSS-05-000120
- Vuln IDs
-
- V-282611
- Rule IDs
-
- SV-282611r1200813_rule
Checks: C-87172r1200811_chk
Verify TOSS 5 removes all software components after updated versions have been installed using the following command: $ grep clean /etc/dnf/dnf.conf clean_requirements_on_remove=1 If "clean_requirements_on_remove" is not set to "1", this is a finding.
Fix: F-87077r1200812_fix
Configure TOSS 5 to remove all software components after updated versions have been installed. Edit the file /etc/dnf/dnf.conf by adding or editing the following line: clean_requirements_on_remove=1
- RMF Control
- SI-6
- Severity
- M
- CCI
- CCI-002696
- Version
- TOSS-05-000024
- Vuln IDs
-
- V-282613
- Rule IDs
-
- SV-282613r1201304_rule
Checks: C-87174r1200817_chk
Note: At lower classification levels (CUI, Secret) where vast amounts of data are processed and a performance impact is occurring, an authorizing official can consider this requirement not applicable. Check that TOSS verifies correct operation of all security functions. Determine if "SELinux" is active and is enforcing the targeted policy using the following command: $ sudo sestatus SELinux status: enabled SELinuxfs mount: /sys/fs/selinux SELinux root directory: /etc/selinux Loaded policy name: targeted Current mode: enforcing Mode from config file: enforcing Policy MLS status: enabled Policy deny_unknown status: allowed Memory protection checking: actual (secure) Max kernel policy version: 33 If the "Loaded policy name" is not set to "targeted", this is a finding. Verify the "/etc/selinux/config" file is configured with the "SELINUXTYPE" of "targeted": $ sudo grep -i "selinuxtype" /etc/selinux/config | grep -v '^#' SELINUXTYPE = targeted If no results are returned, or "SELINUXTYPE" is not set to "targeted", this is a finding.
Fix: F-87079r1201303_fix
Configure the operating system to verify correct operation of all security functions. Set the "SELinuxtype" to the "targeted" policy by modifying the "/etc/selinux/config" file to have the following line: SELINUXTYPE=targeted Restart the system for the changes to take effect.
- RMF Control
- SC-13
- Severity
- H
- CCI
- CCI-002450
- Version
- TOSS-05-000469
- Vuln IDs
-
- V-282615
- Rule IDs
-
- SV-282615r1201495_rule
Checks: C-87176r1200823_chk
Verify the TOSS 5 package "crypto-policies" has not been modified using the following command: $ rpm -V crypto-policies If the command has any output, this is a finding.
Fix: F-87081r1200824_fix
Reinstall the "crypto-policies" package to remove any modifications. $ sudo dnf reinstall crypto-policies
- RMF Control
- AU-4
- Severity
- M
- CCI
- CCI-001851
- Version
- TOSS-05-000375
- Vuln IDs
-
- V-282616
- Rule IDs
-
- SV-282616r1200828_rule
Checks: C-87177r1200826_chk
Verify TOSS 5 has the "rsyslogd" package installed using the following command: $ sudo dnf list --installed rsyslog Example output: rsyslog.x86_64 8.2102.0-101.el9_0.1 If the "rsyslogd" package is not installed, this is a finding.
Fix: F-87082r1200827_fix
Install the "rsyslogd" package using the following command: $ sudo dnf install rsyslogd
- RMF Control
- AU-4
- Severity
- M
- CCI
- CCI-001851
- Version
- TOSS-05-000384
- Vuln IDs
-
- V-282617
- Rule IDs
-
- SV-282617r1201621_rule
Checks: C-87178r1200829_chk
Verify TOSS 5 audit system offloads audit records onto a different system or media from the system being audited via rsyslog using TCP using the following command: $ sudo grep @@ /etc/rsyslog.conf /etc/rsyslog.d/*.conf /etc/rsyslog.conf:*.* @@[remoteloggingserver]:[port] If a remote server is not configured, or the line is commented out, ask the system administrator (SA) to indicate how the audit logs are offloaded to a different system or media. If there is no evidence that the audit logs are being offloaded to another system or media, this is a finding.
Fix: F-87083r1200830_fix
Configure TOSS 5 to offload audit records onto a different system or media from the system being audited via TCP using rsyslog by specifying the remote logging server in "/etc/rsyslog.conf"" or "/etc/rsyslog.d/[customfile].conf" with the name or IP address of the log aggregation server. *.* @@[remoteloggingserver]:[port]"
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000347
- Vuln IDs
-
- V-282618
- Rule IDs
-
- SV-282618r1200834_rule
Checks: C-87179r1200832_chk
Verify TOSS 5 prevents using dictionary words for passwords using the following command: $ sudo grep dictcheck /etc/security/pwquality.conf /etc/pwquality.conf.d/*.conf /etc/security/pwquality.conf:dictcheck=1 If "dictcheck" does not have a value other than "0" or is commented out, this is a finding.
Fix: F-87084r1200833_fix
Configure TOSS 5 to prevent the use of dictionary words for passwords. Add or update the following line in the "/etc/security/pwquality.conf" file or a configuration file in the /etc/pwquality.conf.d/ directory to contain the "dictcheck" parameter: dictcheck=1
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000315
- Vuln IDs
-
- V-282619
- Rule IDs
-
- SV-282619r1200837_rule
Checks: C-87180r1200835_chk
Verify TOSS 5 enforces a delay of at least four seconds between console logon prompts following a failed logon attempt using the following command: $ grep -i fail_delay /etc/login.defs FAIL_DELAY 4 If the value of "FAIL_DELAY" is not set to "4" or greater or the line is commented out, this is a finding.
Fix: F-87085r1200836_fix
Configure the TOSS 5 to enforce a delay of at least four seconds between logon prompts following a failed console logon attempt. Modify the "/etc/login.defs" file to set the "FAIL_DELAY" parameter to 4 or greater: FAIL_DELAY 4
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000029
- Vuln IDs
-
- V-282620
- Rule IDs
-
- SV-282620r1200840_rule
Checks: C-87181r1200838_chk
Verify the current GRUB 2 configuration disables virtual system calls using the following command: $ sudo grubby --info=ALL | grep args | grep -v 'vsyscall=none' If any output is returned and is not documented with the information system security officer (ISSO) as an operational requirement, this is a finding.
Fix: F-87086r1200839_fix
Document the use of virtual system calls with the ISSO as an operational requirement or disable them using the following command: $ sudo grubby --update-kernel=ALL --args="vsyscall=none" Add or modify the following line in "/etc/default/grub" to ensure the configuration survives kernel updates: GRUB_CMDLINE_LINUX="vsyscall=none"
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000030
- Vuln IDs
-
- V-282621
- Rule IDs
-
- SV-282621r1200843_rule
Checks: C-87182r1200841_chk
Verify GRUB 2 is configured to enable page poisoning to mitigate use-after-free vulnerabilities. Check that the current GRUB 2 configuration has page poisoning enabled using the following command: $ sudo grubby --info=ALL | grep args | grep -v 'page_poison=1' If any output is returned, this is a finding.
Fix: F-87087r1200842_fix
Configure TOSS 5 to enable page poisoning with the following commands: $ sudo grubby --update-kernel=ALL --args="page_poison=1" Add or modify the following line in "/etc/default/grub" to ensure the configuration survives kernel updates: GRUB_CMDLINE_LINUX="page_poison=1"
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000033
- Vuln IDs
-
- V-282622
- Rule IDs
-
- SV-282622r1201309_rule
Checks: C-87183r1200844_chk
Verify TOSS 5 disables storing core dumps with the following commands: $ sudo sysctl kernel.core_pattern kernel.core_pattern = |/bin/false If the returned line does not have a value of "|/bin/false", or a line is not returned and the need for core dumps is not documented with the information system security officer (ISSO) as an operational requirement, this is a finding.
Fix: F-87088r1201308_fix
Configure TOSS 5 to disable storing core dumps. Add or edit the following line in a system configuration file in the "/etc/sysctl.d/" directory: kernel.core_pattern = |/bin/false Reload the system configuration files for the changes to take effect. $ sudo sysctl --system
- RMF Control
- CM-6
- Severity
- H
- CCI
- CCI-000366
- Version
- TOSS-05-000084
- Vuln IDs
-
- V-282623
- Rule IDs
-
- SV-282623r1201600_rule
Checks: C-87184r1200847_chk
Verify the version of TOSS 5 is vendor supported using the following command: $ cat /etc/toss-release toss-release-5.1-1 If the installed version of TOSS 5 is not supported, this is a finding.
Fix: F-87089r1200848_fix
Upgrade to a supported version of TOSS 5.
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000085
- Vuln IDs
-
- V-282624
- Rule IDs
-
- SV-282624r1200852_rule
Checks: C-87185r1200850_chk
Verify TOSS 5 security patches and updates are installed and up to date. Updates are required in a frequency determined by organizational policy. Check the TOSS release notes sent via email for security updates. It is important to note that updates provided by Red Hat/TOSS may not be present on the system if the underlying packages are not installed. Check that the available package security updates have been installed on the system using the following command: $ dnf history list | more ID | Command line | Date and time | Action(s) | Altered ------------------------------------------------------------------------------- 70 | install aide | 2023-03-05 10:58 | Install | 1 69 | update -y | 2023-03-04 14:34 | Update | 18 EE 68 | install vlc | 2023-02-21 17:12 | Install | 21 67 | update -y | 2023-02-21 17:04 | Update | 7 EE Typical update frequency may be overridden by Information Assurance Vulnerability Alert (IAVA) notifications from CYBERCOM. If the system is not compliant with the organizational patching policy, this is a finding.
Fix: F-87090r1200851_fix
Install TOSS 5 security patches and updates at the organizationally defined frequency. If system updates are installed via a centralized repository that is configured on the system, install all updates using the following command: $ sudo dnf update
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000087
- Vuln IDs
-
- V-282625
- Rule IDs
-
- SV-282625r1200855_rule
Checks: C-87186r1200853_chk
Verify TOSS 5 is configured to boot to the command line: $ systemctl get-default multi-user.target If the system default target is not set to "multi-user.target" and the information system security officer (ISSO) lacks a documented requirement for a graphical user interface, this is a finding.
Fix: F-87091r1200854_fix
Document the requirement for a graphical user interface with the ISSO or set the default target to "multi-user" using the following command: $ sudo systemctl set-default multi-user.target
- RMF Control
- CM-6
- Severity
- L
- CCI
- CCI-000366
- Version
- TOSS-05-000088
- Vuln IDs
-
- V-282626
- Rule IDs
-
- SV-282626r1200858_rule
Checks: C-87187r1200856_chk
Verify TOSS 5 enabled the hardware random number generator entropy gatherer service using the following command: Note: For TOSS 5 systems running with kernel FIPS mode enabled as specified by TOSS-05-000470, this requirement is not applicable. $ systemctl is-active rngd active If the "rngd" service is not active, this is a finding.
Fix: F-87092r1200857_fix
Install the "rng-tools" package using the following command: $ sudo dnf install rng-tools Enable the "rngd" service using the following command: $ sudo systemctl enable --now rngd
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000093
- Vuln IDs
-
- V-282627
- Rule IDs
-
- SV-282627r1200861_rule
Checks: C-87188r1200859_chk
Verify GRUB 2 is configured to disable interactive boot. Check that the current GRUB 2 configuration disables the ability of systemd to spawn an interactive boot process using the following command: $ sudo grubby --info=ALL | grep args | grep 'systemd.confirm_spawn' If any output is returned, this is a finding.
Fix: F-87093r1200860_fix
Configure TOSS 5 to allocate sufficient audit_backlog_limit to disable the ability of systemd to spawn an interactive boot process using the following command: $ sudo grubby --update-kernel=ALL --remove-args="systemd.confirm_spawn"
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000095
- Vuln IDs
-
- V-282628
- Rule IDs
-
- SV-282628r1200864_rule
Checks: C-87189r1200862_chk
Verify the group ownership of the "/boot/grub2/grub.cfg" file using the following command: $ sudo stat -c "%G %n" /boot/grub2/grub.cfg root /boot/grub2/grub.cfg If "/boot/grub2/grub.cfg" file does not have a group owner of "root", this is a finding.
Fix: F-87094r1200863_fix
Change the group of the file /boot/grub2/grub.cfg to root using the following command: $ sudo chgrp root /boot/grub2/grub.cfg
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000096
- Vuln IDs
-
- V-282629
- Rule IDs
-
- SV-282629r1200867_rule
Checks: C-87190r1200865_chk
Verify the ownership of the "/boot/grub2/grub.cfg" file using the following command: $ sudo stat -c "%U %n" /boot/grub2/grub.cfg root /boot/grub2/grub.cfg If "/boot/grub2/grub.cfg" file does not have an owner of "root", this is a finding.
Fix: F-87095r1200866_fix
Change the owner of the file "/boot/grub2/grub.cfg" to root using the following command: $ sudo chown root /boot/grub2/grub.cfg
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000100
- Vuln IDs
-
- V-282630
- Rule IDs
-
- SV-282630r1200870_rule
Checks: C-87191r1200868_chk
Verify TOSS 5 is configured to disable kernel image loading using the following command: $ sudo sysctl kernel.kexec_load_disabled kernel.kexec_load_disabled = 1 If "kernel.kexec_load_disabled" is not set to "1" or is missing, this is a finding.
Fix: F-87096r1200869_fix
Add or edit the following line in a system configuration file in the "/etc/sysctl.d/" directory: kernel.kexec_load_disabled = 1 Load settings from all system configuration files using the following command: $ sudo sysctl --system
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000111
- Vuln IDs
-
- V-282631
- Rule IDs
-
- SV-282631r1200873_rule
Checks: C-87192r1200871_chk
Verify TOSS 5 disables core dump backtraces using the following command: $ grep -i process /etc/systemd/coredump.conf ProcessSizeMax=0 If the "ProcessSizeMax" item is missing, commented out, or the value is anything other than "0" and the need for core dumps is not documented with the information system security officer (ISSO) as an operational requirement for all domains that have the "core" item assigned, this is a finding.
Fix: F-87097r1200872_fix
Configure TOSS 5 to disable core dump backtraces. Add or modify the following line in /etc/systemd/coredump.conf: ProcessSizeMax=0
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000112
- Vuln IDs
-
- V-282632
- Rule IDs
-
- SV-282632r1200876_rule
Checks: C-87193r1200874_chk
Verify TOSS 5 disables storing core dumps for all users using the following command: $ grep -i storage /etc/systemd/coredump.conf Storage=none If the "Storage" item is missing, commented out, or the value is anything other than "none" and the need for core dumps is not documented with the information system security officer (ISSO) as an operational requirement for all domains that have the "core" item assigned, this is a finding.
Fix: F-87098r1200875_fix
Configure TOSS 5 to disable storing core dumps for all users. Add or modify the following line in /etc/systemd/coredump.conf: Storage=none
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000113
- Vuln IDs
-
- V-282633
- Rule IDs
-
- SV-282633r1200879_rule
Checks: C-87194r1200877_chk
Verify TOSS 5 is not configured to acquire, save, or process core dumps using the following command: $ sudo systemctl status systemd-coredump.socket systemd-coredump.socket Loaded: masked (Reason: Unit systemd-coredump.socket is masked.) Active: inactive (dead) If the "systemd-coredump.socket" is loaded and not masked and the need for core dumps is not documented with the information system security officer (ISSO) as an operational requirement, this is a finding.
Fix: F-87099r1200878_fix
Configure the system to disable the systemd-coredump.socket using the following command: $ sudo systemctl mask --now systemd-coredump.socket Created symlink /etc/systemd/system/systemd-coredump.socket -> /dev/null Reload the daemon for this change to take effect. $ sudo systemctl daemon-reload
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000122
- Vuln IDs
-
- V-282634
- Rule IDs
-
- SV-282634r1200882_rule
Checks: C-87195r1200880_chk
Verify the "sendmail" package is not installed using the following command: $ sudo dnf list --installed sendmail Error: No matching Packages to list If the "sendmail" package is installed, this is a finding.
Fix: F-87100r1200881_fix
Remove the "sendmail" package using the following command: $ sudo dnf remove sendmail
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000127
- Vuln IDs
-
- V-282635
- Rule IDs
-
- SV-282635r1201602_rule
Checks: C-87196r1200883_chk
Verify the "quagga" package is not installed using the following command: $ sudo dnf list --installed quagga Error: No matching Packages to list If the "quagga" package is installed and is not documented with the information system security officer (ISSO) as an operational requirement, this is a finding.
Fix: F-87101r1200884_fix
Remove the "quagga" package using the following command: $ sudo dnf remove quagga
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000129
- Vuln IDs
-
- V-282636
- Rule IDs
-
- SV-282636r1201310_rule
Checks: C-87197r1200886_chk
Verify TOSS 5 has the "gnutls-utils" package installed using the following command: $ dnf list --installed gnutls-utils Example output: gnutls-utils.x86_64 3.7.3-9.el9 If the "gnutls-utils" package is not installed, this is a finding.
Fix: F-87102r1200887_fix
Install the "gnutls-utils" package using the following command: $ sudo dnf install gnutls-utils
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000130
- Vuln IDs
-
- V-282637
- Rule IDs
-
- SV-282637r1200891_rule
Checks: C-87198r1200889_chk
Verify TOSS 5 has the "nss-tools" package installed using the following command: $ dnf list --installed nss-tools Example output: nss-tools.x86_64 3.71.0-7.el9 If the "nss-tools" package is not installed, this is a finding.
Fix: F-87103r1200890_fix
Install the "nss-tools" package using the following command: $ sudo dnf install nss-tools
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000131
- Vuln IDs
-
- V-282638
- Rule IDs
-
- SV-282638r1200894_rule
Checks: C-87199r1200892_chk
Verify TOSS 5 has the "rng-tools" package installed using the following command: $ sudo dnf list --installed rng-tools Example output: rng-tools.x86_64 6.14-2.git.b2b7934e.el9 If the "rng-tools" package is not installed, this is a finding.
Fix: F-87104r1200893_fix
Install the "rng-tools" package using the following command: $ sudo dnf install rng-tools
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000134
- Vuln IDs
-
- V-282639
- Rule IDs
-
- SV-282639r1200897_rule
Checks: C-87200r1200895_chk
Verify TOSS 5 has the "sec" option configured for all NFS mounts using the following command: Note: If no NFS mounts are configured, this requirement is not applicable. $ cat /etc/fstab | grep nfs 192.168.22.2:/mnt/export /data nfs4 rw,nosuid,nodev,noexec,sync,soft,sec=krb5p:krb5i:krb5 If the system is mounting file systems via NFS and has the sec option without the "krb5:krb5i:krb5p" settings, the "sec" option has the "sys" setting, or the "sec" option is missing, this is a finding.
Fix: F-87105r1200896_fix
Update the "/etc/fstab" file so the option "sec" is defined for each NFS mounted file system and the "sec" option does not have the "sys" setting. Ensure the "sec" option is defined as "krb5p:krb5i:krb5".
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000135
- Vuln IDs
-
- V-282640
- Rule IDs
-
- SV-282640r1200900_rule
Checks: C-87201r1200898_chk
Verify TOSS 5 has the "nodev" option configured for all NFS mounts using the following command: Note: If no NFS mounts are configured, this requirement is not applicable. $ cat /etc/fstab | grep nfs 192.168.22.2:/mnt/export /data nfs4 rw,nosuid,nodev,noexec,sync,soft,sec=krb5:krb5i:krb5p If the system is mounting file systems via NFS and the "nodev" option is missing, this is a finding.
Fix: F-87106r1200899_fix
Update each NFS mounted file system to use the "nodev" option on file systems that are being imported via NFS.
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000145
- Vuln IDs
-
- V-282641
- Rule IDs
-
- SV-282641r1200903_rule
Checks: C-87202r1200901_chk
Verify the permissions of the cron directories using the following command: $ find /etc/cron* -type d | xargs stat -c "%a %n" 700 /etc/cron.d 700 /etc/cron.daily 700 /etc/cron.hourly 700 /etc/cron.monthly 700 /etc/cron.weekly If any cron configuration directory is more permissive than "700", this is a finding.
Fix: F-87107r1200902_fix
Configure any TOSS 5 cron configuration directory with a mode more permissive than "0700" as follows: $ sudo chmod 0700 [cron configuration directory]
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000146
- Vuln IDs
-
- V-282642
- Rule IDs
-
- SV-282642r1200906_rule
Checks: C-87203r1200904_chk
Verify all local initialization files have a mode of "0740" or less permissive using the following command: Note: The example will be for the "wadea" user, who has a home directory of "/home/wadea". $ sudo ls -al /home/wadea/.[^.]* | more -rwxr---- 1 wadea users 896 Mar 10 2011 .profile -rwxr---- 1 wadea users 497 Jan 6 2007 .login -rwxr---- 1 wadea users 886 Jan 6 2007 .something If any local initialization files have a mode more permissive than "0740", and is not documented with the information system security officer (ISSO) as an operational requirement, this is a finding.
Fix: F-87108r1200905_fix
Set the mode of the local initialization files to "0740" using the following command: Note: The example will be for the wadea user, who has a home directory of "/home/wadea". $ sudo chmod 0740 /home/wadea/.<INIT_FILE>
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000147
- Vuln IDs
-
- V-282643
- Rule IDs
-
- SV-282643r1200909_rule
Checks: C-87204r1200907_chk
Verify the assigned home directory of all local interactive users has a mode of "0770" or less permissive using the following command: Note: This may miss interactive users that have been assigned a privileged user identifier (UID). Evidence of interactive use may be obtained from a number of log files containing system logon information. $ sudo ls -ld $(awk -F: '($3>=1000)&&($7 !~ /nologin/){print $6}' /etc/passwd) drwxrwx--- 2 wadea admin 4096 Jun 5 12:41 wadea If home directories referenced in "/etc/passwd" do not have a mode of "0770" or less permissive, this is a finding.
Fix: F-87109r1200908_fix
Change the mode of interactive user's home directories to "0770". To change the mode of a local interactive user's home directory, use the following command: Note: The example will be for the user "wadea". $ sudo chmod 0770 /home/wadea
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000148
- Vuln IDs
-
- V-282644
- Rule IDs
-
- SV-282644r1200912_rule
Checks: C-87205r1200910_chk
Verify the "/etc/group" file has mode "0644" or less permissive using the following command: $ sudo stat -c "%a %n" /etc/group 644 /etc/group If a value of "0644" or less permissive is not returned, this is a finding.
Fix: F-87110r1200911_fix
Change the mode of the file "/etc/group" to "0644" using the following command: $ sudo chmod 0644 /etc/group
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000149
- Vuln IDs
-
- V-282645
- Rule IDs
-
- SV-282645r1200915_rule
Checks: C-87206r1200913_chk
Verify the "/etc/group-" file has mode "0644" or less permissive using the following command: $ sudo stat -c "%a %n" /etc/group- 644 /etc/group- If a value of "0644" or less permissive is not returned, this is a finding.
Fix: F-87111r1200914_fix
Change the mode of the file "/etc/group-" to "0644" using the following command: $ sudo chmod 0644 /etc/group-
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000150
- Vuln IDs
-
- V-282646
- Rule IDs
-
- SV-282646r1200918_rule
Checks: C-87207r1200916_chk
Verify the "/etc/gshadow" file has mode "0000" using the following command: $ sudo stat -c "%a %n" /etc/gshadow 0 /etc/gshadow If a value of "0" is not returned, this is a finding.
Fix: F-87112r1200917_fix
Change the mode of the file "/etc/gshadow" to "0000" using the following command: $ sudo chmod 0000 /etc/gshadow
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000151
- Vuln IDs
-
- V-282647
- Rule IDs
-
- SV-282647r1200921_rule
Checks: C-87208r1200919_chk
Verify the "/etc/gshadow-" file has mode "0000" using the following command: $ sudo stat -c "%a %n" /etc/gshadow- 0 /etc/gshadow- If a value of "0" is not returned, this is a finding.
Fix: F-87113r1200920_fix
Change the mode of the file "/etc/gshadow-" to "0000" using the following command: $ sudo chmod 0000 /etc/gshadow-
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000152
- Vuln IDs
-
- V-282648
- Rule IDs
-
- SV-282648r1201583_rule
Checks: C-87209r1200922_chk
Verify the "/etc/passwd" file has mode "0644" or less permissive using the following command: $ sudo stat -c "%a %n" /etc/passwd 644 /etc/passwd If a value of "0644" or less permissive is not returned, this is a finding.
Fix: F-87114r1200923_fix
Change the mode of the file "/etc/passwd" to "0644" using the following command: $ sudo chmod 0644 /etc/passwd
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000153
- Vuln IDs
-
- V-282649
- Rule IDs
-
- SV-282649r1200927_rule
Checks: C-87210r1200925_chk
Verify the "/etc/passwd-" file has mode "0644" or less permissive using the following command: $ sudo stat -c "%a %n" /etc/passwd- 644 /etc/passwd- If a value of "0644" or less permissive is not returned, this is a finding.
Fix: F-87115r1200926_fix
Change the mode of the file "/etc/passwd-" to "0644" using the following command: $ sudo chmod 0644 /etc/passwd-
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000154
- Vuln IDs
-
- V-282650
- Rule IDs
-
- SV-282650r1200930_rule
Checks: C-87211r1200928_chk
Verify the "/etc/shadow-" file has mode "0000" using the following command: $ sudo stat -c "%a %n" /etc/shadow- 0 /etc/shadow- If a value of "0" is not returned, this is a finding.
Fix: F-87116r1200929_fix
Change the mode of the file "/etc/shadow-" to "0000" using the following command: $ sudo chmod 0000 /etc/shadow-
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000155
- Vuln IDs
-
- V-282651
- Rule IDs
-
- SV-282651r1200933_rule
Checks: C-87212r1200931_chk
Verify the ownership of the "/etc/group" file using the following command: $ sudo stat -c "%U %n" /etc/group root /etc/group If "/etc/group" file does not have an owner of "root", this is a finding.
Fix: F-87117r1200932_fix
Change the owner of the file "/etc/group" to "root" using the following command: $ sudo chown root /etc/group
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000156
- Vuln IDs
-
- V-282652
- Rule IDs
-
- SV-282652r1200936_rule
Checks: C-87213r1200934_chk
Verify the group ownership of the "/etc/group" file using the following command: $ sudo stat -c "%G %n" /etc/group root /etc/group If "/etc/group" file does not have a group owner of "root", this is a finding.
Fix: F-87118r1200935_fix
Change the group of the file "/etc/group" to "root" using the following command: $ sudo chgrp root /etc/group
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000157
- Vuln IDs
-
- V-282653
- Rule IDs
-
- SV-282653r1200939_rule
Checks: C-87214r1200937_chk
Verify the ownership of the "/etc/group-" file using the following command: $ sudo stat -c "%U %n" /etc/group- root /etc/group- If "/etc/group-" file does not have an owner of "root", this is a finding.
Fix: F-87119r1200938_fix
Change the owner of the file /etc/group- to root using the following command: $ sudo chown root /etc/group-
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000158
- Vuln IDs
-
- V-282654
- Rule IDs
-
- SV-282654r1200942_rule
Checks: C-87215r1200940_chk
Verify the group ownership of the "/etc/group-" file using the following command: $ sudo stat -c "%G %n" /etc/group- root /etc/group- If "/etc/group-" file does not have a group owner of "root", this is a finding.
Fix: F-87120r1200941_fix
Change the group of the file /etc/group- to root using the following command: $ sudo chgrp root /etc/group-
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000159
- Vuln IDs
-
- V-282655
- Rule IDs
-
- SV-282655r1200945_rule
Checks: C-87216r1200943_chk
Verify the ownership of the "/etc/gshadow" file using the following command: $ sudo stat -c "%U %n" /etc/gshadow root /etc/gshadow If "/etc/gshadow" file does not have an owner of "root", this is a finding.
Fix: F-87121r1200944_fix
Change the owner of the file /etc/gshadow to root using the following command: $ sudo chown root /etc/gshadow
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000160
- Vuln IDs
-
- V-282656
- Rule IDs
-
- SV-282656r1200948_rule
Checks: C-87217r1200946_chk
Verify the group ownership of the "/etc/gshadow" file using the following command: $ sudo stat -c "%G %n" /etc/gshadow root /etc/gshadow If "/etc/gshadow" file does not have a group owner of "root", this is a finding.
Fix: F-87122r1200947_fix
Change the group of the file /etc/gshadow to root using the following command: $ sudo chgrp root /etc/gshadow
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000161
- Vuln IDs
-
- V-282657
- Rule IDs
-
- SV-282657r1200951_rule
Checks: C-87218r1200949_chk
Verify the ownership of the "/etc/gshadow-" file using the following command: $ sudo stat -c "%U %n" /etc/gshadow- root /etc/gshadow- If "/etc/gshadow-" file does not have an owner of "root", this is a finding.
Fix: F-87123r1200950_fix
Change the owner of the file /etc/gshadow- to root using the following command: $ sudo chown root /etc/gshadow-
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000162
- Vuln IDs
-
- V-282658
- Rule IDs
-
- SV-282658r1200954_rule
Checks: C-87219r1200952_chk
Verify the group ownership of the "/etc/gshadow-" file using the following command: $ sudo stat -c "%G %n" /etc/gshadow- root /etc/gshadow- If "/etc/gshadow-" file does not have a group owner of "root", this is a finding.
Fix: F-87124r1200953_fix
Change the group of the file /etc/gshadow- to root using the following command: $ sudo chgrp root /etc/gshadow-
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000163
- Vuln IDs
-
- V-282659
- Rule IDs
-
- SV-282659r1200957_rule
Checks: C-87220r1200955_chk
Verify the ownership of the "/etc/passwd" file using the following command: $ sudo stat -c "%U %n" /etc/passwd root /etc/passwd If "/etc/passwd" file does not have an owner of "root", this is a finding.
Fix: F-87125r1200956_fix
Change the owner of the file /etc/passwd to root using the following command: $ sudo chown root /etc/passwd
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000164
- Vuln IDs
-
- V-282660
- Rule IDs
-
- SV-282660r1200960_rule
Checks: C-87221r1200958_chk
Verify the group ownership of the "/etc/passwd" file using the following command: $ sudo stat -c "%G %n" /etc/passwd root /etc/passwd If "/etc/passwd" file does not have a group owner of "root", this is a finding.
Fix: F-87126r1200959_fix
Change the group of the file /etc/passwd to root using the following command: $ sudo chgrp root /etc/passwd
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000165
- Vuln IDs
-
- V-282661
- Rule IDs
-
- SV-282661r1200963_rule
Checks: C-87222r1200961_chk
Verify the ownership of the "/etc/passwd-" file using the following command: $ sudo stat -c "%U %n" /etc/passwd- root /etc/passwd- If "/etc/passwd-" file does not have an owner of "root", this is a finding.
Fix: F-87127r1200962_fix
Change the owner of the file /etc/passwd- to root using the following command: $ sudo chown root /etc/passwd-
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000166
- Vuln IDs
-
- V-282662
- Rule IDs
-
- SV-282662r1200966_rule
Checks: C-87223r1200964_chk
Verify the group ownership of the "/etc/passwd-" file using the following command: $ sudo stat -c "%G %n" /etc/passwd- root /etc/passwd- If "/etc/passwd-" file does not have a group owner of "root", this is a finding.
Fix: F-87128r1200965_fix
Change the group of the file /etc/passwd- to root using the following command: $ sudo chgrp root /etc/passwd-
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000167
- Vuln IDs
-
- V-282663
- Rule IDs
-
- SV-282663r1200969_rule
Checks: C-87224r1200967_chk
Verify the ownership of the "/etc/shadow" file using the following command: $ sudo stat -c "%U %n" /etc/shadow root /etc/shadow If "/etc/shadow" file does not have an owner of "root", this is a finding.
Fix: F-87129r1200968_fix
Change the owner of the file /etc/shadow to root using the following command: $ sudo chown root /etc/shadow
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000168
- Vuln IDs
-
- V-282664
- Rule IDs
-
- SV-282664r1200972_rule
Checks: C-87225r1200970_chk
Verify the group ownership of the "/etc/shadow" file using the following command: $ sudo stat -c "%G %n" /etc/shadow root /etc/shadow If "/etc/shadow" file does not have a group owner of "root", this is a finding.
Fix: F-87130r1200971_fix
Change the group of the file /etc/shadow to root using the following command: $ sudo chgrp root /etc/shadow
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000169
- Vuln IDs
-
- V-282665
- Rule IDs
-
- SV-282665r1200975_rule
Checks: C-87226r1200973_chk
Verify the ownership of the "/etc/shadow-" file using the following command: $ sudo stat -c "%U %n" /etc/shadow- root /etc/shadow- If "/etc/shadow-" file does not have an owner of "root", this is a finding.
Fix: F-87131r1200974_fix
Change the owner of the file /etc/shadow- to root using the following command: $ sudo chown root /etc/shadow-
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000170
- Vuln IDs
-
- V-282666
- Rule IDs
-
- SV-282666r1200978_rule
Checks: C-87227r1200976_chk
Verify the group ownership of the "/etc/shadow-" file using the following command: $ sudo stat -c "%G %n" /etc/shadow- root /etc/shadow- If "/etc/shadow-" file does not have a group owner of "root", this is a finding.
Fix: F-87132r1200977_fix
Change the group of the file /etc/shadow- to root using the following command: $ sudo chgrp root /etc/shadow-
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000183
- Vuln IDs
-
- V-282667
- Rule IDs
-
- SV-282667r1200981_rule
Checks: C-87228r1200979_chk
Verify the ownership of all cron configuration files with the command: $ stat -c "%U %n" /etc/cron* root /etc/cron.d root /etc/cron.daily root /etc/cron.deny root /etc/cron.hourly root /etc/cron.monthly root /etc/crontab root /etc/cron.weekly If any crontab is not owned by root, this is a finding.
Fix: F-87133r1200980_fix
Configure any cron configuration not owned by root using the following command: $ sudo chown root [cron config file]
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000184
- Vuln IDs
-
- V-282668
- Rule IDs
-
- SV-282668r1200984_rule
Checks: C-87229r1200982_chk
Verify the group ownership of all cron configuration files using the following command: $ stat -c "%G %n" /etc/cron* root /etc/cron.d root /etc/cron.daily root /etc/cron.deny root /etc/cron.hourly root /etc/cron.monthly root /etc/crontab root /etc/cron.weekly If any crontab is not group owned by root, this is a finding.
Fix: F-87134r1200983_fix
Configure any cron configuration not group-owned by root using the following command: $ sudo chgrp root [cron config file]
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000185
- Vuln IDs
-
- V-282669
- Rule IDs
-
- SV-282669r1200987_rule
Checks: C-87230r1200985_chk
Verify world writable directories are owned by root, a system account, or an application account. The following command will discover and print world-writable directories that are not owned by root. Run it once for each local partition [PART]: $ sudo find PART -xdev -type d -perm -0002 -uid +0 -print If there is output, this is a finding.
Fix: F-87135r1200986_fix
Configure all public directories to be owned by root or a system account to prevent unauthorized and unintended information transferred via shared system resources. Set the owner of all public directories as root or a system account using the command, replace "[Public Directory]" with any directory path not owned by root or a system account: $ sudo chown root [Public Directory]
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000187
- Vuln IDs
-
- V-282670
- Rule IDs
-
- SV-282670r1200990_rule
Checks: C-87231r1200988_chk
Verify all local files and directories on TOSS 5 have a valid group using the following command: $ df --local -P | awk {'if (NR!=1) print $6'} | sudo xargs -I '{}' find '{}' -xdev -nogroup If any files on the system do not have an assigned group, this is a finding.
Fix: F-87136r1200989_fix
Either remove all files and directories from TOSS 5 that do not have a valid group, or assign a valid group to all files and directories on the system with the "chgrp" command: $ sudo chgrp <group> <file>
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000188
- Vuln IDs
-
- V-282671
- Rule IDs
-
- SV-282671r1200993_rule
Checks: C-87232r1200991_chk
Verify all local files and directories on TOSS 5 have a valid owner using the following command: $ df --local -P | awk {'if (NR!=1) print $6'} | sudo xargs -I '{}' find '{}' -xdev -nouser If any files on the system do not have an assigned owner, this is a finding.
Fix: F-87137r1200992_fix
Either remove all files and directories from the system that do not have a valid user, or assign a valid user to all unowned files and directories on TOSS 5 with the "chown" command: $ sudo chown <user> <file>
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000189
- Vuln IDs
-
- V-282672
- Rule IDs
-
- SV-282672r1200996_rule
Checks: C-87233r1200994_chk
Verify all system device files are correctly labeled to prevent unauthorized modification. List all device files on the system that are incorrectly labeled with the following commands: Note: Device files are normally found under "/dev", but applications may place device files in other directories and may necessitate a search of the entire system. # find /dev -context *:device_t:* \( -type c -o -type b \) -printf "%p %Z\n" # find /dev -context *:unlabeled_t:* \( -type c -o -type b \) -printf "%p %Z\n" Note: There are device files, such as "/dev/vmci", that are used when the operating system is a host virtual machine. They will not be owned by a user on the system and require the "device_t" label to operate. These device files are not a finding. If there is output from either of these commands, other than already noted, this is a finding.
Fix: F-87138r1200995_fix
Restore the SELinux policy for the affected device file from the system policy database using the following command: $ sudo restorecon -v <device_path> Substituting "<device_path>" with the path to the affected device file (from the output of the previous commands). An example device file path would be "/dev/ttyUSB0". If the output of the above command does not indicate that the device was relabeled to a more specific SELinux type label, then the SELinux policy of the system must be updated with more specific policy for the device class specified. If a package was used to install support for a device class, that package could be reinstalled using the following command: $ sudo dnf reinstall <package_name> If a package was not used to install the SELinux policy for a given device class, then it must be generated manually and provide specific type labels.
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000190
- Vuln IDs
-
- V-282673
- Rule IDs
-
- SV-282673r1201585_rule
Checks: C-87234r1200997_chk
Verify the permissions of /etc/crontab using the following command: $ stat -c "%a %n" /etc/crontab 0600 If /etc/crontab does not have a mode of "0600", this is a finding.
Fix: F-87139r1201584_fix
Configure the TOSS 5 file /etc/crontab with mode "600". $ sudo chmod 0600 /etc/crontab
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000191
- Vuln IDs
-
- V-282674
- Rule IDs
-
- SV-282674r1201002_rule
Checks: C-87235r1201000_chk
Verify the "/etc/shadow" file has mode "0000" using the following command: $ sudo stat -c "%a %n" /etc/shadow 0 /etc/shadow If a value of "0" is not returned, this is a finding.
Fix: F-87140r1201001_fix
Change the mode of the file "/etc/shadow" to "0000" using the following command: $ sudo chmod 0000 /etc/shadow
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000194
- Vuln IDs
-
- V-282675
- Rule IDs
-
- SV-282675r1201005_rule
Checks: C-87236r1201003_chk
Verify the TOSS 5 "firewalld" is configured to employ a deny-all, allow-by-exception policy for allowing connections to other systems with the following commands: $ sudo firewall-cmd --state running $ sudo firewall-cmd --get-active-zones public interfaces: ens33 $ sudo firewall-cmd --info-zone=public | grep target target: DROP $ sudo firewall-cmd --permanent --info-zone=public | grep target target: DROP If no zones are active on the TOSS 5 interfaces or if runtime and permanent targets are set to a different option other than "DROP", this is a finding.
Fix: F-87141r1201004_fix
Configure the "firewalld" daemon to employ a deny-all, allow-by-exception with the following commands: Start by adding the exceptions that are required for mission functionality to the "drop" zone. If SSH access on port 22 is needed, for example, run the following: "sudo firewall-cmd --permanent --add-service=ssh --zone=drop" Reload the firewall rules to update the runtime configuration from the "--permanent" changes made above: $ sudo firewall-cmd --reload Set the default zone to the drop zone: $ sudo firewall-cmd --set-default-zone=drop Note: This is a runtime and permanent change. Add any interfaces to the newly modified "drop" zone: $ sudo firewall-cmd --permanent --zone=drop --change-interface=ens33 Reload the firewall rules for changes to take effect: $ sudo firewall-cmd --reload
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000198
- Vuln IDs
-
- V-282676
- Rule IDs
-
- SV-282676r1201008_rule
Checks: C-87237r1201006_chk
Verify network interfaces are not in promiscuous mode using the following command: $ ip link | grep -i promisc If network interfaces are found on the system in promiscuous mode and their use has not been approved by the ISSO and documented, this is a finding.
Fix: F-87142r1201007_fix
Configure network interfaces to turn off promiscuous mode unless approved by the ISSO and documented. Set the promiscuous mode of an interface to off using the following command: $ sudo ip link set dev <devicename> multicast off promisc off
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000199
- Vuln IDs
-
- V-282677
- Rule IDs
-
- SV-282677r1201330_rule
Checks: C-87238r1201009_chk
Verify TOSS 5 enables hardening for the BPF JIT with the following commands: $ sudo sysctl net.core.bpf_jit_harden net.core.bpf_jit_harden = 2 If the returned line does not have a value of "2", or a line is not returned, this is a finding. Check that the configuration files are present to enable this kernel parameter. $ sudo /usr/lib/systemd/systemd-sysctl --cat-config | egrep -v '^(#|;)' | grep -F net.core.bpf_jit_harden | tail -1 net.core.bpf_jit_harden = 2 If the network parameter "net.core.bpf_jit_harden" is not equal to "2" or nothing is returned, this is a finding.
Fix: F-87143r1201329_fix
Configure TOSS 5 to enable hardening for the BPF JIT compiler by adding the following line to a file, in the "/etc/sysctl.d" directory: net.core.bpf_jit_harden = 2 Reload the system configuration files for the changes to take effect. $ sudo sysctl --system
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000204
- Vuln IDs
-
- V-282678
- Rule IDs
-
- SV-282678r1201587_rule
Checks: C-87239r1201012_chk
Verify the name servers used by the system using the following command: $ grep nameserver /etc/resolv.conf nameserver 192.168.1.2 nameserver 192.168.1.3 If less than two lines are returned that are not commented out, this is a finding.
Fix: F-87144r1201586_fix
Configure TOSS 5 to use two or more name servers for DNS resolution based on the DNS mode of the system. If the NetworkManager DNS mode is set to "none", then add the following lines to "/etc/resolv.conf": nameserver [name server 1] nameserver [name server 2] Replace [name server 1] and [name server 2] with the IPs of two different DNS resolvers. If the NetworkManager DNS mode is set to "default" then add two DNS servers to a NetworkManager connection using the following commands: $ sudo nmcli connection modify [connection name] ipv4.dns [name server 1] $ sudo nmcli connection modify [connection name] ipv4.dns [name server 2] Replace [name server 1] and [name server 2] with the IPs of two different DNS resolvers. Replace [connection name] with a valid NetworkManager connection name on the system. Replace ipv4 with ipv6 if IPv6 DNS servers are used.
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000205
- Vuln IDs
-
- V-282679
- Rule IDs
-
- SV-282679r1201334_rule
Checks: C-87240r1201015_chk
Verify TOSS 5 has a DNS mode configured in Network Manager. $ NetworkManager --print-config [main] dns=none If the dns key under main does not exist or is not set to "none" or "default", this is a finding.
Fix: F-87145r1201333_fix
Configure NetworkManager in TOSS 5 to use a DNS mode. In "/etc/NetworkManager/NetworkManager.conf" add the following line in the "[main]" section: dns = none Reload NetworkManager for the change to take effect. $ sudo systemctl reload NetworkManager
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000206
- Vuln IDs
-
- V-282680
- Rule IDs
-
- SV-282680r1201020_rule
Checks: C-87241r1201018_chk
Verify TOSS 5 does not have unauthorized IP tunnels configured. Determine if the "IPsec" service is active using the following command: $ systemctl status ipsec ipsec.service - Internet Key Exchange (IKE) Protocol Daemon for IPsec Loaded: loaded (/usr/lib/systemd/system/ipsec.service; disabled) Active: inactive (dead) If the "IPsec" service is active, check for configured IPsec connections ("conn"), using the following command: $ grep -rni conn /etc/ipsec.conf /etc/ipsec.d/ Verify any returned results are documented with the ISSO. If the IPsec tunnels are active and not approved, this is a finding.
Fix: F-87146r1201019_fix
Remove all unapproved tunnels from the system or document them with the ISSO.
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000207
- Vuln IDs
-
- V-282681
- Rule IDs
-
- SV-282681r1201023_rule
Checks: C-87242r1201021_chk
Verify TOSS 5 is configured to prevent unrestricted mail relaying using the following command: $ postconf -n smtpd_client_restrictions smtpd_client_restrictions = permit_mynetworks,reject If the "smtpd_client_restrictions" parameter contains any entries other than "permit_mynetworks" and "reject", and the additional entries have not been documented with the information system security officer (ISSO), this is a finding.
Fix: F-87147r1201022_fix
Modify the postfix configuration file to restrict client connections to the local network using the following command: $ sudo postconf -e 'smtpd_client_restrictions = permit_mynetworks,reject'
- RMF Control
- CM-6
- Severity
- H
- CCI
- CCI-000366
- Version
- TOSS-05-000208
- Vuln IDs
-
- V-282682
- Rule IDs
-
- SV-282682r1201337_rule
Checks: C-87243r1201335_chk
Note: If TFTP is not required, it should not be installed. If TFTP is not installed, this is not applicable. Determine if TFTP server is installed using the following command: $ sudo dnf list installed | grep tftp-server tftp-server.x86_64 x.x-x.el8 Verify the TFTP daemon, if tftp.server is installed, is configured to operate in secure mode using the following command: $ grep -i execstart /usr/lib/systemd/system/tftp.service ExecStart=/usr/sbin/in.tftpd -s /var/lib/tftpboot If TFTP is installed and is not documented with the information system security officer (ISSO) as an operational requirement, this is a finding. Note: The "-s" option ensures that the TFTP server only serves files from the specified directory, which is a security measure to prevent unauthorized access to other parts of the file system.
Fix: F-87148r1201336_fix
Configure the TFTP daemon to operate in secure mode using the following command: $ sudo systemctl edit tftp.service In the editor, enter: [Service] ExecStart=/usr/sbin/in.tftpd -s /var/lib/tftpboot After making changes, reload the systemd daemon and restart the TFTP service: $ sudo systemctl daemon-reload $ sudo systemctl restart tftp.service
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000210
- Vuln IDs
-
- V-282683
- Rule IDs
-
- SV-282683r1201340_rule
Checks: C-87244r1201338_chk
Verify the TOSS 5 "libreswan" service package is installed. Check that the "libreswan" service package is installed using the following command: $ sudo dnf list --installed libreswan Example output: libreswan.x86_64 4.6-3.el9 If the "libreswan" package is not installed, this is a finding.
Fix: F-87149r1201339_fix
Install the "libreswan" service (if it is not already installed) using the following command: $ sudo dnf install libreswan
- RMF Control
- CM-6
- Severity
- H
- CCI
- CCI-000366
- Version
- TOSS-05-000211
- Vuln IDs
-
- V-282684
- Rule IDs
-
- SV-282684r1201032_rule
Checks: C-87245r1201030_chk
Verify there are no ".shosts" files on TOSS 5 using the following command: $ sudo find / -name .shosts If a ".shosts" file is found, this is a finding.
Fix: F-87150r1201031_fix
Remove any found ".shosts" files from the system. $ sudo rm /[path]/[to]/[file]/.shosts
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000213
- Vuln IDs
-
- V-282685
- Rule IDs
-
- SV-282685r1201035_rule
Checks: C-87246r1201033_chk
Verify TOSS 5 will not accept IPv4 ICMP redirect messages using the following command: $ sudo sysctl net.ipv4.conf.all.accept_redirects net.ipv4.conf.all.accept_redirects = 0 If the returned line does not have a value of "0", or a line is not returned, this is a finding.
Fix: F-87151r1201034_fix
Configure TOSS 5 to ignore IPv4 ICMP redirect messages. Add or edit the following line in a single system configuration file, in the "/etc/sysctl.d/" directory: net.ipv4.conf.all.accept_redirects = 0 Load settings from all system configuration files using the following command: $ sudo sysctl --system
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000214
- Vuln IDs
-
- V-282686
- Rule IDs
-
- SV-282686r1201038_rule
Checks: C-87247r1201036_chk
Verify TOSS 5 will not accept IPv4 source-routed packets using the following command: $ sudo sysctl net.ipv4.conf.all.accept_source_route net.ipv4.conf.all.accept_source_route = 0 If "net.ipv4.conf.all.accept_source_route" is not set to "0", or a line is not returned, this is a finding.
Fix: F-87152r1201037_fix
Configure TOSS 5 to ignore IPv4 source-routed packets. Add or edit the following line in a single system configuration file, in the "/etc/sysctl.d/" directory: net.ipv4.conf.all.accept_source_route = 0 Load settings from all system configuration files using the following command: $ sudo sysctl --system
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000215
- Vuln IDs
-
- V-282687
- Rule IDs
-
- SV-282687r1201041_rule
Checks: C-87248r1201039_chk
Verify TOSS 5 logs IPv4 martian packets using the following command: $ sudo sysctl net.ipv4.conf.all.log_martians net.ipv4.conf.all.log_martians = 1 If "net.ipv4.conf.all.log_martians" is not set to "1", or a line is not returned, this is a finding.
Fix: F-87153r1201040_fix
Configure TOSS 5 to log martian packets on IPv4 interfaces. Add or edit the following line in a single system configuration file, in the "/etc/sysctl.d/" directory: net.ipv4.conf.all.log_martians=1 Load settings from all system configuration files using the following command: $ sudo sysctl --system
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000216
- Vuln IDs
-
- V-282688
- Rule IDs
-
- SV-282688r1201044_rule
Checks: C-87249r1201042_chk
Verify TOSS 5 logs IPv4 martian packets by default using the following command: $ sudo sysctl net.ipv4.conf.default.log_martians net.ipv4.conf.default.log_martians = 1 If "net.ipv4.conf.default.log_martians" is not set to "1" , or a line is not returned, this is a finding.
Fix: F-87154r1201043_fix
Configure TOSS 5 to log martian packets on IPv4 interfaces by default. Add or edit the following line in a single system configuration file, in the "/etc/sysctl.d/" directory: net.ipv4.conf.default.log_martians=1 Load settings from all system configuration files using the following command: $ sudo sysctl --system
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000217
- Vuln IDs
-
- V-282689
- Rule IDs
-
- SV-282689r1201344_rule
Checks: C-87250r1201045_chk
Verify TOSS 5 uses reverse path filtering on all IPv4 interfaces using the following command: $ sudo sysctl net.ipv4.conf.all.rp_filter net.ipv4.conf.all.rp_filter = 1 If the returned line does not have a value of "1", or a line is not returned, this is a finding.
Fix: F-87155r1201343_fix
Configure TOSS 5 to use reverse path filtering on all IPv4 interfaces. Add or edit the following line in a single system configuration file, in the "/etc/sysctl.d/" directory: net.ipv4.conf.all.rp_filter = 1 Reload the system configuration files for the changes to take effect. $ sudo sysctl --system
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000218
- Vuln IDs
-
- V-282690
- Rule IDs
-
- SV-282690r1201050_rule
Checks: C-87251r1201048_chk
Verify TOSS 5 will not accept IPv4 ICMP redirect messages using the following command: $ sudo sysctl net.ipv4.conf.default.accept_redirects net.ipv4.conf.default.accept_redirects = 0 If the returned line does not have a value of "0", or a line is not returned, this is a finding.
Fix: F-87156r1201049_fix
Configure TOSS 5 to prevent IPv4 ICMP redirect messages from being accepted. Add or edit the following line in a single system configuration file, in the "/etc/sysctl.d/" directory: net.ipv4.conf.default.accept_redirects = 0 Load settings from all system configuration files using the following command: $ sudo sysctl --system
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000219
- Vuln IDs
-
- V-282691
- Rule IDs
-
- SV-282691r1201053_rule
Checks: C-87252r1201051_chk
Verify TOSS 5 does not accept IPv4 source-routed packets by default using the following command: $ sudo sysctl net.ipv4.conf.default.accept_source_route net.ipv4.conf.default.accept_source_route = 0 If the returned line does not have a value of "0", a line is not returned, this is a finding.
Fix: F-87157r1201052_fix
Configure TOSS 5 to not forward IPv4 source-routed packets by default. Add or edit the following line in a single system configuration file, in the "/etc/sysctl.d/" directory: net.ipv4.conf.default.accept_source_route = 0 Load settings from all system configuration files using the following command: $ sudo sysctl --system
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000220
- Vuln IDs
-
- V-282692
- Rule IDs
-
- SV-282692r1201056_rule
Checks: C-87253r1201054_chk
Verify TOSS 5 uses reverse path filtering on IPv4 interfaces using the following command: $ sudo sysctl net.ipv4.conf.default.rp_filter net.ipv4.conf.default.rp_filter = 1 If the returned line does not have a value of "1", or a line is not returned, this is a finding.
Fix: F-87158r1201055_fix
Configure TOSS 5 to use reverse path filtering on IPv4 interfaces by default. Add or edit the following line in a single system configuration file, in the "/etc/sysctl.d/" directory: net.ipv4.conf.default.rp_filter = 1 Load settings from all system configuration files using the following command: $ sudo sysctl --system
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000221
- Vuln IDs
-
- V-282693
- Rule IDs
-
- SV-282693r1201059_rule
Checks: C-87254r1201057_chk
Verify TOSS 5 does not respond to ICMP echoes sent to a broadcast address using the following command: $ sudo sysctl net.ipv4.icmp_echo_ignore_broadcasts net.ipv4.icmp_echo_ignore_broadcasts = 1 If the returned line does not have a value of "1", or a line is not returned, this is a finding. Check that the configuration files are present to enable this network parameter. $ sudo /usr/lib/systemd/systemd-sysctl --cat-config | egrep -v '^(#|$)' | grep -F net.ipv4.icmp_echo_ignore_broadcasts | tail -1 net.ipv4.icmp_echo_ignore_broadcasts = 1 If "net.ipv4.icmp_echo_ignore_broadcasts" is not set to "1" or is missing, this is a finding.
Fix: F-87159r1201058_fix
Configure TOSS 5 to not respond to IPv4 ICMP echoes sent to a broadcast address. Add or edit the following line in a single system configuration file, in the "/etc/sysctl.d/" directory: net.ipv4.icmp_echo_ignore_broadcasts = 1 Load settings from all system configuration files using the following command: $ sudo sysctl --system
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000222
- Vuln IDs
-
- V-282694
- Rule IDs
-
- SV-282694r1201062_rule
Checks: C-87255r1201060_chk
Query the runtime status of the net.ipv4.icmp_ignore_bogus_error_responses kernel parameter using the following command: $ sudo sysctl net.ipv4.icmp_ignore_bogus_error_responses net.ipv4.icmp_ignore_bogus_error_responses = 1 If "net.ipv4.icmp_ignore_bogus_error_responses" is not set to "1", or a line is not returned, this is a finding. Check that the configuration files are present to enable this network parameter. $ sudo /usr/lib/systemd/systemd-sysctl --cat-config | egrep -v '^(#|;)' | grep -F net.ipv4.icmp_ignore_bogus_error_response | tail -1 net.ipv4.icmp_ignore_bogus_error_response = 1 If "net.ipv4.icmp_ignore_bogus_error_response" is not set to "1" or is missing, this is a finding.
Fix: F-87160r1201061_fix
Configure TOSS 5 to not log bogus ICMP errors: Add or edit the following line in a single system configuration file, in the "/etc/sysctl.d/" directory: net.ipv4.icmp_ignore_bogus_error_responses = 1 Load settings from all system configuration files using the following command: $ sudo sysctl --system
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000223
- Vuln IDs
-
- V-282695
- Rule IDs
-
- SV-282695r1201065_rule
Checks: C-87256r1201063_chk
Verify TOSS 5 does not IPv4 ICMP redirect messages using the following command: $ sudo sysctl net.ipv4.conf.all.send_redirects net.ipv4.conf.all.send_redirects = 0 If the returned line does not have a value of "0", or a line is not returned, this is a finding.
Fix: F-87161r1201064_fix
Configure TOSS 5 to not allow interfaces to perform IPv4 ICMP redirects. Add or edit the following line in a single system configuration file, in the "/etc/sysctl.d/" directory: net.ipv4.conf.all.send_redirects = 0 Load settings from all system configuration files using the following command: $ sudo sysctl --system
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000224
- Vuln IDs
-
- V-282696
- Rule IDs
-
- SV-282696r1201346_rule
Checks: C-87257r1201066_chk
Verify TOSS 5 does not allow interfaces to perform Internet Protocol version 4 (IPv4) ICMP redirects by default. Check the value of the "default send_redirects" variables using the following command: $ sudo sysctl net.ipv4.conf.default.send_redirects net.ipv4.conf.default.send_redirects=0 If the returned line does not have a value of "0", or a line is not returned, this is a finding. Check that the configuration files are present to enable this network parameter. $ sudo /usr/lib/systemd/systemd-sysctl --cat-config | egrep -v '^(#|;)' | grep -F net.ipv4.conf.default.send_redirects | tail -1 net.ipv4.conf.default.send_redirects = 0 If "net.ipv4.conf.default.send_redirects" is not set to "0" and is not documented with the information system security officer (ISSO) as an operational requirement or is missing, this is a finding.
Fix: F-87162r1201345_fix
Configure TOSS 5 to not allow interfaces to perform IPv4 ICMP redirects by default. Add or edit the following line in a single system configuration file, in the "/etc/sysctl.d/" directory: net.ipv4.conf.default.send_redirects = 0 Load settings from all system configuration files using the following command: $ sudo sysctl --system
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000225
- Vuln IDs
-
- V-282697
- Rule IDs
-
- SV-282697r1201349_rule
Checks: C-87258r1201347_chk
Verify TOSS 5 is not performing IPv4 packet forwarding unless the system is a router using the following command: $ sudo sysctl net.ipv4.conf.all.forwarding net.ipv4.conf.all.forwarding = 0 If the IPv4 forwarding value is not "0" and is not documented with the information system security officer (ISSO) as an operational requirement is missing, this is a finding.
Fix: F-87163r1201348_fix
Configure TOSS 5 to not allow IPv4 packet forwarding unless the system is a router. Add or edit the following line in a single system configuration file, in the "/etc/sysctl.d/" directory: net.ipv4.conf.all.forwarding = 0 Load settings from all system configuration files using the following command: $ sudo sysctl --system
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000226
- Vuln IDs
-
- V-282698
- Rule IDs
-
- SV-282698r1201350_rule
Checks: C-87259r1201072_chk
Verify TOSS 5 does not accept router advertisements on all IPv6 interfaces, unless the system is a router. Note: If IPv6 is disabled on the system, this requirement is not applicable. Determine if router advertisements are not accepted by using the following command: $ sudo sysctl net.ipv6.conf.all.accept_ra net.ipv6.conf.all.accept_ra = 0 If the "accept_ra" value is not "0" and is not documented with the information system security officer (ISSO) as an operational requirement, this is a finding.
Fix: F-87164r1201073_fix
Configure TOSS 5 to not accept router advertisements on all IPv6 interfaces unless the system is a router. Add or edit the following line in a single system configuration file, in the "/etc/sysctl.d/" directory: net.ipv6.conf.all.accept_ra = 0 Load settings from all system configuration files using the following command: $ sudo sysctl --system
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000227
- Vuln IDs
-
- V-282699
- Rule IDs
-
- SV-282699r1201351_rule
Checks: C-87260r1201075_chk
Verify TOSS 5 ignores IPv6 ICMP redirect messages. Note: If IPv6 is disabled on the system, this requirement is not applicable. Check the value of the "accept_redirects" variables using the following command: $ sysctl net.ipv6.conf.all.accept_redirects net.ipv6.conf.all.accept_redirects = 0 If the returned line does not have a value of "0", or a line is not returned, this is a finding.
Fix: F-87165r1201076_fix
Configure TOSS 5 to ignore IPv6 ICMP redirect messages. Add or edit the following line in a single system configuration file, in the "/etc/sysctl.d/" directory: net.ipv6.conf.all.accept_redirects = 0 Load settings from all system configuration files using the following command: $ sudo sysctl --system
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000228
- Vuln IDs
-
- V-282700
- Rule IDs
-
- SV-282700r1201352_rule
Checks: C-87261r1201078_chk
Verify TOSS 5 does not accept IPv6 source-routed packets. Note: If IPv6 is disabled on the system, this requirement is not applicable. Check the value of the accept source route variable using the following command: $ sudo sysctl net.ipv6.conf.all.accept_source_route net.ipv6.conf.all.accept_source_route = 0 If the returned line does not have a value of "0", or a line is not returned, this is a finding.
Fix: F-87166r1201079_fix
Configure TOSS 5 to not forward IPv6 source-routed packets. Add or edit the following line in a single system configuration file, in the "/etc/sysctl.d/" directory: net.ipv6.conf.all.accept_source_route = 0 Load settings from all system configuration files using the following command: $ sudo sysctl --system
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000229
- Vuln IDs
-
- V-282701
- Rule IDs
-
- SV-282701r1201355_rule
Checks: C-87262r1201353_chk
Verify TOSS 5 is not performing IPv6 packet forwarding unless the system is a router. Note: If IPv6 is disabled on the system, this requirement is not applicable. Check that IPv6 forwarding is disabled using the following commands: $ sudo sysctl net.ipv6.conf.all.forwarding net.ipv6.conf.all.forwarding = 0 If the IPv6 forwarding value is not "0" and is not documented with the information system security officer (ISSO) as an operational requirement, this is a finding.
Fix: F-87167r1201354_fix
Configure TOSS 5 to not allow IPv6 packet forwarding unless the system is a router. Add or edit the following line in a single system configuration file, in the "/etc/sysctl.d/" directory: net.ipv6.conf.all.forwarding = 0 Load settings from all system configuration files using the following command: $ sudo sysctl --system
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000230
- Vuln IDs
-
- V-282702
- Rule IDs
-
- SV-282702r1201356_rule
Checks: C-87263r1201084_chk
Verify TOSS 5 does not accept router advertisements on all IPv6 interfaces by default, unless the system is a router. Note: If IPv6 is disabled on the system, this requirement is not applicable. Determine if router advertisements are not accepted by default by using the following command: $ sudo sysctl net.ipv6.conf.default.accept_ra net.ipv6.conf.default.accept_ra = 0 If the "accept_ra" value is not "0" and is not documented with the information system security officer (ISSO) as an operational requirement, this is a finding.
Fix: F-87168r1201085_fix
Configure TOSS 5 to not accept router advertisements on all IPv6 interfaces by default unless the system is a router. Add or edit the following line in a single system configuration file, in the "/etc/sysctl.d/" directory: net.ipv6.conf.default.accept_ra = 0 Load settings from all system configuration files using the following command: $ sudo sysctl --system
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000231
- Vuln IDs
-
- V-282703
- Rule IDs
-
- SV-282703r1201358_rule
Checks: C-87264r1201357_chk
Verify TOSS 5 will not accept IPv6 ICMP redirect messages. Note: If IPv6 is disabled on the system, this requirement is not applicable. Check the value of the default "accept_redirects" variables using the following command: $ sudo sysctl net.ipv6.conf.default.accept_redirects net.ipv6.conf.default.accept_redirects = 0 If the returned line does not have a value of "0", or a line is not returned, this is a finding.
Fix: F-87169r1201088_fix
Configure TOSS 5 to prevent IPv6 ICMP redirect messages from being accepted. Add or edit the following line in a single system configuration file, in the "/etc/sysctl.d/" directory: net.ipv6.conf.default.accept_redirects = 0 Load settings from all system configuration files using the following command: $ sudo sysctl --system
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000232
- Vuln IDs
-
- V-282704
- Rule IDs
-
- SV-282704r1201359_rule
Checks: C-87265r1201090_chk
Verify TOSS 5 does not accept IPv6 source-routed packets by default. Note: If IPv6 is disabled on the system, this requirement is not applicable. Check the value of the accept source route variable using the following command: $ sudo sysctl net.ipv6.conf.default.accept_source_route net.ipv6.conf.default.accept_source_route = 0 If the returned line does not have a value of "0", or a line is not returned, this is a finding.
Fix: F-87170r1201091_fix
Configure TOSS 5 to not forward IPv6 source-routed packets by default. Add or edit the following line in a single system configuration file, in the "/etc/sysctl.d/" directory: net.ipv6.conf.default.accept_source_route = 0 Load settings from all system configuration files using the following command: $ sudo sysctl --system
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000235
- Vuln IDs
-
- V-282705
- Rule IDs
-
- SV-282705r1201362_rule
Checks: C-87266r1201361_chk
Verify TOSS 5 has the "openssh-clients" package installed using the following command: $ sudo dnf list --installed openssh-clients Example output: openssh-clients.x86_64 8.7p1-8.el9 If the "openssh-clients" package is not installed, this is a finding.
Fix: F-87171r1201094_fix
Install the openssh-clients package using the following command: $ sudo dnf install openssh-clients
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000250
- Vuln IDs
-
- V-282706
- Rule IDs
-
- SV-282706r1201098_rule
Checks: C-87267r1201096_chk
Verify the group ownership of the "/etc/ssh/sshd_config" file using the following command: $ ls -al /etc/ssh/sshd_config rw-------. 1 root root 3669 Feb 22 11:34 /etc/ssh/sshd_config If the "/etc/ssh/sshd_config" file does not have a group owner of "root", this is a finding.
Fix: F-87172r1201097_fix
Configure the "/etc/ssh/sshd_config" file to be group-owned by root using the following command: $ sudo chgrp root /etc/ssh/sshd_config
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000251
- Vuln IDs
-
- V-282707
- Rule IDs
-
- SV-282707r1201101_rule
Checks: C-87268r1201099_chk
Verify the ownership of the "/etc/ssh/sshd_config" file using the following command: $ ls -al /etc/ssh/sshd_config rw-------. 1 root root 3669 Feb 22 11:34 /etc/ssh/sshd_config If the "/etc/ssh/sshd_config" file does not have an owner of "root", this is a finding.
Fix: F-87173r1201100_fix
Configure the "/etc/ssh/sshd_config" file to be owned by root using the following command: $ sudo chown root /etc/ssh/sshd_config
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000252
- Vuln IDs
-
- V-282708
- Rule IDs
-
- SV-282708r1201104_rule
Checks: C-87269r1201102_chk
Verify the permissions of the "/etc/ssh/sshd_config" file using the following command: $ ls -al /etc/ssh/sshd_config rw-------. 1 root root 3669 Feb 22 11:34 /etc/ssh/sshd_config If the "/etc/ssh/sshd_config" permissions are not "0600", this is a finding.
Fix: F-87174r1201103_fix
Configure the "/etc/ssh/sshd_config" permissions to be "0600" using the following command: $ sudo chmod 0600 /etc/ssh/sshd_config
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000253
- Vuln IDs
-
- V-282709
- Rule IDs
-
- SV-282709r1201369_rule
Checks: C-87270r1201105_chk
Verify the SSH private host key files have a mode of "0640" or less permissive using the following command: $ ls -l /etc/ssh/*_key 640 /etc/ssh/ssh_host_dsa_key 640 /etc/ssh/ssh_host_ecdsa_key 640 /etc/ssh/ssh_host_ed25519_key 640 /etc/ssh/ssh_host_rsa_key If any private host key file has a mode more permissive than "0640", this is a finding.
Fix: F-87175r1201368_fix
Configure the mode of SSH private host key files under "/etc/ssh" to "0640" using the following command: $ sudo chmod 0640 /etc/ssh/ssh_host*key Restart the SSH daemon for the changes to take effect. $ sudo systemctl restart sshd.service
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000254
- Vuln IDs
-
- V-282710
- Rule IDs
-
- SV-282710r1201371_rule
Checks: C-87271r1201108_chk
Verify the SSH public host key files have a mode of "0644" or less permissive using the following command: Note: SSH public key files may be found in other directories on the system depending on the installation. $ sudo stat -c "%a %n" /etc/ssh/*.pub 644 /etc/ssh/ssh_host_dsa_key.pub 644 /etc/ssh/ssh_host_ecdsa_key.pub 644 /etc/ssh/ssh_host_ed25519_key.pub 644 /etc/ssh/ssh_host_rsa_key.pub If any key.pub file has a mode more permissive than "0644", this is a finding.
Fix: F-87176r1201370_fix
Change the mode of public host key files under "/etc/ssh" to "0644" using the following command: $ sudo chmod 0644 /etc/ssh/*key.pub Restart the SSH daemon for the changes to take effect. $ sudo systemctl restart sshd.service
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000257
- Vuln IDs
-
- V-282711
- Rule IDs
-
- SV-282711r1201373_rule
Checks: C-87272r1201111_chk
Verify the SSH daemon does not allow rhosts authentication using the following command: $ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH '^\s*ignorerhosts' IgnoreRhosts yes If the value is returned as "no", the returned line is commented out, or no output is returned, this is a finding.
Fix: F-87177r1201372_fix
Configure the SSH daemon to not allow rhosts authentication. Add the following line in "/etc/ssh/sshd_config" or uncomment the line and set the value to "yes": IgnoreRhosts yes Restart the SSH service for changes to take effect: $ sudo systemctl restart sshd.service
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000258
- Vuln IDs
-
- V-282712
- Rule IDs
-
- SV-282712r1201589_rule
Checks: C-87273r1201114_chk
Verify the SSH daemon does not allow known hosts authentication using the following command: $ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH '^\s*ignoreuserknownhosts' IgnoreUserKnownHosts yes If the value is returned as "no", the returned line is commented out, or no output is returned, this is a finding.
Fix: F-87178r1201588_fix
Configure the SSH daemon to not allow known hosts authentication. Add the following line in "/etc/ssh/sshd_config" or uncomment the line and set the value to "yes": IgnoreUserKnownHosts yes Restart the SSH service for changes to take effect: $ sudo systemctl restart sshd.service
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000259
- Vuln IDs
-
- V-282713
- Rule IDs
-
- SV-282713r1201377_rule
Checks: C-87274r1201117_chk
Verify the SSH daemon performs strict mode checking of home directory configuration files using the following command: $ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH '^\s*strictmodes' StrictModes yes If the "StrictModes" keyword is set to "no", the returned line is commented out, or no output is returned, this is a finding.
Fix: F-87179r1201376_fix
Configure the SSH daemon to perform strict mode checking of home directory configuration files. Add the following line in "/etc/ssh/sshd_config" or uncomment the line and set the value to "yes": StrictModes yes Restart the SSH service for changes to take effect: $ sudo systemctl restart sshd.service
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000260
- Vuln IDs
-
- V-282714
- Rule IDs
-
- SV-282714r1201379_rule
Checks: C-87275r1201120_chk
Verify the SSH daemon provides users with feedback on when account accesses last occurred using the following command: $ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH '^\s*printlastlog' PrintLastLog yes If the "PrintLastLog" keyword is set to "no", the returned line is commented out, or no output is returned, this is a finding.
Fix: F-87180r1201378_fix
Configure the SSH daemon to provide users with feedback on when account accesses last occurred. Add the following line in "/etc/ssh/sshd_config" or uncomment the line and set the value to "yes": PrintLastLog yes Restart the SSH service for changes to take effect: $ sudo systemctl restart sshd.service
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000278
- Vuln IDs
-
- V-282715
- Rule IDs
-
- SV-282715r1201125_rule
Checks: C-87276r1201123_chk
Check the last modification time of the local databases, comparing it to the last modification time of the related keyfiles. The following command will check every dconf database and compare its modification time to the related system keyfiles: Note: This requirement assumes the use of the TOSS 5 default graphical user interface, the GNOME desktop environment. If the system does not have any graphical user interface installed, this requirement is not applicable. $ function dconf_needs_update { for db in $(find /etc/dconf/db -maxdepth 1 -type f); do db_mtime=$(stat -c %Y "$db"); keyfile_mtime=$(stat -c %Y "$db".d/* | sort -n | tail -1); if [ -n "$db_mtime" ] && [ -n "$keyfile_mtime" ] && [ "$db_mtime" -lt "$keyfile_mtime" ]; then echo "$db needs update"; return 1; fi; done; }; dconf_needs_update If the command has any output, then a dconf database needs to be updated, and this is a finding.
Fix: F-87181r1201124_fix
Update the dconf databases using the following command: $ sudo dconf update
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000279
- Vuln IDs
-
- V-282716
- Rule IDs
-
- SV-282716r1201128_rule
Checks: C-87277r1201126_chk
Verify TOSS 5 disables a user's ability to restart the system using the following command: Note: This requirement assumes the use of the TOSS 5 default graphical user interface, Gnome Shell. If the system does not have any graphical user interface installed, this requirement is not applicable. $ grep -R disable-restart-buttons /etc/dconf/db/* /etc/dconf/db/distro.d/20-authselect:disable-restart-buttons='true' If the "disable-restart-button" setting is not set to "true", is missing or commented out from the dconf database files, this is a finding.
Fix: F-87182r1201127_fix
Configure TOSS 5 to disable a user's ability to restart the system. Add or update the [org/gnome/settings-daemon/] section of the /etc/dconf/db/local.d/00-security-settings" database file and add or update the following lines: [org/gnome/login-screen] disable-restart-buttons='true' Then update the dconf system databases: $ sudo dconf update
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000280
- Vuln IDs
-
- V-282717
- Rule IDs
-
- SV-282717r1201644_rule
Checks: C-87278r1201643_chk
Verify TOSS 5 prevents a user from overriding the disable-restart-buttons setting for graphical user interfaces. Note: This requirement assumes the use of the TOSS 5 default graphical user interface, the GNOME desktop environment. If the system does not have any graphical user interface installed, this requirement is not applicable. Determine which profile the system database is using the following command: $ sudo grep system-db /etc/dconf/profile/user system-db:local Check that graphical settings are locked from nonprivileged user modification using the following command: Note: The example below is using the database "local" for the system, so the path is "/etc/dconf/db/local.d". This path must be modified if a database other than "local" is being used. $ grep disable-restart-buttons /etc/dconf/db/local.d/locks/* /org/gnome/login-screen/disable-restart-buttons If the command does not return at least the example result, this is a finding.
Fix: F-87183r1201130_fix
Configure TOSS 5 to prevent a user from overriding the disable-restart-buttons setting for graphical user interfaces. Create a database to contain the systemwide graphical user logon settings (if it does not already exist) using the following command: $ sudo touch /etc/dconf/db/local.d/locks/session Add the following line to prevent nonprivileged users from modifying it: /org/gnome/login-screen/disable-restart-buttons Run the following command to update the database: $ sudo dconf update
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000281
- Vuln IDs
-
- V-282718
- Rule IDs
-
- SV-282718r1201134_rule
Checks: C-87279r1201132_chk
Verify TOSS 5 is configured to ignore the Ctrl-Alt-Del sequence in the GNOME desktop using the following command: Note: This requirement assumes the use of the TOSS 5 default graphical user interface, the GNOME desktop environment. If the system does not have any graphical user interface installed, this requirement is not applicable. $ gsettings get org.gnome.settings-daemon.plugins.media-keys logout "['']" If the GNOME desktop is configured to shut down when Ctrl-Alt-Del is pressed, this is a finding.
Fix: F-87184r1201133_fix
Configure TOSS 5 to ignore the Ctrl-Alt-Del sequence in the GNOME desktop. Add or update the [org/gnome/settings-daemon/plugins/media-keys] section of the /etc/dconf/db/local.d/00-security-settings database file and add or update the following lines: [org/gnome/settings-daemon/plugins/media-keys] logout=[''] Run the following command to update the database: $ sudo dconf update
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000282
- Vuln IDs
-
- V-282719
- Rule IDs
-
- SV-282719r1201137_rule
Checks: C-87280r1201135_chk
Verify users cannot enable the Ctrl-Alt-Del sequence in the GNOME desktop using the following command: Note: This requirement assumes the use of the TOSS 5 default graphical user interface, the GNOME desktop environment. If the system does not have any graphical user interface installed, this requirement is not applicable. $ grep logout /etc/dconf/db/local.d/locks/* /org/gnome/settings-daemon/plugins/media-keys/logout If the output is not "/org/gnome/settings-daemon/plugins/media-keys/logout", the line is commented out, or the line is missing, this is a finding.
Fix: F-87185r1201136_fix
Configure TOSS 5 to disallow the user changing the Ctrl-Alt-Del sequence in the GNOME desktop. Create a database to container systemwide graphical user logon settings (if it does not already exist) using the following command: $ sudo touch /etc/dconf/db/local.d/locks/session Add the following line to the session locks file to prevent nonprivileged users from modifying the Ctrl-Alt-Del setting: /org/gnome/settings-daemon/plugins/media-keys/logout Run the following command to update the database: $ sudo dconf update
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000283
- Vuln IDs
-
- V-282720
- Rule IDs
-
- SV-282720r1201591_rule
Checks: C-87281r1201138_chk
Verify TOSS 5 disables the user logon list for graphical user interfaces using the following command: Note: This requirement assumes the use of the TOSS 5 default graphical user interface, the GNOME desktop environment. If the system does not have any graphical user interface installed, this requirement is not applicable. $ sudo gsettings get org.gnome.login-screen disable-user-list true If the setting is "false", this is a finding.
Fix: F-87186r1201590_fix
Configure TOSS 5 to disable the user list at logon for graphical user interfaces. Create a database to contain the systemwide screensaver settings (if it does not already exist) using the following command: Note: The example below is using the database "local" for the system, so if the system is using another database in "/etc/dconf/profile/user", the file should be created under the appropriate subdirectory. $ sudo touch /etc/dconf/db/local.d/02-login-screen [org/gnome/login-screen] disable-user-list=true Update the system databases: $ sudo dconf update
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000293
- Vuln IDs
-
- V-282721
- Rule IDs
-
- SV-282721r1201143_rule
Checks: C-87282r1201141_chk
Verify all local interactive users on TOSS 5 are assigned a home directory upon creation using the following command: $ grep -i create_home /etc/login.defs CREATE_HOME yes If the value for "CREATE_HOME" parameter is not set to "yes", the line is missing, or the line is commented out, this is a finding.
Fix: F-87187r1201142_fix
Configure TOSS 5 to assign home directories to all new local interactive users by setting the "CREATE_HOME" parameter in "/etc/login.defs" to "yes" as follows. CREATE_HOME yes
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000294
- Vuln IDs
-
- V-282722
- Rule IDs
-
- SV-282722r1201146_rule
Checks: C-87283r1201144_chk
Verify the default umask for all local interactive users is "077". Identify the locations of all local interactive user home directories in the "/etc/passwd" file. Check all local interactive user initialization files for interactive users using the following command. Note: The example is for a system that is configured to create users home directories in the "/home" directory. # grep -ri umask /home/ /home/wadea/.bash_history:grep -i umask /etc/bashrc /etc/csh.cshrc /etc/profile /home/wadea/.bash_history:grep -i umask /etc/login.defs If any local interactive user initialization files are found to have a umask statement that sets a value less restrictive than "077", this is a finding.
Fix: F-87188r1201145_fix
Remove the umask statement from all local interactive user's initialization files. If the account is for an application, the requirement for a umask less restrictive than "077" can be documented with the information system security officer, but the user agreement for access to the account must specify that the local interactive user must log on to their account first and then switch the user to the application account with the correct option to gain the account's environment variables.
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000296
- Vuln IDs
-
- V-282723
- Rule IDs
-
- SV-282723r1201149_rule
Checks: C-87284r1201147_chk
Verify system accounts must not have an interactive login shell using the following command: $ awk -F: '($3<1000){print $1 ":" $3 ":" $7}' /etc/passwd root:0:/bin/bash bin:1:/sbin/nologin daemon:2:/sbin/nologin adm:3:/sbin/nologin lp:4:/sbin/nologin Identify the system accounts from this listing that do not have a nologin or similar noninteractive shell. If any system account (other than the root account) has a login shell and it is not documented with the information system security officer (ISSO), this is a finding.
Fix: F-87189r1201148_fix
Configure TOSS 5 so that all noninteractive accounts on the system do not have an interactive shell assigned to them. If the system account needs a shell assigned for mission operations, document the need with the information system security officer (ISSO). Run the following command to disable the interactive shell for a specific noninteractive user account: Replace <user> with the user that has a login shell. $ sudo usermod --shell /sbin/nologin <user> Do not perform the steps in this section on the root account. Doing so will cause the system to become inaccessible.
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000300
- Vuln IDs
-
- V-282724
- Rule IDs
-
- SV-282724r1201152_rule
Checks: C-87285r1201150_chk
Verify all local interactive user initialization file executable search path statements do not contain statements that will reference a working directory other than user home directories with the following commands: $ sudo grep -i path= /home/*/.* /home/[localinteractiveuser]/.bash_profile:PATH=$PATH:$HOME/.local/bin:$HOME/bin If any local interactive user initialization files have executable search path statements that include directories outside of their home directory and is not documented with the ISSO as an operational requirement, this is a finding.
Fix: F-87190r1201151_fix
Edit the local interactive user initialization files to change any PATH variable statements that reference directories other than their home directory. If a local interactive user requires path variables to reference a directory owned by the application, it must be documented with the ISSO.
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000301
- Vuln IDs
-
- V-282725
- Rule IDs
-
- SV-282725r1201593_rule
Checks: C-87286r1201592_chk
Verify interactive users on the system have a home directory assigned using the following command: $ sudo awk -F: '($3>=1000)&&($7 !~ /nologin/){print $1, $3, $6}' /etc/passwd smithk:x:1000:1000:smithk:/home/smithk:/bin/bash scsaustin:x:1001:1001:scsaustin:/home/scsaustin:/bin/bash djohnson:x:1002:1002:djohnson:/home/djohnson:/bin/bash Inspect the output and verify that all interactive users (normally users with a user identifier [UID] greater than 1000) have a home directory defined. If users home directory is not defined, this is a finding.
Fix: F-87191r1201154_fix
Create and assign home directories to all local interactive users on TOSS 5 that currently do not have a home directory assigned.
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000302
- Vuln IDs
-
- V-282726
- Rule IDs
-
- SV-282726r1201158_rule
Checks: C-87287r1201156_chk
Verify the assigned home directories of all interactive users on the system exist using the following command: $ sudo pwck -r user 'mailnull': directory 'var/spool/mqueue' does not exist The output should not return any interactive users. If the user's home directory does not exist, this is a finding.
Fix: F-87192r1201157_fix
Create home directories to all local interactive users that currently do not have a home directory assigned. Use the following commands to create the user home directory assigned in "/etc/ passwd": Note: The example will be for the user "wadea", who has a home directory of "/home/wadea", a user identifier (UID) of "wadea", and a Group Identifier (GID) of "users assigned" in "/etc/passwd". $ sudo mkdir /home/wadea $ sudo chown wadea /home/wadea $ sudo chgrp users /home/wadea $ sudo chmod 0750 /home/wadea
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000303
- Vuln IDs
-
- V-282727
- Rule IDs
-
- SV-282727r1201161_rule
Checks: C-87288r1201159_chk
Verify the assigned home directory of all local interactive users is group owned by that user's primary GID using the following command. Note: This may miss local interactive users that have been assigned a privileged user identifier (UID). Evidence of interactive use may be obtained from a number of log files containing system logon information. The returned directory "/home/wadea" is used as an example. $ sudo ls -ld $(awk -F: '($3>=1000)&&($7 !~ /nologin/){print $6}' /etc/passwd) drwxr-x--- 2 wadea admin 4096 Jun 5 12:41 wadea Check the user's primary group using the following command: $ sudo grep $(grep wadea /etc/passwd | awk -F: ‘{print $4}') /etc/group admin:x:250:wadea,jonesj,jacksons If the user home directory referenced in "/etc/passwd" is not group-owned by that user's primary GID, this is a finding.
Fix: F-87193r1201160_fix
Change the group owner of a local interactive user's home directory to the group found in "/etc/passwd". To change the group owner of a local interactive user's home directory, use the following command: Note: The example will be for the user "wadea", who has a home directory of "/home/wadea", and has a primary group of users. $ sudo chgrp users /home/wadea
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000306
- Vuln IDs
-
- V-282728
- Rule IDs
-
- SV-282728r1201164_rule
Checks: C-87289r1201162_chk
Verify there are no unauthorized interactive user accounts using the following command: $ less /etc/passwd root:x:0:0:root:/root:/bin/bash ... games:x:12:100:games:/usr/games:/sbin/nologin scsaustin:x:1001:1001:scsaustin:/home/scsaustin:/bin/bash djohnson:x:1002:1002:djohnson:/home/djohnson:/bin/bash Interactive user account, generally will have a user identifier (UID) of 1000 or greater, a home directory in a specific partition, and an interactive shell. Obtain the list of interactive user accounts authorized to be on the system from the system administrator (SA) or information system security officer (ISSO) and compare it to the list of local interactive user accounts on the system. If there are unauthorized local user accounts on the system, this is a finding.
Fix: F-87194r1201163_fix
Remove unauthorized local interactive user accounts with the following command where <unauthorized_user> is the unauthorized account: $ sudo userdel <unauthorized_user>
- RMF Control
- CM-6
- Severity
- H
- CCI
- CCI-000366
- Version
- TOSS-05-000307
- Vuln IDs
-
- V-282729
- Rule IDs
-
- SV-282729r1201167_rule
Checks: C-87290r1201165_chk
Verify only the "root" account has a UID "0" assignment using the following command: $ awk -F: '$3 == 0 {print $1}' /etc/passwd root If any accounts other than "root" have a UID of "0", this is a finding.
Fix: F-87195r1201166_fix
Change the UID of any account on the system, other than root, that has a UID of "0". If the account is associated with system commands or applications, the UID should be changed to one greater than "0" but less than "1000". Otherwise, assign a UID of greater than "1000" that has not already been assigned.
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000310
- Vuln IDs
-
- V-282730
- Rule IDs
-
- SV-282730r1201170_rule
Checks: C-87291r1201168_chk
Verify local initialization files do not execute world-writable programs using the following command. Note: The example will be for a system that is configured to create user home directories in the "/home" directory. $ sudo find /home -perm -002 -type f -name ".[^.]*" -exec ls -ld {} \; If any local initialization files are found to reference world-writable files, this is a finding.
Fix: F-87196r1201169_fix
Set the mode on files being executed by the local initialization files using the following command: $ sudo chmod 0755 <file>
- RMF Control
- CM-6
- Severity
- L
- CCI
- CCI-000366
- Version
- TOSS-05-000320
- Vuln IDs
-
- V-282731
- Rule IDs
-
- SV-282731r1201173_rule
Checks: C-87292r1201171_chk
Verify users are provided with feedback on when account accesses last occurred using the following command: $ sudo grep pam_lastlog /etc/pam.d/postlogin session required pam_lastlog.so showfailed If "pam_lastlog" is missing from "/etc/pam.d/postlogin" file, or the silent option is present, this is a finding.
Fix: F-87197r1201172_fix
Configure TOSS 5 to provide users with feedback on when account accesses last occurred by setting the required configuration options in "/etc/pam.d/postlogin". Add the following line to the top of "/etc/pam.d/postlogin": session required pam_lastlog.so showfailed
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000322
- Vuln IDs
-
- V-282732
- Rule IDs
-
- SV-282732r1201176_rule
Checks: C-87293r1201174_chk
Verify the TOSS 5 "policycoreutils" package is installed using the following command: $ sudo dnf list --installed policycoreutils Example output: policycoreutils.x86_64 3.3-6.el9_0 If the "policycoreutils" package is not installed, this is a finding.
Fix: F-87198r1201175_fix
Install the "policycoreutils" package using the following command: $ sudo dnf install policycoreutils
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000323
- Vuln IDs
-
- V-282733
- Rule IDs
-
- SV-282733r1201179_rule
Checks: C-87294r1201177_chk
Verify the TOSS 5 "policycoreutils-python-utils" service package is installed using the following command: $ sudo dnf list --installed policycoreutils-python-utils Example output: policycoreutils-python-utils.noarch 3.3-6.el9_0 If the "policycoreutils-python-utils" package is not installed, this is a finding.
Fix: F-87199r1201178_fix
Install the "policycoreutils-python-utils" service package using the following command: $ sudo dnf install policycoreutils-python-utils
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000325
- Vuln IDs
-
- V-282734
- Rule IDs
-
- SV-282734r1201182_rule
Checks: C-87295r1201180_chk
Verify TOSS 5 requires reauthentication when using the "sudo" command to elevate privileges using the following command: $ sudo grep -ir 'timestamp_timeout' /etc/sudoers /etc/sudoers.d/* /etc/sudoers:Defaults timestamp_timeout=0 If results are returned from more than one file location, this is a finding. If "timestamp_timeout" is set to a negative number, is commented out, or no results are returned, this is a finding.
Fix: F-87200r1201181_fix
Configure TOSS 5 to reauthenticate "sudo" commands after the specified timeout. Add the following line to "/etc/sudoers": Defaults timestamp_timeout=0
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000327
- Vuln IDs
-
- V-282735
- Rule IDs
-
- SV-282735r1201185_rule
Checks: C-87296r1201183_chk
Verify "/etc/sudoers" has no occurrences of "!authenticate" using the following command: $ sudo grep -ir '!authenticate' /etc/sudoers /etc/sudoers.d/* If any occurrences of "!authenticate" are returned, this is a finding.
Fix: F-87201r1201184_fix
Configure TOSS 5 to not allow users to execute privileged actions without authenticating. Remove any occurrence of "!authenticate" found in "/etc/sudoers" file or files in the "/etc/sudoers.d" directory: $ sudo sed -i '/\!authenticate/ s/^/# /g' /etc/sudoers /etc/sudoers.d/*
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000328
- Vuln IDs
-
- V-282736
- Rule IDs
-
- SV-282736r1201188_rule
Checks: C-87297r1201186_chk
Verify TOSS 5 restricts privilege elevation to authorized personnel using the following command: $ sudo sh -c 'grep -iw ALL /etc/sudoers /etc/sudoers.d/*' If the either of the following entries are returned, this is a finding: ALL ALL=(ALL) ALL ALL ALL=(ALL:ALL) ALL
Fix: F-87202r1201187_fix
Remove the following entries from the /etc/sudoers file or configuration file under /etc/sudoers.d/: ALL ALL=(ALL) ALL ALL ALL=(ALL:ALL) ALL
- RMF Control
- CM-6
- Severity
- H
- CCI
- CCI-000366
- Version
- TOSS-05-000331
- Vuln IDs
-
- V-282737
- Rule IDs
-
- SV-282737r1201191_rule
Checks: C-87298r1201189_chk
Verify null passwords cannot be used by running the following command: $ sudo grep -i nullok /etc/pam.d/system-auth /etc/pam.d/password-auth If an output is produced, this is a finding.
Fix: F-87203r1201190_fix
Remove any instances of the "nullok" option in the "/etc/pam.d/password-auth" and "/etc/pam.d/system-auth" files to prevent logons with empty passwords. Note: Manual changes to the listed file may be overwritten by the "authselect" program.
- RMF Control
- CM-6
- Severity
- H
- CCI
- CCI-000366
- Version
- TOSS-05-000335
- Vuln IDs
-
- V-282738
- Rule IDs
-
- SV-282738r1201194_rule
Checks: C-87299r1201192_chk
Verify TOSS 5 uses "pwquality" to enforce the password complexity rules in the "system-auth" file using the following command: $ cat /etc/pam.d/system-auth | grep pam_pwquality password required pam_pwquality.so If the command does not return a line containing the value "pam_pwquality.so", or the line is commented out, this is a finding.
Fix: F-87204r1201193_fix
Configure TOSS 5 to use "pwquality" to enforce password complexity rules. Add the following line to the "/etc/pam.d/system-auth" file(or modify the line to have the required value): password required pam_pwquality.so
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000343
- Vuln IDs
-
- V-282739
- Rule IDs
-
- SV-282739r1201595_rule
Checks: C-87300r1201594_chk
Verify "/etc/sudoers" has no occurrences of "NOPASSWD" using the following command: $ sudo grep -ri nopasswd /etc/sudoers /etc/sudoers.d/* If any occurrences of "NOPASSWD" are returned and this is not documented with the information system security officer (ISSO) as an operational requirement, this is a finding.
Fix: F-87205r1201196_fix
Configure TOSS 5 to not allow users to execute privileged actions without authenticating with a password. Remove any occurrence of "NOPASSWD" found in "/etc/sudoers" file or files in the "/etc/sudoers.d" directory. $ sudo sed -i '/NOPASSWD/ s/^/# /g' /etc/sudoers /etc/sudoers.d/*
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000355
- Vuln IDs
-
- V-282740
- Rule IDs
-
- SV-282740r1201200_rule
Checks: C-87301r1201198_chk
Verify TOSS 5 is not configured to bypass password requirements for privilege escalation using the following command: $ sudo grep pam_succeed_if /etc/pam.d/sudo If any occurrences of " pam_succeed_if " are returned, this is a finding.
Fix: F-87206r1201199_fix
Configure TOSS 5 to require users to supply a password for privilege escalation. Remove any occurrences of " pam_succeed_if " in the "/etc/pam.d/sudo" file.
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000357
- Vuln IDs
-
- V-282741
- Rule IDs
-
- SV-282741r1201203_rule
Checks: C-87302r1201201_chk
Verify null or blank passwords cannot be used using the following command: $ sudo awk -F: '!$2 {print $1}' /etc/shadow If the command returns any results, this is a finding.
Fix: F-87207r1201202_fix
Configure all accounts on TOSS 5 to have a password or lock the account using the following commands: Perform a password reset: $ sudo passwd [username] To lock an account: $ sudo passwd -l [username]
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000371
- Vuln IDs
-
- V-282742
- Rule IDs
-
- SV-282742r1201206_rule
Checks: C-87303r1201204_chk
Verify AIDE is configured to use FIPS 140-3 file hashing using the following command: $ grep sha512 /etc/aide.conf All=p+i+n+u+g+s+m+S+sha512+acl+xattrs+selinux If the "sha512" rule is not being used on all uncommented selection lines in the "/etc/aide.conf" file, or another file integrity tool is not using 140-3-approved cryptographic hashes for validating file contents and directories, this is a finding.
Fix: F-87208r1201205_fix
Configure the file integrity tool to use FIPS 140-3 cryptographic hashes for validating file and directory contents. If AIDE is installed, ensure the "sha512" rule is present on all uncommented file and directory selection lists. Exclude any log files or files expected to change frequently to reduce unnecessary notifications.
- RMF Control
- CM-6
- Severity
- L
- CCI
- CCI-000366
- Version
- TOSS-05-000373
- Vuln IDs
-
- V-282743
- Rule IDs
-
- SV-282743r1201209_rule
Checks: C-87304r1201207_chk
Confirm AIDE is verifying ACLs using the following command: $ grep acl /etc/aide.conf All= p+i+n+u+g+s+m+S+sha512+acl+xattrs+selinux If the "acl" rule is not being used on all uncommented selection lines in the "/etc/aide.conf" file, or ACLs are not being checked by another file integrity tool, this is a finding.
Fix: F-87209r1201208_fix
Configure the file integrity tool to check file and directory ACLs. If AIDE is installed, ensure the "acl" rule is present on all uncommented file and directory selection lists.
- RMF Control
- CM-6
- Severity
- L
- CCI
- CCI-000366
- Version
- TOSS-05-000374
- Vuln IDs
-
- V-282744
- Rule IDs
-
- SV-282744r1201212_rule
Checks: C-87305r1201210_chk
Verify AIDE is configured to verify extended attributes using the following command: $ grep xattrs /etc/aide.conf All= p+i+n+u+g+s+m+S+sha512+acl+xattrs+selinux If the "xattrs" rule is not being used on all uncommented selection lines in the "/etc/aide.conf" file, or extended attributes are not being checked by another file integrity tool, this is a finding.
Fix: F-87210r1201211_fix
Configure the file integrity tool to check file and directory extended attributes. If AIDE is installed, ensure the "xattrs" rule is present on all uncommented file and directory selection lists.
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000376
- Vuln IDs
-
- V-282745
- Rule IDs
-
- SV-282745r1201645_rule
Checks: C-87306r1201213_chk
Verify TOSS 5 has the "rsyslog-gnutls" package installed using the following command: $ sudo dnf list --installed rsyslog-gnutls Example output: rsyslog-gnutls.x86_64 8.2102.0-101.el9_0.1 If the "rsyslog-gnutls" package is not installed, this is a finding.
Fix: F-87211r1201214_fix
Install the "rsyslog-gnutls" package using the following command: $ sudo dnf install rsyslog-gnutls
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000377
- Vuln IDs
-
- V-282746
- Rule IDs
-
- SV-282746r1201218_rule
Checks: C-87307r1201216_chk
Verify "rsyslog" is active using the following command: $ systemctl is-active rsyslog active If the "rsyslog" service is not active, this is a finding.
Fix: F-87212r1201217_fix
To enable the rsyslog service, run the following command: $ sudo systemctl enable --now rsyslog
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000378
- Vuln IDs
-
- V-282747
- Rule IDs
-
- SV-282747r1201386_rule
Checks: C-87308r1201219_chk
Verify TOSS 5 is not configured to receive remote logs using rsyslog with the following commands: $ grep -i modload /etc/rsyslog.conf /etc/rsyslog.d/* $ModLoad imtcp $ModLoad imrelp $ grep -i serverrun /etc/rsyslog.conf /etc/rsyslog.d/* $InputTCPServerRun 514 $InputRELPServerRun 514 Note: An error about no files or directories may be returned. This is not a finding. If any lines are returned by the command, then rsyslog is configured to receive remote messages, and this is a finding.
Fix: F-87213r1201385_fix
Configure TOSS 5 to not receive remote logs using rsyslog. Remove the lines in "/etc/rsyslog.conf" and any files in the "/etc/rsyslog.d" directory that match any of the following: $ModLoad imtcp $ModLoad imudp $ModLoad imrelp $InputTCPServerRun [0-9]* $UDPServerRun [0-9]* $InputRELPServerRun [0-9]* Restart the rsyslog daemon for the changes to take effect. $ sudo systemctl restart rsyslog.service
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000385
- Vuln IDs
-
- V-282748
- Rule IDs
-
- SV-282748r1201388_rule
Checks: C-87309r1201222_chk
Verify "rsyslog" is configured to log cron events using the following command: Note: If another logging package is used, substitute the utility configuration file for "/etc/rsyslog.conf" or "/etc/rsyslog.d/*.conf" files. $ sudo grep -s cron /etc/rsyslog.conf /etc/rsyslog.d/*.conf /etc/rsyslog.conf:*.info;mail.none;authpriv.none;cron.none /var/log/messages /etc/rsyslog.conf:cron.* /var/log/cron If the command does not return a response, check for cron logging all facilities using the following command: $ sudo grep -s /var/log/messages /etc/rsyslog.conf /etc/rsyslog.d/*.conf /etc/rsyslog.conf:*.info;mail.none;authpriv.none;cron.none /var/log/messages If "rsyslog" is not logging messages for the cron facility or all facilities, this is a finding.
Fix: F-87214r1201387_fix
Configure "rsyslog" to log all cron messages by adding or updating the following line to "/etc/rsyslog.conf" or a configuration file in the /etc/rsyslog.d/ directory: cron.* /var/log/cron Restart the rsyslog daemon for the changes to take effect. $ sudo systemctl restart rsyslog.service
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000388
- Vuln IDs
-
- V-282749
- Rule IDs
-
- SV-282749r1201227_rule
Checks: C-87310r1201225_chk
Verify TOSS 5 takes the appropriate action when an audit processing failure occurs using the following command: $ sudo grep disk_error_action /etc/audit/auditd.conf disk_error_action = HALT If the value of the "disk_error_action" option is not "SYSLOG", "SINGLE", or "HALT", or the line is commented out, ask the system administrator (SA) to indicate how the system takes appropriate action when an audit process failure occurs. If there is no evidence of appropriate action, this is a finding.
Fix: F-87215r1201226_fix
Configure TOSS 5 to shut down by default upon audit failure (unless availability is an overriding concern). Add or update the following line (depending on the configuration, "disk_error_action" can be set to "SYSLOG" or "SINGLE") in "/etc/audit/auditd.conf" file: disk_error_action = HALT If availability has been determined to be more important, and this decision is documented with the information system security officer (ISSO), configure the operating system to notify the SA and ISSO in the event of an audit processing failure by setting the "disk_error_action" to "SYSLOG".
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000389
- Vuln IDs
-
- V-282750
- Rule IDs
-
- SV-282750r1201230_rule
Checks: C-87311r1201228_chk
Verify TOSS 5 takes the appropriate action when the audit storage volume is full using the following command: $ sudo grep disk_full_action /etc/audit/auditd.conf disk_full_action = HALT If the value of the "disk_full_action" option is not "SYSLOG", "SINGLE", or "HALT", or the line is commented out, ask the system administrator (SA) to indicate how the system takes appropriate action when an audit storage volume is full. If there is no evidence of appropriate action, this is a finding.
Fix: F-87216r1201229_fix
Configure TOSS 5 to shut down by default upon audit failure (unless availability is an overriding concern). Add or update the following line (depending on the configuration, "disk_full_action" can be set to "SYSLOG" or "SINGLE") in "/etc/audit/auditd.conf" file: disk_full_action = HALT If availability has been determined to be more important, and this decision is documented with the information system security officer (ISSO), configure the operating system to notify the SA and ISSO in the event of an audit processing failure by setting the "disk_full_action" to "SYSLOG".
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000395
- Vuln IDs
-
- V-282751
- Rule IDs
-
- SV-282751r1201233_rule
Checks: C-87312r1201231_chk
Verify TOSS 5 takes the appropriate action when the audit files have reached maximum size using the following command: $ sudo grep max_log_file_action /etc/audit/auditd.conf max_log_file_action = ROTATE If the value of the "max_log_file_action" option is not "ROTATE", "SINGLE", or the line is commented out, ask the system administrator (SA)to indicate how the system takes appropriate action when an audit storage volume is full. If there is no evidence of appropriate action, this is a finding.
Fix: F-87217r1201232_fix
Configure TOSS 5 to rotate the audit log when it reaches maximum size. Add or update the following line in "/etc/audit/auditd.conf" file: max_log_file_action = ROTATE
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000405
- Vuln IDs
-
- V-282752
- Rule IDs
-
- SV-282752r1201236_rule
Checks: C-87313r1201234_chk
If the system is configured to immediately offload audit records to an external system, this requirement is not applicable. Verify the audit system is configured to write logs to the disk using the following command: $ sudo grep write_logs /etc/audit/auditd.conf write_logs = yes If "write_logs" does not have a value of "yes", the line is commented out, or the line is missing, this is a finding.
Fix: F-87218r1201235_fix
Configure the audit system to write log files to the disk. Edit the "/etc/audit/auditd.conf" file and add or update the "write_logs" option to "yes": write_logs = yes Restart the audit daemon for changes to take effect.
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000316
- Vuln IDs
-
- V-282753
- Rule IDs
-
- SV-282753r1201612_rule
Checks: C-87314r1201611_chk
Verify the "umask" setting is configured correctly in the "/etc/bashrc" file using the following command: Note: If the value of the "umask" parameter is set to "000" "/etc/bashrc" file, the severity is raised to a CAT I. $ grep umask /etc/bashrc umask 077 umask 077 If the value for the "umask" parameter is not "077", or the "umask" parameter is missing or is commented out, this is a finding.
Fix: F-87219r1201238_fix
Configure TOSS 5 to define default permissions for all authenticated users using the bash shell. Add or edit the lines for the "umask" parameter in the "/etc/bashrc" file to "077": umask 077
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000317
- Vuln IDs
-
- V-282754
- Rule IDs
-
- SV-282754r1201614_rule
Checks: C-87315r1201613_chk
Verify the "umask" setting is configured correctly in the "/etc/csh.cshrc" file using the following command: Note: If the value of the "umask" parameter is set to "000" "/etc/csh.cshrc" file, the severity is raised to a CAT I. $ grep umask /etc/csh.cshrc umask 077 umask 077 If the value for the "umask" parameter is not "077", or the "umask" parameter is missing or is commented out, this is a finding.
Fix: F-87220r1201241_fix
Configure TOSS 5 to define default permissions for all authenticated users using the c shell. Add or edit the lines for the "umask" parameter in the "/etc/csh.cshrc" file to "077": umask 077
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000318
- Vuln IDs
-
- V-282755
- Rule IDs
-
- SV-282755r1201616_rule
Checks: C-87316r1201615_chk
Note: If the value of the "UMASK" parameter is set to "000" in "/etc/login.defs" file, the severity is raised to a CAT I. Verify TOSS 5 defines default permissions for all authenticated users in such a way that the user can only read and modify their own files using the following command: # grep -i umask /etc/login.defs UMASK 077 If the value for the "UMASK" parameter is not "077", or the "UMASK" parameter is missing or is commented out, this is a finding.
Fix: F-87221r1201244_fix
Configure TOSS 5 to define default permissions for all authenticated users in such a way that the user can only read and modify their own files. Add or edit the lines for the "UMASK" parameter in the "/etc/login.defs" file to "077": UMASK 077
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000319
- Vuln IDs
-
- V-282756
- Rule IDs
-
- SV-282756r1201618_rule
Checks: C-87317r1201617_chk
Note: If the value of the "umask" parameter is set to "000" "/etc/profile" file, the severity is raised to a CAT I. Verify the "umask" setting is configured correctly in the "/etc/profile" file using the following command: $ grep umask /etc/profile umask 077 If the value for the "umask" parameter is not "077", or the "umask" parameter is missing or is commented out, this is a finding.
Fix: F-87222r1201247_fix
Configure TOSS 5 to define default permissions for all authenticated users in such a way that the user can only read and modify their own files. Add or edit the lines for the "umask" parameter in the "/etc/profile" file to "077": umask 077
- RMF Control
- CM-6
- Severity
- H
- CCI
- CCI-000366
- Version
- TOSS-05-000245
- Vuln IDs
-
- V-282757
- Rule IDs
-
- SV-282757r1201251_rule
Checks: C-87318r1201249_chk
Verify TOSS does not allow an unattended or automatic logon to the system via a graphical user interface. Note: This requirement assumes the use of the TOSS default graphical user interface, Gnome Shell. If the system does not have any graphical user interface installed, this requirement is not applicable. Check for the value of the "AutomaticLoginEnable" in the "/etc/gdm/custom.conf" file using the following command: $ sudo grep -i automaticloginenable /etc/gdm/custom.conf AutomaticLoginEnable=false Automatic logon as an authorized user allows access to any user with physical access to the operating system. If the value of "AutomaticLoginEnable" is missing or is not set to "false", this is a finding.
Fix: F-87223r1201250_fix
Configure TOSS to not allow an unattended or automatic logon to the system via a graphical user interface. Add or edit the line for the "AutomaticLoginEnable" parameter in the [daemon] section of the "/etc/gdm/custom.conf" file to "false": [daemon] AutomaticLoginEnable=false
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000246
- Vuln IDs
-
- V-282758
- Rule IDs
-
- SV-282758r1201254_rule
Checks: C-87319r1201252_chk
Verify unattended or automatic logon via SSH is disabled using the following command: $ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH '^\s*permituserenvironment' PermitUserEnvironment no If "PermitUserEnvironment" is set to "yes", is missing completely, or is commented out, this is a finding.
Fix: F-87224r1201253_fix
Configure the TOSS 5 SSH daemon to not allow unattended or automatic logon to the system. Add or edit the following line in the "/etc/ssh/sshd_config" file: PermitUserEnvironment no Restart the SSH daemon for the setting to take effect: $ sudo systemctl restart sshd.service
- RMF Control
- CM-6
- Severity
- H
- CCI
- CCI-000366
- Version
- TOSS-05-000268
- Vuln IDs
-
- V-282759
- Rule IDs
-
- SV-282759r1201257_rule
Checks: C-87320r1201255_chk
Verify TOSS 5 does not allow an unattended or automatic logon to the system via a graphical user interface. Note: This requirement assumes the use of the TOSS 5 default graphical user interface, the GNOME desktop environment. If the system does not have any graphical user interface installed, this requirement is not applicable. Check for the value of the "AutomaticLoginEnable" in the "/etc/gdm/custom.conf" file using the following command: $ grep -i automaticlogin /etc/gdm/custom.conf [daemon] AutomaticLoginEnable=false If the value of "AutomaticLoginEnable" is not set to "false", this is a finding.
Fix: F-87225r1201256_fix
Configure the GNOME desktop display manager to disable automatic login. Set "AutomaticLoginEnable" to "false" in the [daemon] section in "/etc/gdm/custom.conf". For example: [daemon] AutomaticLoginEnable=false
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- TOSS-05-000493
- Vuln IDs
-
- V-282760
- Rule IDs
-
- SV-282760r1201260_rule
Checks: C-87321r1201258_chk
Verify TOSS 5 limits the ability of nonprivileged users to grant other users direct access to the contents of their home directories/folders. Ensure the user permissions on all user home directories is set to 770 permissions using the following command: $ find $(awk -F: '($3>=1000)&&($7 !~ /nologin/){print $6}' /etc/passwd) -maxdepth 0 -not -perm 770 -ls 2> /dev/null If there is any output, this is a finding.
Fix: F-87226r1201259_fix
Change the mode of interactive user's home directories to "0770." using the following command: Note: The example will be for the user "smithj." $ sudo chmod 0770 /home/smithj
- RMF Control
- Severity
- M
- CCI
- CCI-004061
- Version
- TOSS-05-000079
- Vuln IDs
-
- V-282764
- Rule IDs
-
- SV-282764r1201597_rule
Checks: C-87325r1201270_chk
Verify TOSS 5 is configured not allow users create or update passwords with passwords that are found on the list of commonly-used, expected, or compromised passwords using the following command: $ sudo grep pam_pwquality /etc/pam.d/system-auth or $ sudo grep pam_pwquality /etc/pam.d/password-auth password requisite pam_pwquality.so local_users_only If the parameter "pam_pwquality" is not set and required in at least one of the pam stacks, this is a finding.
Fix: F-87230r1201596_fix
Configure TOSS 5 to verify when users create or update passwords, the passwords are not found on a list of commonly-used, expected, or compromised passwords by adding the following to the /etc/pam.d/password-auth and /etc/pam.d/system-auth files: password requisite pam_pwquality.so local_users_only
- RMF Control
- Severity
- M
- CCI
- CCI-004083
- Version
- TOSS-05-000027
- Vuln IDs
-
- V-282768
- Rule IDs
-
- SV-282768r1201307_rule
Checks: C-87329r1201305_chk
Sites must document external authenticators being used and that they are NIST compliant. The following command will verify that Kerberos is functional and produce the list of signing hosts: $ sudo klist -ekt /etc/krb5.keytab If external authenticators are being use that are not documented and are not NIST compliant, this is a finding.
Fix: F-87234r1201306_fix
Document all NIST-compliant external authenticators in use.
- RMF Control
- Severity
- M
- CCI
- CCI-004909
- Version
- TOSS-05-000080
- Vuln IDs
-
- V-282770
- Rule IDs
-
- SV-282770r1201607_rule
Checks: C-87331r1201606_chk
Verify TOSS 5 only uses trusted certificates using the following command: $ sudo trust list --filter=blocklist type: certificate label: Explicitly Distrust DigiNotar Root CA trust: distrusted category: authority If the "label" field is not configured with "Explicitly Distrust DigiNotar Root CA", if any other labels are present, the line is commented out, or the line is missing, this is a finding.
Fix: F-87236r1201289_fix
Configure TOSS 5 to include only approved trust anchors in trust stores or certificate stores by adding certificates using the following command: $ sudo cp /path/to/new-ca-cert.pem /etc/pki/ca-trust/source/anchors/ $ sudo /bin/update-ca-trust
- RMF Control
- Severity
- M
- CCI
- CCI-004910
- Version
- TOSS-05-000081
- Vuln IDs
-
- V-282771
- Rule IDs
-
- SV-282771r1201293_rule
Checks: C-87332r1201291_chk
Verify TOSS 5 is using the TPM 2.0 hardware with the following command (if TPM 2.0 hardware is available): $sudo tpm2_pcrread <multiple SHA keys> If the command returns a status of "ERROR", and TPM 2.0 hardware is available, this is a finding.
Fix: F-87237r1201292_fix
Configure TOSS 5 to provide protected storage for cryptographic keys by enabling TPM hardware, if available.
- RMF Control
- Severity
- M
- CCI
- CCI-004922
- Version
- TOSS-05-000082
- Vuln IDs
-
- V-282772
- Rule IDs
-
- SV-282772r1201296_rule
Checks: C-87333r1201294_chk
Verify TOSS 5 is securely comparing internal information system clocks at least every 24 hours with an NTP server with the following commands: $ sudo grep maxpoll /etc/chrony.conf server 0.us.pool.ntp.mil iburst maxpoll 16 If the "maxpoll" option is set to a number greater than 16 or the line is commented out, this is a finding. Verify the "chrony.conf" file is configured to an authoritative DOD or other U.S. Government time source using the following command: $ sudo grep -i server /etc/chrony.conf server 0.us.pool.ntp.mil If the parameter "server" is not set or is not set to an authoritative DOD or other U.S. Government time source, this is a finding.
Fix: F-87238r1201295_fix
Configure TOSS 5 to securely compare internal information system clocks at least every 24 hours with an appropriate NTP server by adding/modifying the following line in the "/etc/chrony.conf file": server [ntp.server.name] iburst maxpoll 16