xccdf_org.open-scap_testresult_xccdf_org.ssgproject.content_profile_stig

Guide to the Secure Configuration of Red Hat Enterprise Linux 8

with profile [DRAFT] DISA STIG for Red Hat Enterprise Linux 8
This profile contains configuration checks that align to the [DRAFT] DISA STIG for Red Hat Enterprise Linux 8. In addition to being applicable to Red Hat Enterprise Linux 8, DISA recognizes this configuration baseline as applicable to the operating system tier of Red Hat technologies that are based on Red Hat Enterprise Linux 8, such as: - Red Hat Enterprise Linux Server - Red Hat Enterprise Linux Workstation and Desktop - Red Hat Enterprise Linux for HPC - Red Hat Storage - Red Hat Containers with a Red Hat Enterprise Linux 8 image

The SCAP Security Guide Project
https://www.open-scap.org/security-policies/scap-security-guide

This guide presents a catalog of security-relevant configuration settings for Red Hat Enterprise Linux 8. It is a rendering of content structured in the eXtensible Configuration Checklist Description Format (XCCDF) in order to support security automation. The SCAP content is is available in the scap-security-guide package which is developed at https://www.open-scap.org/security-policies/scap-security-guide.

Providing system administrators with such guidance informs them how to securely configure systems under their control in a variety of network roles. Policy makers and baseline creators can use this catalog of settings, with its associated references to higher-level security control catalogs, in order to assist them in security baseline creation. This guide is a catalog, not a checklist, and satisfaction of every item is not likely to be possible or sensible in many operational scenarios. However, the XCCDF format enables granular selection and adjustment of settings, and their association with OVAL and OCIL content provides an automated checking capability. Transformations of this document, and its associated automated checking content, are capable of providing baselines that meet a diverse set of policy objectives. Some example XCCDF Profiles, which are selections of items that form checklists and can be used as baselines, are available with this guide. They can be processed, in an automated fashion, with tools that support the Security Content Automation Protocol (SCAP). The DISA STIG, which provides required settings for US Department of Defense systems, is one example of a baseline created from this guidance.

Do not attempt to implement any of the settings in this guide without first testing them in a non-operational environment. The creators of this guidance assume no responsibility whatsoever for its use by other parties, and makes no guarantees, expressed or implied, about its quality, reliability, or any other characteristic.

Evaluation Characteristics

Evaluation target	localhost.localdomain
Target ID	podman-image://c195d38e471bf6fa3150a01717252bff61e2dc65dffbfa398bb7a5838dad467d [localhost/twistlock/private:console_20_12_541]
Benchmark URL	scap-security-guide-0.1.54/ssg-rhel8-ds.xml
Benchmark ID	xccdf_org.ssgproject.content_benchmark_RHEL-8
Benchmark version	0.1.54
Profile ID	xccdf_org.ssgproject.content_profile_stig
Started at	2021-02-11T19:31:22+00:00
Finished at	2021-02-11T19:31:22+00:00
Performed by	unknown user
Test system	cpe:/a:redhat:openscap:1.3.3

CPE Platforms

cpe:/o:redhat:enterprise_linux:8

Addresses

Compliance and Scoring

The target system did not satisfy the conditions of 19 rules! Please review rule results and consider applying remediation.

Rule results

28 passed

19 failed

3 other

Severity of failed rules

2 other

1 low

16 medium

0 high

Score

Scoring system	Score	Maximum	Percent
urn:xccdf:scoring:default	50.983795	100.000000	50.98%

Rule Overview

Title	Severity	Result
Guide to the Secure Configuration of Red Hat Enterprise Linux 8 19x fail 3x notchecked
System Settings 16x fail 3x notchecked
Installing and Maintaining Software 12x fail
System and Software Integrity 1x fail
Software Integrity Checking
Verify Integrity with AIDE
Install AIDE	medium	notapplicable
Federal Information Processing Standard (FIPS)
Enable FIPS Mode	high	notapplicable
Enable Dracut FIPS Module	medium	notapplicable
System Cryptographic Policies 1x fail
Install crypto-policies package	medium	pass
Configure session renegotiation for SSH client	medium	fail
Configure System Cryptography Policy	high	pass
Configure Libreswan to use System Crypto Policy	medium	pass
OpenSSL uses strong entropy source	medium	pass
Configure SSH to use System Crypto Policy	medium	pass
Configure Kerberos to use System Crypto Policy	medium	pass
Configure OpenSSL library to use System Crypto Policy	medium	pass
Configure BIND to use System Crypto Policy	medium	pass
Operating System Vendor Support and Certification
The Installed Operating System Is Vendor Supported	high	pass
Disk Partitioning
Ensure /home Located On Separate Partition	low	notapplicable
Encrypt Partitions	high	notapplicable
Ensure /var/log/audit Located On Separate Partition	low	notapplicable
Ensure /var Located On Separate Partition	low	notapplicable
Ensure /var/log Located On Separate Partition	medium	notapplicable
GNOME Desktop Environment
Make sure that the dconf databases are up-to-date with regards to respective keyfiles	high	notapplicable
Sudo 1x fail
Install sudo Package	medium	fail
Updating Software 4x fail
Install dnf-automatic Package	medium	fail
Ensure gpgcheck Enabled In Main yum Configuration	high	notapplicable
Ensure gpgcheck Enabled for Local Packages	high	notapplicable
Enable dnf-automatic Timer	medium	fail
Configure dnf-automatic to Install Available Updates Automatically	medium	fail
Ensure Red Hat GPG Key Installed	high	pass
Ensure yum Removes Previous Package Versions	low	notapplicable
Configure dnf-automatic to Install Only Security Updates	low	fail
Ensure gpgcheck Enabled for All yum Package Repositories	high	pass
System Tooling / Utilities 6x fail
Install dnf-plugin-subscription-manager Package	medium	fail
Ensure gnutls-utils is installed	medium	fail
Install libcap-ng-utils Package	medium	fail
Install openscap-scanner Package	medium	fail
Install scap-security-guide Package	medium	fail
Install subscription-manager Package	medium	fail
Uninstall abrt-addon-ccpp Package	low	pass
Uninstall abrt-addon-kerneloops Package	low	pass
Uninstall abrt-addon-python Package	low	pass
Uninstall abrt-cli Package	low	pass
Uninstall abrt-plugin-logger Package	low	pass
Uninstall abrt-plugin-rhtsupport Package	low	pass
Uninstall abrt-plugin-sosreport Package	low	pass
Uninstall gssproxy Package	low	pass
Uninstall iprutils Package	low	pass
Uninstall krb5-workstation Package	medium	pass
Account and Access Control 2x fail 3x notchecked
Warning Banners for System Accesses 1x fail
Implement a GUI Warning Banner
Set the GNOME3 Login Warning Banner Text	medium	notapplicable
Enable GNOME3 Login Warning Banner	medium	notapplicable
Modify the System Login Banner	medium	fail
Protect Accounts by Configuring PAM
Set Lockouts for Failed Password Attempts
Set Lockout Time for Failed Password Attempts	medium	notapplicable
Set Deny For Failed Password Attempts	medium	notapplicable
Set Interval For Counting Failed Password Attempts	medium	notapplicable
Enforce pam_faillock for Local Accounts Only	medium	notapplicable
Limit Password Reuse	medium	notapplicable
Set Password Quality Requirements
Set Password Quality Requirements with pam_pwquality
Set Password Maximum Consecutive Repeating Characters	medium	notapplicable
Ensure PAM Enforces Password Requirements - Maximum Consecutive Repeating Characters from Same Character Class	medium	notapplicable
Ensure PAM Enforces Password Requirements - Minimum Length	medium	notapplicable
Ensure PAM Enforces Password Requirements - Minimum Uppercase Characters	medium	notapplicable
Ensure PAM Enforces Password Requirements - Minimum Different Characters	medium	notapplicable
Ensure PAM Enforces Password Requirements - Minimum Digit Characters	medium	notapplicable
Ensure PAM Enforces Password Requirements - Enforce for root User	medium	notapplicable
Ensure PAM Enforces Password Requirements - Minimum Special Characters	medium	notapplicable
Ensure PAM Enforces Password Requirements - Minimum Lowercase Characters	medium	notapplicable
Ensure PAM Enforces Password Requirements - Enforce for Local Accounts Only	medium	notapplicable
Protect Physical Console Access
Configure Screen Locking
Hardware Tokens for Authentication
Configure Smart Card Certificate Status Checking	medium	notapplicable
Configure Console Screen Locking
Install the tmux Package	medium	notapplicable
Configure tmux to lock session after inactivity	medium	notapplicable
Configure the tmux Lock Command	medium	notapplicable
Support session locking with tmux	medium	notapplicable
Prevent user from disabling the screen lock	medium	notapplicable
Disable debug-shell SystemD Service	medium	notapplicable
Require Authentication for Single User Mode	medium	notapplicable
Disable Ctrl-Alt-Del Reboot Activation	high	notapplicable
Disable Ctrl-Alt-Del Burst Action	high	notapplicable
Verify that Interactive Boot is Disabled	medium	notapplicable
Protect Accounts by Restricting Password-Based Login 1x fail 3x notchecked
Restrict Root Logins 1x fail
Enforce usage of pam_wheel for su authentication	medium	fail
Restrict Virtual Console Root Logins	medium	pass
Verify Proper Storage and Existence of Password Hashes
Prevent Login to Accounts With Empty Password	high	pass
Set Password Expiration Parameters 2x notchecked
Set Existing Passwords Minimum Age	medium	notchecked
Set Existing Passwords Maximum Age	medium	notchecked
Set Password Minimum Length in login.defs	medium	notapplicable
Set Account Expiration Parameters 1x notchecked
Assign Expiration Date to Temporary Accounts	unknown	notchecked
Set Account Expiration Following Inactivity	medium	notapplicable
Secure Session Configuration Files for Login Accounts
Ensure that Users Have Sensible Umask Values
Ensure the Default C Shell Umask is Set Correctly	unknown	pass
Ensure the Default Bash Umask is Set Correctly	unknown	pass
Ensure the Default Umask is Set Correctly in /etc/profile	unknown	pass
Limit the Number of Concurrent Login Sessions Allowed Per User	low	notapplicable
System Accounting with auditd
System Accounting with auditd
Configure auditing of unsuccessful file modifications	medium	notapplicable
Configure auditing of unsuccessful file creations	medium	notapplicable
Configure auditing of unsuccessful permission changes	medium	notapplicable
Configure auditing of successful file accesses	medium	notapplicable
Configure auditing of unsuccessful file deletions	medium	notapplicable
Configure basic parameters of Audit system	medium	notapplicable
Configure auditing of unsuccessful file accesses	medium	notapplicable
Configure auditing of successful file deletions	medium	notapplicable
Configure auditing of unsuccessful ownership changes	medium	notapplicable
Configure immutable Audit login UIDs	medium	notapplicable
Configure auditing of loading and unloading of kernel modules	medium	notapplicable
Perform general configuration of Audit for OSPP	medium	notapplicable
Configure auditing of successful permission changes	medium	notapplicable
Configure auditing of successful file modifications	medium	notapplicable
Configure auditing of successful ownership changes	medium	notapplicable
Configure auditing of successful file creations	medium	notapplicable
Configure auditd Data Retention
Set hostname as computer node name in audit logs	medium	notapplicable
Write Audit Logs to the Disk	medium	notapplicable
Resolve information before writing to audit logs	medium	notapplicable
Configure auditd to use audispd's syslog plugin	medium	notapplicable
Configure auditd flush priority	medium	notapplicable
Set number of records to cause an explicit flush to audit logs	medium	notapplicable
Include Local Events in Audit Logs	medium	notapplicable
Configure auditd Rules for Comprehensive Auditing
Record Events that Modify User/Group Information - /etc/passwd	medium	notapplicable
Install audispd-plugins Package	medium	notapplicable
Ensure the audit Subsystem is Installed	medium	notapplicable
Enable auditd Service	medium	notapplicable
Enable Auditing for Processes Which Start Prior to the Audit Daemon	medium	notapplicable
Extend Audit Backlog Limit for the Audit Daemon	medium	notapplicable
File Permissions and Masks 2x fail
Restrict Dynamic Mounting and Unmounting of Filesystems
Disable Mounting of cramfs	low	notapplicable
Restrict Partition Mount Options
Add nosuid Option to /var/log/audit	medium	notapplicable
Add nosuid Option to /var/tmp	unknown	notapplicable
Add nosuid Option to /tmp	unknown	notapplicable
Add noexec Option to /tmp	unknown	notapplicable
Add nosuid Option to /boot	medium	notapplicable
Add nodev Option to /var/tmp	unknown	notapplicable
Add nosuid Option to /var/log	medium	notapplicable
Add nodev Option to /boot	medium	notapplicable
Add nodev Option to /dev/shm	low	notapplicable
Add nodev Option to /tmp	unknown	notapplicable
Add noexec Option to /dev/shm	low	notapplicable
Add nodev Option to /var/log	medium	notapplicable
Add noexec Option to /var/log	medium	notapplicable
Add noexec Option to /var/tmp	unknown	notapplicable
Add nosuid Option to /home	medium	notapplicable
Add nodev Option to /var	medium	notapplicable
Add noexec Option to /var/log/audit	medium	notapplicable
Add nodev Option to Non-Root Local Partitions	unknown	notapplicable
Add nodev Option to /var/log/audit	medium	notapplicable
Add nosuid Option to /dev/shm	low	notapplicable
Add nodev Option to /home	unknown	notapplicable
Restrict Programs from Dangerous Execution Patterns 2x fail
Memory Poisoning
Enable page allocator poisoning	medium	notapplicable
Enable SLUB/SLAB allocator poisoning	medium	notapplicable
Enable ExecShield
Restrict Exposed Kernel Pointer Addresses Access	medium	notapplicable
Disable Core Dumps 2x fail
Disable acquiring, saving, and processing core dumps	unknown	notapplicable
Disable Core Dumps for All Users	unknown	notapplicable
Disable core dump backtraces	unknown	fail
Disable storing core dump	unknown	fail
Restrict Access to Kernel Message Buffer	medium	notapplicable
Disable Kernel Image Loading	medium	notapplicable
Disable the use of user namespaces	info	notapplicable
Disable storing core dumps	unknown	notapplicable
Disable Access to Network bpf() Syscall From Unprivileged Processes	medium	notapplicable
Restrict usage of ptrace to descendant processes	medium	notapplicable
Disallow kernel profiling by unprivileged users	medium	notapplicable
Harden the operation of the BPF just-in-time compiler	medium	notapplicable
Verify Permissions on Important Files and Directories
Enable Kernel Parameter to Enforce DAC on Hardlinks	unknown	notapplicable
Enable Kernel Parameter to Enforce DAC on Symlinks	unknown	notapplicable
GRUB2 bootloader configuration
UEFI GRUB2 bootloader configuration
Set the UEFI Boot Loader Password	high	notapplicable
Enable Kernel Page-Table Isolation (KPTI)	high	notapplicable
Disable vsyscalls	info	notapplicable
Configure kernel to trust the CPU random number generator	medium	notapplicable
Configure Syslog
Rsyslog Logs Sent To Remote Host
Configure TLS for rsyslog remote logging	medium	notapplicable
Configure CA certificate for rsyslog remote logging	medium	notapplicable
Ensure rsyslog-gnutls is installed	medium	notapplicable
Ensure rsyslog is Installed	medium	notapplicable
Network Configuration and Firewalls
Wireless Networking
Disable Wireless Through Software Configuration
Disable Bluetooth Kernel Module	medium	notapplicable
Uncommon Network Protocols
Disable CAN Support	medium	notapplicable
Disable IEEE 1394 (FireWire) Support	medium	notapplicable
Disable TIPC Support	medium	notapplicable
Disable ATM Support	medium	notapplicable
Disable SCTP Support	medium	notapplicable
firewalld
Inspect and Activate Default firewalld Rules
Install firewalld Package	medium	notapplicable
Verify firewalld Enabled	medium	notapplicable
IPv6
Configure IPv6 Settings if Necessary
Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces	medium	notapplicable
Disable Accepting ICMP Redirects for All IPv6 Interfaces	medium	notapplicable
Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces	medium	notapplicable
Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default	medium	notapplicable
Configure Accepting Router Advertisements on All IPv6 Interfaces	unknown	notapplicable
Disable Accepting Router Advertisements on all IPv6 Interfaces by Default	unknown	notapplicable
Kernel Parameters Which Affect Networking
Network Related Kernel Runtime Parameters for Hosts and Routers
Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default	medium	notapplicable
Disable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces	medium	notapplicable
Configure Kernel Parameter for Accepting Secure Redirects By Default	medium	notapplicable
Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces	medium	notapplicable
Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces	medium	notapplicable
Disable Accepting ICMP Redirects for All IPv4 Interfaces	medium	notapplicable
Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default	medium	notapplicable
Enable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces	unknown	notapplicable
Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces	medium	notapplicable
Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces	medium	notapplicable
Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces	medium	notapplicable
Enable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces	unknown	notapplicable
Enable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default	unknown	notapplicable
Network Parameters for Hosts Only
Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces	medium	notapplicable
Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default	medium	notapplicable
Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces	medium	notapplicable
SELinux
Install policycoreutils-python-utils package	medium	notapplicable
Install policycoreutils Package	high	notapplicable
Ensure SELinux State is Enforcing	medium	notapplicable
Configure SELinux Policy	medium	notapplicable
Services 3x fail
System Security Services Daemon
Enable Smartcards in SSSD	medium	notapplicable
Configure SSSD to Expire Offline Credentials	medium	notapplicable
Mail Server Software
Uninstall Sendmail Package	medium	notapplicable
SSH Server
Configure OpenSSH Server if Necessary
Set SSH Client Alive Count Max	medium	notapplicable
Enable SSH Warning Banner	medium	notapplicable
Disable GSSAPI Authentication	medium	notapplicable
Disable Host-Based Authentication	medium	notapplicable
Disable SSH Root Login	medium	notapplicable
Force frequent session key renegotiation	medium	notapplicable
Disable SSH Access via Empty Passwords	high	notapplicable
SSH server uses strong entropy to seed	medium	notapplicable
Disable Kerberos Authentication	medium	notapplicable
Enable Use of Strict Mode Checking	medium	notapplicable
Set SSH Idle Timeout Interval	medium	notapplicable
Configure OpenSSH Client if Necessary
SSH client uses strong entropy to seed (for CSH like shells)	medium	notapplicable
SSH client uses strong entropy to seed (Bash-like shells)	medium	notapplicable
Install OpenSSH client software	medium	notapplicable
Install the OpenSSH Server Package	medium	notapplicable
Network Time Protocol
The Chrony package is installed	medium	notapplicable
Disable network management of chrony daemon	unknown	notapplicable
Disable chrony daemon from acting as server	unknown	notapplicable
Application Whitelisting Daemon
Install fapolicyd Package	medium	notapplicable
Enable the File Access Policy Service	medium	notapplicable
Base Services
Uninstall Automatic Bug Reporting Tool (abrt)	medium	pass
Disable KDump Kernel Crash Analyzer (kdump)	medium	notapplicable
NFS and RPC
Uninstall nfs-utils Package	low	pass
Kerberos
Disable Kerberos by removing host keytab	medium	notapplicable
USBGuard daemon 3x fail
Install usbguard Package	medium	fail
Enable the USBGuard Service	medium	notapplicable
Authorize Human Interface Devices and USB hubs in USBGuard daemon	medium	fail
Log USBGuard daemon audit events using Linux Audit	medium	fail

Result Details

Install AIDE

Rule ID	xccdf_org.ssgproject.content_rule_package_aide_installed
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-80844-4 References: 1.4.1, 5.10.1.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, BP28(R51), SRG-OS-000363-GPOS-00150, 1034, 1288, 1341, 1417
Description	The `aide` package can be installed with the following command: $ sudo yum install aide
Rationale	The AIDE package must be installed if it is to be available for integrity checking.

Enable FIPS Mode

Rule ID	xccdf_org.ssgproject.content_rule_enable_fips_mode
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	high
Identifiers and References	Identifiers: CCE-80942-6 References: CCI-000068, CCI-000803, CCI-002450, SC-12(2), SC-12(3), IA-7, SC-13, CM-6(a), SC-12, SRG-OS-000120-VMM-000600, SRG-OS-000478-VMM-001980, SRG-OS-000396-VMM-001590, FCS_COP.1(1), FCS_COP.1(2), FCS_COP.1(3), FCS_COP.1(4), FCS_CKM.1, FCS_CKM.2, FCS_TLSC_EXT.1, SRG-OS-000478-GPOS-00223, SRG-OS-000396-GPOS-00176, 1446
Description	To enable FIPS mode, run the following command: fips-mode-setup --enable The `fips-mode-setup` command will configure the system in FIPS mode by automatically configuring the following: Setting the kernel FIPS mode flag (`/proc/sys/crypto/fips_enabled`) to `1` Creating `/etc/system-fips` Setting the system crypto policy in `/etc/crypto-policies/config` to `FIPS` Loading the Dracut `fips` module Furthermore, the system running in FIPS mode should be FIPS certified by NIST.
Rationale	Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. The operating system must implement cryptographic modules adhering to the higher standards approved by the federal government since this provides assurance they have been tested and validated.
Warnings	warning The system needs to be rebooted for these changes to take effect. warning System Crypto Modules must be provided by a vendor that undergoes FIPS-140 certifications. FIPS-140 is applicable to all Federal agencies that use cryptographic-based security systems to protect sensitive information in computer and telecommunication systems (including voice systems) as defined in Section 5131 of the Information Technology Management Reform Act of 1996, Public Law 104-106. This standard shall be used in designing and implementing cryptographic modules that Federal departments and agencies operate or are operated for them under contract. See https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf To meet this, the system has to have cryptographic software provided by a vendor that has undergone this certification. This means providing documentation, test results, design information, and independent third party review by an accredited lab. While open source software is capable of meeting this, it does not meet FIPS-140 unless the vendor submits to this process.

Enable Dracut FIPS Module

Rule ID	xccdf_org.ssgproject.content_rule_enable_dracut_fips_module
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-82155-3 References: CCI-000068, CCI-000803, CCI-002450, SC-12(2), SC-12(3), IA-7, SC-13, CM-6(a), SC-12, SRG-OS-000120-VMM-000600, SRG-OS-000478-VMM-001980, SRG-OS-000396-VMM-001590, SRG-OS-000478-GPOS-00223, 1446
Description	To enable FIPS mode, run the following command: fips-mode-setup --enable To enable FIPS, the system requires that the `fips` module is added in `dracut` configuration. Check if `/etc/dracut.conf.d/40-fips.conf` contain `add_dracutmodules+=" fips "`
Rationale	Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. The operating system must implement cryptographic modules adhering to the higher standards approved by the federal government since this provides assurance they have been tested and validated.
Warnings	warning The system needs to be rebooted for these changes to take effect. warning System Crypto Modules must be provided by a vendor that undergoes FIPS-140 certifications. FIPS-140 is applicable to all Federal agencies that use cryptographic-based security systems to protect sensitive information in computer and telecommunication systems (including voice systems) as defined in Section 5131 of the Information Technology Management Reform Act of 1996, Public Law 104-106. This standard shall be used in designing and implementing cryptographic modules that Federal departments and agencies operate or are operated for them under contract. See https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf To meet this, the system has to have cryptographic software provided by a vendor that has undergone this certification. This means providing documentation, test results, design information, and independent third party review by an accredited lab. While open source software is capable of meeting this, it does not meet FIPS-140 unless the vendor submits to this process.

Install crypto-policies package

Rule ID	xccdf_org.ssgproject.content_rule_package_crypto-policies_installed
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-package_crypto-policies_installed:def:1
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-82723-8 References: FCS_COP.1(1), FCS_COP.1(2), FCS_COP.1(3), FCS_COP.1(4), FCS_CKM.1, FCS_CKM.2, FCS_TLSC_EXT.1, SRG-OS-000396-GPOS-00176, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174
Description	The `crypto-policies` package can be installed with the following command: $ sudo yum install crypto-policies
Rationale	Centralized cryptographic policies simplify applying secure ciphers across an operating system and the applications that run on that operating system. Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data.

OVAL test results details

package crypto-policies is installed oval:ssg-test_package_crypto-policies_installed:tst:1 true

Following items have been found on the system:

Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
crypto-policies	noarch	(none)	1.git51d1222.el8	20200713	0:20200713-1.git51d1222.el8	199e2f91fd431d51	crypto-policies-0:20200713-1.git51d1222.el8.noarch

Configure session renegotiation for SSH client

Rule ID xccdf_org.ssgproject.content_rule_ssh_client_rekey_limit

Result

fail

Multi-check rule no

OVAL Definition ID oval:ssg-ssh_client_rekey_limit:def:1

Time 2021-02-11T19:31:22+00:00

Severity medium

Identifiers and References

Identifiers: CCE-82880-6

References: FCS_SSHS_EXT.1, SRG-OS-000423-GPOS-00187

Description

The RekeyLimit parameter specifies how often the session key is renegotiated, both in terms of amount of data that may be transmitted and the time elapsed. To decrease the default limits, put line RekeyLimit 1G 1h to file /etc/ssh/ssh_config.d/02-rekey-limit.conf. Make sure that there is no other RekeyLimit configuration preceding the include directive in the main config file /etc/ssh/ssh_config. Check also other files in /etc/ssh/ssh_config.d directory. Files are processed according to lexicographical order of file names. Make sure that there is no file processed before 02-rekey-limit.conf containing definition of RekeyLimit.

Rationale

By decreasing the limit based on the amount of data and enabling time-based limit, effects of potential attacks against encryption keys are limited.

Remediation Shell script ⇲



var_ssh_client_rekey_limit_size="1G"

var_ssh_client_rekey_limit_time="1h"



main_config="/etc/ssh/ssh_config"
include_directory="/etc/ssh/ssh_config.d"

if grep -q '^[\s]*RekeyLimit.*$' "$main_config"; then
  sed -i '/^[\s]*RekeyLimit.*/d' "$main_config"
fi

for file in "$include_directory"/*.conf; do
  if grep -q '^[\s]*RekeyLimit.*$' "$file"; then
    sed -i '/^[\s]*RekeyLimit.*/d' "$file"
  fi
done

if [ -e "/etc/ssh/ssh_config.d/02-rekey-limit.conf" ] ; then
    LC_ALL=C sed -i "/^\s*RekeyLimit\s\+/d" "/etc/ssh/ssh_config.d/02-rekey-limit.conf"
else
    touch "/etc/ssh/ssh_config.d/02-rekey-limit.conf"
fi
cp "/etc/ssh/ssh_config.d/02-rekey-limit.conf" "/etc/ssh/ssh_config.d/02-rekey-limit.conf.bak"
# Insert at the end of the file
printf '%s\n' "RekeyLimit $var_ssh_client_rekey_limit_size $var_ssh_client_rekey_limit_time" >> "/etc/ssh/ssh_config.d/02-rekey-limit.conf"
# Clean up after ourselves.
rm "/etc/ssh/ssh_config.d/02-rekey-limit.conf.bak"

Remediation Ansible snippet ⇲

Complexity:	low
Disruption:	low
Strategy:	configure

- name: XCCDF Value var_ssh_client_rekey_limit_size # promote to variable
  set_fact:
    var_ssh_client_rekey_limit_size: !!str 1G
  tags:
    - always
- name: XCCDF Value var_ssh_client_rekey_limit_time # promote to variable
  set_fact:
    var_ssh_client_rekey_limit_time: !!str 1h
  tags:
    - always

- name: Ensure RekeyLimit is not configured in /etc/ssh/ssh_config
  lineinfile:
    path: /etc/ssh/ssh_config
    create: false
    regexp: ^\s*RekeyLimit.*$
    state: absent
  tags:
    - CCE-82880-6
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - ssh_client_rekey_limit

- name: Collect all include config files for ssh client which configure RekeyLimit
  find:
    paths: /etc/ssh/ssh_config.d/
    contains: ^[\s]*RekeyLimit.*$
    patterns: '*.config'
  register: ssh_config_include_files
  tags:
    - CCE-82880-6
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - ssh_client_rekey_limit

- name: Remove all occurences of RekeyLimit configuration from include config files
    of ssh client
  lineinfile:
    path: '{{ item }}'
    regexp: ^[\s]*RekeyLimit.*$
    state: absent
  loop: '{{ ssh_config_include_files.files }}'
  tags:
    - CCE-82880-6
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - ssh_client_rekey_limit

- name: Ensure that rekey limit is set to {{ var_ssh_client_rekey_limit_size }} {{
    var_ssh_client_rekey_limit_time }} in /etc/ssh/ssh_config.d/02-rekey-limit.conf
  lineinfile:
    path: /etc/ssh/ssh_config.d/02-rekey-limit.conf
    create: true
    regexp: ^\s*RekeyLimit.*$
    line: RekeyLimit {{ var_ssh_client_rekey_limit_size }} {{ var_ssh_client_rekey_limit_time
      }}
    state: present
  tags:
    - CCE-82880-6
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - ssh_client_rekey_limit

OVAL test results details

tests the value of RekeyLimit setting in /etc/ssh/ssh_config file oval:ssg-test_ssh_client_rekey_limit_main_config:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_ssh_client_rekey_limit_main_config:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/etc/ssh/ssh_config	^[\s]RekeyLimit.$	1

tests the value of RekeyLimit setting in /etc/ssh/ssh_config.d/*.conf oval:ssg-test_ssh_client_rekey_limit_include_configs:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_ssh_client_rekey_limit_include_configs:obj:1 of type textfilecontent54_object

Filepath

Pattern

Instance

^[\s]*RekeyLimit[\s]+1G[\s]+1h[\s]*$

^/etc/ssh/ssh_config\.d/.*\.conf$

Configure System Cryptography Policy

Rule ID	xccdf_org.ssgproject.content_rule_configure_crypto_policy
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-configure_crypto_policy:def:1
Time	2021-02-11T19:31:22+00:00
Severity	high
Identifiers and References	Identifiers: CCE-80935-0 References: AC-17(a), AC-17(2), CM-6(a), MA-4(6), SC-13, SC-12(2), SC-12(3), FCS_COP.1(1), FCS_COP.1(2), FCS_COP.1(3), FCS_COP.1(4), FCS_CKM.1, FCS_CKM.2, FCS_TLSC_EXT.1, SRG-OS-000396-GPOS-00176, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174, 1.10, 1.11, 1446
Description	To configure the system cryptography policy to use ciphers only from the `FIPS:OSPP` policy, run the following command: $ sudo update-crypto-policies --set FIPS:OSPP The rule checks if settings for selected crypto policy are configured as expected. Configuration files in the `/etc/crypto-policies/back-ends` are either symlinks to correct files provided by Crypto-policies package or they are regular files in case crypto policy customizations are applied. Crypto policies may be customized by crypto policy modules, in which case it is delimited from the base policy using a colon.
Rationale	Centralized cryptographic policies simplify applying secure ciphers across an operating system and the applications that run on that operating system. Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data.
Warnings	warning The system needs to be rebooted for these changes to take effect. warning System Crypto Modules must be provided by a vendor that undergoes FIPS-140 certifications. FIPS-140 is applicable to all Federal agencies that use cryptographic-based security systems to protect sensitive information in computer and telecommunication systems (including voice systems) as defined in Section 5131 of the Information Technology Management Reform Act of 1996, Public Law 104-106. This standard shall be used in designing and implementing cryptographic modules that Federal departments and agencies operate or are operated for them under contract. See https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf To meet this, the system has to have cryptographic software provided by a vendor that has undergone this certification. This means providing documentation, test results, design information, and independent third party review by an accredited lab. While open source software is capable of meeting this, it does not meet FIPS-140 unless the vendor submits to this process.

OVAL test results details

check for crypto policy correctly configured in /etc/crypto-policies/config oval:ssg-test_configure_crypto_policy:tst:1 true

Following items have been found on the system:

Path	Content
/etc/crypto-policies/config	FIPS:OSPP

check for crypto policy correctly configured in /etc/crypto-policies/state/current oval:ssg-test_configure_crypto_policy_current:tst:1 true

Following items have been found on the system:

Path	Content
/etc/crypto-policies/state/current	FIPS:OSPP

Check if update-crypto-policies has been run oval:ssg-test_crypto_policies_updated:tst:1 true

Following items have been found on the system:

Var ref	Value
oval:ssg-variable_crypto_policies_config_file_timestamp:var:1	1612713248

Check if /etc/crypto-policies/back-ends/nss.config exists oval:ssg-test_crypto_policy_nss_config:tst:1 true

Following items have been found on the system:

Path	Type	UID	GID	Size (B)	Permissions
/etc/crypto-policies/back-ends/nss.config	regular	0	0	338	`rw-r--r--`

Configure Libreswan to use System Crypto Policy

Rule ID	xccdf_org.ssgproject.content_rule_configure_libreswan_crypto_policy
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-configure_libreswan_crypto_policy:def:1
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-80937-6 References: CM-6(a), MA-4(6), SC-13, SC-12(2), SC-12(3), SRG-OS-000033-GPOS-00014, FCS_IPSEC_EXT.1.4, FCS_IPSEC_EXT.1.6
Description	Crypto Policies provide a centralized control over crypto algorithms usage of many packages. Libreswan is supported by system crypto policy, but the Libreswan configuration may be set up to ignore it. To check that Crypto Policies settings are configured correctly, ensure that the `/etc/ipsec.conf` includes the appropriate configuration file. In `/etc/ipsec.conf`, make sure that the following line is not commented out or superseded by later includes: `include /etc/crypto-policies/back-ends/libreswan.config`
Rationale	Overriding the system crypto policy makes the behavior of the Libreswan service violate expectations, and makes system configuration more fragmented.

OVAL test results details

package libreswan is installed oval:ssg-test_package_libreswan_installed:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_test_package_libreswan_installed:obj:1 of type rpminfo_object

Name
libreswan

Check that the libreswan configuration includes the crypto policy config file oval:ssg-test_configure_libreswan_crypto_policy:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_configure_libreswan_crypto_policy:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/etc/ipsec.conf	^\sinclude\s+/etc/crypto-policies/back-ends/libreswan.config\s(?:#.*)?$	1

OpenSSL uses strong entropy source

Rule ID	xccdf_org.ssgproject.content_rule_openssl_use_strong_entropy
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-openssl_use_strong_entropy:def:1
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-82721-2 References: FCS_RBG_EXT.1.2, SRG-OS-000480-GPOS-00227, 1277, 1552
Description	By default, OpenSSL doesn't always use a SP800-90A compliant random number generator. A way to configure OpenSSL to always use a strong source is to setup a wrapper that defines a shell function that shadows the actual `openssl` binary, and that ensures that the `-rand /dev/random` option is added to every `openssl` invocation. To do so, place the following shell snippet exactly as-is to `/etc/profile.d/openssl-rand.sh`: # provide a default -rand /dev/random option to openssl commands that # support it # written inefficiently for maximum shell compatibility openssl() ( openssl_bin=/usr/bin/openssl case "$" in # if user specified -rand, honor it \ -rand\ \|\ -help) exec $openssl_bin "$@" ;; esac cmds=`$openssl_bin list -digest-commands -cipher-commands \| tr '\n' ' '` for i in `$openssl_bin list -commands`; do if $openssl_bin list -options "$i" \| grep -q '^rand '; then cmds=" $i $cmds" fi done case "$cmds" in \ "$1"\ *) cmd="$1"; shift exec $openssl_bin "$cmd" -rand /dev/random "$@" ;; esac exec $openssl_bin "$@" )
Rationale	This rule ensures that `openssl` invocations always uses SP800-90A compliant random number generator as a default behavior.
Warnings	warning This setting can cause problems on computers without the hardware random generator, because insufficient entropy blocks the program until enough entropy is available.

OVAL test results details

Test if openssl is configured to generate random data with strong entropy oval:ssg-test_openssl_strong_entropy:tst:1 true

Following items have been found on the system:

Filepath	Path	Filename	Hash type	Hash
/etc/profile.d/openssl-rand.sh	/etc/profile.d	openssl-rand.sh	SHA-256	6488c757642cd493da09dd78ee27f039711a1ad79039900970553772fd2106af

Configure SSH to use System Crypto Policy

Rule ID	xccdf_org.ssgproject.content_rule_configure_ssh_crypto_policy
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-configure_ssh_crypto_policy:def:1
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-80939-2 References: AC-17(a), AC-17(2), CM-6(a), MA-4(6), SC-13, 5.2.20, SRG-OS-000250-GPOS-00093
Description	Crypto Policies provide a centralized control over crypto algorithms usage of many packages. SSH is supported by crypto policy, but the SSH configuration may be set up to ignore it. To check that Crypto Policies settings are configured correctly, ensure that the `CRYPTO_POLICY` variable is either commented or not set at all in the `/etc/sysconfig/sshd`.
Rationale	Overriding the system crypto policy makes the behavior of the SSH service violate expectations, and makes system configuration more fragmented.

OVAL test results details

Check that the SSH configuration mandates usage of system-wide crypto policies. oval:ssg-test_configure_ssh_crypto_policy:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_configure_ssh_crypto_policy:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/etc/sysconfig/sshd	^\sCRYPTO_POLICY\s=.*$	1

Configure Kerberos to use System Crypto Policy

Rule ID	xccdf_org.ssgproject.content_rule_configure_kerberos_crypto_policy
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-configure_kerberos_crypto_policy:def:1
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-80936-8 References: SC-13, SC-12(2), SC-12(3), SRG-OS-000120-GPOS-00061, 0418, 1055, 1402
Description	Crypto Policies provide a centralized control over crypto algorithms usage of many packages. Kerberos is supported by crypto policy, but it's configuration may be set up to ignore it. To check that Crypto Policies settings for Kerberos are configured correctly, examine that there is a symlink at /etc/krb5.conf.d/crypto-policies targeting /etc/cypto-policies/back-ends/krb5.config. If the symlink exists, kerberos is configured to use the system-wide crypto policy settings.
Rationale	Overriding the system crypto policy makes the behavior of Kerberos violate expectations, and makes system configuration more fragmented.

OVAL test results details

Check if kerberos configuration symlink and crypto policy kerberos backend symlink point to same file oval:ssg-test_configure_kerberos_crypto_policy_symlink:tst:1 error

Following items have been found on the system:

Var ref	Value
oval:ssg-var_symlink_kerberos_crypto_policy_configuration:var:1	/etc/crypto-policies/back-ends/krb5.config

Check if kerberos configuration symlink links to the crypto-policy backend file oval:ssg-test_configure_kerberos_crypto_policy_nosymlink:tst:1 true

Following items have been found on the system:

Var ref	Value
oval:ssg-var_symlink_kerberos_crypto_policy_configuration:var:1	/etc/crypto-policies/back-ends/krb5.config

Configure OpenSSL library to use System Crypto Policy

Rule ID	xccdf_org.ssgproject.content_rule_configure_openssl_crypto_policy
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-configure_openssl_crypto_policy:def:1
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-80938-4 References: AC-17(a), AC-17(2), CM-6(a), MA-4(6), SC-13, SC-12(2), SC-12(3), SRG-OS-000250-GPOS-00093
Description	Crypto Policies provide a centralized control over crypto algorithms usage of many packages. OpenSSL is supported by crypto policy, but the OpenSSL configuration may be set up to ignore it. To check that Crypto Policies settings are configured correctly, you have to examine the OpenSSL config file available under `/etc/pki/tls/openssl.cnf`. This file has the `ini` format, and it enables crypto policy support if there is a `[ crypto_policy ]` section that contains the `.include /etc/crypto-policies/back-ends/opensslcnf.config` directive.
Rationale	Overriding the system crypto policy makes the behavior of the Java runtime violates expectations, and makes system configuration more fragmented.

OVAL test results details

Check that the configuration mandates usage of system-wide crypto policies. oval:ssg-test_configure_openssl_crypto_policy:tst:1 true

Following items have been found on the system:

Path	Content
/etc/pki/tls/openssl.cnf	[ crypto_policy ] .include /etc/crypto-policies/back-ends/opensslcnf.config

Configure BIND to use System Crypto Policy

Rule ID	xccdf_org.ssgproject.content_rule_configure_bind_crypto_policy
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-configure_bind_crypto_policy:def:1
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-80934-3 References: SC-13, SC-12(2), SC-12(3), SRG-OS-000423-GPOS-00187, SRG-OS-000426-GPOS-00190
Description	Crypto Policies provide a centralized control over crypto algorithms usage of many packages. BIND is supported by crypto policy, but the BIND configuration may be set up to ignore it. To check that Crypto Policies settings are configured correctly, ensure that the `/etc/named.conf` includes the appropriate configuration: In the `options` section of `/etc/named.conf`, make sure that the following line is not commented out or superseded by later includes: `include "/etc/crypto-policies/back-ends/bind.config";`
Rationale	Overriding the system crypto policy makes the behavior of the BIND service violate expectations, and makes system configuration more fragmented.

OVAL test results details

package bind is removed oval:ssg-test_package_bind_removed:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-obj_test_package_bind_removed:obj:1 of type rpminfo_object

Name
bind

Check that the configuration includes the policy config file. oval:ssg-test_configure_bind_crypto_policy:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_configure_bind_crypto_policy:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/etc/named.conf	^\sinclude\s+"/etc/crypto-policies/back-ends/bind.config"\s;\s*$	1

The Installed Operating System Is Vendor Supported

Rule ID	xccdf_org.ssgproject.content_rule_installed_OS_is_vendor_supported
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-installed_OS_is_vendor_supported:def:1
Time	2021-02-11T19:31:22+00:00
Severity	high
Identifiers and References	Identifiers: CCE-80947-5 References: CCI-000366, CM-6(a), MA-6, SA-13(a), ID.RA-1, PR.IP-12, SRG-OS-000480-GPOS-00227, 4.2.3, 4.2.3.12, 4.2.3.7, 4.2.3.9, APO12.01, APO12.02, APO12.03, APO12.04, BAI03.10, DSS05.01, DSS05.02, A.12.6.1, A.14.2.3, A.16.1.3, A.18.2.2, A.18.2.3, 18, 20, 4, RHEL-08-010000, SV-230221r599732_rule
Description	The installed operating system must be maintained by a vendor. Red Hat Enterprise Linux is supported by Red Hat, Inc. As the Red Hat Enterprise Linux vendor, Red Hat, Inc. is responsible for providing security patches.
Rationale	An operating system is considered "supported" if the vendor continues to provide security patches for the product. With an unsupported release, it will not be possible to resolve any security issue discovered in the system software.
Warnings	warning There is no remediation besides switching to a different operating system.

OVAL test results details

installed OS part of unix family oval:ssg-test_rhel7_unix_family:tst:1 not evaluated

No items have been found conforming to the following objects:

Object oval:ssg-obj_rhel7_unix_family:obj:1 of type family_object

installed OS part of unix family oval:ssg-test_rhel7_unix_family:tst:1 true

Following items have been found on the system:

Family
unix

redhat-release-client is version 7 oval:ssg-test_rhel7_client:tst:1 not evaluated

No items have been found conforming to the following objects:

Object oval:ssg-obj_rhel7_client:obj:1 of type rpminfo_object

Name
redhat-release-client

redhat-release-client is version 7 oval:ssg-test_rhel7_client:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_rhel7_client:obj:1 of type rpminfo_object

Name
redhat-release-client

redhat-release-workstation is version 7 oval:ssg-test_rhel7_workstation:tst:1 not evaluated

No items have been found conforming to the following objects:

Object oval:ssg-obj_rhel7_workstation:obj:1 of type rpminfo_object

Name
redhat-release-workstation

redhat-release-workstation is version 7 oval:ssg-test_rhel7_workstation:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_rhel7_workstation:obj:1 of type rpminfo_object

Name
redhat-release-workstation

redhat-release-server is version 7 oval:ssg-test_rhel7_server:tst:1 not evaluated

No items have been found conforming to the following objects:

Object oval:ssg-obj_rhel7_server:obj:1 of type rpminfo_object

Name
redhat-release-server

redhat-release-server is version 7 oval:ssg-test_rhel7_server:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_rhel7_server:obj:1 of type rpminfo_object

Name
redhat-release-server

redhat-release-computenode is version 7 oval:ssg-test_rhel7_computenode:tst:1 not evaluated

No items have been found conforming to the following objects:

Object oval:ssg-obj_rhel7_computenode:obj:1 of type rpminfo_object

Name
redhat-release-computenode

redhat-release-computenode is version 7 oval:ssg-test_rhel7_computenode:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_rhel7_computenode:obj:1 of type rpminfo_object

Name
redhat-release-computenode

redhat-release-virtualization-host RPM package is installed oval:ssg-test_rhvh4_version:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_rhvh4_version:obj:1 of type rpminfo_object

Name
redhat-release-virtualization-host

redhat-release-virtualization-host RPM package is installed oval:ssg-test_rhvh4_version:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_rhvh4_version:obj:1 of type rpminfo_object

Name
redhat-release-virtualization-host

RHEVH base RHEL is version 7 oval:ssg-test_rhevh_rhel7_version:tst:1 not evaluated

No items have been found conforming to the following objects:

Object oval:ssg-obj_rhevh_rhel7_version:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/etc/redhat-release	^Red Hat Enterprise Linux release (\d)\.\d+$	1

RHEVH base RHEL is version 7 oval:ssg-test_rhevh_rhel7_version:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_rhevh_rhel7_version:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/etc/redhat-release	^Red Hat Enterprise Linux release (\d)\.\d+$	1

installed OS part of unix family oval:ssg-test_rhel7_unix_family:tst:1 not evaluated

No items have been found conforming to the following objects:

Object oval:ssg-obj_rhel7_unix_family:obj:1 of type family_object

installed OS part of unix family oval:ssg-test_rhel7_unix_family:tst:1 true

Following items have been found on the system:

Family
unix

redhat-release-client is version 7 oval:ssg-test_rhel7_client:tst:1 not evaluated

No items have been found conforming to the following objects:

Object oval:ssg-obj_rhel7_client:obj:1 of type rpminfo_object

Name
redhat-release-client

redhat-release-client is version 7 oval:ssg-test_rhel7_client:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_rhel7_client:obj:1 of type rpminfo_object

Name
redhat-release-client

redhat-release-workstation is version 7 oval:ssg-test_rhel7_workstation:tst:1 not evaluated

No items have been found conforming to the following objects:

Object oval:ssg-obj_rhel7_workstation:obj:1 of type rpminfo_object

Name
redhat-release-workstation

redhat-release-workstation is version 7 oval:ssg-test_rhel7_workstation:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_rhel7_workstation:obj:1 of type rpminfo_object

Name
redhat-release-workstation

redhat-release-server is version 7 oval:ssg-test_rhel7_server:tst:1 not evaluated

No items have been found conforming to the following objects:

Object oval:ssg-obj_rhel7_server:obj:1 of type rpminfo_object

Name
redhat-release-server

redhat-release-server is version 7 oval:ssg-test_rhel7_server:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_rhel7_server:obj:1 of type rpminfo_object

Name
redhat-release-server

redhat-release-computenode is version 7 oval:ssg-test_rhel7_computenode:tst:1 not evaluated

No items have been found conforming to the following objects:

Object oval:ssg-obj_rhel7_computenode:obj:1 of type rpminfo_object

Name
redhat-release-computenode

redhat-release-computenode is version 7 oval:ssg-test_rhel7_computenode:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_rhel7_computenode:obj:1 of type rpminfo_object

Name
redhat-release-computenode

redhat-release-virtualization-host RPM package is installed oval:ssg-test_rhvh4_version:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_rhvh4_version:obj:1 of type rpminfo_object

Name
redhat-release-virtualization-host

redhat-release-virtualization-host RPM package is installed oval:ssg-test_rhvh4_version:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_rhvh4_version:obj:1 of type rpminfo_object

Name
redhat-release-virtualization-host

RHEVH base RHEL is version 7 oval:ssg-test_rhevh_rhel7_version:tst:1 not evaluated

No items have been found conforming to the following objects:

Object oval:ssg-obj_rhevh_rhel7_version:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/etc/redhat-release	^Red Hat Enterprise Linux release (\d)\.\d+$	1

RHEVH base RHEL is version 7 oval:ssg-test_rhevh_rhel7_version:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_rhevh_rhel7_version:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/etc/redhat-release	^Red Hat Enterprise Linux release (\d)\.\d+$	1

installed OS part of unix family oval:ssg-test_rhel8_unix_family:tst:1 true

Following items have been found on the system:

Family
unix

installed OS part of unix family oval:ssg-test_rhel8_unix_family:tst:1 true

Following items have been found on the system:

Family
unix

redhat-release is version 8 oval:ssg-test_rhel8:tst:1 true

Following items have been found on the system:

Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
redhat-release	x86_64	(none)	1.0.el8	8.3	0:8.3-1.0.el8	199e2f91fd431d51	redhat-release-0:8.3-1.0.el8.x86_64

redhat-release is version 8 oval:ssg-test_rhel8:tst:1 true

Following items have been found on the system:

Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
redhat-release	x86_64	(none)	1.0.el8	8.3	0:8.3-1.0.el8	199e2f91fd431d51	redhat-release-0:8.3-1.0.el8.x86_64

redhat-release-virtualization-host RPM package is installed oval:ssg-test_rhvh4_version:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_rhvh4_version:obj:1 of type rpminfo_object

Name
redhat-release-virtualization-host

redhat-release-virtualization-host RPM package is installed oval:ssg-test_rhvh4_version:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_rhvh4_version:obj:1 of type rpminfo_object

Name
redhat-release-virtualization-host

RHEVH base RHEL is version 8 oval:ssg-test_rhevh_rhel8_version:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_rhevh_rhel8_version:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/etc/redhat-release	^Red Hat Enterprise Linux release (\d)\.\d+$	1

RHEVH base RHEL is version 8 oval:ssg-test_rhevh_rhel8_version:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_rhevh_rhel8_version:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/etc/redhat-release	^Red Hat Enterprise Linux release (\d)\.\d+$	1

installed OS part of unix family oval:ssg-test_rhel8_unix_family:tst:1 true

Following items have been found on the system:

Family
unix

installed OS part of unix family oval:ssg-test_rhel8_unix_family:tst:1 true

Following items have been found on the system:

Family
unix

redhat-release is version 8 oval:ssg-test_rhel8:tst:1 true

Following items have been found on the system:

Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
redhat-release	x86_64	(none)	1.0.el8	8.3	0:8.3-1.0.el8	199e2f91fd431d51	redhat-release-0:8.3-1.0.el8.x86_64

redhat-release is version 8 oval:ssg-test_rhel8:tst:1 true

Following items have been found on the system:

Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
redhat-release	x86_64	(none)	1.0.el8	8.3	0:8.3-1.0.el8	199e2f91fd431d51	redhat-release-0:8.3-1.0.el8.x86_64

redhat-release-virtualization-host RPM package is installed oval:ssg-test_rhvh4_version:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_rhvh4_version:obj:1 of type rpminfo_object

Name
redhat-release-virtualization-host

redhat-release-virtualization-host RPM package is installed oval:ssg-test_rhvh4_version:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_rhvh4_version:obj:1 of type rpminfo_object

Name
redhat-release-virtualization-host

RHEVH base RHEL is version 8 oval:ssg-test_rhevh_rhel8_version:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_rhevh_rhel8_version:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/etc/redhat-release	^Red Hat Enterprise Linux release (\d)\.\d+$	1

RHEVH base RHEL is version 8 oval:ssg-test_rhevh_rhel8_version:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_rhevh_rhel8_version:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/etc/redhat-release	^Red Hat Enterprise Linux release (\d)\.\d+$	1

Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 not evaluated

No items have been found conforming to the following objects:

Object oval:ssg-object_unix_family:obj:1 of type family_object

Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 true

Following items have been found on the system:

Family
unix

Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 not evaluated

No items have been found conforming to the following objects:

Object oval:ssg-object_unix_family:obj:1 of type family_object

Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 true

Following items have been found on the system:

Family
unix

oraclelinux-release is version 7 oval:ssg-test_ol7_system:tst:1 not evaluated

No items have been found conforming to the following objects:

Object oval:ssg-obj_ol7_system:obj:1 of type rpminfo_object

Name
oraclelinux-release

oraclelinux-release is version 7 oval:ssg-test_ol7_system:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_ol7_system:obj:1 of type rpminfo_object

Name
oraclelinux-release

Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 not evaluated

No items have been found conforming to the following objects:

Object oval:ssg-object_unix_family:obj:1 of type family_object

Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 true

Following items have been found on the system:

Family
unix

Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 not evaluated

No items have been found conforming to the following objects:

Object oval:ssg-object_unix_family:obj:1 of type family_object

Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 true

Following items have been found on the system:

Family
unix

oraclelinux-release is version 7 oval:ssg-test_ol7_system:tst:1 not evaluated

No items have been found conforming to the following objects:

Object oval:ssg-obj_ol7_system:obj:1 of type rpminfo_object

Name
oraclelinux-release

oraclelinux-release is version 7 oval:ssg-test_ol7_system:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_ol7_system:obj:1 of type rpminfo_object

Name
oraclelinux-release

Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 not evaluated

No items have been found conforming to the following objects:

Object oval:ssg-object_unix_family:obj:1 of type family_object

Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 true

Following items have been found on the system:

Family
unix

Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 not evaluated

No items have been found conforming to the following objects:

Object oval:ssg-object_unix_family:obj:1 of type family_object

Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 true

Following items have been found on the system:

Family
unix

oraclelinux-release is version 8 oval:ssg-test_ol8_system:tst:1 not evaluated

No items have been found conforming to the following objects:

Object oval:ssg-obj_ol8_system:obj:1 of type rpminfo_object

Name
oraclelinux-release

oraclelinux-release is version 8 oval:ssg-test_ol8_system:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_ol8_system:obj:1 of type rpminfo_object

Name
oraclelinux-release

Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 not evaluated

No items have been found conforming to the following objects:

Object oval:ssg-object_unix_family:obj:1 of type family_object

Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 true

Following items have been found on the system:

Family
unix

Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 not evaluated

No items have been found conforming to the following objects:

Object oval:ssg-object_unix_family:obj:1 of type family_object

Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 true

Following items have been found on the system:

Family
unix

oraclelinux-release is version 8 oval:ssg-test_ol8_system:tst:1 not evaluated

No items have been found conforming to the following objects:

Object oval:ssg-obj_ol8_system:obj:1 of type rpminfo_object

Name
oraclelinux-release

oraclelinux-release is version 8 oval:ssg-test_ol8_system:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_ol8_system:obj:1 of type rpminfo_object

Name
oraclelinux-release

installed OS part of unix family oval:ssg-test_sle12_unix_family:tst:1 not evaluated

No items have been found conforming to the following objects:

Object oval:ssg-obj_sle12_unix_family:obj:1 of type family_object

installed OS part of unix family oval:ssg-test_sle12_unix_family:tst:1 true

Following items have been found on the system:

Family
unix

sled-release is version 6 oval:ssg-test_sle12_desktop:tst:1 not evaluated

No items have been found conforming to the following objects:

Object oval:ssg-obj_sle12_desktop:obj:1 of type rpminfo_object

Name
sled-release

sled-release is version 6 oval:ssg-test_sle12_desktop:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_sle12_desktop:obj:1 of type rpminfo_object

Name
sled-release

sles-release is version 6 oval:ssg-test_sle12_server:tst:1 not evaluated

No items have been found conforming to the following objects:

Object oval:ssg-obj_sle12_server:obj:1 of type rpminfo_object

Name
sles-release

sles-release is version 6 oval:ssg-test_sle12_server:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_sle12_server:obj:1 of type rpminfo_object

Name
sles-release

installed OS part of unix family oval:ssg-test_sle12_unix_family:tst:1 not evaluated

No items have been found conforming to the following objects:

Object oval:ssg-obj_sle12_unix_family:obj:1 of type family_object

installed OS part of unix family oval:ssg-test_sle12_unix_family:tst:1 true

Following items have been found on the system:

Family
unix

sled-release is version 6 oval:ssg-test_sle12_desktop:tst:1 not evaluated

No items have been found conforming to the following objects:

Object oval:ssg-obj_sle12_desktop:obj:1 of type rpminfo_object

Name
sled-release

sled-release is version 6 oval:ssg-test_sle12_desktop:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_sle12_desktop:obj:1 of type rpminfo_object

Name
sled-release

sles-release is version 6 oval:ssg-test_sle12_server:tst:1 not evaluated

No items have been found conforming to the following objects:

Object oval:ssg-obj_sle12_server:obj:1 of type rpminfo_object

Name
sles-release

sles-release is version 6 oval:ssg-test_sle12_server:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_sle12_server:obj:1 of type rpminfo_object

Name
sles-release

installed OS part of unix family oval:ssg-test_sle15_unix_family:tst:1 not evaluated

No items have been found conforming to the following objects:

Object oval:ssg-obj_sle15_unix_family:obj:1 of type family_object

installed OS part of unix family oval:ssg-test_sle15_unix_family:tst:1 true

Following items have been found on the system:

Family
unix

sled-release is version 15 oval:ssg-test_sle15_desktop:tst:1 not evaluated

No items have been found conforming to the following objects:

Object oval:ssg-obj_sle15_desktop:obj:1 of type rpminfo_object

Name
sled-release

sled-release is version 15 oval:ssg-test_sle15_desktop:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_sle15_desktop:obj:1 of type rpminfo_object

Name
sled-release

sles-release is version 15 oval:ssg-test_sle15_server:tst:1 not evaluated

No items have been found conforming to the following objects:

Object oval:ssg-obj_sle15_server:obj:1 of type rpminfo_object

Name
sles-release

sles-release is version 15 oval:ssg-test_sle15_server:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_sle15_server:obj:1 of type rpminfo_object

Name
sles-release

installed OS part of unix family oval:ssg-test_sle15_unix_family:tst:1 not evaluated

No items have been found conforming to the following objects:

Object oval:ssg-obj_sle15_unix_family:obj:1 of type family_object

installed OS part of unix family oval:ssg-test_sle15_unix_family:tst:1 true

Following items have been found on the system:

Family
unix

sled-release is version 15 oval:ssg-test_sle15_desktop:tst:1 not evaluated

No items have been found conforming to the following objects:

Object oval:ssg-obj_sle15_desktop:obj:1 of type rpminfo_object

Name
sled-release

sled-release is version 15 oval:ssg-test_sle15_desktop:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_sle15_desktop:obj:1 of type rpminfo_object

Name
sled-release

sles-release is version 15 oval:ssg-test_sle15_server:tst:1 not evaluated

No items have been found conforming to the following objects:

Object oval:ssg-obj_sle15_server:obj:1 of type rpminfo_object

Name
sles-release

sles-release is version 15 oval:ssg-test_sle15_server:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_sle15_server:obj:1 of type rpminfo_object

Name
sles-release

Ensure /home Located On Separate Partition

Rule ID	xccdf_org.ssgproject.content_rule_partition_for_home
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	low
Identifiers and References	Identifiers: CCE-81044-0 References: BP28(R12), 1.1.13, CCI-000366, CCI-001208, CM-6(a), SC-5(2), PR.PT-4, SRG-OS-000480-GPOS-00227, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, APO13.01, DSS05.02, A.13.1.1, A.13.2.1, A.14.1.3, 12, 15, 8
Description	If user home directories will be stored locally, create a separate partition for `/home` at installation time (or migrate it later using LVM). If `/home` will be mounted from another system such as an NFS server, then creating a separate partition is not necessary at installation time, and the mountpoint can instead be configured later.
Rationale	Ensuring that `/home` is mounted on its own partition enables the setting of more restrictive mount options, and also helps ensure that users cannot trivially fill partitions used for log or audit data storage.

Encrypt Partitions

Rule ID	xccdf_org.ssgproject.content_rule_encrypt_partitions
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	high
Identifiers and References	Identifiers: CCE-80789-1 References: 3.13.16, CCI-001199, CCI-002475, CCI-002476, 164.308(a)(1)(ii)(D), 164.308(b)(1), 164.310(d), 164.312(a)(1), 164.312(a)(2)(iii), 164.312(a)(2)(iv), 164.312(b), 164.312(c), 164.314(b)(2)(i), 164.312(d), A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CM-6(a), SC-28, SC-28(1), SC-13, AU-9(3), PR.DS-1, PR.DS-5, SRG-OS-000405-GPOS-00184, SRG-OS-000185-GPOS-00079, SRG-OS-000404-GPOS-00183, SRG-OS-000404-VMM-001650, SRG-OS-000405-VMM-001660, SR 3.4, SR 4.1, SR 5.2, APO01.06, BAI02.01, BAI06.01, DSS04.07, DSS05.03, DSS05.04, DSS05.07, DSS06.02, DSS06.06, 13, 14
Description	Red Hat Enterprise Linux 8 natively supports partition encryption through the Linux Unified Key Setup-on-disk-format (LUKS) technology. The easiest way to encrypt a partition is during installation time. For manual installations, select the `Encrypt` checkbox during partition creation to encrypt the partition. When this option is selected the system will prompt for a passphrase to use in decrypting the partition. The passphrase will subsequently need to be entered manually every time the system boots. For automated/unattended installations, it is possible to use Kickstart by adding the `--encrypted` and `--passphrase=` options to the definition of each partition to be encrypted. For example, the following line would encrypt the root partition: part / --fstype=ext4 --size=100 --onpart=hda1 --encrypted --passphrase=PASSPHRASE Any PASSPHRASE is stored in the Kickstart in plaintext, and the Kickstart must then be protected accordingly. Omitting the `--passphrase=` option from the partition definition will cause the installer to pause and interactively ask for the passphrase during installation. By default, the `Anaconda` installer uses `aes-xts-plain64` cipher with a minimum `512` bit key size which should be compatible with FIPS enabled. Detailed information on encrypting partitions using LUKS or LUKS ciphers can be found on the Red Hat Enterprise Linux 8 Documentation web site: https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Security_Guide/sec-Encryption.html.
Rationale	The risk of a system's physical compromise, particularly mobile systems such as laptops, places its data at risk of compromise. Encrypting this data mitigates the risk of its loss if the system is lost.

Ensure /var/log/audit Located On Separate Partition

Rule ID	xccdf_org.ssgproject.content_rule_partition_for_var_log_audit
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	low
Identifiers and References	Identifiers: CCE-80854-3 References: 1.1.12, CCI-000366, CCI-001849, 164.312(a)(2)(ii), A.12.1.3, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.17.2.1, CM-6(a), AU-4, SC-5(2), PR.DS-4, PR.PT-1, PR.PT-4, SRG-OS-000341-GPOS-00132, SRG-OS-000480-GPOS-00227, SRG-OS-000341-VMM-001220, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.2, SR 7.6, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, APO11.04, APO13.01, BAI03.05, BAI04.04, DSS05.02, DSS05.04, DSS05.07, MEA02.01, 1, 12, 13, 14, 15, 16, 2, 3, 5, 6, 8
Description	Audit logs are stored in the `/var/log/audit` directory. Ensure that it has its own partition or logical volume at installation time, or migrate it later using LVM. Make absolutely certain that it is large enough to store all audit logs that will be created by the auditing daemon.
Rationale	Placing `/var/log/audit` in its own partition enables better separation between audit files and other files, and helps ensure that auditing cannot be halted due to the partition running out of space.

Ensure /var Located On Separate Partition

Rule ID	xccdf_org.ssgproject.content_rule_partition_for_var
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	low
Identifiers and References	Identifiers: CCE-80852-7 References: BP28(R12), 1.1.6, CCI-000366, CM-6(a), SC-5(2), PR.PT-4, SRG-OS-000480-GPOS-00227, SRG-OS-000341-VMM-001220, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, APO13.01, DSS05.02, A.13.1.1, A.13.2.1, A.14.1.3, 12, 15, 8
Description	The `/var` directory is used by daemons and other system services to store frequently-changing data. Ensure that `/var` has its own partition or logical volume at installation time, or migrate it using LVM.
Rationale	Ensuring that `/var` is mounted on its own partition enables the setting of more restrictive mount options. This helps protect system services such as daemons or other programs which use it. It is not uncommon for the `/var` directory to contain world-writable directories installed by other software packages.

Ensure /var/log Located On Separate Partition

Rule ID	xccdf_org.ssgproject.content_rule_partition_for_var_log
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-80853-5 References: BP28(R12), BP28(R47), 1.1.11, CM-6(a), AU-4, SC-5(2), PR.PT-1, PR.PT-4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, APO11.04, APO13.01, BAI03.05, DSS05.02, DSS05.04, DSS05.07, MEA02.01, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, 1, 12, 14, 15, 16, 3, 5, 6, 8, SRG-OS-000480-GPOS-00227
Description	System logs are stored in the `/var/log` directory. Ensure that it has its own partition or logical volume at installation time, or migrate it using LVM.
Rationale	Placing `/var/log` in its own partition enables better separation between log files and other files in `/var/`.

Make sure that the dconf databases are up-to-date with regards to respective keyfiles

Rule ID	xccdf_org.ssgproject.content_rule_dconf_db_up_to_date
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	high
Identifiers and References	Identifiers: CCE-81003-6 References: SRG-OS-000480-GPOS-00227
Description	By default, DConf uses a binary database as a data backend. The system-level database is compiled from keyfiles in the /etc/dconf/db/ directory by the dconf update command.
Rationale	Unlike text-based keyfiles, the binary database is impossible to check by OVAL. Therefore, in order to evaluate dconf configuration, both have to be true at the same time - configuration files have to be compliant, and the database needs to be more recent than those keyfiles, which gives confidence that it reflects them.

Install sudo Package

Rule ID xccdf_org.ssgproject.content_rule_package_sudo_installed

Result

fail

Multi-check rule no

OVAL Definition ID oval:ssg-package_sudo_installed:def:1

Time 2021-02-11T19:31:22+00:00

Severity medium

Identifiers and References

Identifiers: CCE-82214-8

References: CM-6(a), SRG-OS-000324-GPOS-00125, 1.3.1, 1382, 1384, 1386

Description

The sudo package can be installed with the following command:

$ sudo yum install sudo

Rationale

sudo is a program designed to allow a system administrator to give limited root privileges to users and log root activity. The basic philosophy is to give as few privileges as possible but still allow system users to get their work done.

Remediation Shell script ⇲

Complexity:	low
Disruption:	low
Strategy:	enable


if ! rpm -q --quiet "sudo" ; then
    yum install -y "sudo"
fi

Remediation Ansible snippet ⇲

Complexity:	low
Disruption:	low
Strategy:	enable

- name: Ensure sudo is installed
  package:
    name: sudo
    state: present
  tags:
    - CCE-82214-8
    - NIST-800-53-CM-6(a)
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_sudo_installed

Remediation Puppet snippet ⇲

Complexity:	low
Disruption:	low
Strategy:	enable

include install_sudo

class install_sudo {
  package { 'sudo':
    ensure => 'installed',
  }
}

Remediation Anaconda snippet ⇲

Complexity:	low
Disruption:	low
Strategy:	enable


package --add=sudo

OVAL test results details

package sudo is installed oval:ssg-test_package_sudo_installed:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_test_package_sudo_installed:obj:1 of type rpminfo_object

Name
sudo

Install dnf-automatic Package

Rule ID xccdf_org.ssgproject.content_rule_package_dnf-automatic_installed

Result

fail

Multi-check rule no

OVAL Definition ID oval:ssg-package_dnf-automatic_installed:def:1

Time 2021-02-11T19:31:22+00:00

Severity medium

Identifiers and References

Identifiers: CCE-82985-3

References: SRG-OS-000191-GPOS-00080

Description

The dnf-automatic package can be installed with the following command:

$ sudo yum install dnf-automatic

Rationale

dnf-automatic is an alternative command line interface (CLI) to dnf upgrade suitable for automatic, regular execution.

Remediation Shell script ⇲

Complexity:	low
Disruption:	low
Strategy:	enable


if ! rpm -q --quiet "dnf-automatic" ; then
    yum install -y "dnf-automatic"
fi

Remediation Ansible snippet ⇲

Complexity:	low
Disruption:	low
Strategy:	enable

- name: Ensure dnf-automatic is installed
  package:
    name: dnf-automatic
    state: present
  tags:
    - CCE-82985-3
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_dnf-automatic_installed

Remediation Puppet snippet ⇲

Complexity:	low
Disruption:	low
Strategy:	enable

include install_dnf-automatic

class install_dnf-automatic {
  package { 'dnf-automatic':
    ensure => 'installed',
  }
}

Remediation Anaconda snippet ⇲

Complexity:	low
Disruption:	low
Strategy:	enable


package --add=dnf-automatic

OVAL test results details

package dnf-automatic is installed oval:ssg-test_package_dnf-automatic_installed:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_test_package_dnf-automatic_installed:obj:1 of type rpminfo_object

Name
dnf-automatic

Ensure gpgcheck Enabled In Main yum Configuration

Rule ID	xccdf_org.ssgproject.content_rule_ensure_gpgcheck_globally_activated
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	high
Identifiers and References	Identifiers: CCE-80790-9 References: 1.2.4, 5.10.4.1, 3.4.8, CCI-001749, 164.308(a)(1)(ii)(D), 164.312(b), 164.312(c)(1), 164.312(c)(2), 164.312(e)(2)(i), CM-5(3), SI-7, SC-12, SC-12(3), CM-6(a), SA-12, SA-12(10), CM-11(a), CM-11(b), PR.DS-6, PR.DS-8, PR.IP-1, FPT_TUD_EXT.1, FPT_TUD_EXT.2, Req-6.2, SRG-OS-000366-GPOS-00153, SRG-OS-000366-VMM-001430, SRG-OS-000370-VMM-001460, SRG-OS-000404-VMM-001650, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 7.6, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, APO01.06, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS06.02, A.11.2.4, A.12.1.2, A.12.2.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, 11, 2, 3, 9, BP28(R15)
Description	The `gpgcheck` option controls whether RPM packages' signatures are always checked prior to installation. To configure yum to check package signatures before installing them, ensure the following line appears in `/etc/yum.conf` in the `[main]` section: gpgcheck=1
Rationale	Changes to any software components can have significant effects on the overall security of the operating system. This requirement ensures the software has not been tampered with and that it has been provided by a trusted vendor. Accordingly, patches, service packs, device drivers, or operating system components must be signed with a certificate recognized and approved by the organization. Verifying the authenticity of the software prior to installation validates the integrity of the patch or upgrade received from a vendor. This ensures the software has not been tampered with and that it has been provided by a trusted vendor. Self-signed certificates are disallowed by this requirement. Certificates used to verify the software must be from an approved Certificate Authority (CA).

Ensure gpgcheck Enabled for Local Packages

Rule ID	xccdf_org.ssgproject.content_rule_ensure_gpgcheck_local_packages
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	high
Identifiers and References	Identifiers: CCE-80791-7 References: 3.4.8, CCI-001749, 164.308(a)(1)(ii)(D), 164.312(b), 164.312(c)(1), 164.312(c)(2), 164.312(e)(2)(i), CM-11(a), CM-11(b), CM-6(a), CM-5(3), SA-12, SA-12(10), PR.IP-1, FPT_TUD_EXT.1, FPT_TUD_EXT.2, SRG-OS-000366-GPOS-00153, SRG-OS-000366-VMM-001430, SRG-OS-000370-VMM-001460, SRG-OS-000404-VMM-001650, SR 7.6, 4.3.4.3.2, 4.3.4.3.3, BAI10.01, BAI10.02, BAI10.03, BAI10.05, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, 11, 3, 9, BP28(R15)
Description	`yum` should be configured to verify the signature(s) of local packages prior to installation. To configure `yum` to verify signatures of local packages, set the `localpkg_gpgcheck` to `1` in `/etc/yum.conf`.
Rationale	Changes to any software components can have significant effects to the overall security of the operating system. This requirement ensures the software has not been tampered and has been provided by a trusted vendor. Accordingly, patches, service packs, device drivers, or operating system components must be signed with a certificate recognized and approved by the organization.

Enable dnf-automatic Timer

Rule ID xccdf_org.ssgproject.content_rule_timer_dnf-automatic_enabled

Result

fail

Multi-check rule no

OVAL Definition ID oval:ssg-timer_dnf-automatic_enabled:def:1

Time 2021-02-11T19:31:22+00:00

Severity medium

Identifiers and References

Identifiers: CCE-82360-9

References: FMT_SMF_EXT.1, SI-2(5), CM-6(a), SI-2(c), SRG-OS-000191-GPOS-00080

Description

The dnf-automatic timer can be enabled with the following command:

$ sudo systemctl enable dnf-automatic.timer

Rationale

The dnf-automatic is an alternative command line interface (CLI) to dnf upgrade with specific facilities to make it suitable to be executed automatically and regularly from systemd timers, cron jobs and similar. The tool is controlled by dnf-automatic.timer SystemD timer.

Remediation Shell script ⇲

Complexity:	low
Disruption:	low
Strategy:	enable


SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" start 'dnf-automatic.timer'
"$SYSTEMCTL_EXEC" enable 'dnf-automatic.timer'

Remediation Ansible snippet ⇲

Complexity:	low
Disruption:	low
Strategy:	enable

- name: Enable timer dnf-automatic
  block:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Enable timer dnf-automatic
      systemd:
        name: dnf-automatic.timer
        enabled: 'yes'
        state: started
      when:
        - '"dnf-automatic" in ansible_facts.packages'
  tags:
    - CCE-82360-9
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SI-2(5)
    - NIST-800-53-SI-2(c)
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - timer_dnf-automatic_enabled

OVAL test results details

package dnf-automatic is installed oval:ssg-test_package_dnf-automatic_installed:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_test_package_dnf-automatic_installed:obj:1 of type rpminfo_object

Name
dnf-automatic

Test that the dnf-automatic timer is running oval:ssg-test_timer_running_dnf-automatic:tst:1 unknown

No items have been found conforming to the following objects:

Object oval:ssg-obj_timer_running_dnf-automatic:obj:1 of type systemdunitproperty_object

Unit	Property
dnf-automatic\.timer	ActiveState

systemd test oval:ssg-test_multi_user_wants_dnf-automatic:tst:1 unknown

No items have been found conforming to the following objects:

Object oval:ssg-object_multi_user_target_for_dnf-automatic_enabled:obj:1 of type systemdunitdependency_object

Unit
multi-user.target

Configure dnf-automatic to Install Available Updates Automatically

Rule ID xccdf_org.ssgproject.content_rule_dnf-automatic_apply_updates

Result

fail

Multi-check rule no

OVAL Definition ID oval:ssg-dnf-automatic_apply_updates:def:1

Time 2021-02-11T19:31:22+00:00

Severity medium

Identifiers and References

Identifiers: CCE-82494-6

References: FMT_SMF_EXT.1, SI-2(5), CM-6(a), SI-2(c), SRG-OS-000191-GPOS-00080, 0940, 1144, 1467, 1472, 1483, 1493, 1494, 1495

Description

To ensure that the packages comprising the available updates will be automatically installed by dnf-automatic, set apply_updates to yes under [commands] section in /etc/dnf/automatic.conf.

Rationale

Installing software updates is a fundamental mitigation against the exploitation of publicly-known vulnerabilities. If the most recent security patches and updates are not installed, unauthorized users may take advantage of weaknesses in the unpatched software. The lack of prompt attention to patching could result in a system compromise. The automated installation of updates ensures that recent security patches are applied in a timely manner.

Remediation Shell script ⇲


CONF="/etc/dnf/automatic.conf"
APPLY_UPDATES_REGEX="[[:space:]]*\[commands]([^\n\[]*\n+)+?[[:space:]]*apply_updates"
COMMANDS_REGEX="[[:space:]]*\[commands]"

# Try find [commands] and apply_updates in automatic.conf, if it exists, set
# to yes, if it isn't here, add it, if [commands] doesn't exist, add it there
if grep -qzosP $APPLY_UPDATES_REGEX $CONF; then
    sed -i "s/apply_updates[^(\n)]*/apply_updates = yes/" $CONF
elif grep -qs $COMMANDS_REGEX $CONF; then
    sed -i "/$COMMANDS_REGEX/a apply_updates = yes" $CONF
else
    mkdir -p /etc/dnf
    echo -e "[commands]\napply_updates = yes" >> $CONF
fi

Remediation Ansible snippet ⇲

Complexity:	low
Disruption:	medium

- name: Configure dnf-automatic to Install Available Updates Automatically
  ini_file:
    dest: /etc/dnf/automatic.conf
    section: commands
    option: apply_updates
    value: 'yes'
    create: true
  tags:
    - CCE-82494-6
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SI-2(5)
    - NIST-800-53-SI-2(c)
    - dnf-automatic_apply_updates
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

OVAL test results details

tests the value of apply_updates setting in the /etc/dnf/automatic.conf file oval:ssg-test_dnf-automatic_apply_updates:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_dnf-automatic_apply_updates:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/etc/dnf/automatic.conf	^\s\[commands\].(?:\n\s[^[\s].)\n^\sapply_updates[ \t]=[ \t](.+?)[ \t]*(?:$\|#)	1

The configuration file /etc/dnf/automatic.conf exists for dnf-automatic_apply_updates oval:ssg-test_dnf-automatic_apply_updates_config_file_exists:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_dnf-automatic_apply_updates_config_file:obj:1 of type file_object

Filepath
^/etc/dnf/automatic.conf

Ensure Red Hat GPG Key Installed

Rule ID	xccdf_org.ssgproject.content_rule_ensure_redhat_gpgkey_installed
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-ensure_redhat_gpgkey_installed:def:1
Time	2021-02-11T19:31:22+00:00
Severity	high
Identifiers and References	Identifiers: CCE-80795-8 References: SRG-OS-000366-GPOS-00153, SRG-OS-000366-VMM-001430, SRG-OS-000370-VMM-001460, SRG-OS-000404-VMM-001650, 1.2.3, 5.10.4.1, 3.4.8, CCI-001749, 164.308(a)(1)(ii)(D), 164.312(b), 164.312(c)(1), 164.312(c)(2), 164.312(e)(2)(i), CM-5(3), SI-7, SC-12, SC-12(3), CM-6(a), PR.DS-6, PR.DS-8, PR.IP-1, FPT_TUD_EXT.1, FPT_TUD_EXT.2, Req-6.2, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 7.6, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, APO01.06, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS06.02, A.11.2.4, A.12.1.2, A.12.2.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, 11, 2, 3, 9, BP28(R15)
Description	To ensure the system can cryptographically verify base software packages come from Red Hat (and to connect to the Red Hat Network to receive them), the Red Hat GPG key must properly be installed. To install the Red Hat GPG key, run: $ sudo subscription-manager register If the system is not connected to the Internet or an RHN Satellite, then install the Red Hat GPG key from trusted media such as the Red Hat installation CD-ROM or DVD. Assuming the disc is mounted in `/media/cdrom`, use the following command as the root user to import it into the keyring: $ sudo rpm --import /media/cdrom/RPM-GPG-KEY Alternatively, the key may be pre-loaded during the RHEL installation. In such cases, the key can be installed by running the following command: sudo rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
Rationale	Changes to software components can have significant effects on the overall security of the operating system. This requirement ensures the software has not been tampered with and that it has been provided by a trusted vendor. The Red Hat GPG key is necessary to cryptographically verify packages are from Red Hat.

OVAL test results details

installed OS part of unix family oval:ssg-test_rhel8_unix_family:tst:1 true

Following items have been found on the system:

Family
unix

installed OS part of unix family oval:ssg-test_rhel8_unix_family:tst:1 true

Following items have been found on the system:

Family
unix

redhat-release is version 8 oval:ssg-test_rhel8:tst:1 true

Following items have been found on the system:

Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
redhat-release	x86_64	(none)	1.0.el8	8.3	0:8.3-1.0.el8	199e2f91fd431d51	redhat-release-0:8.3-1.0.el8.x86_64

redhat-release is version 8 oval:ssg-test_rhel8:tst:1 true

Following items have been found on the system:

Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
redhat-release	x86_64	(none)	1.0.el8	8.3	0:8.3-1.0.el8	199e2f91fd431d51	redhat-release-0:8.3-1.0.el8.x86_64

redhat-release-virtualization-host RPM package is installed oval:ssg-test_rhvh4_version:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_rhvh4_version:obj:1 of type rpminfo_object

Name
redhat-release-virtualization-host

redhat-release-virtualization-host RPM package is installed oval:ssg-test_rhvh4_version:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_rhvh4_version:obj:1 of type rpminfo_object

Name
redhat-release-virtualization-host

RHEVH base RHEL is version 8 oval:ssg-test_rhevh_rhel8_version:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_rhevh_rhel8_version:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/etc/redhat-release	^Red Hat Enterprise Linux release (\d)\.\d+$	1

RHEVH base RHEL is version 8 oval:ssg-test_rhevh_rhel8_version:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_rhevh_rhel8_version:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/etc/redhat-release	^Red Hat Enterprise Linux release (\d)\.\d+$	1

installed OS part of unix family oval:ssg-test_rhel8_unix_family:tst:1 true

Following items have been found on the system:

Family
unix

installed OS part of unix family oval:ssg-test_rhel8_unix_family:tst:1 true

Following items have been found on the system:

Family
unix

redhat-release is version 8 oval:ssg-test_rhel8:tst:1 true

Following items have been found on the system:

Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
redhat-release	x86_64	(none)	1.0.el8	8.3	0:8.3-1.0.el8	199e2f91fd431d51	redhat-release-0:8.3-1.0.el8.x86_64

redhat-release is version 8 oval:ssg-test_rhel8:tst:1 true

Following items have been found on the system:

Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
redhat-release	x86_64	(none)	1.0.el8	8.3	0:8.3-1.0.el8	199e2f91fd431d51	redhat-release-0:8.3-1.0.el8.x86_64

redhat-release-virtualization-host RPM package is installed oval:ssg-test_rhvh4_version:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_rhvh4_version:obj:1 of type rpminfo_object

Name
redhat-release-virtualization-host

redhat-release-virtualization-host RPM package is installed oval:ssg-test_rhvh4_version:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_rhvh4_version:obj:1 of type rpminfo_object

Name
redhat-release-virtualization-host

RHEVH base RHEL is version 8 oval:ssg-test_rhevh_rhel8_version:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_rhevh_rhel8_version:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/etc/redhat-release	^Red Hat Enterprise Linux release (\d)\.\d+$	1

RHEVH base RHEL is version 8 oval:ssg-test_rhevh_rhel8_version:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_rhevh_rhel8_version:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/etc/redhat-release	^Red Hat Enterprise Linux release (\d)\.\d+$	1

Red Hat release key package is installed oval:ssg-test_package_gpgkey-fd431d51-4ae0493b_installed:tst:1 true

Following items have been found on the system:

Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
gpg-pubkey	(none)	(none)	4ae0493b	fd431d51	0:fd431d51-4ae0493b	0	gpg-pubkey-0:fd431d51-4ae0493b.(none)
gpg-pubkey	(none)	(none)	5b32db75	d4082792	0:d4082792-5b32db75	0	gpg-pubkey-0:d4082792-5b32db75.(none)

Red Hat auxiliary key package is installed oval:ssg-test_package_gpgkey-d4082792-5b32db75_installed:tst:1 true

Following items have been found on the system:

Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
gpg-pubkey	(none)	(none)	4ae0493b	fd431d51	0:fd431d51-4ae0493b	0	gpg-pubkey-0:fd431d51-4ae0493b.(none)
gpg-pubkey	(none)	(none)	5b32db75	d4082792	0:d4082792-5b32db75	0	gpg-pubkey-0:d4082792-5b32db75.(none)

Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 not evaluated

No items have been found conforming to the following objects:

Object oval:ssg-object_unix_family:obj:1 of type family_object

Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 true

Following items have been found on the system:

Family
unix

Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 not evaluated

No items have been found conforming to the following objects:

Object oval:ssg-object_unix_family:obj:1 of type family_object

Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 true

Following items have been found on the system:

Family
unix

Check os-release ID oval:ssg-test_centos8_name:tst:1 not evaluated

No items have been found conforming to the following objects:

Object oval:ssg-obj_name_centos8:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/etc/os-release	^ID="(\w+)"$	1

Check os-release ID oval:ssg-test_centos8_name:tst:1 false

Following items have been found on the system:

Path	Content
/etc/os-release	ID="rhel"

Check os-release VERSION_ID oval:ssg-test_centos8_version:tst:1 not evaluated

No items have been found conforming to the following objects:

Object oval:ssg-obj_version_centos8:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/etc/os-release	^VERSION_ID="(\d)"$	1

Check os-release VERSION_ID oval:ssg-test_centos8_version:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_version_centos8:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/etc/os-release	^VERSION_ID="(\d)"$	1

Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 not evaluated

No items have been found conforming to the following objects:

Object oval:ssg-object_unix_family:obj:1 of type family_object

Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 true

Following items have been found on the system:

Family
unix

Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 not evaluated

No items have been found conforming to the following objects:

Object oval:ssg-object_unix_family:obj:1 of type family_object

Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 true

Following items have been found on the system:

Family
unix

Check os-release ID oval:ssg-test_centos8_name:tst:1 not evaluated

No items have been found conforming to the following objects:

Object oval:ssg-obj_name_centos8:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/etc/os-release	^ID="(\w+)"$	1

Check os-release ID oval:ssg-test_centos8_name:tst:1 false

Following items have been found on the system:

Path	Content
/etc/os-release	ID="rhel"

Check os-release VERSION_ID oval:ssg-test_centos8_version:tst:1 not evaluated

No items have been found conforming to the following objects:

Object oval:ssg-obj_version_centos8:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/etc/os-release	^VERSION_ID="(\d)"$	1

Check os-release VERSION_ID oval:ssg-test_centos8_version:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_version_centos8:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/etc/os-release	^VERSION_ID="(\d)"$	1

CentOS8 key package is installed oval:ssg-test_package_gpgkey-8483c65d-5ccc5b19_installed:tst:1 false

Following items have been found on the system:

Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
gpg-pubkey	(none)	(none)	4ae0493b	fd431d51	0:fd431d51-4ae0493b	0	gpg-pubkey-0:fd431d51-4ae0493b.(none)
gpg-pubkey	(none)	(none)	5b32db75	d4082792	0:d4082792-5b32db75	0	gpg-pubkey-0:d4082792-5b32db75.(none)

Ensure yum Removes Previous Package Versions

Rule ID	xccdf_org.ssgproject.content_rule_clean_components_post_updating
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	low
Identifiers and References	Identifiers: CCE-82476-3 References: 3.4.8, CCI-002617, SI-2(6), CM-11(a), CM-11(b), CM-6(a), ID.RA-1, PR.IP-12, SRG-OS-000437-GPOS-00194, SRG-OS-000437-VMM-001760, 4.2.3, 4.2.3.12, 4.2.3.7, 4.2.3.9, APO12.01, APO12.02, APO12.03, APO12.04, BAI03.10, DSS05.01, DSS05.02, A.12.6.1, A.14.2.3, A.16.1.3, A.18.2.2, A.18.2.3, 18, 20, 4
Description	`yum` should be configured to remove previous software components after new versions have been installed. To configure `yum` to remove the previous software components after updating, set the `clean_requirements_on_remove` to `1` in `/etc/yum.conf`.
Rationale	Previous versions of software components that are not removed from the information system after updates have been installed may be exploited by some adversaries.

Configure dnf-automatic to Install Only Security Updates

Rule ID xccdf_org.ssgproject.content_rule_dnf-automatic_security_updates_only

Result

fail

Multi-check rule no

OVAL Definition ID oval:ssg-dnf-automatic_security_updates_only:def:1

Time 2021-02-11T19:31:22+00:00

Severity low

Identifiers and References

Identifiers: CCE-82267-6

References: FMT_SMF_EXT.1, SI-2(5), CM-6(a), SI-2(c), SRG-OS-000191-GPOS-00080

Description

To configure dnf-automatic to install only security updates automatically, set upgrade_type to security under [commands] section in /etc/dnf/automatic.conf.

Rationale

By default, dnf-automatic installs all available updates. Reducing the amount of updated packages only to updates that were issued as a part of a security advisory increases the system stability.

Remediation Shell script ⇲


CONF="/etc/dnf/automatic.conf"
APPLY_UPDATES_REGEX="[[:space:]]*\[commands]([^\n\[]*\n+)+?[[:space:]]*upgrade_type"
COMMANDS_REGEX="[[:space:]]*\[commands]"

# Try find [commands] and upgrade_type in automatic.conf, if it exists, set
# it to security, if it isn't here, add it, if [commands] doesn't exist,
# add it there
if grep -qzosP $APPLY_UPDATES_REGEX $CONF; then
    sed -i "s/upgrade_type[^(\n)]*/upgrade_type = security/" $CONF
elif grep -qs $COMMANDS_REGEX $CONF; then
    sed -i "/$COMMANDS_REGEX/a upgrade_type = security" $CONF
else
    mkdir -p /etc/dnf
    echo -e "[commands]\nupgrade_type = security" >> $CONF
fi

Remediation Ansible snippet ⇲

Complexity:	low
Disruption:	medium

- name: Configure dnf-automatic to Install Only Security Updates
  ini_file:
    dest: /etc/dnf/automatic.conf
    section: commands
    option: upgrade_type
    value: security
    create: true
  tags:
    - CCE-82267-6
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SI-2(5)
    - NIST-800-53-SI-2(c)
    - dnf-automatic_security_updates_only
    - low_complexity
    - low_severity
    - medium_disruption
    - no_reboot_needed
    - unknown_strategy

OVAL test results details

tests the value of upgrade_type setting in the /etc/dnf/automatic.conf file oval:ssg-test_dnf-automatic_security_updates_only:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_dnf-automatic_security_updates_only:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/etc/dnf/automatic.conf	^\s\[commands\].(?:\n\s[^[\s].)\n^\supgrade_type[ \t]=[ \t](.+?)[ \t]*(?:$\|#)	1

The configuration file /etc/dnf/automatic.conf exists for dnf-automatic_security_updates_only oval:ssg-test_dnf-automatic_security_updates_only_config_file_exists:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_dnf-automatic_security_updates_only_config_file:obj:1 of type file_object

Filepath
^/etc/dnf/automatic.conf

Ensure gpgcheck Enabled for All yum Package Repositories

Rule ID	xccdf_org.ssgproject.content_rule_ensure_gpgcheck_never_disabled
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-ensure_gpgcheck_never_disabled:def:1
Time	2021-02-11T19:31:22+00:00
Severity	high
Identifiers and References	Identifiers: CCE-80792-5 References: SRG-OS-000366-GPOS-00153, SRG-OS-000366-VMM-001430, SRG-OS-000370-VMM-001460, SRG-OS-000404-VMM-001650, 5.10.4.1, 3.4.8, CCI-001749, 164.308(a)(1)(ii)(D), 164.312(b), 164.312(c)(1), 164.312(c)(2), 164.312(e)(2)(i), CM-5(3), SI-7, SC-12, SC-12(3), CM-6(a), SA-12, SA-12(10), CM-11(a), CM-11(b), PR.DS-6, PR.DS-8, PR.IP-1, FPT_TUD_EXT.1, FPT_TUD_EXT.2, Req-6.2, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 7.6, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, APO01.06, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS06.02, A.11.2.4, A.12.1.2, A.12.2.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, 11, 2, 3, 9, BP28(R15)
Description	To ensure signature checking is not disabled for any repos, remove any lines from files in `/etc/yum.repos.d` of the form: gpgcheck=0
Rationale	Verifying the authenticity of the software prior to installation validates the integrity of the patch or upgrade received from a vendor. This ensures the software has not been tampered with and that it has been provided by a trusted vendor. Self-signed certificates are disallowed by this requirement. Certificates used to verify the software must be from an approved Certificate Authority (CA)."

OVAL test results details

check for existence of gpgcheck=0 in /etc/yum.repos.d/ files oval:ssg-test_ensure_gpgcheck_never_disabled:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-obj_ensure_gpgcheck_never_disabled:obj:1 of type textfilecontent54_object

Path	Filename	Pattern	Instance
/etc/yum.repos.d	.*	^\sgpgcheck\s=\s0\s$	1

Install dnf-plugin-subscription-manager Package

Rule ID xccdf_org.ssgproject.content_rule_package_dnf-plugin-subscription-manager_installed

Result

fail

Multi-check rule no

OVAL Definition ID oval:ssg-package_dnf-plugin-subscription-manager_installed:def:1

Time 2021-02-11T19:31:22+00:00

Severity medium

Identifiers and References

Identifiers: CCE-82315-3

References: FPT_TUD_EXT.1, FPT_TUD_EXT.2, SRG-OS-000366-GPOS-00153, 0940, 1144, 1467, 1472, 1483, 1493, 1494, 1495

Description

The dnf-plugin-subscription-manager package can be installed with the following command:

$ sudo yum install dnf-plugin-subscription-manager

Rationale

This package provides plugins to interact with repositories and subscriptions from the Red Hat entitlement platform; contains subscription-manager and product-id plugins.

Remediation Shell script ⇲

Complexity:	low
Disruption:	low
Strategy:	enable


if ! rpm -q --quiet "dnf-plugin-subscription-manager" ; then
    yum install -y "dnf-plugin-subscription-manager"
fi

Remediation Ansible snippet ⇲

Complexity:	low
Disruption:	low
Strategy:	enable

- name: Ensure dnf-plugin-subscription-manager is installed
  package:
    name: dnf-plugin-subscription-manager
    state: present
  tags:
    - CCE-82315-3
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_dnf-plugin-subscription-manager_installed

Remediation Puppet snippet ⇲

Complexity:	low
Disruption:	low
Strategy:	enable

include install_dnf-plugin-subscription-manager

class install_dnf-plugin-subscription-manager {
  package { 'dnf-plugin-subscription-manager':
    ensure => 'installed',
  }
}

Remediation Anaconda snippet ⇲

Complexity:	low
Disruption:	low
Strategy:	enable


package --add=dnf-plugin-subscription-manager

OVAL test results details

package dnf-plugin-subscription-manager is installed oval:ssg-test_package_dnf-plugin-subscription-manager_installed:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_test_package_dnf-plugin-subscription-manager_installed:obj:1 of type rpminfo_object

Name
dnf-plugin-subscription-manager

Ensure gnutls-utils is installed

Rule ID xccdf_org.ssgproject.content_rule_package_gnutls-utils_installed

Result

fail

Multi-check rule no

OVAL Definition ID oval:ssg-package_gnutls-utils_installed:def:1

Time 2021-02-11T19:31:22+00:00

Severity medium

Identifiers and References

Identifiers: CCE-82395-5

References: FIA_X509_EXT, SRG-OS-000480-GPOS-00227

Description

The gnutls-utils package can be installed with the following command:

$ sudo yum install gnutls-utils

Rationale

GnuTLS is a secure communications library implementing the SSL, TLS and DTLS protocols and technologies around them. It provides a simple C language application programming interface (API) to access the secure communications protocols as well as APIs to parse and write X.509, PKCS #12, OpenPGP and other required structures. This package contains command line TLS client and server and certificate manipulation tools.

Remediation Shell script ⇲

Complexity:	low
Disruption:	low
Strategy:	enable


if ! rpm -q --quiet "gnutls-utils" ; then
    yum install -y "gnutls-utils"
fi

Remediation Ansible snippet ⇲

Complexity:	low
Disruption:	low
Strategy:	enable

- name: Ensure gnutls-utils is installed
  package:
    name: gnutls-utils
    state: present
  tags:
    - CCE-82395-5
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_gnutls-utils_installed

Remediation Puppet snippet ⇲

Complexity:	low
Disruption:	low
Strategy:	enable

include install_gnutls-utils

class install_gnutls-utils {
  package { 'gnutls-utils':
    ensure => 'installed',
  }
}

Remediation Anaconda snippet ⇲

Complexity:	low
Disruption:	low
Strategy:	enable


package --add=gnutls-utils

OVAL test results details

package gnutls-utils is installed oval:ssg-test_package_gnutls-utils_installed:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_test_package_gnutls-utils_installed:obj:1 of type rpminfo_object

Name
gnutls-utils

Install libcap-ng-utils Package

Rule ID xccdf_org.ssgproject.content_rule_package_libcap-ng-utils_installed

Result

fail

Multi-check rule no

OVAL Definition ID oval:ssg-package_libcap-ng-utils_installed:def:1

Time 2021-02-11T19:31:22+00:00

Severity medium

Identifiers and References

Identifiers: CCE-82979-6

References: SRG-OS-000445-GPOS-00199

Description

The libcap-ng-utils package can be installed with the following command:

$ sudo yum install libcap-ng-utils

Rationale

libcap-ng-utils contains applications to analyze the posix posix capabilities of all the programs running on a system. libcap-ng-utils also lets system operators set the file system based capabilities.

Remediation Shell script ⇲

Complexity:	low
Disruption:	low
Strategy:	enable


if ! rpm -q --quiet "libcap-ng-utils" ; then
    yum install -y "libcap-ng-utils"
fi

Remediation Ansible snippet ⇲

Complexity:	low
Disruption:	low
Strategy:	enable

- name: Ensure libcap-ng-utils is installed
  package:
    name: libcap-ng-utils
    state: present
  tags:
    - CCE-82979-6
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_libcap-ng-utils_installed

Remediation Puppet snippet ⇲

Complexity:	low
Disruption:	low
Strategy:	enable

include install_libcap-ng-utils

class install_libcap-ng-utils {
  package { 'libcap-ng-utils':
    ensure => 'installed',
  }
}

Remediation Anaconda snippet ⇲

Complexity:	low
Disruption:	low
Strategy:	enable


package --add=libcap-ng-utils

OVAL test results details

package libcap-ng-utils is installed oval:ssg-test_package_libcap-ng-utils_installed:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_test_package_libcap-ng-utils_installed:obj:1 of type rpminfo_object

Name
libcap-ng-utils

Install openscap-scanner Package

Rule ID xccdf_org.ssgproject.content_rule_package_openscap-scanner_installed

Result

fail

Multi-check rule no

OVAL Definition ID oval:ssg-package_openscap-scanner_installed:def:1

Time 2021-02-11T19:31:22+00:00

Severity medium

Identifiers and References

Identifiers: CCE-82220-5

References: SRG-OS-000480-GPOS-00227, SRG-OS-000191-GPOS-00080

Description

The openscap-scanner package can be installed with the following command:

$ sudo yum install openscap-scanner

Rationale

openscap-scanner contains the oscap command line tool. This tool is a configuration and vulnerability scanner, capable of performing compliance checking using SCAP content.

Remediation Shell script ⇲

Complexity:	low
Disruption:	low
Strategy:	enable


if ! rpm -q --quiet "openscap-scanner" ; then
    yum install -y "openscap-scanner"
fi

Remediation Ansible snippet ⇲

Complexity:	low
Disruption:	low
Strategy:	enable

- name: Ensure openscap-scanner is installed
  package:
    name: openscap-scanner
    state: present
  tags:
    - CCE-82220-5
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_openscap-scanner_installed

Remediation Puppet snippet ⇲

Complexity:	low
Disruption:	low
Strategy:	enable

include install_openscap-scanner

class install_openscap-scanner {
  package { 'openscap-scanner':
    ensure => 'installed',
  }
}

Remediation Anaconda snippet ⇲

Complexity:	low
Disruption:	low
Strategy:	enable


package --add=openscap-scanner

OVAL test results details

package openscap-scanner is installed oval:ssg-test_package_openscap-scanner_installed:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_test_package_openscap-scanner_installed:obj:1 of type rpminfo_object

Name
openscap-scanner

Install scap-security-guide Package

Rule ID xccdf_org.ssgproject.content_rule_package_scap-security-guide_installed

Result

fail

Multi-check rule no

OVAL Definition ID oval:ssg-package_scap-security-guide_installed:def:1

Time 2021-02-11T19:31:22+00:00

Severity medium

Identifiers and References

Identifiers: CCE-82949-9

References: SRG-OS-000480-GPOS-00227

Description

The scap-security-guide package can be installed with the following command:

$ sudo yum install scap-security-guide

Rationale

The scap-security-guide package provides a guide for configuration of the system from the final system's security point of view. The guidance is specified in the Security Content Automation Protocol (SCAP) format and constitutes a catalog of practical hardening advice, linked to government requirements where applicable. The SCAP Security Guide project bridges the gap between generalized policy requirements and specific implementation guidelines. A system administrator can use the oscap CLI tool from the openscap-scanner package, or the SCAP Workbench GUI tool from the scap-workbench package, to verify that the system conforms to provided guidelines. Refer to the scap-security-guide(8) manual page for futher information.

Remediation Shell script ⇲

Complexity:	low
Disruption:	low
Strategy:	enable


if ! rpm -q --quiet "scap-security-guide" ; then
    yum install -y "scap-security-guide"
fi

Remediation Ansible snippet ⇲

Complexity:	low
Disruption:	low
Strategy:	enable

- name: Ensure scap-security-guide is installed
  package:
    name: scap-security-guide
    state: present
  tags:
    - CCE-82949-9
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_scap-security-guide_installed

Remediation Puppet snippet ⇲

Complexity:	low
Disruption:	low
Strategy:	enable

include install_scap-security-guide

class install_scap-security-guide {
  package { 'scap-security-guide':
    ensure => 'installed',
  }
}

Remediation Anaconda snippet ⇲

Complexity:	low
Disruption:	low
Strategy:	enable


package --add=scap-security-guide

OVAL test results details

package scap-security-guide is installed oval:ssg-test_package_scap-security-guide_installed:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_test_package_scap-security-guide_installed:obj:1 of type rpminfo_object

Name
scap-security-guide

Install subscription-manager Package

Rule ID xccdf_org.ssgproject.content_rule_package_subscription-manager_installed

Result

fail

Multi-check rule no

OVAL Definition ID oval:ssg-package_subscription-manager_installed:def:1

Time 2021-02-11T19:31:22+00:00

Severity medium

Identifiers and References

Identifiers: CCE-82316-1

References: SRG-OS-000366-GPOS-00153, FPT_TUD_EXT.1, FPT_TUD_EXT.2, 0940, 1144, 1467, 1472, 1483, 1493, 1494, 1495

Description

The subscription-manager package can be installed with the following command:

$ sudo yum install subscription-manager

Rationale

Red Hat Subscription Manager is a local service which tracks installed products and subscriptions on a local system to help manage subscription assignments. It communicates with the backend subscription service (the Customer Portal or an on-premise server such as Subscription Asset Manager) and works with content management tools such as yum.

Remediation Shell script ⇲

Complexity:	low
Disruption:	low
Strategy:	enable


if ! rpm -q --quiet "subscription-manager" ; then
    yum install -y "subscription-manager"
fi

Remediation Ansible snippet ⇲

Complexity:	low
Disruption:	low
Strategy:	enable

- name: Ensure subscription-manager is installed
  package:
    name: subscription-manager
    state: present
  tags:
    - CCE-82316-1
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_subscription-manager_installed

Remediation Puppet snippet ⇲

Complexity:	low
Disruption:	low
Strategy:	enable

include install_subscription-manager

class install_subscription-manager {
  package { 'subscription-manager':
    ensure => 'installed',
  }
}

Remediation Anaconda snippet ⇲

Complexity:	low
Disruption:	low
Strategy:	enable


package --add=subscription-manager

OVAL test results details

package subscription-manager is installed oval:ssg-test_package_subscription-manager_installed:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_test_package_subscription-manager_installed:obj:1 of type rpminfo_object

Name
subscription-manager

Uninstall abrt-addon-ccpp Package

Rule ID	xccdf_org.ssgproject.content_rule_package_abrt-addon-ccpp_removed
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-package_abrt-addon-ccpp_removed:def:1
Time	2021-02-11T19:31:22+00:00
Severity	low
Identifiers and References	Identifiers: CCE-82919-2 References: SRG-OS-000095-GPOS-00049
Description	The `abrt-addon-ccpp` package can be removed with the following command: $ sudo yum erase abrt-addon-ccpp
Rationale	`abrt-addon-ccpp` contains hooks for C/C++ crashed programs and `abrt`'s C/C++ analyzer plugin.

OVAL test results details

package abrt-addon-ccpp is removed oval:ssg-test_package_abrt-addon-ccpp_removed:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-obj_test_package_abrt-addon-ccpp_removed:obj:1 of type rpminfo_object

Name
abrt-addon-ccpp

Uninstall abrt-addon-kerneloops Package

Rule ID	xccdf_org.ssgproject.content_rule_package_abrt-addon-kerneloops_removed
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-package_abrt-addon-kerneloops_removed:def:1
Time	2021-02-11T19:31:22+00:00
Severity	low
Identifiers and References	Identifiers: CCE-82926-7 References: SRG-OS-000095-GPOS-00049
Description	The `abrt-addon-kerneloops` package can be removed with the following command: $ sudo yum erase abrt-addon-kerneloops
Rationale	`abrt-addon-kerneloops` contains plugins for collecting kernel crash information and reporter plugin which sends this information to a specified server, usually to kerneloops.org.

OVAL test results details

package abrt-addon-kerneloops is removed oval:ssg-test_package_abrt-addon-kerneloops_removed:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-obj_test_package_abrt-addon-kerneloops_removed:obj:1 of type rpminfo_object

Name
abrt-addon-kerneloops

Uninstall abrt-addon-python Package

Rule ID	xccdf_org.ssgproject.content_rule_package_abrt-addon-python_removed
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-package_abrt-addon-python_removed:def:1
Time	2021-02-11T19:31:22+00:00
Severity	low
Identifiers and References	Identifiers: CCE-82923-4 References: SRG-OS-000095-GPOS-00049
Description	The `abrt-addon-python` package can be removed with the following command: $ sudo yum erase abrt-addon-python
Rationale	`abrt-addon-python` contains python hook and python analyzer plugin for handling uncaught exceptions in python programs.

OVAL test results details

package abrt-addon-python is removed oval:ssg-test_package_abrt-addon-python_removed:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-obj_test_package_abrt-addon-python_removed:obj:1 of type rpminfo_object

Name
abrt-addon-python

Uninstall abrt-cli Package

Rule ID	xccdf_org.ssgproject.content_rule_package_abrt-cli_removed
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-package_abrt-cli_removed:def:1
Time	2021-02-11T19:31:22+00:00
Severity	low
Identifiers and References	Identifiers: CCE-82907-7 References: SRG-OS-000095-GPOS-00049
Description	The `abrt-cli` package can be removed with the following command: $ sudo yum erase abrt-cli
Rationale	`abrt-cli` contains a command line client for controlling abrt daemon over sockets.

OVAL test results details

package abrt-cli is removed oval:ssg-test_package_abrt-cli_removed:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-obj_test_package_abrt-cli_removed:obj:1 of type rpminfo_object

Name
abrt-cli

Uninstall abrt-plugin-logger Package

Rule ID	xccdf_org.ssgproject.content_rule_package_abrt-plugin-logger_removed
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-package_abrt-plugin-logger_removed:def:1
Time	2021-02-11T19:31:22+00:00
Severity	low
Identifiers and References	Identifiers: CCE-82913-5 References: SRG-OS-000095-GPOS-00049
Description	The `abrt-plugin-logger` package can be removed with the following command: $ sudo yum erase abrt-plugin-logger
Rationale	`abrt-plugin-logger` is an ABRT plugin which writes a report to a specified file.

OVAL test results details

package abrt-plugin-logger is removed oval:ssg-test_package_abrt-plugin-logger_removed:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-obj_test_package_abrt-plugin-logger_removed:obj:1 of type rpminfo_object

Name
abrt-plugin-logger

Uninstall abrt-plugin-rhtsupport Package

Rule ID	xccdf_org.ssgproject.content_rule_package_abrt-plugin-rhtsupport_removed
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-package_abrt-plugin-rhtsupport_removed:def:1
Time	2021-02-11T19:31:22+00:00
Severity	low
Identifiers and References	Identifiers: CCE-82916-8 References: SRG-OS-000095-GPOS-00049
Description	The `abrt-plugin-rhtsupport` package can be removed with the following command: $ sudo yum erase abrt-plugin-rhtsupport
Rationale	`abrt-plugin-rhtsupport` is a ABRT plugin to report bugs into the Red Hat Support system.

OVAL test results details

package abrt-plugin-rhtsupport is removed oval:ssg-test_package_abrt-plugin-rhtsupport_removed:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-obj_test_package_abrt-plugin-rhtsupport_removed:obj:1 of type rpminfo_object

Name
abrt-plugin-rhtsupport

Uninstall abrt-plugin-sosreport Package

Rule ID	xccdf_org.ssgproject.content_rule_package_abrt-plugin-sosreport_removed
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-package_abrt-plugin-sosreport_removed:def:1
Time	2021-02-11T19:31:22+00:00
Severity	low
Identifiers and References	Identifiers: CCE-82910-1 References: SRG-OS-000095-GPOS-00049
Description	The `abrt-plugin-sosreport` package can be removed with the following command: $ sudo yum erase abrt-plugin-sosreport
Rationale	`abrt-plugin-sosreport` provides a plugin to include an sosreport in an ABRT report.

OVAL test results details

package abrt-plugin-sosreport is removed oval:ssg-test_package_abrt-plugin-sosreport_removed:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-obj_test_package_abrt-plugin-sosreport_removed:obj:1 of type rpminfo_object

Name
abrt-plugin-sosreport

Uninstall gssproxy Package

Rule ID	xccdf_org.ssgproject.content_rule_package_gssproxy_removed
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-package_gssproxy_removed:def:1
Time	2021-02-11T19:31:22+00:00
Severity	low
Identifiers and References	Identifiers: CCE-82943-2 References: SRG-OS-000095-GPOS-00049
Description	The `gssproxy` package can be removed with the following command: $ sudo yum erase gssproxy
Rationale	`gssproxy` is a proxy for GSS API credential handling.

OVAL test results details

package gssproxy is removed oval:ssg-test_package_gssproxy_removed:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-obj_test_package_gssproxy_removed:obj:1 of type rpminfo_object

Name
gssproxy

Uninstall iprutils Package

Rule ID	xccdf_org.ssgproject.content_rule_package_iprutils_removed
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-package_iprutils_removed:def:1
Time	2021-02-11T19:31:22+00:00
Severity	low
Identifiers and References	Identifiers: CCE-82946-5 References: SRG-OS-000095-GPOS-00049
Description	The `iprutils` package can be removed with the following command: $ sudo yum erase iprutils
Rationale	`iprutils` provides a suite of utlilities to manage and configure SCSI devices supported by the ipr SCSI storage device driver.

OVAL test results details

package iprutils is removed oval:ssg-test_package_iprutils_removed:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-obj_test_package_iprutils_removed:obj:1 of type rpminfo_object

Name
iprutils

Uninstall krb5-workstation Package

Rule ID	xccdf_org.ssgproject.content_rule_package_krb5-workstation_removed
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-package_krb5-workstation_removed:def:1
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-82931-7 References: SRG-OS-000095-GPOS-00049, SRG-OS-000120-GPOS-00061
Description	The `krb5-workstation` package can be removed with the following command: $ sudo yum erase krb5-workstation
Rationale	Kerberos is a network authentication system. The `krb5-workstation` package contains the basic Kerberos programs (`kinit`, `klist`, `kdestroy`, `kpasswd`). Currently, Kerberos does not utilize FIPS 140-2 cryptography and is not permitted on Government networks, nor is it permitted in many regulatory environments such as HIPAA.

OVAL test results details

package krb5-workstation is removed oval:ssg-test_package_krb5-workstation_removed:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-obj_test_package_krb5-workstation_removed:obj:1 of type rpminfo_object

Name
krb5-workstation

Set the GNOME3 Login Warning Banner Text

Rule ID	xccdf_org.ssgproject.content_rule_dconf_gnome_login_banner_text
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-80770-1 References: 1.8.2, 3.1.9, CCI-000048, AC-8(a), AC-8(c), PR.AC-7, FMT_MOF_EXT.1, SRG-OS-000023-GPOS-00006, SRG-OS-000024-GPOS-00007, SRG-OS-000228-GPOS-00088, SR 1.1, SR 1.10, SR 1.2, SR 1.5, SR 1.7, SR 1.8, SR 1.9, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, DSS05.04, DSS05.10, DSS06.10, A.18.1.4, A.9.2.1, A.9.2.4, A.9.3.1, A.9.4.2, A.9.4.3, 1, 12, 15, 16
Description	In the default graphical environment, configuring the login warning banner text in the GNOME Display Manager's login screen can be configured on the login screen by setting `banner-message-text` to `'APPROVED_BANNER'` where APPROVED_BANNER is the approved banner for your environment. To enable, add or edit `banner-message-text` to `/etc/dconf/db/gdm.d/00-security-settings`. For example: [org/gnome/login-screen] banner-message-text='APPROVED_BANNER' Once the setting has been added, add a lock to `/etc/dconf/db/gdm.d/locks/00-security-settings-lock` to prevent user modification. For example: /org/gnome/login-screen/banner-message-text After the settings have been set, run `dconf update`. When entering a warning banner that spans several lines, remember to begin and end the string with `'` and use `\n` for new lines.
Rationale	An appropriate warning message reinforces policy awareness during the logon process and facilitates possible legal action against attackers.

Enable GNOME3 Login Warning Banner

Rule ID	xccdf_org.ssgproject.content_rule_dconf_gnome_banner_enabled
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-80768-5 References: 1.8.2, 3.1.9, CCI-000048, CCI-000050, CCI-001384, CCI-001385, CCI-001386, CCI-001387, CCI-001388, AC-8(a), AC-8(b), AC-8(c), PR.AC-7, FMT_MOF_EXT.1, SRG-OS-000023-GPOS-00006, SRG-OS-000024-GPOS-00007, SRG-OS-000228-GPOS-00088, SR 1.1, SR 1.10, SR 1.2, SR 1.5, SR 1.7, SR 1.8, SR 1.9, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, DSS05.04, DSS05.10, DSS06.10, A.18.1.4, A.9.2.1, A.9.2.4, A.9.3.1, A.9.4.2, A.9.4.3, 1, 12, 15, 16
Description	In the default graphical environment, displaying a login warning banner in the GNOME Display Manager's login screen can be enabled on the login screen by setting `banner-message-enable` to `true`. To enable, add or edit `banner-message-enable` to `/etc/dconf/db/gdm.d/00-security-settings`. For example: [org/gnome/login-screen] banner-message-enable=true Once the setting has been added, add a lock to `/etc/dconf/db/gdm.d/locks/00-security-settings-lock` to prevent user modification. For example: /org/gnome/login-screen/banner-message-enable After the settings have been set, run `dconf update`. The banner text must also be set.
Rationale	Display of a standardized and approved use notification before granting access to the operating system ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. For U.S. Government systems, system use notifications are required only for access via login interfaces with human users and are not required when such human interfaces do not exist.

Modify the System Login Banner

Rule ID xccdf_org.ssgproject.content_rule_banner_etc_issue

Result

fail

Multi-check rule no

OVAL Definition ID oval:ssg-banner_etc_issue:def:1

Time 2021-02-11T19:31:22+00:00

Severity medium

Identifiers and References

Identifiers: CCE-80763-6

References: 1.8.1.2, 3.1.9, CCI-000048, CCI-000050, AC-8(a), AC-8(c), PR.AC-7, FMT_MOF_EXT.1, SRG-OS-000023-GPOS-00006, SRG-OS-000024-GPOS-00007, SRG-OS-000023-VMM-000060, SRG-OS-000024-VMM-000070, SR 1.1, SR 1.10, SR 1.2, SR 1.5, SR 1.7, SR 1.8, SR 1.9, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, DSS05.04, DSS05.10, DSS06.10, A.18.1.4, A.9.2.1, A.9.2.4, A.9.3.1, A.9.4.2, A.9.4.3, 1, 12, 15, 16

Description

To configure the system login banner edit /etc/issue. Replace the default text with a message compliant with the local site policy or a legal disclaimer. The DoD required text is either:

You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests -- not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.

OR:

I've read & consent to terms in IS user agreem't.

Rationale

Display of a standardized and approved use notification before granting access to the operating system ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.

System use notifications are required only for access via login interfaces with human users and are not required when such human interfaces do not exist.

Remediation Shell script ⇲


login_banner_text="^(You[\s\n]+are[\s\n]+accessing[\s\n]+a[\s\n]+U\.S\.[\s\n]+Government[\s\n]+\(USG\)[\s\n]+Information[\s\n]+System[\s\n]+\(IS\)[\s\n]+that[\s\n]+is[\s\n]+provided[\s\n]+for[\s\n]+USG\-authorized[\s\n]+use[\s\n]+only\.[\s\n]+By[\s\n]+using[\s\n]+this[\s\n]+IS[\s\n]+\(which[\s\n]+includes[\s\n]+any[\s\n]+device[\s\n]+attached[\s\n]+to[\s\n]+this[\s\n]+IS\)\,[\s\n]+you[\s\n]+consent[\s\n]+to[\s\n]+the[\s\n]+following[\s\n]+conditions\:(?:[\n]+|(?:\\n)+)\-The[\s\n]+USG[\s\n]+routinely[\s\n]+intercepts[\s\n]+and[\s\n]+monitors[\s\n]+communications[\s\n]+on[\s\n]+this[\s\n]+IS[\s\n]+for[\s\n]+purposes[\s\n]+including\,[\s\n]+but[\s\n]+not[\s\n]+limited[\s\n]+to\,[\s\n]+penetration[\s\n]+testing\,[\s\n]+COMSEC[\s\n]+monitoring\,[\s\n]+network[\s\n]+operations[\s\n]+and[\s\n]+defense\,[\s\n]+personnel[\s\n]+misconduct[\s\n]+\(PM\)\,[\s\n]+law[\s\n]+enforcement[\s\n]+\(LE\)\,[\s\n]+and[\s\n]+counterintelligence[\s\n]+\(CI\)[\s\n]+investigations\.(?:[\n]+|(?:\\n)+)\-At[\s\n]+any[\s\n]+time\,[\s\n]+the[\s\n]+USG[\s\n]+may[\s\n]+inspect[\s\n]+and[\s\n]+seize[\s\n]+data[\s\n]+stored[\s\n]+on[\s\n]+this[\s\n]+IS\.(?:[\n]+|(?:\\n)+)\-Communications[\s\n]+using\,[\s\n]+or[\s\n]+data[\s\n]+stored[\s\n]+on\,[\s\n]+this[\s\n]+IS[\s\n]+are[\s\n]+not[\s\n]+private\,[\s\n]+are[\s\n]+subject[\s\n]+to[\s\n]+routine[\s\n]+monitoring\,[\s\n]+interception\,[\s\n]+and[\s\n]+search\,[\s\n]+and[\s\n]+may[\s\n]+be[\s\n]+disclosed[\s\n]+or[\s\n]+used[\s\n]+for[\s\n]+any[\s\n]+USG\-authorized[\s\n]+purpose\.(?:[\n]+|(?:\\n)+)\-This[\s\n]+IS[\s\n]+includes[\s\n]+security[\s\n]+measures[\s\n]+\(e\.g\.\,[\s\n]+authentication[\s\n]+and[\s\n]+access[\s\n]+controls\)[\s\n]+to[\s\n]+protect[\s\n]+USG[\s\n]+interests\-\-not[\s\n]+for[\s\n]+your[\s\n]+personal[\s\n]+benefit[\s\n]+or[\s\n]+privacy\.(?:[\n]+|(?:\\n)+)\-Notwithstanding[\s\n]+the[\s\n]+above\,[\s\n]+using[\s\n]+this[\s\n]+IS[\s\n]+does[\s\n]+not[\s\n]+constitute[\s\n]+consent[\s\n]+to[\s\n]+PM\,[\s\n]+LE[\s\n]+or[\s\n]+CI[\s\n]+investigative[\s\n]+searching[\s\n]+or[\s\n]+monitoring[\s\n]+of[\s\n]+the[\s\n]+content[\s\n]+of[\s\n]+privileged[\s\n]+communications\,[\s\n]+or[\s\n]+work[\s\n]+product\,[\s\n]+related[\s\n]+to[\s\n]+personal[\s\n]+representation[\s\n]+or[\s\n]+services[\s\n]+by[\s\n]+attorneys\,[\s\n]+psychotherapists\,[\s\n]+or[\s\n]+clergy\,[\s\n]+and[\s\n]+their[\s\n]+assistants\.[\s\n]+Such[\s\n]+communications[\s\n]+and[\s\n]+work[\s\n]+product[\s\n]+are[\s\n]+private[\s\n]+and[\s\n]+confidential\.[\s\n]+See[\s\n]+User[\s\n]+Agreement[\s\n]+for[\s\n]+details\.|I've[\s\n]+read[\s\n]+\&[\s\n]+consent[\s\n]+to[\s\n]+terms[\s\n]+in[\s\n]+IS[\s\n]+user[\s\n]+agreem't\.)$"



# Multiple regexes transform the banner regex into a usable banner
# 0 - Remove anchors around the banner text
login_banner_text=$(echo "$login_banner_text" | sed 's/^\^\(.*\)\$$/\1/g')
# 1 - Keep only the first banners if there are multiple
#    (dod_banners contains the long and short banner)
login_banner_text=$(echo "$login_banner_text" | sed 's/^(\(.*\)|.*)$/\1/g')
# 2 - Add spaces ' '. (Transforms regex for "space or newline" into a " ")
login_banner_text=$(echo "$login_banner_text" | sed 's/\[\\s\\n\]+/ /g')
# 3 - Adds newlines. (Transforms "(?:\[\\n\]+|(?:\\n)+)" into "\n")
login_banner_text=$(echo "$login_banner_text" | sed 's/(?:\[\\n\]+|(?:\\n)+)/\n/g')
# 4 - Remove any leftover backslash. (From any parethesis in the banner, for example).
login_banner_text=$(echo "$login_banner_text" | sed 's/\\//g')
formatted=$(echo "$login_banner_text" | fold -sw 80)

cat <<EOF >/etc/issue
$formatted
EOF

Remediation Ansible snippet ⇲

Complexity:	low
Disruption:	medium

- name: XCCDF Value login_banner_text # promote to variable
  set_fact:
    login_banner_text: !!str ^(You[\s\n]+are[\s\n]+accessing[\s\n]+a[\s\n]+U\.S\.[\s\n]+Government[\s\n]+\(USG\)[\s\n]+Information[\s\n]+System[\s\n]+\(IS\)[\s\n]+that[\s\n]+is[\s\n]+provided[\s\n]+for[\s\n]+USG\-authorized[\s\n]+use[\s\n]+only\.[\s\n]+By[\s\n]+using[\s\n]+this[\s\n]+IS[\s\n]+\(which[\s\n]+includes[\s\n]+any[\s\n]+device[\s\n]+attached[\s\n]+to[\s\n]+this[\s\n]+IS\)\,[\s\n]+you[\s\n]+consent[\s\n]+to[\s\n]+the[\s\n]+following[\s\n]+conditions\:(?:[\n]+|(?:\\n)+)\-The[\s\n]+USG[\s\n]+routinely[\s\n]+intercepts[\s\n]+and[\s\n]+monitors[\s\n]+communications[\s\n]+on[\s\n]+this[\s\n]+IS[\s\n]+for[\s\n]+purposes[\s\n]+including\,[\s\n]+but[\s\n]+not[\s\n]+limited[\s\n]+to\,[\s\n]+penetration[\s\n]+testing\,[\s\n]+COMSEC[\s\n]+monitoring\,[\s\n]+network[\s\n]+operations[\s\n]+and[\s\n]+defense\,[\s\n]+personnel[\s\n]+misconduct[\s\n]+\(PM\)\,[\s\n]+law[\s\n]+enforcement[\s\n]+\(LE\)\,[\s\n]+and[\s\n]+counterintelligence[\s\n]+\(CI\)[\s\n]+investigations\.(?:[\n]+|(?:\\n)+)\-At[\s\n]+any[\s\n]+time\,[\s\n]+the[\s\n]+USG[\s\n]+may[\s\n]+inspect[\s\n]+and[\s\n]+seize[\s\n]+data[\s\n]+stored[\s\n]+on[\s\n]+this[\s\n]+IS\.(?:[\n]+|(?:\\n)+)\-Communications[\s\n]+using\,[\s\n]+or[\s\n]+data[\s\n]+stored[\s\n]+on\,[\s\n]+this[\s\n]+IS[\s\n]+are[\s\n]+not[\s\n]+private\,[\s\n]+are[\s\n]+subject[\s\n]+to[\s\n]+routine[\s\n]+monitoring\,[\s\n]+interception\,[\s\n]+and[\s\n]+search\,[\s\n]+and[\s\n]+may[\s\n]+be[\s\n]+disclosed[\s\n]+or[\s\n]+used[\s\n]+for[\s\n]+any[\s\n]+USG\-authorized[\s\n]+purpose\.(?:[\n]+|(?:\\n)+)\-This[\s\n]+IS[\s\n]+includes[\s\n]+security[\s\n]+measures[\s\n]+\(e\.g\.\,[\s\n]+authentication[\s\n]+and[\s\n]+access[\s\n]+controls\)[\s\n]+to[\s\n]+protect[\s\n]+USG[\s\n]+interests\-\-not[\s\n]+for[\s\n]+your[\s\n]+personal[\s\n]+benefit[\s\n]+or[\s\n]+privacy\.(?:[\n]+|(?:\\n)+)\-Notwithstanding[\s\n]+the[\s\n]+above\,[\s\n]+using[\s\n]+this[\s\n]+IS[\s\n]+does[\s\n]+not[\s\n]+constitute[\s\n]+consent[\s\n]+to[\s\n]+PM\,[\s\n]+LE[\s\n]+or[\s\n]+CI[\s\n]+investigative[\s\n]+searching[\s\n]+or[\s\n]+monitoring[\s\n]+of[\s\n]+the[\s\n]+content[\s\n]+of[\s\n]+privileged[\s\n]+communications\,[\s\n]+or[\s\n]+work[\s\n]+product\,[\s\n]+related[\s\n]+to[\s\n]+personal[\s\n]+representation[\s\n]+or[\s\n]+services[\s\n]+by[\s\n]+attorneys\,[\s\n]+psychotherapists\,[\s\n]+or[\s\n]+clergy\,[\s\n]+and[\s\n]+their[\s\n]+assistants\.[\s\n]+Such[\s\n]+communications[\s\n]+and[\s\n]+work[\s\n]+product[\s\n]+are[\s\n]+private[\s\n]+and[\s\n]+confidential\.[\s\n]+See[\s\n]+User[\s\n]+Agreement[\s\n]+for[\s\n]+details\.|I've[\s\n]+read[\s\n]+\&[\s\n]+consent[\s\n]+to[\s\n]+terms[\s\n]+in[\s\n]+IS[\s\n]+user[\s\n]+agreem't\.)$
  tags:
    - always

- name: Modify the System Login Banner - remove incorrect banner
  file:
    state: absent
    path: /etc/issue
  tags:
    - CCE-80763-6
    - NIST-800-171-3.1.9
    - NIST-800-53-AC-8(a)
    - NIST-800-53-AC-8(c)
    - banner_etc_issue
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Modify the System Login Banner - add correct banner
  lineinfile:
    dest: /etc/issue
    line: '{{ login_banner_text | regex_replace("^\^(.*)\$$", "\1") | regex_replace("^\((.*)\|.*\)$",
      "\1") | regex_replace("\[\\s\\n\]\+"," ") | regex_replace("\(\?:\[\\n\]\+\|\(\?:\\\\n\)\+\)",
      "\n") | regex_replace("\\", "") | wordwrap() }}'
    create: true
  tags:
    - CCE-80763-6
    - NIST-800-171-3.1.9
    - NIST-800-53-AC-8(a)
    - NIST-800-53-AC-8(c)
    - banner_etc_issue
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

OVAL test results details

correct banner in /etc/issue oval:ssg-test_banner_etc_issue:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_banner_etc_issue:obj:1 of type textfilecontent54_object

Behaviors	Filepath	Pattern	Instance
no value	/etc/issue	^(.*)$	1

Set Lockout Time for Failed Password Attempts

Rule ID	xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_unlock_time
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-80670-3 References: 5.3.2, 5.5.3, 3.1.8, CCI-000044, CCI-002238, CM-6(a), AC-7(b), PR.AC-7, FIA_AFL.1, Req-8.1.7, SRG-OS-000329-GPOS-00128, SRG-OS-000021-GPOS-00005, SRG-OS-000329-VMM-001180, SR 1.1, SR 1.10, SR 1.2, SR 1.5, SR 1.7, SR 1.8, SR 1.9, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, DSS05.04, DSS05.10, DSS06.10, A.18.1.4, A.9.2.1, A.9.2.4, A.9.3.1, A.9.4.2, A.9.4.3, 1, 12, 15, 16, 0421, 0422, 0431, 0974, 1173, 1401, 1504, 1505, 1546, 1557, 1558, 1559, 1560, 1561
Description	To configure the system to lock out accounts after a number of incorrect login attempts and require an administrator to unlock the account using `pam_faillock.so`, modify the content of both `/etc/pam.d/system-auth` and `/etc/pam.d/password-auth` as follows: add the following line immediately `before` the `pam_unix.so` statement in the `AUTH` section: auth required pam_faillock.so preauth silent deny=3 unlock_time=0 fail_interval=900 add the following line immediately `after` the `pam_unix.so` statement in the `AUTH` section: auth [default=die] pam_faillock.so authfail deny=3 unlock_time=0 fail_interval=900 add the following line immediately `before` the `pam_unix.so` statement in the `ACCOUNT` section: account required pam_faillock.so If `unlock_time` is set to `0`, manual intervention by an administrator is required to unlock a user.
Rationale	Locking out user accounts after a number of incorrect attempts prevents direct password guessing attacks. Ensuring that an administrator is involved in unlocking locked accounts draws appropriate attention to such situations.

Set Deny For Failed Password Attempts

Rule ID	xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_deny
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-80667-9 References: 5.3.2, 5.5.3, 3.1.8, CCI-000044, CCI-002238, CM-6(a), AC-7(a), PR.AC-7, FIA_AFL.1, Req-8.1.6, SRG-OS-000329-GPOS-00128, SRG-OS-000021-GPOS-00005, SRG-OS-000021-VMM-000050, SR 1.1, SR 1.10, SR 1.2, SR 1.5, SR 1.7, SR 1.8, SR 1.9, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, DSS05.04, DSS05.10, DSS06.10, A.18.1.4, A.9.2.1, A.9.2.4, A.9.3.1, A.9.4.2, A.9.4.3, 1, 12, 15, 16, 0421, 0422, 0431, 0974, 1173, 1401, 1504, 1505, 1546, 1557, 1558, 1559, 1560, 1561
Description	To configure the system to lock out accounts after a number of incorrect login attempts using `pam_faillock.so`, modify the content of both `/etc/pam.d/system-auth` and `/etc/pam.d/password-auth` as follows: add the following line immediately `before` the `pam_unix.so` statement in the `AUTH` section: auth required pam_faillock.so preauth silent deny=3 unlock_time=0 fail_interval=900 add the following line immediately `after` the `pam_unix.so` statement in the `AUTH` section: auth [default=die] pam_faillock.so authfail deny=3 unlock_time=0 fail_interval=900 add the following line immediately `before` the `pam_unix.so` statement in the `ACCOUNT` section: account required pam_faillock.so
Rationale	Locking out user accounts after a number of incorrect attempts prevents direct password guessing attacks.

Set Interval For Counting Failed Password Attempts

Rule ID	xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_interval
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-80669-5 References: CCI-000044, CCI-002238, CM-6(a), AC-7(a), PR.AC-7, FIA_AFL.1, SRG-OS-000329-GPOS-00128, SRG-OS-000021-GPOS-00005, SRG-OS-000021-VMM-000050, SR 1.1, SR 1.10, SR 1.2, SR 1.5, SR 1.7, SR 1.8, SR 1.9, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, DSS05.04, DSS05.10, DSS06.10, A.18.1.4, A.9.2.1, A.9.2.4, A.9.3.1, A.9.4.2, A.9.4.3, 1, 12, 15, 16, 0421, 0422, 0431, 0974, 1173, 1401, 1504, 1505, 1546, 1557, 1558, 1559, 1560, 1561
Description	Utilizing `pam_faillock.so`, the `fail_interval` directive configures the system to lock out an account after a number of incorrect login attempts within a specified time period. Modify the content of both `/etc/pam.d/system-auth` and `/etc/pam.d/password-auth` as follows: Add the following line immediately `before` the `pam_unix.so` statement in the `AUTH` section: auth required pam_faillock.so preauth silent deny=3 unlock_time=0 fail_interval=900 Add the following line immediately `after` the `pam_unix.so` statement in the `AUTH` section: auth [default=die] pam_faillock.so authfail deny=3 unlock_time=0 fail_interval=900 Add the following line immediately `before` the `pam_unix.so` statement in the `ACCOUNT` section: account required pam_faillock.so
Rationale	By limiting the number of failed logon attempts the risk of unauthorized system access via user password guessing, otherwise known as brute-forcing, is reduced. Limits are imposed by locking the account.

Enforce pam_faillock for Local Accounts Only

Rule ID	xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_enforce_local
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-83401-0 References: CCI-000015, AC-2(1), SRG-OS-000001-GPOS-00001
Description	The pam_faillock module's `local_users_only` parameter controls requirements for enforcing failed lockout attempts only for local user accounts and ignoring centralized user account management failed attempt configurations. Enable the `local_users_only` setting in `/etc/security/faillock.conf` to require failed password attempts for only local user accounts.
Rationale	The operating system must provide automated mechanisms for supporting account management functions. Enterprise environments make application account management challenging and complex. A manual process for account management functions adds the risk of a potential oversight or other error.
Warnings	warning Using this rule bypasses pam_faillock's functionality and should be used in cases where centralized management such as LDAP or Active Directory is in use.

Limit Password Reuse

Rule ID	xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_remember
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-80666-1 References: 5.3.3, 5.6.2.1.1, 3.5.8, CCI-000200, IA-5(f), IA-5(1)(e), PR.AC-1, PR.AC-6, PR.AC-7, Req-8.2.5, SRG-OS-000077-GPOS-00045, SRG-OS-000077-VMM-000440, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10, A.18.1.4, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, 1, 12, 15, 16, 5
Description	Do not allow users to reuse recent passwords. This can be accomplished by using the `remember` option for the `pam_unix` or `pam_pwhistory` PAM modules. In the file `/etc/pam.d/system-auth`, append `remember=5` to the line which refers to the `pam_unix.so` or `pam_pwhistory.so`module, as shown below: for the `pam_unix.so` case: password sufficient pam_unix.so ...existing_options... remember=5 for the `pam_pwhistory.so` case: password requisite pam_pwhistory.so ...existing_options... remember=5 The DoD STIG requirement is 5 passwords.
Rationale	Preventing re-use of previous passwords helps ensure that a compromised password is not re-used by a user.

Set Password Maximum Consecutive Repeating Characters

Rule ID	xccdf_org.ssgproject.content_rule_accounts_password_pam_maxrepeat
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-82066-2 References: CCI-000195, IA-5(c), CM-6(a), IA-5(4), PR.AC-1, PR.AC-6, PR.AC-7, SRG-OS-000072-GPOS-00040, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10, A.18.1.4, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, 1, 12, 15, 16, 5
Description	The pam_pwquality module's `maxrepeat` parameter controls requirements for consecutive repeating characters. When set to a positive number, it will reject passwords which contain more than that number of consecutive characters. Modify the `maxrepeat` setting in `/etc/security/pwquality.conf` to equal 3 to prevent a run of (3 + 1) or more identical characters.
Rationale	Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised. Passwords with excessive repeating characters may be more vulnerable to password-guessing attacks.

Ensure PAM Enforces Password Requirements - Maximum Consecutive Repeating Characters from Same Character Class

Rule ID	xccdf_org.ssgproject.content_rule_accounts_password_pam_maxclassrepeat
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-81034-1 References: CCI-000195, IA-5(c), IA-5(1)(a), CM-6(a), IA-5(4), PR.AC-1, PR.AC-6, PR.AC-7, SRG-OS-000072-GPOS-00040, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10, A.18.1.4, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, 1, 12, 15, 16, 5
Description	The pam_pwquality module's `maxclassrepeat` parameter controls requirements for consecutive repeating characters from the same character class. When set to a positive number, it will reject passwords which contain more than that number of consecutive characters from the same character class. Modify the `maxclassrepeat` setting in `/etc/security/pwquality.conf` to equal 4 to prevent a run of (4 + 1) or more identical characters.
Rationale	Use of a complex password helps to increase the time and resources required to comrpomise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password complexity is one factor of several that determines how long it takes to crack a password. The more complex a password, the greater the number of possible combinations that need to be tested before the password is compromised.

Ensure PAM Enforces Password Requirements - Minimum Length

Rule ID	xccdf_org.ssgproject.content_rule_accounts_password_pam_minlen
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-80656-2 References: 6.3.2, 5.6.2.1.1, CCI-000205, IA-5(c), IA-5(1)(a), CM-6(a), IA-5(4), PR.AC-1, PR.AC-6, PR.AC-7, FMT_MOF_EXT.1, Req-8.2.3, SRG-OS-000078-GPOS-00046, SRG-OS-000072-VMM-000390, SRG-OS-000078-VMM-000450, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10, A.18.1.4, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, 1, 12, 15, 16, 5, 0421, 0422, 0431, 0974, 1173, 1401, 1504, 1505, 1546, 1557, 1558, 1559, 1560, 1561
Description	The pam_pwquality module's `minlen` parameter controls requirements for minimum characters required in a password. Add `minlen=12` after pam_pwquality to set minimum password length requirements.
Rationale	The shorter the password, the lower the number of possible combinations that need to be tested before the password is compromised. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password length is one factor of several that helps to determine strength and how long it takes to crack a password. Use of more characters in a password helps to exponentially increase the time and/or resources required to compromose the password.

Ensure PAM Enforces Password Requirements - Minimum Uppercase Characters

Rule ID	xccdf_org.ssgproject.content_rule_accounts_password_pam_ucredit
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-80665-3 References: 6.3.2, CCI-000192, IA-5(c), IA-5(1)(a), CM-6(a), IA-5(4), PR.AC-1, PR.AC-6, PR.AC-7, FMT_MOF_EXT.1, Req-8.2.3, SRG-OS-000069-GPOS-00037, SRG-OS-000069-VMM-000360, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10, A.18.1.4, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, 1, 12, 15, 16, 5, 0421, 0422, 0431, 0974, 1173, 1401, 1504, 1505, 1546, 1557, 1558, 1559, 1560, 1561
Description	The pam_pwquality module's `ucredit=` parameter controls requirements for usage of uppercase letters in a password. When set to a negative number, any password will be required to contain that many uppercase characters. When set to a positive number, pam_pwquality will grant +1 additional length credit for each uppercase character. Modify the `ucredit` setting in `/etc/security/pwquality.conf` to require the use of an uppercase character in passwords.
Rationale	Use of a complex password helps to increase the time and resources reuiqred to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised.

Ensure PAM Enforces Password Requirements - Minimum Different Characters

Rule ID	xccdf_org.ssgproject.content_rule_accounts_password_pam_difok
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-80654-7 References: 5.6.2.1.1, CCI-000195, IA-5(c), IA-5(1)(b), CM-6(a), IA-5(4), PR.AC-1, PR.AC-6, PR.AC-7, SRG-OS-000072-GPOS-00040, SRG-OS-000072-VMM-000390, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10, A.18.1.4, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, 1, 12, 15, 16, 5
Description	The pam_pwquality module's `difok` parameter sets the number of characters in a password that must not be present in and old password during a password change. Modify the `difok` setting in `/etc/security/pwquality.conf` to equal 4 to require differing characters when changing passwords.
Rationale	Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute–force attacks. Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised. Requiring a minimum number of different characters during password changes ensures that newly changed passwords should not resemble previously compromised ones. Note that passwords which are changed on compromised systems will still be compromised, however.

Ensure PAM Enforces Password Requirements - Minimum Digit Characters

Rule ID	xccdf_org.ssgproject.content_rule_accounts_password_pam_dcredit
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-80653-9 References: 6.3.2, CCI-000194, IA-5(c), IA-5(1)(a), CM-6(a), IA-5(4), PR.AC-1, PR.AC-6, PR.AC-7, FMT_MOF_EXT.1, Req-8.2.3, SRG-OS-000071-GPOS-00039, SRG-OS-000071-VMM-000380, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10, A.18.1.4, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, 1, 12, 15, 16, 5, 0421, 0422, 0431, 0974, 1173, 1401, 1504, 1505, 1546, 1557, 1558, 1559, 1560, 1561
Description	The pam_pwquality module's `dcredit` parameter controls requirements for usage of digits in a password. When set to a negative number, any password will be required to contain that many digits. When set to a positive number, pam_pwquality will grant +1 additional length credit for each digit. Modify the `dcredit` setting in `/etc/security/pwquality.conf` to require the use of a digit in passwords.
Rationale	Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised. Requiring digits makes password guessing attacks more difficult by ensuring a larger search space.

Ensure PAM Enforces Password Requirements - Enforce for root User

Rule ID	xccdf_org.ssgproject.content_rule_accounts_password_pam_enforce_root
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-83377-2 References: CCI-000194, CCI-000193, CCI-001619, CCI-000205, CCI-000195, CCI-000192, CCI-000366, IA-5(c), IA-5(1)(a), CM-6(a), IA-5(4), SRG-OS-000072-GPOS-00040, SRG-OS-000071-GPOS-00039, SRG-OS-000070-GPOS-00038, SRG-OS-000266-GPOS-00101, SRG-OS-000078-GPOS-00046, SRG-OS-000480-GPOS-00225, SRG-OS-000069-GPOS-00037
Description	The pam_pwquality module's `enforce_for_root` parameter controls requirements for enforcing password complexity for the root user. Enable the `enforce_for_root` setting in `/etc/security/pwquality.conf` to require the `root` user to use complex passwords.
Rationale	Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised.

Ensure PAM Enforces Password Requirements - Minimum Special Characters

Rule ID	xccdf_org.ssgproject.content_rule_accounts_password_pam_ocredit
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-80663-8 References: CCI-001619, IA-5(c), IA-5(1)(a), CM-6(a), IA-5(4), PR.AC-1, PR.AC-6, PR.AC-7, FMT_MOF_EXT.1, SRG-OS-000266-GPOS-00101, SRG-OS-000266-VMM-000940, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10, A.18.1.4, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, 1, 12, 15, 16, 5, 0421, 0422, 0431, 0974, 1173, 1401, 1504, 1505, 1546, 1557, 1558, 1559, 1560, 1561
Description	The pam_pwquality module's `ocredit=` parameter controls requirements for usage of special (or "other") characters in a password. When set to a negative number, any password will be required to contain that many special characters. When set to a positive number, pam_pwquality will grant +1 additional length credit for each special character. Modify the `ocredit` setting in `/etc/security/pwquality.conf` to equal -1 to require use of a special character in passwords.
Rationale	Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possble combinations that need to be tested before the password is compromised. Requiring a minimum number of special characters makes password guessing attacks more difficult by ensuring a larger search space.

Ensure PAM Enforces Password Requirements - Minimum Lowercase Characters

Rule ID	xccdf_org.ssgproject.content_rule_accounts_password_pam_lcredit
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-80655-4 References: CCI-000193, IA-5(c), IA-5(1)(a), CM-6(a), IA-5(4), PR.AC-1, PR.AC-6, PR.AC-7, FMT_MOF_EXT.1, Req-8.2.3, SRG-OS-000070-GPOS-00038, SRG-OS-000070-VMM-000370, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10, A.18.1.4, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, 1, 12, 15, 16, 5, 0421, 0422, 0431, 0974, 1173, 1401, 1504, 1505, 1546, 1557, 1558, 1559, 1560, 1561
Description	The pam_pwquality module's `lcredit` parameter controls requirements for usage of lowercase letters in a password. When set to a negative number, any password will be required to contain that many lowercase characters. When set to a positive number, pam_pwquality will grant +1 additional length credit for each lowercase character. Modify the `lcredit` setting in `/etc/security/pwquality.conf` to require the use of a lowercase character in passwords.
Rationale	Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possble combinations that need to be tested before the password is compromised. Requiring a minimum number of lowercase characters makes password guessing attacks more difficult by ensuring a larger search space.

Ensure PAM Enforces Password Requirements - Enforce for Local Accounts Only

Rule ID	xccdf_org.ssgproject.content_rule_accounts_password_pam_enforce_local
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-83364-0 References: CCI-000015, AC-2(1), SRG-OS-000001-GPOS-00001
Description	The pam_pwquality module's `local_users_only` parameter controls requirements for enforcing password complexity by pam_pwquality only for local user accounts and ignoring centralized user account management password complexity configurations. Enable the `local_users_only` setting in `/etc/security/pwquality.conf` to require password complexity enforcement for only local user accounts.
Rationale	The operating system must provide automated mechanisms for supporting account management functions. Enterprise environments make application account management challenging and complex. A manual process for account management functions adds the risk of a potential oversight or other error.
Warnings	warning Using this rule bypasses pam_faillock's functionality and should be used in cases where centralized management such as LDAP or Active Directory is in use.

Configure Smart Card Certificate Status Checking

Rule ID	xccdf_org.ssgproject.content_rule_smartcard_configure_cert_checking
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-82475-5 References: CCI-001948, CCI-001953, CCI-001954, SRG-OS-000375-GPOS-00160, SRG-OS-000376-GPOS-00161, SRG-OS-000377-GPOS-00162, SRG-OS-000384-GPOS-00167
Description	Configure the operating system to do certificate status checking for PKI authentication. Modify all of the `cert_policy` lines in `/etc/pam_pkcs11/pam_pkcs11.conf` to include `ocsp_on` like so: cert_policy = ca, ocsp_on, signature;
Rationale	Using an authentication device, such as a CAC or token that is separate from the information system, ensures that even if the information system is compromised, that compromise will not affect credentials stored on the authentication device. Multifactor solutions that require devices separate from information systems gaining access include, for example, hardware tokens providing time-based or challenge-response authenticators and smart cards such as the U.S. Government Personal Identity Verification card and the DoD Common Access Card.

Install the tmux Package

Rule ID	xccdf_org.ssgproject.content_rule_package_tmux_installed
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-80644-8 References: 3.1.10, CCI-000058, CM-6(a), PR.AC-7, FMT_MOF_EXT.1, SRG-OS-000030-GPOS-00011, SRG-OS-000030-VMM-000110, SR 1.1, SR 1.10, SR 1.2, SR 1.5, SR 1.7, SR 1.8, SR 1.9, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, DSS05.04, DSS05.10, DSS06.10, A.18.1.4, A.9.2.1, A.9.2.4, A.9.3.1, A.9.4.2, A.9.4.3, 1, 12, 15, 16
Description	To enable console screen locking, install the `tmux` package. The `tmux` package can be installed with the following command: $ sudo yum install tmux Instruct users to begin new terminal sessions with the following command: $ tmux The console can now be locked with the following key combination: ctrl+b :lock-session
Rationale	A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not logout because of the temporary nature of the absence. Rather than relying on the user to manually lock their operation system session prior to vacating the vicinity, operating systems need to be able to identify when a user's session has idled and take action to initiate the session lock. The `tmux` package allows for a session lock to be implemented and configured.

Configure tmux to lock session after inactivity

Rule ID	xccdf_org.ssgproject.content_rule_configure_tmux_lock_after_time
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-82199-1 References: FMT_SMF_EXT.1, SRG-OS-000029-GPOS-00010
Description	To enable console screen locking in `tmux` terminal multiplexer after a period of inactivity, the `lock-after-time` option has to be set to nonzero value in `/etc/tmux.conf`.
Rationale	Locking the session after a period of inactivity limits the potential exposure if the session is left unattended.

Configure the tmux Lock Command

Rule ID	xccdf_org.ssgproject.content_rule_configure_tmux_lock_command
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-80940-0 References: CCI-000056, CCI-000058, AC-11(a), AC-11(b), CM-6(a), SRG-OS-000028-VMM-000090, SRG-OS-000030-VMM-000110, SRG-OS-000028-GPOS-00009
Description	To enable console screen locking in `tmux` terminal multiplexer, the `vlock` command must be configured to be used as a locking mechanism. Add the following line to `/etc/tmux.conf`: set -g lock-command vlock . The console can now be locked with the following key combination: ctrl+b :lock-session
Rationale	The `tmux` package allows for a session lock to be implemented and configured. However, the session lock is implemented by an external command. The `tmux` default configuration does not contain an effective session lock.

Support session locking with tmux

Rule ID	xccdf_org.ssgproject.content_rule_configure_bashrc_exec_tmux
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-82266-8 References: FMT_SMF_EXT.1, SRG-OS-000031-GPOS-00012
Description	The `tmux` terminal multiplexer is used to implement automatic session locking. It should be started from `/etc/bashrc`.
Rationale	Unlike `bash` itself, the `tmux` terminal multiplexer provides a mechanism to lock sessions after period of inactivity.

Prevent user from disabling the screen lock

Rule ID	xccdf_org.ssgproject.content_rule_no_tmux_in_shells
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-82361-7 References: FMT_SMF_EXT.1, SRG-OS-000324-GPOS-00125
Description	The `tmux` terminal multiplexer is used to implement autimatic session locking. It should not be listed in `/etc/shells`.
Rationale	Not listing `tmux` among permitted shells prevents malicious program running as user from lowering security by disabling the screen lock.

Disable debug-shell SystemD Service

Rule ID	xccdf_org.ssgproject.content_rule_service_debug-shell_disabled
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-80876-6 References: 3.4.5, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), FIA_UAU.1, SRG-OS-000324-GPOS-00125
Description	SystemD's `debug-shell` service is intended to diagnose SystemD related boot issues with various `systemctl` commands. Once enabled and following a system reboot, the root shell will be available on `tty9` which is access by pressing `CTRL-ALT-F9`. The `debug-shell` service should only be used for SystemD related issues and should otherwise be disabled. By default, the `debug-shell` SystemD service is already disabled. The `debug-shell` service can be disabled with the following command: $ sudo systemctl mask --now debug-shell.service
Rationale	This prevents attackers with physical access from trivially bypassing security on the machine through valid troubleshooting configurations and gaining root access when the system is rebooted.

Require Authentication for Single User Mode

Rule ID	xccdf_org.ssgproject.content_rule_require_singleuser_auth
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-80855-0 References: 1.5.3, 3.1.1, 3.4.5, CCI-000213, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), IA-2, AC-3, CM-6(a), PR.AC-1, PR.AC-4, PR.AC-6, PR.AC-7, PR.PT-3, FIA_UAU.1, SRG-OS-000080-GPOS-00048, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, DSS05.02, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.06, DSS06.10, A.18.1.4, A.6.1.2, A.7.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5, 1, 11, 12, 14, 15, 16, 18, 3, 5, 0421, 0422, 0431, 0974, 1173, 1401, 1504, 1505, 1546, 1557, 1558, 1559, 1560, 1561
Description	Single-user mode is intended as a system recovery method, providing a single user root access to the system by providing a boot option at startup. By default, no authentication is performed if single-user mode is selected. By default, single-user mode is protected by requiring a password and is set in `/usr/lib/systemd/system/rescue.service`.
Rationale	This prevents attackers with physical access from trivially bypassing security on the machine and gaining root access. Such accesses are further prevented by configuring the bootloader password.

Disable Ctrl-Alt-Del Reboot Activation

Rule ID	xccdf_org.ssgproject.content_rule_disable_ctrlaltdel_reboot
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	high
Identifiers and References	Identifiers: CCE-80785-9 References: 3.4.5, CCI-000366, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), CM-6(a), AC-6(1), PR.AC-4, PR.DS-5, SRG-OS-000324-GPOS-00125, SRG-OS-000480-GPOS-00227, SR 2.1, SR 5.2, 4.3.3.7.3, APO01.06, DSS05.04, DSS05.07, DSS06.02, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, 12, 13, 14, 15, 16, 18, 3, 5
Description	By default, `SystemD` will reboot the system if the `Ctrl-Alt-Del` key sequence is pressed. To configure the system to ignore the `Ctrl-Alt-Del` key sequence from the command line instead of rebooting the system, do either of the following: ln -sf /dev/null /etc/systemd/system/ctrl-alt-del.target or systemctl mask ctrl-alt-del.target Do not simply delete the `/usr/lib/systemd/system/ctrl-alt-del.service` file, as this file may be restored during future system updates.
Rationale	A locally logged-in user who presses Ctrl-Alt-Del, when at the console, can reboot the system. If accidentally pressed, as could happen in the case of mixed OS environment, this can create the risk of short-term loss of availability of systems due to unintentional reboot.

Disable Ctrl-Alt-Del Burst Action

Rule ID	xccdf_org.ssgproject.content_rule_disable_ctrlaltdel_burstaction
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	high
Identifiers and References	Identifiers: CCE-80784-2 References: 3.4.5, CCI-000366, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), CM-6(a), AC-6(1), CM-6(a), PR.AC-4, PR.DS-5, SRG-OS-000324-GPOS-00125, SR 2.1, SR 5.2, 4.3.3.7.3, APO01.06, DSS05.04, DSS05.07, DSS06.02, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, 12, 13, 14, 15, 16, 18, 3, 5
Description	By default, `SystemD` will reboot the system if the `Ctrl-Alt-Del` key sequence is pressed Ctrl-Alt-Delete more than 7 times in 2 seconds. To configure the system to ignore the `CtrlAltDelBurstAction` setting, add or modify the following to `/etc/systemd/system.conf`: CtrlAltDelBurstAction=none
Rationale	A locally logged-in user who presses Ctrl-Alt-Del, when at the console, can reboot the system. If accidentally pressed, as could happen in the case of mixed OS environment, this can create the risk of short-term loss of availability of systems due to unintentional reboot.
Warnings	warning Disabling the `Ctrl-Alt-Del` key sequence in `/etc/init/control-alt-delete.conf` DOES NOT disable the `Ctrl-Alt-Del` key sequence if running in `runlevel 6` (e.g. in GNOME, KDE, etc.)! The `Ctrl-Alt-Del` key sequence will only be disabled if running in the non-graphical `runlevel 3`.

Verify that Interactive Boot is Disabled

Rule ID	xccdf_org.ssgproject.content_rule_grub2_disable_interactive_boot
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-80826-1 References: 3.1.2, 3.4.5, CCI-000213, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), SC-2(1), CM-6(a), PR.AC-4, PR.AC-6, PR.PT-3, FIA_UAU.1, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, DSS05.02, DSS05.04, DSS05.05, DSS05.07, DSS06.03, DSS06.06, A.6.1.2, A.7.1.1, A.9.1.2, A.9.2.1, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, 11, 12, 14, 15, 16, 18, 3, 5, SRG-OS-000480-GPOS-00227
Description	Red Hat Enterprise Linux 8 systems support an "interactive boot" option that can be used to prevent services from being started. On a Red Hat Enterprise Linux 8 system, interactive boot can be enabled by providing a `1`, `yes`, `true`, or `on` value to the `systemd.confirm_spawn` kernel argument in `/etc/default/grub`. Remove any instance of systemd.confirm_spawn=(1\|yes\|true\|on) from the kernel arguments in that file to disable interactive boot. It is also required to change the runtime configuration, run: /sbin/grubby --update-kernel=ALL --remove-args="systemd.confirm_spawn"
Rationale	Using interactive boot, the console user could disable auditing, firewalls, or other services, weakening system security.

Enforce usage of pam_wheel for su authentication

Rule ID xccdf_org.ssgproject.content_rule_use_pam_wheel_for_su

Result

fail

Multi-check rule no

OVAL Definition ID oval:ssg-use_pam_wheel_for_su:def:1

Time 2021-02-11T19:31:22+00:00

Severity medium

Identifiers and References

Identifiers: CCE-83318-6

References: FMT_SMF_EXT.1.1, SRG-OS-000373-GPOS-00156, SRG-OS-000312-GPOS-00123

Description

To ensure that only users who are members of the wheel group can run commands with altered privileges through the su command, make sure that the following line exists in the file /etc/pam.d/su:

auth             required        pam_wheel.so use_uid

Rationale

The su program allows to run commands with a substitute user and group ID. It is commonly used to run commands as the root user. Limiting access to such command is considered a good security practice.

Remediation Shell script ⇲

#!/bin/bash

# uncomment the option if commented
  sed '/^[[:space:]]*#[[:space:]]*auth[[:space:]]\+required[[:space:]]\+pam_wheel\.so[[:space:]]\+use_uid$/s/^[[:space:]]*#//' -i /etc/pam.d/su

Remediation Ansible snippet ⇲

Complexity:	low
Disruption:	low
Strategy:	restrict

- name: restrict usage of su command only to members of wheel group
  replace:
    path: /etc/pam.d/su
    regexp: ^[\s]*#[\s]*auth[\s]+required[\s]+pam_wheel\.so[\s]+use_uid$
    replace: auth             required        pam_wheel.so use_uid
  tags:
    - CCE-83318-6
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - use_pam_wheel_for_su

OVAL test results details

check /etc/pam.d/su for correct setting oval:ssg-test_use_pam_wheel_for_su:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_use_pam_wheel_for_su:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/etc/pam.d/su	^[\s]*auth[\s]+required[\s]+pam_wheel\.so[\s]+use_uid$	1

Restrict Virtual Console Root Logins

Rule ID	xccdf_org.ssgproject.content_rule_securetty_root_login_console_only
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-securetty_root_login_console_only:def:1
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-80864-2 References: 3.1.1, 3.1.5, CCI-000770, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), AC-6, CM-6(a), PR.AC-4, PR.DS-5, SR 2.1, SR 5.2, 4.3.3.7.3, APO01.06, DSS05.04, DSS05.07, DSS06.02, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, 12, 13, 14, 15, 16, 18, 3, 5, 5.6, SRG-OS-000324-GPOS-00125
Description	To restrict root logins through the (deprecated) virtual console devices, ensure lines of this form do not appear in `/etc/securetty`: vc/1 vc/2 vc/3 vc/4
Rationale	Preventing direct root login to virtual console devices helps ensure accountability for actions taken on the system using the root account.

OVAL test results details

virtual consoles /etc/securetty oval:ssg-test_virtual_consoles_etc_securetty:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_virtual_consoles_etc_securetty:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/etc/securetty	^vc/[0-9]+$	1

Prevent Login to Accounts With Empty Password

Rule ID	xccdf_org.ssgproject.content_rule_no_empty_passwords
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-no_empty_passwords:def:1
Time	2021-02-11T19:31:22+00:00
Severity	high
Identifiers and References	Identifiers: CCE-80841-0 References: 5.5.2, 3.1.1, 3.1.5, CCI-000366, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), IA-5(1)(a), IA-5(c), CM-6(a), PR.AC-1, PR.AC-4, PR.AC-6, PR.AC-7, PR.DS-5, FIA_UAU.1, Req-8.2.3, SRG-OS-000480-GPOS-00227, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 5.2, 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, APO01.06, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.02, DSS06.03, DSS06.10, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.18.1.4, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5, 1, 12, 13, 14, 15, 16, 18, 3, 5
Description	If an account is configured for password authentication but does not have an assigned password, it may be possible to log into the account without authentication. Remove any instances of the `nullok` in `/etc/pam.d/system-auth` to prevent logins with empty passwords.
Rationale	If an account has an empty password, anyone could log in and run commands with the privileges of that account. Accounts with empty passwords should never be used in operational environments.

OVAL test results details

make sure nullok is not used in /etc/pam.d/system-auth oval:ssg-test_no_empty_passwords:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_no_empty_passwords:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/etc/pam.d/system-auth	^[^#]\bnullok\b.$	1

Set Existing Passwords Minimum Age

Rule ID	xccdf_org.ssgproject.content_rule_accounts_password_set_min_life_existing
Result	notchecked
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-82472-2 References: IA-5(f), IA-5(1)(d), CM-6(a), CCI-000198, SRG-OS-000075-GPOS-00043, SRG-OS-000075-VMM000420
Description	Configure non-compliant accounts to enforce a 24 hours/1 day minimum password lifetime by running the following command: $ sudo chage -m 1 USER
Rationale	Enforcing a minimum password lifetime helps to prevent repeated password changes to defeat the password reuse or history enforcement requirement. If users are allowed to immediately and continually change their password, the password could be repeatedly changed in a short period of time to defeat the organization's policy regarding password reuse.
Evaluation messages info No candidate or applicable check found.

Set Existing Passwords Maximum Age

Rule ID	xccdf_org.ssgproject.content_rule_accounts_password_set_max_life_existing
Result	notchecked
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-82473-0 References: IA-5(f), IA-5(1)(d), CM-6(a), CCI-000199, SRG-OS-000076-GPOS-00044, SRG-OS-000076-VMM-000430
Description	Configure non-compliant accounts to enforce a 60-day maximum password lifetime restriction by running the following command: $ sudo chage -M 60 USER
Rationale	Any password, no matter how complex, can eventually be cracked. Therefore, passwords need to be changed periodically. If the operating system does not limit the lifetime of passwords and force users to change their passwords, there is the risk that the operating system passwords could be compromised.
Evaluation messages info No candidate or applicable check found.

Set Password Minimum Length in login.defs

Rule ID	xccdf_org.ssgproject.content_rule_accounts_password_minlen_login_defs
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-80652-1 References: 5.6.2.1, 3.5.7, IA-5(f), IA-5(1)(a), CM-6(a), PR.AC-1, PR.AC-6, PR.AC-7, FMT_MOF_EXT.1, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10, A.18.1.4, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, 1, 12, 15, 16, 5, SRG-OS-000078-GPOS-00046, 0421, 0422, 0431, 0974, 1173, 1401, 1504, 1505, 1546, 1557, 1558, 1559, 1560, 1561
Description	To specify password length requirements for new accounts, edit the file `/etc/login.defs` and add or correct the following line: PASS_MIN_LEN 12 The DoD requirement is `15`. The FISMA requirement is `12`. The profile requirement is `12`. If a program consults `/etc/login.defs` and also another PAM module (such as `pam_pwquality`) during a password change operation, then the most restrictive must be satisfied. See PAM section for more information about enforcing password quality requirements.
Rationale	Requiring a minimum password length makes password cracking attacks more difficult by ensuring a larger search space. However, any security benefit from an onerous requirement must be carefully weighed against usability problems, support costs, or counterproductive behavior that may result.

Assign Expiration Date to Temporary Accounts

Rule ID	xccdf_org.ssgproject.content_rule_account_temp_expire_date
Result	notchecked
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	unknown
Identifiers and References	Identifiers: CCE-82474-8 References: CCI-000016, CCI-001682, AC-2(2), AC-2(3), CM-6(a), DE.CM-1, DE.CM-3, PR.AC-1, PR.AC-4, PR.AC-6, SRG-OS-000123-GPOS-00064, SRG-OS-000002-GPOS-00002, SRG-OS-000002-VMM-000020, SRG-OS-000123-VMM-000620, SR 1.1, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 6.2, 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, DSS01.03, DSS03.05, DSS05.04, DSS05.05, DSS05.07, DSS06.03, A.12.4.1, A.12.4.3, A.6.1.2, A.7.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5, 1, 12, 13, 14, 15, 16, 18, 3, 5, 7, 8
Description	Temporary accounts are established as part of normal account activation procedures when there is a need for short-term accounts. In the event temporary or emergency accounts are required, configure the system to terminate them after a documented time period. For every temporary and emergency account, run the following command to set an expiration date on it, substituting `USER` and `YYYY-MM-DD` appropriately: $ sudo chage -E YYYY-MM-DD USER `YYYY-MM-DD` indicates the documented expiration date for the account. For U.S. Government systems, the operating system must be configured to automatically terminate these types of accounts after a period of 72 hours.
Rationale	If temporary user accounts remain active when no longer needed or for an excessive period, these accounts may be used to gain unauthorized access. To mitigate this risk, automated termination of all temporary accounts must be set upon account creation.
Evaluation messages info No candidate or applicable check found.

Set Account Expiration Following Inactivity

Rule ID	xccdf_org.ssgproject.content_rule_account_disable_post_pw_expiration
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-80954-1 References: 5.6.2.1.1, 3.5.6, CCI-000017, CCI-000795, IA-4(e), AC-2(3), CM-6(a), DE.CM-1, DE.CM-3, PR.AC-1, PR.AC-4, PR.AC-6, PR.AC-7, Req-8.1.4, SRG-OS-000118-GPOS-00060, SRG-OS-000003-VMM-000030, SRG-OS-000118-VMM-000590, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 6.2, 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, DSS01.03, DSS03.05, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10, A.12.4.1, A.12.4.3, A.18.1.4, A.6.1.2, A.7.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5, 1, 12, 13, 14, 15, 16, 18, 3, 5, 7, 8
Description	To specify the number of days after a password expires (which signifies inactivity) until an account is permanently disabled, add or correct the following line in `/etc/default/useradd`: INACTIVE=35 If a password is currently on the verge of expiration, then `35` day(s) remain(s) until the account is automatically disabled. However, if the password will not expire for another 60 days, then 60 days plus `35` day(s) could elapse until the account would be automatically disabled. See the `useradd` man page for more information.
Rationale	Disabling inactive accounts ensures that accounts which may not have been responsibly removed are not available to attackers who may have compromised their credentials.

Ensure the Default C Shell Umask is Set Correctly

Rule ID	xccdf_org.ssgproject.content_rule_accounts_umask_etc_csh_cshrc
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-accounts_umask_etc_csh_cshrc:def:1
Time	2021-02-11T19:31:22+00:00
Severity	unknown
Identifiers and References	Identifiers: CCE-81037-4 References: CCI-000366, AC-6(1), CM-6(a), PR.IP-2, 4.3.4.3.3, APO13.01, BAI03.01, BAI03.02, BAI03.03, A.14.1.1, A.14.2.1, A.14.2.5, A.6.1.5, 18, SRG-OS-000480-GPOS-00228
Description	To ensure the default umask for users of the C shell is set properly, add or correct the `umask` setting in `/etc/csh.cshrc` to read as follows: umask 027
Rationale	The umask value influences the permissions assigned to files when they are created. A misconfigured umask value could result in files with excessive permissions that can be read or written to by unauthorized users.

OVAL test results details

Verify the existence of var_accounts_user_umask_as_number variable oval:ssg-test_existence_of_var_accounts_user_umask_as_number_variable:tst:1 true

Following items have been found on the system:

Var ref	Value
oval:ssg-var_accounts_user_umask_umask_as_number:var:1	23

Test the retrieved /etc/csh.cshrc umask value(s) match the var_accounts_user_umask requirement oval:ssg-tst_accounts_umask_etc_csh_cshrc:tst:1 true

Following items have been found on the system:

Var ref	Value	Value	Value	Value	Value	Value	Value	Value
oval:ssg-var_etc_csh_cshrc_umask_as_number:var:1	23	23	23	23	23	23	23	23

Ensure the Default Bash Umask is Set Correctly

Rule ID	xccdf_org.ssgproject.content_rule_accounts_umask_etc_bashrc
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-accounts_umask_etc_bashrc:def:1
Time	2021-02-11T19:31:22+00:00
Severity	unknown
Identifiers and References	Identifiers: CCE-81036-6 References: 5.4.4, CCI-000366, AC-6(1), CM-6(a), PR.IP-2, 4.3.4.3.3, APO13.01, BAI03.01, BAI03.02, BAI03.03, A.14.1.1, A.14.2.1, A.14.2.5, A.6.1.5, 18, SRG-OS-000480-GPOS-00228
Description	To ensure the default umask for users of the Bash shell is set properly, add or correct the `umask` setting in `/etc/bashrc` to read as follows: umask 027
Rationale	The umask value influences the permissions assigned to files when they are created. A misconfigured umask value could result in files with excessive permissions that can be read or written to by unauthorized users.

OVAL test results details

Verify the existence of var_accounts_user_umask_as_number variable oval:ssg-test_existence_of_var_accounts_user_umask_as_number_variable:tst:1 true

Following items have been found on the system:

Var ref	Value
oval:ssg-var_accounts_user_umask_umask_as_number:var:1	23

Test the retrieved /etc/bashrc umask value(s) match the var_accounts_user_umask requirement oval:ssg-tst_accounts_umask_etc_bashrc:tst:1 true

Following items have been found on the system:

Var ref	Value	Value	Value	Value	Value	Value	Value	Value
oval:ssg-var_etc_bashrc_umask_as_number:var:1	23	23	23	23	23	23	23	23

Ensure the Default Umask is Set Correctly in /etc/profile

Rule ID	xccdf_org.ssgproject.content_rule_accounts_umask_etc_profile
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-accounts_umask_etc_profile:def:1
Time	2021-02-11T19:31:22+00:00
Severity	unknown
Identifiers and References	Identifiers: CCE-81035-8 References: 5.4.4, CCI-000366, AC-6(1), CM-6(a), PR.IP-2, 4.3.4.3.3, APO13.01, BAI03.01, BAI03.02, BAI03.03, A.14.1.1, A.14.2.1, A.14.2.5, A.6.1.5, 18, BP28(R35), SRG-OS-000480-GPOS-00228
Description	To ensure the default umask controlled by `/etc/profile` is set properly, add or correct the `umask` setting in `/etc/profile` to read as follows: umask 027
Rationale	The umask value influences the permissions assigned to files when they are created. A misconfigured umask value could result in files with excessive permissions that can be read or written to by unauthorized users.

OVAL test results details

Verify the existence of var_accounts_user_umask_as_number variable oval:ssg-test_existence_of_var_accounts_user_umask_as_number_variable:tst:1 true

Following items have been found on the system:

Var ref	Value
oval:ssg-var_accounts_user_umask_umask_as_number:var:1	23

Test the retrieved /etc/profile umask value(s) match the var_accounts_user_umask requirement oval:ssg-tst_accounts_umask_etc_profile:tst:1 true

Following items have been found on the system:

Var ref	Value	Value	Value	Value	Value	Value	Value	Value
oval:ssg-var_etc_profile_umask_as_number:var:1	23	23	23	23	23	23	23	23

Limit the Number of Concurrent Login Sessions Allowed Per User

Rule ID	xccdf_org.ssgproject.content_rule_accounts_max_concurrent_login_sessions
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	low
Identifiers and References	Identifiers: CCE-80955-8 References: 5.5.2.2, CCI-000054, AC-10, CM-6(a), PR.AC-5, SRG-OS-000027-GPOS-00008, SRG-OS-000027-VMM-000080, SR 3.1, SR 3.8, 4.3.3.4, DSS01.05, DSS05.02, A.13.1.1, A.13.1.3, A.13.2.1, A.14.1.2, A.14.1.3, 14, 15, 18, 9
Description	Limiting the number of allowed users and sessions per user can limit risks related to Denial of Service attacks. This addresses concurrent sessions for a single account and does not address concurrent sessions by a single user via multiple accounts. To set the number of concurrent sessions per user add the following line in `/etc/security/limits.conf` or a file under `/etc/security/limits.d/`: * hard maxlogins 10
Rationale	Limiting simultaneous user logins can insulate the system from denial of service problems caused by excessive logins. Automated login processes operating improperly or maliciously may result in an exceptional number of simultaneous login sessions.

Configure auditing of unsuccessful file modifications

Rule ID	xccdf_org.ssgproject.content_rule_audit_modify_failed
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-82830-1 References: FAU_GEN.1.1.c, AU-2(a), SRG-OS-000458-GPOS-00203, SRG-OS-000474-GPOS-00219, SRG-OS-000475-GPOS-00220, SRG-OS-000463-GPOS-00207, SRG-OS-000465-GPOS-00209, SRG-OS-000461-GPOS-00205
Description	Ensure that unsuccessful attempts to modify a file are audited. The following rules configure audit as described above: ## Unsuccessful file modifications (open for write or truncate) -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification -a always,exit -F arch=b32 -S open -F a1&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification -a always,exit -F arch=b64 -S open -F a1&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification -a always,exit -F arch=b32 -S truncate,ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification -a always,exit -F arch=b64 -S truncate,ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification -a always,exit -F arch=b32 -S open -F a1&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification -a always,exit -F arch=b64 -S open -F a1&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification -a always,exit -F arch=b32 -S truncate,ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification -a always,exit -F arch=b64 -S truncate,ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification The `Audit` package provides pre-configured rules in `/usr/share/audit/sample-rules`. The above content can be found in `/usr/share/audit/sample-rules/30-ospp-v42-2-modify-failed.rules`. To deploy this configuration, it is recommended to copy it over to the `/etc/audit/rules.d/` directory: cp /usr/share/audit/sample-rules/30-ospp-v42-2-modify-failed.rules /etc/audit/rules.d/ Load new Audit rules into kernel by running: augenrules --load Note: This rule utilizes a file provided by `Audit` package to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are alligned with your needs.
Rationale	Unsuccessful file modifications might be a sign of a malicious action being performed on the system. Auditing of such events helps in detection and investigation of such actions.

Configure auditing of unsuccessful file creations

Rule ID	xccdf_org.ssgproject.content_rule_audit_create_failed
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-82374-0 References: FAU_GEN.1.1.c, AU-2(a), SRG-OS-000458-GPOS-00203, SRG-OS-000474-GPOS-00219, SRG-OS-000475-GPOS-00220, SRG-OS-000463-GPOS-00207, SRG-OS-000465-GPOS-00209, SRG-OS-000461-GPOS-00205
Description	Ensure that unsuccessful attempts to create a file are audited. The following rules configure audit as described above: ## Unsuccessful file creation (open with O_CREAT) -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-create -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-create -a always,exit -F arch=b32 -S open -F a1&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-create -a always,exit -F arch=b64 -S open -F a1&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-create -a always,exit -F arch=b32 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-create -a always,exit -F arch=b64 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-create -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-create -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-create -a always,exit -F arch=b32 -S open -F a1&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-create -a always,exit -F arch=b64 -S open -F a1&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-create -a always,exit -F arch=b32 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-create -a always,exit -F arch=b64 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-create The `Audit` package provides pre-configured rules in `/usr/share/audit/sample-rules`. The above content can be found in `/usr/share/audit/sample-rules/30-ospp-v42-1-create-failed.rules`. To deploy this configuration, it is recommended to copy it over to the `/etc/audit/rules.d/` directory: cp /usr/share/audit/sample-rules/30-ospp-v42-1-create-failed.rules /etc/audit/rules.d/ Load new Audit rules into kernel by running: augenrules --load Note: This rule utilizes a file provided by `Audit` package to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are alligned with your needs.
Rationale	Unsuccessful file creations might be a sign of a malicious action being performed on the system. Keeping log of such events helps in monitoring and investigation of such actions.

Configure auditing of unsuccessful permission changes

Rule ID	xccdf_org.ssgproject.content_rule_audit_perm_change_failed
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-82837-6 References: FAU_GEN.1.1.c, AU-2(a), SRG-OS-000462-GPOS-00206, SRG-OS-000463-GPOS-00207, SRG-OS-000465-GPOS-00209, SRG-OS-000474-GPOS-00219, SRG-OS-000475-GPOS-00220, SRG-OS-000466-GPOS-00210, SRG-OS-000064-GPOS-00033
Description	Ensure that unsuccessful attempts to change file or directory permissions are audited. The following rules configure audit as described above: ## Unsuccessful permission change -a always,exit -F arch=b32 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-perm-change -a always,exit -F arch=b64 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-perm-change -a always,exit -F arch=b32 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-perm-change -a always,exit -F arch=b64 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-perm-change The `Audit` package provides pre-configured rules in `/usr/share/audit/sample-rules`. The above content can be found in `/usr/share/audit/sample-rules/30-ospp-v42-5-perm-change-failed.rules`. To deploy this configuration, it is recommended to copy it over to the `/etc/audit/rules.d/` directory: cp /usr/share/audit/sample-rules/30-ospp-v42-5-perm-change-failed.rules /etc/audit/rules.d/ Load new Audit rules into kernel by running: augenrules --load Note: This rule utilizes a file provided by `Audit` package to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are alligned with your needs.
Rationale	Unsuccessful attempts to change permissions of files or directories might be signs of malicious activity. Having such events audited helps in monitoring and investigation of such activities.

Configure auditing of successful file accesses

Rule ID	xccdf_org.ssgproject.content_rule_audit_access_success
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-82834-3 References: FAU_GEN.1.1.c, AU-2(a), SRG-OS-000458-GPOS-00203, SRG-OS-000474-GPOS-00219, SRG-OS-000475-GPOS-00220, SRG-OS-000463-GPOS-00207, SRG-OS-000465-GPOS-00209, SRG-OS-000461-GPOS-00205, 0582, 0584, 05885, 0586, 0846, 0957
Description	Ensure that successful attempts to access a file are audited. The following rules configure audit as described above: ## Successful file access (any other opens) This has to go last. ## These next two are likely to result in a whole lot of events -a always,exit -F arch=b32 -S open,openat,open_by_handle_at -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-access -a always,exit -F arch=b64 -S open,openat,open_by_handle_at -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-access The `Audit` package provides pre-configured rules in `/usr/share/audit/sample-rules`. The above content can be found in `/usr/share/audit/sample-rules/30-ospp-v42-3-access-success.rules`. To deploy this configuration, it is recommended to copy it over to the `/etc/audit/rules.d/` directory: cp /usr/share/audit/sample-rules/30-ospp-v42-3-access-success.rules /etc/audit/rules.d/ Load new Audit rules into kernel by running: augenrules --load Note: This rule utilizes a file provided by `Audit` package to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are alligned with your needs.
Rationale	Auditing of successful attempts to access a file helps in investigation of activities performed on the system.

Configure auditing of unsuccessful file deletions

Rule ID	xccdf_org.ssgproject.content_rule_audit_delete_failed
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-82835-0 References: FAU_GEN.1.1.c, AU-2(a), SRG-OS-000458-GPOS-00203, SRG-OS-000474-GPOS-00219, SRG-OS-000475-GPOS-00220, SRG-OS-000463-GPOS-00207, SRG-OS-000465-GPOS-00209, SRG-OS-000461-GPOS-00205, SRG-OS-000468-GPOS-00212, SRG-OS-000467-GPOS-00211
Description	Ensure that unsuccessful attempts to delete a file are audited. The following rules configure audit as described above: ## Unsuccessful file delete -a always,exit -F arch=b32 -S unlink,unlinkat,rename,renameat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete -a always,exit -F arch=b64 -S unlink,unlinkat,rename,renameat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete -a always,exit -F arch=b32 -S unlink,unlinkat,rename,renameat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete -a always,exit -F arch=b64 -S unlink,unlinkat,rename,renameat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete The `Audit` package provides pre-configured rules in `/usr/share/audit/sample-rules`. The above content can be found in `/usr/share/audit/sample-rules/30-ospp-v42-4-delete-failed.rules`. To deploy this configuration, it is recommended to copy it over to the `/etc/audit/rules.d/` directory: cp /usr/share/audit/sample-rules/30-ospp-v42-4-delete-failed.rules /etc/audit/rules.d/ Load new Audit rules into kernel by running: augenrules --load Note: This rule utilizes a file provided by `Audit` package to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are alligned with your needs.
Rationale	Unsuccessful attempts to delete a file might be signs of malicious activities. Auditing of such events help in monitoring and investigating of such activities.

Configure basic parameters of Audit system

Rule ID	xccdf_org.ssgproject.content_rule_audit_basic_configuration
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-82827-7 References: FAU_GEN.1.1.c, AU-2(a), SRG-OS-000365-GPOS-00152, SRG-OS-000475-GPOS-00220
Description	Perform basic configuration of Audit system. Make sure that any previously defined rules are cleared, the auditing system is configured to handle sudden bursts of events, and in cases of failure, messages are configured to be directed to system log. The following rules configure audit as described above: ## First rule - delete all -D ## Increase the buffers to survive stress events. ## Make this bigger for busy systems -b 8192 ## This determine how long to wait in burst of events --backlog_wait_time 60000 ## Set failure mode to syslog -f 1 The `Audit` package provides pre-configured rules in `/usr/share/audit/sample-rules`. The above content can be found in `/usr/share/audit/sample-rules/10-base-config.rules`. To deploy this configuration, it is recommended to copy it over to the `/etc/audit/rules.d/` directory: cp /usr/share/audit/sample-rules/10-base-config.rules /etc/audit/rules.d/ Load new Audit rules into kernel by running: augenrules --load
Rationale	Without basic configurations, audit may not perform as expected. It may not be able to correctly handle events under stressful conditions, or log events in case of failure.

Configure auditing of unsuccessful file accesses

Rule ID	xccdf_org.ssgproject.content_rule_audit_access_failed
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-82833-5 References: FAU_GEN.1.1.c, AU-2(a), SRG-OS-000458-GPOS-00203, SRG-OS-000474-GPOS-00219, SRG-OS-000475-GPOS-00220, SRG-OS-000463-GPOS-00207, SRG-OS-000465-GPOS-00209, SRG-OS-000461-GPOS-00205, 0582, 0584, 05885, 0586, 0846, 0957
Description	Ensure that unsuccessful attempts to access a file are audited. The following rules configure audit as described above: ## Unsuccessful file access (any other opens) This has to go last. -a always,exit -F arch=b32 -S open,openat,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-access -a always,exit -F arch=b64 -S open,openat,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-access -a always,exit -F arch=b32 -S open,openat,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-access -a always,exit -F arch=b64 -S open,openat,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-access Load new Audit rules into kernel by running: augenrules --load Note: This rule utilizes a file provided by `Audit` package to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are alligned with your needs.
Rationale	Unsuccessful attempts to access a file might be signs of malicious activity happening within the system. Auditing of such activities helps in their monitoring and investigation.

Configure auditing of successful file deletions

Rule ID	xccdf_org.ssgproject.content_rule_audit_delete_success
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-82836-8 References: FAU_GEN.1.1.c, AU-2(a), SRG-OS-000458-GPOS-00203, SRG-OS-000474-GPOS-00219, SRG-OS-000475-GPOS-00220, SRG-OS-000463-GPOS-00207, SRG-OS-000465-GPOS-00209, SRG-OS-000461-GPOS-00205, SRG-OS-000468-GPOS-00212, SRG-OS-000467-GPOS-00211
Description	Ensure that successful attempts to delete a file are audited. The following rules configure audit as described above: ## Successful file delete -a always,exit -F arch=b32 -S unlink,unlinkat,rename,renameat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-delete -a always,exit -F arch=b64 -S unlink,unlinkat,rename,renameat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-delete The `Audit` package provides pre-configured rules in `/usr/share/audit/sample-rules`. The above content can be found in `/usr/share/audit/sample-rules/30-ospp-v42-4-delete-success.rules`. To deploy this configuration, it is recommended to copy it over to the `/etc/audit/rules.d/` directory: cp /usr/share/audit/sample-rules/30-ospp-v42-4-delete-success.rules /etc/audit/rules.d/ Load new Audit rules into kernel by running: augenrules --load Note: This rule utilizes a file provided by `Audit` package to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are alligned with your needs.
Rationale	Auditing of successful attempts to delete a file may help in monitoring and investigation of activities performed on the system.

Configure auditing of unsuccessful ownership changes

Rule ID	xccdf_org.ssgproject.content_rule_audit_owner_change_failed
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-82384-9 References: FAU_GEN.1.1.c, AU-2(a), SRG-OS-000462-GPOS-00206, SRG-OS-000463-GPOS-00207, SRG-OS-000465-GPOS-00209, SRG-OS-000474-GPOS-00219, SRG-OS-000475-GPOS-00220, SRG-OS-000466-GPOS-00210, SRG-OS-000064-GPOS-00033
Description	Ensure that unsuccessful attempts to change an ownership of files or directories are audited. The following rules configure audit as described above: ## Unsuccessful ownership change -a always,exit -F arch=b32 -S lchown,fchown,chown,fchownat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-owner-change -a always,exit -F arch=b64 -S lchown,fchown,chown,fchownat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-owner-change -a always,exit -F arch=b32 -S lchown,fchown,chown,fchownat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-owner-change -a always,exit -F arch=b64 -S lchown,fchown,chown,fchownat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-owner-change The `Audit` package provides pre-configured rules in `/usr/share/audit/sample-rules`. The above content can be found in `/usr/share/audit/sample-rules/30-ospp-v42-6-owner-change-failed.rules`. To deploy this configuration, it is recommended to copy it over to the `/etc/audit/rules.d/` directory: cp /usr/share/audit/sample-rules/30-ospp-v42-6-owner-change-failed.rules /etc/audit/rules.d/ Load new Audit rules into kernel by running: augenrules --load Note: This rule utilizes a file provided by `Audit` package to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are alligned with your needs.
Rationale	Unsuccessful attempts to change an ownership of files or directories might be signs of a malicious activity. Having such events audited helps in monitoring and investigation of such activities.

Configure immutable Audit login UIDs

Rule ID	xccdf_org.ssgproject.content_rule_audit_immutable_login_uids
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-82828-5 References: FAU_GEN.1.1.c, AU-2(a), SRG-OS-000462-GPOS-00206, SRG-OS-000475-GPOS-00220
Description	Configure kernel to prevent modification of login UIDs once they are set. Changing login UUIDs while this configuration is enforced requires special capabilities which are not available to unprivileged users. The following rules configure audit as described above: ## Make the loginuid immutable. This prevents tampering with the auid. --loginuid-immutable The `Audit` provides pre-configured rules in `/usr/share/audit/sample-rules`. The above content can be found in `/usr/share/audit/sample-rules/11-loginuid.rules`. To deploy this configuration, it is recommended to copy it over to the `/etc/audit/rules.d/` directory: cp /usr/share/audit/sample-rules/11-loginuid.rules /etc/audit/rules.d/ Load new Audit rules into kernel by running: augenrules --load
Rationale	If modification of login UIDs is not prevented, they can be changed by unprivileged users and make auditing complicated or impossible.

Configure auditing of loading and unloading of kernel modules

Rule ID	xccdf_org.ssgproject.content_rule_audit_module_load
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-82838-4 References: FAU_GEN.1.1.c, AU-2(a), SRG-OS-000471-GPOS-00216, SRG-OS-000477-GPOS-00222, SRG-OS-000475-GPOS-00220
Description	Ensure that loading and unloading of kernel modules is audited. The following rules configure audit as described above: ## These rules watch for kernel module insertion. By monitoring ## the syscall, we do not need any watches on programs. -a always,exit -F arch=b32 -S init_module,finit_module -F key=module-load -a always,exit -F arch=b64 -S init_module,finit_module -F key=module-load -a always,exit -F arch=b32 -S delete_module -F key=module-unload -a always,exit -F arch=b64 -S delete_module -F key=module-unload The `Audit` package provides pre-configured rules in `/usr/share/audit/sample-rules`. The above content can be found in `/usr/share/audit/sample-rules/43-module-load.rules`. To deploy this configuration, it is recommended to copy it over to the `/etc/audit/rules.d/` directory: cp /usr/share/audit/sample-rules/43-module-load.rules /etc/audit/rules.d/ Load new Audit rules into kernel by running: augenrules --load
Rationale	Loading of a malicious kernel module introduces a risk to the system, as the module has access to sensitive data and perform actions at the operating system kernel level. Having such events audited helps in monitoring and investigating of malicious activities.

Perform general configuration of Audit for OSPP

Rule ID	xccdf_org.ssgproject.content_rule_audit_ospp_general
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-82373-2 References: FAU_GEN.1.1.c, AU-2(a), SRG-OS-000004-GPOS-00004, SRG-OS-000241-GPOS-00091, SRG-OS-000476-GPOS-00221, SRG-OS-000327-GPOS-00127, SRG-OS-000475-GPOS-00220, SRG-OS-000239-GPOS-00089, SRG-OS-000274-GPOS-00104, SRG-OS-000275-GPOS-00105, SRG-OS-000303-GPOS-00120, SRG-OS-000304-GPOS-00121
Description	Configure some basic `Audit` parameters specific for OSPP profile. In particular, configure `Audit` to watch for direct modification of files storing system user and group information, and usage of applications with special rights which can change system configuration. Further audited events include access to audit log it self, attempts to Alter Process and Session Initiation Information, and attempts to modify MAC controls. The following rules configure audit as described above: ## The purpose of these rules is to meet the requirements for Operating ## System Protection Profile (OSPP)v4.2. These rules depends on having ## the following rule files copied to /etc/audit/rules.d: ## ## 10-base-config.rules, 11-loginuid.rules, ## 30-ospp-v42-1-create-failed.rules, 30-ospp-v42-1-create-success.rules, ## 30-ospp-v42-2-modify-failed.rules, 30-ospp-v42-2-modify-success.rules, ## 30-ospp-v42-3-access-failed.rules, 30-ospp-v42-3-access-success.rules, ## 30-ospp-v42-4-delete-failed.rules, 30-ospp-v42-4-delete-success.rules, ## 30-ospp-v42-5-perm-change-failed.rules, ## 30-ospp-v42-5-perm-change-success.rules, ## 30-ospp-v42-6-owner-change-failed.rules, ## 30-ospp-v42-6-owner-change-success.rules ## ## original copies may be found in /usr/share/audit/sample-rules/ ## User add delete modify. This is covered by pam. However, someone could ## open a file and directly create or modify a user, so we'll watch passwd and ## shadow for writes -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=user-modify -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=user-modify -a always,exit -F arch=b32 -S open -F a1&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=user-modify -a always,exit -F arch=b64 -S open -F a1&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=user-modify -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify -a always,exit -F arch=b32 -S open -F a1&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify -a always,exit -F arch=b64 -S open -F a1&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify ## User enable and disable. This is entirely handled by pam. ## Group add delete modify. This is covered by pam. However, someone could ## open a file and directly create or modify a user, so we'll watch group and ## gshadow for writes -a always,exit -F path=/etc/passwd -F perm=wa -F auid>=1000 -F auid!=unset -F key=user-modify -a always,exit -F path=/etc/shadow -F perm=wa -F auid>=1000 -F auid!=unset -F key=user-modify -a always,exit -F path=/etc/group -F perm=wa -F auid>=1000 -F auid!=unset -F key=group-modify -a always,exit -F path=/etc/gshadow -F perm=wa -F auid>=1000 -F auid!=unset -F key=group-modify ## Use of special rights for config changes. This would be use of setuid ## programs that relate to user accts. This is not all setuid apps because ## requirements are only for ones that affect system configuration. -a always,exit -F path=/usr/sbin/unix_chkpwd -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F path=/usr/sbin/usernetctl -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F path=/usr/sbin/userhelper -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F path=/usr/sbin/seunshare -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F path=/usr/bin/mount -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F path=/usr/bin/newgrp -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F path=/usr/bin/newuidmap -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F path=/usr/bin/gpasswd -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F path=/usr/bin/newgidmap -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F path=/usr/bin/umount -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F path=/usr/bin/passwd -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F path=/usr/bin/crontab -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F path=/usr/bin/at -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes ## Privilege escalation via su or sudo. This is entirely handled by pam. ## Audit log access -a always,exit -F dir=/var/log/audit/ -F perm=r -F auid>=1000 -F auid!=unset -F key=access-audit-trail ## Attempts to Alter Process and Session Initiation Information -a always,exit -F path=/var/run/utmp -F perm=wa -F auid>=1000 -F auid!=unset -F key=session -a always,exit -F path=/var/log/btmp -F perm=wa -F auid>=1000 -F auid!=unset -F key=session -a always,exit -F path=/var/log/wtmp -F perm=wa -F auid>=1000 -F auid!=unset -F key=session ## Attempts to modify MAC controls -a always,exit -F dir=/etc/selinux/ -F perm=wa -F auid>=1000 -F auid!=unset -F key=MAC-policy ## Software updates. This is entirely handled by rpm. ## System start and shutdown. This is entirely handled by systemd ## Kernel Module loading. This is handled in 43-module-load.rules ## Application invocation. The requirements list an optional requirement ## FPT_SRP_EXT.1 Software Restriction Policies. This event is intended to ## state results from that policy. This would be handled entirely by ## that daemon. The `Audit` package provides pre-configured rules in `/usr/share/audit/sample-rules`. The above content can be found in `/usr/share/audit/sample-rules/30-ospp-v42.rules`. To deploy this configuration, it is recommended to copy it over to the `/etc/audit/rules.d/` directory: cp /usr/share/audit/sample-rules/30-ospp-v42.rules /etc/audit/rules.d/ Load new Audit rules into kernel by running: augenrules --load Note: This rule utilizes a file provided by `Audit` package to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are alligned with your needs.
Rationale	Auditing of events listed in the description provides data for monitoring and investigation of potentially malicious events e.g. tampering with `Audit` logs, malicious access to files storing information about system users and groups etc.

Configure auditing of successful permission changes

Rule ID	xccdf_org.ssgproject.content_rule_audit_perm_change_success
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-82383-1 References: FAU_GEN.1.1.c, AU-2(a), SRG-OS-000462-GPOS-00206, SRG-OS-000463-GPOS-00207, SRG-OS-000465-GPOS-00209, SRG-OS-000474-GPOS-00219, SRG-OS-000475-GPOS-00220, SRG-OS-000466-GPOS-00210, SRG-OS-000064-GPOS-00033
Description	Ensure that successful attempts to modify permissions of iles or directories are audited. The following rules configure audit as described above: ## Successful permission change -a always,exit -F arch=b32 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change -a always,exit -F arch=b64 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change The `Audit` package provides pre-configured rules in `/usr/share/audit/sample-rules`. The above content can be found in `/usr/share/audit/sample-rules/30-ospp-v42-5-perm-change-success.rules`. To deploy this configuration, it is recommended to copy it over to the `/etc/audit/rules.d/` directory: cp /usr/share/audit/sample-rules/30-ospp-v42-5-perm-change-success.rules /etc/audit/rules.d/ Load new Audit rules into kernel by running: augenrules --load Note: This rule utilizes a file provided by `Audit` package to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are alligned with your needs.
Rationale	Auditing successful file or directory permission changes helps in monitoring and investigating of activities performed on the system.

Configure auditing of successful file modifications

Rule ID	xccdf_org.ssgproject.content_rule_audit_modify_success
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-82832-7 References: FAU_GEN.1.1.c, AU-2(a), SRG-OS-000458-GPOS-00203, SRG-OS-000474-GPOS-00219, SRG-OS-000475-GPOS-00220, SRG-OS-000463-GPOS-00207, SRG-OS-000465-GPOS-00209, SRG-OS-000461-GPOS-00205
Description	Ensure that successful attempts to modify a file are audited. The following rules configure audit as described above: ## Successful file modifications (open for write or truncate) -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&01003 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-modification -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&01003 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-modification -a always,exit -F arch=b32 -S open -F a1&01003 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-modification -a always,exit -F arch=b64 -S open -F a1&01003 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-modification -a always,exit -F arch=b32 -S truncate,ftruncate -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-modification -a always,exit -F arch=b64 -S truncate,ftruncate -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-modification The `Audit` package provides pre-configured rules in `/usr/share/audit/sample-rules`. The above content can be found in `/usr/share/audit/sample-rules/30-ospp-v42-2-modify-success.rules`. To deploy this configuration, it is recommended to copy it over to the `/etc/audit/rules.d/` directory: cp /usr/share/audit/sample-rules/30-ospp-v42-2-modify-success.rules /etc/audit/rules.d/ Load new Audit rules into kernel by running: augenrules --load Note: This rule utilizes a file provided by `Audit` package to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are alligned with your needs.
Rationale	Auditing of successful attempts to modify a file helps in investigation of actions which happened on the system.

Configure auditing of successful ownership changes

Rule ID	xccdf_org.ssgproject.content_rule_audit_owner_change_success
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-82385-6 References: FAU_GEN.1.1.c, AU-2(a), SRG-OS-000462-GPOS-00206, SRG-OS-000463-GPOS-00207, SRG-OS-000465-GPOS-00209, SRG-OS-000474-GPOS-00219, SRG-OS-000475-GPOS-00220, SRG-OS-000466-GPOS-00210, SRG-OS-000064-GPOS-00033
Description	Ensure that successful attempts to change an ownership of files or directories are audited. The following rules configure audit as described above: ## Successful ownership change -a always,exit -F arch=b32 -S lchown,fchown,chown,fchownat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-owner-change -a always,exit -F arch=b64 -S lchown,fchown,chown,fchownat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-owner-change The `Audit` package provides pre-configured rules in `/usr/share/audit/sample-rules`. The above content can be found in `/usr/share/audit/sample-rules/30-ospp-v42-6-owner-change-success.rules`. To deploy this configuration, it is recommended to copy it over to the `/etc/audit/rules.d/` directory: cp /usr/share/audit/sample-rules/30-ospp-v42-6-owner-change-success.rules /etc/audit/rules.d/ The file has the following SHA-256 checksum: 7eb41a6aaf6737c2571b6424fae7fa53af4b41a9115b6c5732a5778ccd9900ad Load new Audit rules into kernel by running: augenrules --load Note: This rule utilizes a file provided by `Audit` package to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are alligned with your needs.
Rationale	Auditing of successful ownership changes of files or directories helps in monitoring or investingating of activities performed on the system.

Configure auditing of successful file creations

Rule ID	xccdf_org.ssgproject.content_rule_audit_create_success
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-82829-3 References: FAU_GEN.1.1.c, AU-2(a), SRG-OS-000458-GPOS-00203, SRG-OS-000474-GPOS-00219, SRG-OS-000475-GPOS-00220, SRG-OS-000463-GPOS-00207, SRG-OS-000465-GPOS-00209, SRG-OS-000461-GPOS-00205
Description	Ensure that successful attempts to create a file are audited. The following rules configure audit as described above: ## Successful file creation (open with O_CREAT) -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&0100 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-create -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&0100 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-create -a always,exit -F arch=b32 -S open -F a1&0100 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-create -a always,exit -F arch=b64 -S open -F a1&0100 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-create -a always,exit -F arch=b32 -S creat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-create -a always,exit -F arch=b64 -S creat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-create The `Audit` package provides pre-configured rules in `/usr/share/audit/sample-rules`. The above content can be found in `/usr/share/audit/sample-rules/30-ospp-v42-1-create-success.rules`. To deploy this configuration, it is recommended to copy it over to the `/etc/audit/rules.d/` directory: cp /usr/share/audit/sample-rules/30-ospp-v42-1-create-success.rules /etc/audit/rules.d/ Load new Audit rules into kernel by running: augenrules --load
Rationale	Auditing of successful attempts to create a file helps in investigation of actions which happened on the system.

Set hostname as computer node name in audit logs

Rule ID	xccdf_org.ssgproject.content_rule_auditd_name_format
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-82897-0 References: CCI-001851, FAU_GEN.1, SRG-OS-000039-GPOS-00017, SRG-OS-000342-GPOS-00133, SRG-OS-000479-GPOS-00224
Description	To configure Audit daemon to use value returned by gethostname syscall as computer node name in the audit events, set `name_format` to `hostname` in `/etc/audit/auditd.conf`.
Rationale	If option `name_format` is left at its default value of `none`, audit events from different computers may be hard to distinguish.

Write Audit Logs to the Disk

Rule ID	xccdf_org.ssgproject.content_rule_auditd_write_logs
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-82366-6 References: FAU_GEN.1.1.c, SRG-OS-000480-GPOS-00227
Description	To configure Audit daemon to write Audit logs to the disk, set `write_logs` to `yes` in `/etc/audit/auditd.conf`. This is the default setting.
Rationale	If `write_logs` isn't set to `yes`, the Audit logs will not be written to the disk.

Resolve information before writing to audit logs

Rule ID	xccdf_org.ssgproject.content_rule_auditd_log_format
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-82201-5 References: FAU_GEN.1, SRG-OS-000255-GPOS-00096
Description	To configure Audit daemon to resolve all uid, gid, syscall, architecture, and socket address information before writing the events to disk, set `log_format` to `ENRICHED` in `/etc/audit/auditd.conf`.
Rationale	If option `log_format` isn't set to `ENRICHED`, the audit records will be stored in a format exactly as the kernel sends them.

Configure auditd to use audispd's syslog plugin

Rule ID	xccdf_org.ssgproject.content_rule_auditd_audispd_syslog_plugin_activated
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-80677-8 References: 5.4.1.1, 3.3.1, CCI-000136, 164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(B), 164.308(a)(5)(ii)(C), 164.308(a)(6)(ii), 164.308(a)(8), 164.310(d)(2)(iii), 164.312(b), 164.314(a)(2)(i)(C), 164.314(a)(2)(iii), AU-4(1), CM-6(a), DE.AE-3, DE.AE-5, PR.PT-1, RS.AN-1, RS.AN-4, FAU_GEN.1.1.c, SRG-OS-000051-VMM-000230, SRG-OS-000058-VMM-000270, SRG-OS-000059-VMM-000280, SRG-OS-000479-VMM-001990, SRG-OS-000479-VMM-001990, Req-10.5.3, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, 4.2.3.10, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, APO11.04, APO12.06, BAI03.05, BAI08.02, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS05.04, DSS05.07, MEA02.01, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.16.1.4, A.16.1.5, A.16.1.7, 1, 11, 12, 13, 14, 15, 16, 19, 3, 4, 5, 6, 7, 8, SRG-OS-000479-GPOS-00224, SRG-OS-000342-GPOS-00133
Description	To configure the `auditd` service to use the `syslog` plug-in of the `audispd` audit event multiplexor, set the `active` line in `/etc/audit/plugins.d/syslog.conf` to `yes`. Restart the `auditd` service: $ sudo service auditd restart
Rationale	The auditd service does not include the ability to send audit records to a centralized server for management directly. It does, however, include a plug-in for audit event multiplexor (audispd) to pass audit records to the local syslog server

Configure auditd flush priority

Rule ID	xccdf_org.ssgproject.content_rule_auditd_data_retention_flush
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-80680-2 References: 3.3.1, CCI-001576, 164.308(a)(1)(ii)(D), 164.308(a)(3)(ii)(A), 164.308(a)(5)(ii)(C), 164.312(a)(2)(i), 164.312(b), 164.312(d), 164.312(e), AU-11, CM-6(a), DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.PT-1, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 6.2, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, BAI03.05, DSS01.03, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.14.2.7, A.15.2.1, A.15.2.2, 1, 12, 13, 14, 15, 16, 2, 3, 5, 6, 7, 8, 9, SRG-OS-000480-GPOS-00227
Description	The `auditd` service can be configured to synchronously write audit event data to disk. Add or correct the following line in `/etc/audit/auditd.conf` to ensure that audit event data is fully synchronized with the log files on the disk: flush = incremental_async
Rationale	Audit data should be synchronously written to disk to ensure log integrity. These parameters assure that all audit event data is fully synchronized with the log files on the disk.

Set number of records to cause an explicit flush to audit logs

Rule ID	xccdf_org.ssgproject.content_rule_auditd_freq
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-82258-5 References: FAU_GEN.1, SRG-OS-000051-GPOS-00024
Description	To configure Audit daemon to issue an explicit flush to disk command after writing 50 records, set `freq` to `50` in `/etc/audit/auditd.conf`.
Rationale	If option `freq` isn't set to `50`, the flush to disk may happen after higher number of records, increasing the danger of audit loss.

Include Local Events in Audit Logs

Rule ID	xccdf_org.ssgproject.content_rule_auditd_local_events
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-82233-8 References: FAU_GEN.1.1.c, SRG-OS-000062-GPOS-00031
Description	To configure Audit daemon to include local events in Audit logs, set `local_events` to `yes` in `/etc/audit/auditd.conf`. This is the default setting.
Rationale	If option `local_events` isn't set to `yes` only events from network will be aggregated.

Record Events that Modify User/Group Information - /etc/passwd

Rule ID	xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_passwd
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-80761-0 References: 5.2.5, 5.4.1.1, 3.1.7, CCI-000018, CCI-000172, CCI-001403, CCI-001404, CCI-001405, CCI-001683, CCI-001684, CCI-001685, CCI-001686, CCI-002130, CCI-002132, 164.308(a)(1)(ii)(D), 164.308(a)(3)(ii)(A), 164.308(a)(5)(ii)(C), 164.312(a)(2)(i), 164.312(b), 164.312(d), 164.312(e), AC-2(4), AU-2(d), AU-12(c), AC-6(9), CM-6(a), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-1, PR.AC-3, PR.AC-4, PR.AC-6, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1.1.c, Req-10.2.5, SRG-OS-000004-GPOS-00004, SRG-OS-000239-GPOS-00089, SRG-OS-000240-GPOS-00090, SRG-OS-000241-GPOS-00091, SRG-OS-000274-GPOS-00104, SRG-OS-000275-GPOS-00105, SRG-OS-000276-GPOS-00106, SRG-OS-000277-GPOS-00107, SRG-OS-000303-GPOS-00120, SRG-OS-000476-GPOS-00221, SRG-OS-000004-VMM-000040, SRG-OS-000239-VMM-000810, SRG-OS-000240-VMM-000820, SRG-OS-000241-VMM-000830, SRG-OS-000274-VMM-000960, SRG-OS-000275-VMM-000970, SRG-OS-000276-VMM-000980, SRG-OS-000277-VMM-000990, SRG-OS-000303-VMM-001090, SRG-OS-000304-VMM-001100, SRG-OS-000476-VMM-001960, SR 1.1, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, 4.2.3.10, 4.3.2.6.7, 4.3.3.2.2, 4.3.3.3.9, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.8, 4.3.3.6.6, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, DSS06.03, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.1.2, A.6.2.1, A.6.2.2, A.7.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5, 1, 11, 12, 13, 14, 15, 16, 18, 19, 2, 3, 4, 5, 6, 7, 8, 9
Description	If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`, in order to capture events that modify account changes: -w /etc/passwd -p wa -k audit_rules_usergroup_modification If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file, in order to capture events that modify account changes: -w /etc/passwd -p wa -k audit_rules_usergroup_modification
Rationale	In addition to auditing new user and group accounts, these watches will alert the system administrator(s) to any modifications. Any unexpected users, groups, or modifications should be investigated for legitimacy.

Install audispd-plugins Package

Rule ID	xccdf_org.ssgproject.content_rule_package_audispd-plugins_installed
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-82953-1 References: SRG-OS-000342-GPOS-00133, FMT_SMF_EXT.1
Description	The `audispd-plugins` package can be installed with the following command: $ sudo yum install audispd-plugins
Rationale	`audispd-plugins` provides plugins for the real-time interface to the audit subsystem, `audispd`. These plugins can do things like relay events to remote machines or analyze events for suspicious behavior.

Ensure the audit Subsystem is Installed

Rule ID	xccdf_org.ssgproject.content_rule_package_audit_installed
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-81043-2 References: AC-7(a), AU-7(1), AU-7(2), AU-14, AU-12(2), AU-2(a), CM-6(a), BP28(R50), SRG-OS-000480-GPOS-00227, SRG-OS-000122-GPOS-00063, 4.1.1.1
Description	The audit package should be installed.
Rationale	The auditd service is an access monitoring and accounting daemon, watching system calls to audit any access, in comparison with potential local access control policy such as SELinux policy.

Enable auditd Service

Rule ID	xccdf_org.ssgproject.content_rule_service_auditd_enabled
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-80872-5 References: 4.1.1.2, 5.4.1.1, 3.3.1, 3.3.2, 3.3.6, CCI-000126, CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000134, CCI-000135, CCI-001464, CCI-001487, CCI-001814, 164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(C), 164.310(a)(2)(iv), 164.310(d)(2)(iii), 164.312(b), AC-2(g), AU-3, AU-10, AU-2(d), AU-12(c), AU-14(1), AC-6(9), CM-6(a), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, Req-10.1, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000042-GPOS-00021, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000365-GPOS-00152, SRG-OS-000037-VMM-000150, SRG-OS-000063-VMM-000310, SRG-OS-000038-VMM-000160, SRG-OS-000039-VMM-000170, SRG-OS-000040-VMM-000180, SRG-OS-000041-VMM-000190, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9
Description	The `auditd` service is an essential userspace component of the Linux Auditing System, as it is responsible for writing audit records to disk. The `auditd` service can be enabled with the following command: $ sudo systemctl enable auditd.service
Rationale	Without establishing what type of events occurred, it would be difficult to establish, correlate, and investigate the events leading up to an outage or attack. Ensuring the `auditd` service is active ensures audit records generated by the kernel are appropriately recorded. Additionally, a properly configured audit subsystem ensures that actions of individual system users can be uniquely traced to those users so they can be held accountable for their actions.

Enable Auditing for Processes Which Start Prior to the Audit Daemon

Rule ID	xccdf_org.ssgproject.content_rule_grub2_audit_argument
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-80825-3 References: 4.1.1.3, 5.4.1.1, 3.3.1, CCI-001464, CCI-000130, 164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(C), 164.310(a)(2)(iv), 164.310(d)(2)(iii), 164.312(b), AC-17(1), AU-14(1), AU-10, CM-6(a), IR-5(1), DE.AE-3, DE.AE-5, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, SRG-OS-000254-VMM-000880, Req-10.3, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 7.1, SR 7.6, 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS05.02, DSS05.03, DSS05.04, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, 1, 11, 12, 13, 14, 15, 16, 19, 3, 4, 5, 6, 7, 8, SRG-OS-000254-GPOS-00095
Description	To ensure all processes can be audited, even those which start prior to the audit daemon, add the argument `audit=1` to the default GRUB 2 command line for the Linux operating system in `/boot/grub2/grubenv`, in the manner below: # grub2-editenv - set "$(grub2-editenv - list \| grep kernelopts) audit=1"
Rationale	Each process on the system carries an "auditable" flag which indicates whether its activities can be audited. Although `auditd` takes care of enabling this for all processes which launch after it does, adding the kernel argument ensures it is set for every process during boot.
Warnings	warning The GRUB 2 configuration file, `grub.cfg`, is automatically updated each time a new kernel is installed. Note that any changes to `/etc/default/grub` require rebuilding the `grub.cfg` file. To update the GRUB 2 configuration file manually, use the grub2-mkconfig -o command as follows: On BIOS-based machines, issue the following command as `root`: ~]# grub2-mkconfig -o /boot/grub2/grub.cfg On UEFI-based machines, issue the following command as `root`: ~]# grub2-mkconfig -o /boot/efi/EFI/redhat/grub.cfg

Extend Audit Backlog Limit for the Audit Daemon

Rule ID	xccdf_org.ssgproject.content_rule_grub2_audit_backlog_limit_argument
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-80943-4 References: SRG-OS-000254-GPOS-00095, CM-6(a), 4.1.1.4
Description	To improve the kernel capacity to queue all log events, even those which occurred prior to the audit daemon, add the argument `audit_backlog_limit=8192` to the default GRUB 2 command line for the Linux operating system in `/etc/default/grub`, in the manner below: GRUB_CMDLINE_LINUX="crashkernel=auto rd.lvm.lv=VolGroup/LogVol06 rd.lvm.lv=VolGroup/lv_swap rhgb quiet rd.shell=0 audit=1 audit_backlog_limit=8192"
Rationale	audit_backlog_limit sets the queue length for audit events awaiting transfer to the audit daemon. Until the audit daemon is up and running, all log messages are stored in this queue. If the queue is overrun during boot process, the action defined by audit failure flag is taken.
Warnings	warning The GRUB 2 configuration file, `grub.cfg`, is automatically updated each time a new kernel is installed. Note that any changes to `/etc/default/grub` require rebuilding the `grub.cfg` file. To update the GRUB 2 configuration file manually, use the grub2-mkconfig -o command as follows: On BIOS-based machines, issue the following command as `root`: ~]# grub2-mkconfig -o /boot/grub2/grub.cfg On UEFI-based machines, issue the following command as `root`: ~]# grub2-mkconfig -o /boot/efi/EFI/redhat/grub.cfg

Disable Mounting of cramfs

Rule ID	xccdf_org.ssgproject.content_rule_kernel_module_cramfs_disabled
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	low
Identifiers and References	Identifiers: CCE-81031-7 References: 1.1.1.1, 3.4.6, CM-7(a), CM-7(b), CM-6(a), PR.IP-1, PR.PT-3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2, 11, 14, 3, 9, SRG-OS-000095-GPOS-00049
Description	To configure the system to prevent the `cramfs` kernel module from being loaded, add the following line to a file in the directory `/etc/modprobe.d`: install cramfs /bin/true This effectively prevents usage of this uncommon filesystem. The `cramfs` filesystem type is a compressed read-only Linux filesystem embedded in small footprint systems. A `cramfs` image can be used without having to first decompress the image.
Rationale	Removing support for unneeded filesystem types reduces the local attack surface of the server.

Add nosuid Option to /var/log/audit

Rule ID	xccdf_org.ssgproject.content_rule_mount_option_var_log_audit_nosuid
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-82921-8 References: CM-7(a), CM-7(b), CM-6(a), AC-6, AC-6(1), MP-7, PR.IP-1, PR.PT-2, PR.PT-3, SRG-OS-000368-GPOS-00154
Description	The `nosuid` mount option can be used to prevent execution of setuid programs in `/var/log/audit`. The SUID and SGID permissions should not be required in directories containing audit log files. Add the `nosuid` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/var/log/audit`.
Rationale	The presence of SUID and SGID executables should be tightly controlled. Users should not be able to execute SUID or SGID binaries from partitions designated for audit log files.

Add nosuid Option to /var/tmp

Rule ID	xccdf_org.ssgproject.content_rule_mount_option_var_tmp_nosuid
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	unknown
Identifiers and References	Identifiers: CCE-82154-6 References: 1.1.9, BP28(R12), SRG-OS-000368-GPOS-00154
Description	The `nosuid` mount option can be used to prevent execution of setuid programs in `/var/tmp`. The SUID and SGID permissions should not be required in these world-writable directories. Add the `nosuid` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/var/tmp`.
Rationale	The presence of SUID and SGID executables should be tightly controlled. Users should not be able to execute SUID or SGID binaries from temporary storage partitions.

Add nosuid Option to /tmp

Rule ID	xccdf_org.ssgproject.content_rule_mount_option_tmp_nosuid
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	unknown
Identifiers and References	Identifiers: CCE-82140-5 References: 1.1.4, CM-7(a), CM-7(b), CM-6(a), AC-6, AC-6(1), MP-7, PR.IP-1, PR.PT-2, PR.PT-3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS05.06, DSS06.06, A.11.2.9, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.8.2.1, A.8.2.2, A.8.2.3, A.8.3.1, A.8.3.3, A.9.1.2, 11, 13, 14, 3, 8, 9, BP28(R12), SRG-OS-000368-GPOS-00154
Description	The `nosuid` mount option can be used to prevent execution of setuid programs in `/tmp`. The SUID and SGID permissions should not be required in these world-writable directories. Add the `nosuid` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/tmp`.
Rationale	The presence of SUID and SGID executables should be tightly controlled. Users should not be able to execute SUID or SGID binaries from temporary storage partitions.

Add noexec Option to /tmp

Rule ID	xccdf_org.ssgproject.content_rule_mount_option_tmp_noexec
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	unknown
Identifiers and References	Identifiers: CCE-82139-7 References: 1.1.5, CM-7(a), CM-7(b), CM-6(a), AC-6, AC-6(1), MP-7, PR.IP-1, PR.PT-2, PR.PT-3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS05.06, DSS06.06, A.11.2.9, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.8.2.1, A.8.2.2, A.8.2.3, A.8.3.1, A.8.3.3, A.9.1.2, 11, 13, 14, 3, 8, 9, BP28(R12), SRG-OS-000368-GPOS-00154
Description	The `noexec` mount option can be used to prevent binaries from being executed out of `/tmp`. Add the `noexec` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/tmp`.
Rationale	Allowing users to execute binaries from world-writable directories such as `/tmp` should never be necessary in normal operation and can expose the system to potential compromise.

Add nosuid Option to /boot

Rule ID	xccdf_org.ssgproject.content_rule_mount_option_boot_nosuid
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-81033-3 References: CM-7(a), CM-7(b), CM-6(a), AC-6, AC-6(1), MP-7, PR.IP-1, PR.PT-2, PR.PT-3, SRG-OS-000368-GPOS-00154, BP28(R12)
Description	The `nosuid` mount option can be used to prevent execution of setuid programs in `/boot`. The SUID and SGID permissions should not be required on the boot partition. Add the `nosuid` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/boot`.
Rationale	The presence of SUID and SGID executables should be tightly controlled. Users should not be able to execute SUID or SGID binaries from boot partitions.

Add nodev Option to /var/tmp

Rule ID	xccdf_org.ssgproject.content_rule_mount_option_var_tmp_nodev
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	unknown
Identifiers and References	Identifiers: CCE-82068-8 References: 1.1.8, BP28(R12), SRG-OS-000368-GPOS-00154
Description	The `nodev` mount option can be used to prevent device files from being created in `/var/tmp`. Legitimate character and block devices should not exist within temporary directories like `/var/tmp`. Add the `nodev` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/var/tmp`.
Rationale	The only legitimate location for device files is the `/dev` directory located on the root partition. The only exception to this is chroot jails.

Add nosuid Option to /var/log

Rule ID	xccdf_org.ssgproject.content_rule_mount_option_var_log_nosuid
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-82065-4 References: CM-7(a), CM-7(b), CM-6(a), AC-6, AC-6(1), MP-7, PR.IP-1, PR.PT-2, PR.PT-3, SRG-OS-000368-GPOS-00154, BP28(R12)
Description	The `nosuid` mount option can be used to prevent execution of setuid programs in `/var/log`. The SUID and SGID permissions should not be required in directories containing log files. Add the `nosuid` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/var/log`.
Rationale	The presence of SUID and SGID executables should be tightly controlled. Users should not be able to execute SUID or SGID binaries from partitions designated for log files.

Add nodev Option to /boot

Rule ID	xccdf_org.ssgproject.content_rule_mount_option_boot_nodev
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-82941-6 References: CM-7(a), CM-7(b), CM-6(a), AC-6, AC-6(1), MP-7, PR.IP-1, PR.PT-2, PR.PT-3, SRG-OS-000368-GPOS-00154
Description	The `nodev` mount option can be used to prevent device files from being created in `/boot`. Legitimate character and block devices should exist only in the `/dev` directory on the root partition or within chroot jails built for system services. Add the `nodev` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/boot`.
Rationale	The only legitimate location for device files is the `/dev` directory located on the root partition. The only exception to this is chroot jails.

Add nodev Option to /dev/shm

Rule ID	xccdf_org.ssgproject.content_rule_mount_option_dev_shm_nodev
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	low
Identifiers and References	Identifiers: CCE-80837-8 References: 1.1.5, CCI-001764, CM-7(a), CM-7(b), CM-6(a), AC-6, AC-6(1), MP-7, PR.IP-1, PR.PT-2, PR.PT-3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS05.06, DSS06.06, A.11.2.9, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.8.2.1, A.8.2.2, A.8.2.3, A.8.3.1, A.8.3.3, A.9.1.2, 11, 13, 14, 3, 8, 9, SRG-OS-000368-GPOS-00154
Description	The `nodev` mount option can be used to prevent creation of device files in `/dev/shm`. Legitimate character and block devices should not exist within temporary directories like `/dev/shm`. Add the `nodev` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/dev/shm`.
Rationale	The only legitimate location for device files is the `/dev` directory located on the root partition. The only exception to this is chroot jails.

Add nodev Option to /tmp

Rule ID	xccdf_org.ssgproject.content_rule_mount_option_tmp_nodev
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	unknown
Identifiers and References	Identifiers: CCE-82623-0 References: 1.1.3, CM-7(a), CM-7(b), CM-6(a), AC-6, AC-6(1), MP-7, PR.IP-1, PR.PT-2, PR.PT-3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS05.06, DSS06.06, A.11.2.9, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.8.2.1, A.8.2.2, A.8.2.3, A.8.3.1, A.8.3.3, A.9.1.2, 11, 13, 14, 3, 8, 9, BP28(R12), SRG-OS-000368-GPOS-00154
Description	The `nodev` mount option can be used to prevent device files from being created in `/tmp`. Legitimate character and block devices should not exist within temporary directories like `/tmp`. Add the `nodev` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/tmp`.
Rationale	The only legitimate location for device files is the `/dev` directory located on the root partition. The only exception to this is chroot jails.

Add noexec Option to /dev/shm

Rule ID	xccdf_org.ssgproject.content_rule_mount_option_dev_shm_noexec
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	low
Identifiers and References	Identifiers: CCE-80838-6 References: 1.1.17, CCI-001764, CM-7(a), CM-7(b), CM-6(a), AC-6, AC-6(1), MP-7, PR.IP-1, PR.PT-2, PR.PT-3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS05.06, DSS06.06, A.11.2.9, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.8.2.1, A.8.2.2, A.8.2.3, A.8.3.1, A.8.3.3, A.9.1.2, 11, 13, 14, 3, 8, 9, SRG-OS-000368-GPOS-00154
Description	The `noexec` mount option can be used to prevent binaries from being executed out of `/dev/shm`. It can be dangerous to allow the execution of binaries from world-writable temporary storage directories such as `/dev/shm`. Add the `noexec` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/dev/shm`.
Rationale	Allowing users to execute binaries from world-writable directories such as `/dev/shm` can expose the system to potential compromise.

Add nodev Option to /var/log

Rule ID	xccdf_org.ssgproject.content_rule_mount_option_var_log_nodev
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-82077-9 References: CM-7(a), CM-7(b), CM-6(a), AC-6, AC-6(1), MP-7, PR.IP-1, PR.PT-2, PR.PT-3, SRG-OS-000368-GPOS-00154
Description	The `nodev` mount option can be used to prevent device files from being created in `/var/log`. Legitimate character and block devices should exist only in the `/dev` directory on the root partition or within chroot jails built for system services. Add the `nodev` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/var/log`.
Rationale	The only legitimate location for device files is the `/dev` directory located on the root partition. The only exception to this is chroot jails.

Add noexec Option to /var/log

Rule ID	xccdf_org.ssgproject.content_rule_mount_option_var_log_noexec
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-82008-4 References: CM-7(a), CM-7(b), CM-6(a), AC-6, AC-6(1), MP-7, PR.IP-1, PR.PT-2, PR.PT-3, SRG-OS-000368-GPOS-00154, BP28(R12)
Description	The `noexec` mount option can be used to prevent binaries from being executed out of `/var/log`. Add the `noexec` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/var/log`.
Rationale	Allowing users to execute binaries from directories containing log files such as `/var/log` should never be necessary in normal operation and can expose the system to potential compromise.

Add noexec Option to /var/tmp

Rule ID	xccdf_org.ssgproject.content_rule_mount_option_var_tmp_noexec
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	unknown
Identifiers and References	Identifiers: CCE-82151-2 References: 1.1.10, BP28(R12), SRG-OS-000368-GPOS-00154
Description	The `noexec` mount option can be used to prevent binaries from being executed out of `/var/tmp`. Add the `noexec` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/var/tmp`.
Rationale	Allowing users to execute binaries from world-writable directories such as `/var/tmp` should never be necessary in normal operation and can expose the system to potential compromise.

Add nosuid Option to /home

Rule ID	xccdf_org.ssgproject.content_rule_mount_option_home_nosuid
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-81050-7 References: CCI-000366, 1.1.3, CM-7(a), CM-7(b), CM-6(a), AC-6, AC-6(1), MP-7, PR.IP-1, PR.PT-2, PR.PT-3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS05.06, DSS06.06, A.11.2.9, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.8.2.1, A.8.2.2, A.8.2.3, A.8.3.1, A.8.3.3, A.9.1.2, 11, 13, 14, 3, 8, 9, BP28(R12), SRG-OS-000368-GPOS-00154, SRG-OS-000480-GPOS-00227
Description	The `nosuid` mount option can be used to prevent execution of setuid programs in `/home`. The SUID and SGID permissions should not be required in these user data directories. Add the `nosuid` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/home`.
Rationale	The presence of SUID and SGID executables should be tightly controlled. Users should not be able to execute SUID or SGID binaries from user home directory partitions.

Add nodev Option to /var

Rule ID	xccdf_org.ssgproject.content_rule_mount_option_var_nodev
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-82062-1 References: CM-7(a), CM-7(b), CM-6(a), AC-6, AC-6(1), MP-7, PR.IP-1, PR.PT-2, PR.PT-3, SRG-OS-000368-GPOS-00154
Description	The `nodev` mount option can be used to prevent device files from being created in `/var`. Legitimate character and block devices should exist only in the `/dev` directory on the root partition or within chroot jails built for system services. Add the `nodev` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/var`.
Rationale	The only legitimate location for device files is the `/dev` directory located on the root partition. The only exception to this is chroot jails.

Add noexec Option to /var/log/audit

Rule ID	xccdf_org.ssgproject.content_rule_mount_option_var_log_audit_noexec
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-82975-4 References: CM-7(a), CM-7(b), CM-6(a), AC-6, AC-6(1), MP-7, PR.IP-1, PR.PT-2, PR.PT-3, SRG-OS-000368-GPOS-00154
Description	The `noexec` mount option can be used to prevent binaries from being executed out of `/var/log/audit`. Add the `noexec` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/var/log/audit`.
Rationale	Allowing users to execute binaries from directories containing audit log files such as `/var/log/audit` should never be necessary in normal operation and can expose the system to potential compromise.

Add nodev Option to Non-Root Local Partitions

Rule ID	xccdf_org.ssgproject.content_rule_mount_option_nodev_nonroot_local_partitions
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	unknown
Identifiers and References	Identifiers: CCE-82069-6 References: 1.1.11, CM-7(a), CM-7(b), CM-6(a), AC-6, AC-6(1), MP-7, PR.IP-1, PR.PT-3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2, 11, 14, 3, 9, SRG-OS-000368-GPOS-00154, BP28(R12)
Description	The `nodev` mount option prevents files from being interpreted as character or block devices. Legitimate character and block devices should exist only in the `/dev` directory on the root partition or within chroot jails built for system services. Add the `nodev` option to the fourth column of `/etc/fstab` for the line which controls mounting of any non-root local partitions.
Rationale	The `nodev` mount option prevents files from being interpreted as character or block devices. The only legitimate location for device files is the `/dev` directory located on the root partition. The only exception to this is chroot jails, for which it is not advised to set `nodev` on these filesystems.

Add nodev Option to /var/log/audit

Rule ID	xccdf_org.ssgproject.content_rule_mount_option_var_log_audit_nodev
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-82080-3 References: CM-7(a), CM-7(b), CM-6(a), AC-6, AC-6(1), MP-7, PR.IP-1, PR.PT-2, PR.PT-3, SRG-OS-000368-GPOS-00154
Description	The `nodev` mount option can be used to prevent device files from being created in `/var/log/audit`. Legitimate character and block devices should exist only in the `/dev` directory on the root partition or within chroot jails built for system services. Add the `nodev` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/var/log/audit`.
Rationale	The only legitimate location for device files is the `/dev` directory located on the root partition. The only exception to this is chroot jails.

Add nosuid Option to /dev/shm

Rule ID	xccdf_org.ssgproject.content_rule_mount_option_dev_shm_nosuid
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	low
Identifiers and References	Identifiers: CCE-80839-4 References: 1.1.16, CCI-001764, CM-7(a), CM-7(b), CM-6(a), AC-6, AC-6(1), MP-7, PR.IP-1, PR.PT-2, PR.PT-3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS05.06, DSS06.06, A.11.2.9, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.8.2.1, A.8.2.2, A.8.2.3, A.8.3.1, A.8.3.3, A.9.1.2, 11, 13, 14, 3, 8, 9, SRG-OS-000368-GPOS-00154
Description	The `nosuid` mount option can be used to prevent execution of setuid programs in `/dev/shm`. The SUID and SGID permissions should not be required in these world-writable directories. Add the `nosuid` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/dev/shm`.
Rationale	The presence of SUID and SGID executables should be tightly controlled. Users should not be able to execute SUID or SGID binaries from temporary storage partitions.

Add nodev Option to /home

Rule ID	xccdf_org.ssgproject.content_rule_mount_option_home_nodev
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	unknown
Identifiers and References	Identifiers: CCE-81048-1 References: 1.1.14, BP28(R12), SRG-OS-000368-GPOS-00154
Description	The `nodev` mount option can be used to prevent device files from being created in `/home`. Legitimate character and block devices should exist only in the `/dev` directory on the root partition or within chroot jails built for system services. Add the `nodev` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/home`.
Rationale	The only legitimate location for device files is the `/dev` directory located on the root partition. The only exception to this is chroot jails.

Enable page allocator poisoning

Rule ID	xccdf_org.ssgproject.content_rule_grub2_page_poison_argument
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-80944-2 References: SRG-OS-000480-GPOS-00227, CM-6(a)
Description	To enable poisoning of free pages, add the argument `page_poison=1` to the default GRUB 2 command line for the Linux operating system in `/etc/default/grub`, in the manner below: GRUB_CMDLINE_LINUX="page_poison=1"
Rationale	Poisoning writes an arbitrary value to freed pages, so any modification or reference to that page after being freed or before being initialized will be detected and prevented. This prevents many types of use-after-free vulnerabilities at little performance cost. Also prevents leak of data and detection of corrupted memory.
Warnings	warning The GRUB 2 configuration file, `grub.cfg`, is automatically updated each time a new kernel is installed. Note that any changes to `/etc/default/grub` require rebuilding the `grub.cfg` file. To update the GRUB 2 configuration file manually, use the grub2-mkconfig -o command as follows: On BIOS-based machines, issue the following command as `root`: ~]# grub2-mkconfig -o /boot/grub2/grub.cfg On UEFI-based machines, issue the following command as `root`: ~]# grub2-mkconfig -o /boot/efi/EFI/redhat/grub.cfg

Enable SLUB/SLAB allocator poisoning

Rule ID	xccdf_org.ssgproject.content_rule_grub2_slub_debug_argument
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-80945-9 References: SRG-OS-000433-GPOS-00192, CM-6(a)
Description	To enable poisoning of SLUB/SLAB objects, add the argument `slub_debug=P` to the default GRUB 2 command line for the Linux operating system in `/etc/default/grub`, in the manner below: GRUB_CMDLINE_LINUX="slub_debug=P"
Rationale	Poisoning writes an arbitrary value to freed objects, so any modification or reference to that object after being freed or before being initialized will be detected and prevented. This prevents many types of use-after-free vulnerabilities at little performance cost. Also prevents leak of data and detection of corrupted memory.
Warnings	warning The GRUB 2 configuration file, `grub.cfg`, is automatically updated each time a new kernel is installed. Note that any changes to `/etc/default/grub` require rebuilding the `grub.cfg` file. To update the GRUB 2 configuration file manually, use the grub2-mkconfig -o command as follows: On BIOS-based machines, issue the following command as `root`: ~]# grub2-mkconfig -o /boot/grub2/grub.cfg On UEFI-based machines, issue the following command as `root`: ~]# grub2-mkconfig -o /boot/efi/EFI/redhat/grub.cfg

Restrict Exposed Kernel Pointer Addresses Access

Rule ID	xccdf_org.ssgproject.content_rule_sysctl_kernel_kptr_restrict
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-80915-2 References: BP28(R23), SC-30, SC-30(2), SC-30(5), CM-6(a), SRG-OS-000132-GPOS-00067
Description	To set the runtime status of the `kernel.kptr_restrict` kernel parameter, run the following command: $ sudo sysctl -w kernel.kptr_restrict=1 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: kernel.kptr_restrict = 1
Rationale	Exposing kernel pointers (through procfs or `seq_printf()`) exposes kernel writeable structures that can contain functions pointers. If a write vulnereability occurs in the kernel allowing a write access to any of this structure, the kernel can be compromise. This option disallow any program withtout the CAP_SYSLOG capability from getting the kernel pointers addresses, replacing them with 0.

Disable acquiring, saving, and processing core dumps

Rule ID	xccdf_org.ssgproject.content_rule_service_systemd-coredump_disabled
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	unknown
Identifiers and References	Identifiers: CCE-82881-4 References: FMT_SMF_EXT.1, SRG-OS-000480-GPOS-00227
Description	The `systemd-coredump.socket` unit is a socket activation of the `systemd-coredump@.service` which processes core dumps. By masking the unit, core dump processing is disabled.
Rationale	A core dump includes a memory image taken at the time the operating system terminates an application. The memory image could contain sensitive data and is generally useful only for developers trying to debug problems.

Disable Core Dumps for All Users

Rule ID	xccdf_org.ssgproject.content_rule_disable_users_coredumps
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	unknown
Identifiers and References	Identifiers: CCE-81038-2 References: 1.6.1, DE.CM-1, PR.DS-4, SR 6.2, SR 7.1, SR 7.2, APO13.01, BAI04.04, DSS01.03, DSS03.05, DSS05.07, A.12.1.3, A.17.2.1, 1, 12, 13, 15, 16, 2, 7, 8, SRG-OS-000480-GPOS-00227
Description	To disable core dumps for all users, add the following line to `/etc/security/limits.conf`, or to a file within the `/etc/security/limits.d/` directory: * hard core 0
Rationale	A core dump includes a memory image taken at the time the operating system terminates an application. The memory image could contain sensitive data and is generally useful only for developers trying to debug problems.

Disable core dump backtraces

Rule ID xccdf_org.ssgproject.content_rule_coredump_disable_backtraces

Result

fail

Multi-check rule no

OVAL Definition ID oval:ssg-coredump_disable_backtraces:def:1

Time 2021-02-11T19:31:22+00:00

Severity unknown

Identifiers and References

Identifiers: CCE-82251-0

References: FMT_SMF_EXT.1, SRG-OS-000480-GPOS-00227, 1.6.1

Description

The ProcessSizeMax option in [Coredump] section of /etc/systemd/coredump.conf specifies the maximum size in bytes of a core which will be processed. Core dumps exceeding this size may be stored, but the backtrace will not be generated.

Rationale

A core dump includes a memory image taken at the time the operating system terminates an application. The memory image could contain sensitive data and is generally useful only for developers or system operators trying to debug problems. Enabling core dumps on production systems is not recommended, however there may be overriding operational requirements to enable advanced debuging. Permitting temporary enablement of core dumps during such situations should be reviewed through local needs and policy.

Warnings

warning If the /etc/systemd/coredump.conf file does not already contain the [Coredump] section, the value will not be configured correctly.

Remediation Shell script ⇲

Complexity:	low
Disruption:	low
Strategy:	restrict

if [ -e "/etc/systemd/coredump.conf" ] ; then
    LC_ALL=C sed -i "/^\s*ProcessSizeMax\s*=\s*/Id" "/etc/systemd/coredump.conf"
else
    touch "/etc/systemd/coredump.conf"
fi
cp "/etc/systemd/coredump.conf" "/etc/systemd/coredump.conf.bak"
# Insert at the end of the file
printf '%s\n' "ProcessSizeMax=0" >> "/etc/systemd/coredump.conf"
# Clean up after ourselves.
rm "/etc/systemd/coredump.conf.bak"

Remediation Ansible snippet ⇲

Complexity:	low
Disruption:	low
Strategy:	restrict

- name: Disable core dump backtraces
  block:

    - name: Deduplicate values from /etc/systemd/coredump.conf
      lineinfile:
        path: /etc/systemd/coredump.conf
        create: false
        regexp: ^\s*ProcessSizeMax\s*=\s*
        state: absent

    - name: Insert correct line to /etc/systemd/coredump.conf
      lineinfile:
        path: /etc/systemd/coredump.conf
        create: false
        line: ProcessSizeMax=0
        state: present
  tags:
    - CCE-82251-0
    - coredump_disable_backtraces
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - restrict_strategy
    - unknown_severity

Remediation script ⇲

apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,%23%20%20This%20file%20is%20part%20of%20systemd.%0A%23%0A%23%20%20systemd%20is%20free%20software%3B%20you%20can%20redistribute%20it%20and/or%20modify%20it%0A%23%20%20under%20the%20terms%20of%20the%20GNU%20Lesser%20General%20Public%20License%20as%20published%20by%0A%23%20%20the%20Free%20Software%20Foundation%3B%20either%20version%202.1%20of%20the%20License%2C%20or%0A%23%20%20%28at%20your%20option%29%20any%20later%20version.%0A%23%0A%23%20Entries%20in%20this%20file%20show%20the%20compile%20time%20defaults.%0A%23%20You%20can%20change%20settings%20by%20editing%20this%20file.%0A%23%20Defaults%20can%20be%20restored%20by%20simply%20deleting%20this%20file.%0A%23%0A%23%20See%20coredump.conf%285%29%20for%20details.%0A%0A%5BCoredump%5D%0A%23Storage%3Dexternal%0A%23Compress%3Dyes%0A%23ProcessSizeMax%3D2G%0A%23ExternalSizeMax%3D2G%0A%23JournalSizeMax%3D767M%0A%23MaxUse%3D%0A%23KeepFree%3D%0AStorage%3Dnone%0AProcessSizeMax%3D0%0A
        mode: 0644
        path: /etc/systemd/coredump.conf
        overwrite: true

OVAL test results details

tests the value of ProcessSizeMax setting in the /etc/systemd/coredump.conf file oval:ssg-test_coredump_disable_backtraces:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_coredump_disable_backtraces:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/etc/systemd/coredump.conf	^\s\[Coredump\].(?:\n\s[^[\s].)\n^[ \t](?i)ProcessSizeMax(?-i)[ \t]=[ \t](.+?)[ \t]*(?:$\|#)	1

Disable storing core dump

Rule ID xccdf_org.ssgproject.content_rule_coredump_disable_storage

Result

fail

Multi-check rule no

OVAL Definition ID oval:ssg-coredump_disable_storage:def:1

Time 2021-02-11T19:31:22+00:00

Severity unknown

Identifiers and References

Identifiers: CCE-82252-8

References: FMT_SMF_EXT.1, SRG-OS-000480-GPOS-00227, 1.6.1

Description

The Storage option in [Coredump] section of /etc/systemd/coredump.conf can be set to none to disable storing core dumps permanently.

Rationale

Warnings

warning If the /etc/systemd/coredump.conf file does not already contain the [Coredump] section, the value will not be configured correctly.

Remediation Shell script ⇲

Complexity:	low
Disruption:	low
Strategy:	restrict

if [ -e "/etc/systemd/coredump.conf" ] ; then
    LC_ALL=C sed -i "/^\s*Storage\s*=\s*/Id" "/etc/systemd/coredump.conf"
else
    touch "/etc/systemd/coredump.conf"
fi
cp "/etc/systemd/coredump.conf" "/etc/systemd/coredump.conf.bak"
# Insert at the end of the file
printf '%s\n' "Storage=none" >> "/etc/systemd/coredump.conf"
# Clean up after ourselves.
rm "/etc/systemd/coredump.conf.bak"

Remediation Ansible snippet ⇲

Complexity:	low
Disruption:	low
Strategy:	restrict

- name: Disable storing core dump
  block:

    - name: Deduplicate values from /etc/systemd/coredump.conf
      lineinfile:
        path: /etc/systemd/coredump.conf
        create: false
        regexp: ^\s*Storage\s*=\s*
        state: absent

    - name: Insert correct line to /etc/systemd/coredump.conf
      lineinfile:
        path: /etc/systemd/coredump.conf
        create: false
        line: Storage=none
        state: present
  tags:
    - CCE-82252-8
    - coredump_disable_storage
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - restrict_strategy
    - unknown_severity

Remediation script ⇲

apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,%23%20%20This%20file%20is%20part%20of%20systemd.%0A%23%0A%23%20%20systemd%20is%20free%20software%3B%20you%20can%20redistribute%20it%20and/or%20modify%20it%0A%23%20%20under%20the%20terms%20of%20the%20GNU%20Lesser%20General%20Public%20License%20as%20published%20by%0A%23%20%20the%20Free%20Software%20Foundation%3B%20either%20version%202.1%20of%20the%20License%2C%20or%0A%23%20%20%28at%20your%20option%29%20any%20later%20version.%0A%23%0A%23%20Entries%20in%20this%20file%20show%20the%20compile%20time%20defaults.%0A%23%20You%20can%20change%20settings%20by%20editing%20this%20file.%0A%23%20Defaults%20can%20be%20restored%20by%20simply%20deleting%20this%20file.%0A%23%0A%23%20See%20coredump.conf%285%29%20for%20details.%0A%0A%5BCoredump%5D%0A%23Storage%3Dexternal%0A%23Compress%3Dyes%0A%23ProcessSizeMax%3D2G%0A%23ExternalSizeMax%3D2G%0A%23JournalSizeMax%3D767M%0A%23MaxUse%3D%0A%23KeepFree%3D%0AStorage%3Dnone%0AProcessSizeMax%3D0%0A
        mode: 0644
        path: /etc/systemd/coredump.conf
        overwrite: true

OVAL test results details

tests the value of Storage setting in the /etc/systemd/coredump.conf file oval:ssg-test_coredump_disable_storage:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_coredump_disable_storage:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/etc/systemd/coredump.conf	^\s\[Coredump\].(?:\n\s[^[\s].)\n^[ \t](?i)Storage(?-i)[ \t]=[ \t](.+?)[ \t]*(?:$\|#)	1

Restrict Access to Kernel Message Buffer

Rule ID	xccdf_org.ssgproject.content_rule_sysctl_kernel_dmesg_restrict
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-80913-7 References: 3.1.5, CCI-001314, 164.308(a)(1)(ii)(D), 164.308(a)(3), 164.308(a)(4), 164.310(b), 164.310(c), 164.312(a), 164.312(e), SI-11(a), SI-11(b), BP28(R23), SRG-OS-000132-GPOS-00067
Description	To set the runtime status of the `kernel.dmesg_restrict` kernel parameter, run the following command: $ sudo sysctl -w kernel.dmesg_restrict=1 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: kernel.dmesg_restrict = 1
Rationale	Unprivileged access to the kernel syslog can expose sensitive kernel address information.

Disable Kernel Image Loading

Rule ID	xccdf_org.ssgproject.content_rule_sysctl_kernel_kexec_load_disabled
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-80952-5 References: SRG-OS-000480-GPOS-00227
Description	To set the runtime status of the `kernel.kexec_load_disabled` kernel parameter, run the following command: $ sudo sysctl -w kernel.kexec_load_disabled=1 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: kernel.kexec_load_disabled = 1
Rationale	Disabling kexec_load allows greater control of the kernel memory. It makes it impossible to load another kernel image after it has been disabled.

Disable the use of user namespaces

Rule ID	xccdf_org.ssgproject.content_rule_sysctl_user_max_user_namespaces
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	info
Identifiers and References	Identifiers: CCE-82211-4 References: FMT_SMF_EXT.1, SC-39, CM-6(a), SRG-OS-000480-GPOS-00227
Description	To set the runtime status of the `user.max_user_namespaces` kernel parameter, run the following command: $ sudo sysctl -w user.max_user_namespaces=0 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: user.max_user_namespaces = 0 When containers are deployed on the machine, the value should be set to large non-zero value.
Rationale	User namespaces are used primarily for Linux containers. The value 0 disallows the use of user namespaces.
Warnings	warning This configuration baseline was created to deploy the base operating system for general purpose workloads. When the operating system is configured for certain purposes, such as to host Linux Containers, it is expected that `user.max_user_namespaces` will be enabled.

Disable storing core dumps

Rule ID	xccdf_org.ssgproject.content_rule_sysctl_kernel_core_pattern
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	unknown
Identifiers and References	Identifiers: CCE-82215-5 References: FMT_SMF_EXT.1, SRG-OS-000480-GPOS-00227
Description	To set the runtime status of the `kernel.core_pattern` kernel parameter, run the following command: $ sudo sysctl -w kernel.core_pattern=\|/bin/false To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: kernel.core_pattern = \|/bin/false
Rationale	A core dump includes a memory image taken at the time the operating system terminates an application. The memory image could contain sensitive data and is generally useful only for developers trying to debug problems.

Disable Access to Network bpf() Syscall From Unprivileged Processes

Rule ID	xccdf_org.ssgproject.content_rule_sysctl_kernel_unprivileged_bpf_disabled
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-82974-7 References: FMT_SMF_EXT.1, SRG-OS-000132-GPOS-00067
Description	To set the runtime status of the `kernel.unprivileged_bpf_disabled` kernel parameter, run the following command: $ sudo sysctl -w kernel.unprivileged_bpf_disabled=1 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: kernel.unprivileged_bpf_disabled = 1
Rationale	Loading and accessing the packet filters programs and maps using the bpf() syscall has the potential of revealing sensitive information about the kernel state.

Restrict usage of ptrace to descendant processes

Rule ID	xccdf_org.ssgproject.content_rule_sysctl_kernel_yama_ptrace_scope
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-80953-3 References: BP28(R25), SRG-OS-000132-GPOS-00067
Description	To set the runtime status of the `kernel.yama.ptrace_scope` kernel parameter, run the following command: $ sudo sysctl -w kernel.yama.ptrace_scope=1 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: kernel.yama.ptrace_scope = 1
Rationale	Unrestricted usage of ptrace allows compromised binaries to run ptrace on another processes of the user. Like this, the attacker can steal sensitive information from the target processes (e.g. SSH sessions, web browser, ...) without any additional assistance from the user (i.e. without resorting to phishing).

Disallow kernel profiling by unprivileged users

Rule ID	xccdf_org.ssgproject.content_rule_sysctl_kernel_perf_event_paranoid
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-81054-9 References: BP28(R23), FMT_SMF_EXT.1, SRG-OS-000132-GPOS-00067
Description	To set the runtime status of the `kernel.perf_event_paranoid` kernel parameter, run the following command: $ sudo sysctl -w kernel.perf_event_paranoid=2 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: kernel.perf_event_paranoid = 2
Rationale	Kernel profiling can reveal sensitive information about kernel behaviour.

Harden the operation of the BPF just-in-time compiler

Rule ID	xccdf_org.ssgproject.content_rule_sysctl_net_core_bpf_jit_harden
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-82934-1 References: FMT_SMF_EXT.1, SRG-OS-000480-GPOS-00227
Description	To set the runtime status of the `net.core.bpf_jit_harden` kernel parameter, run the following command: $ sudo sysctl -w net.core.bpf_jit_harden=2 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: net.core.bpf_jit_harden = 2
Rationale	When hardened, the extended Berkeley Packet Filter just-in-time compiler will randomize any kernel addresses in the BPF programs and maps, and will not expose the JIT addresses in `/proc/kallsyms`.

Enable Kernel Parameter to Enforce DAC on Hardlinks

Rule ID	xccdf_org.ssgproject.content_rule_sysctl_fs_protected_hardlinks
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	unknown
Identifiers and References	Identifiers: CCE-81027-5 References: BP28(R23), 1.6.1, CM-6(a), AC-6(1), SRG-OS-000324-GPOS-00125
Description	To set the runtime status of the `fs.protected_hardlinks` kernel parameter, run the following command: $ sudo sysctl -w fs.protected_hardlinks=1 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: fs.protected_hardlinks = 1
Rationale	By enabling this kernel parameter, users can no longer create soft or hard links to files which they do not own. Disallowing such hardlinks mitigate vulnerabilities based on insecure file system accessed by privileged programs, avoiding an exploitation vector exploiting unsafe use of `open()` or `creat()`.

Enable Kernel Parameter to Enforce DAC on Symlinks

Rule ID	xccdf_org.ssgproject.content_rule_sysctl_fs_protected_symlinks
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	unknown
Identifiers and References	Identifiers: CCE-81030-9 References: BP28(R23), 1.6.1, CM-6(a), AC-6(1), SRG-OS-000324-GPOS-00125
Description	To set the runtime status of the `fs.protected_symlinks` kernel parameter, run the following command: $ sudo sysctl -w fs.protected_symlinks=1 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: fs.protected_symlinks = 1
Rationale	By enabling this kernel parameter, symbolic links are permitted to be followed only when outside a sticky world-writable directory, or when the UID of the link and follower match, or when the directory owner matches the symlink's owner. Disallowing such symlinks helps mitigate vulnerabilities based on insecure file system accessed by privileged programs, avoiding an exploitation vector exploiting unsafe use of `open()` or `creat()`.

Set the UEFI Boot Loader Password

Rule ID	xccdf_org.ssgproject.content_rule_grub2_uefi_password
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	high
Identifiers and References	Identifiers: CCE-80829-5 References: 1.4.2, 3.4.5, CCI-000213, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), CM-6(a), PR.AC-4, PR.AC-6, PR.PT-3, FIA_UAU.1, SRG-OS-000080-GPOS-00048, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, DSS05.02, DSS05.04, DSS05.05, DSS05.07, DSS06.03, DSS06.06, A.6.1.2, A.7.1.1, A.9.1.2, A.9.2.1, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, 11, 12, 14, 15, 16, 18, 3, 5, BP28(R17)
Description	The grub2 boot loader should have a superuser account and password protection enabled to protect boot-time settings. Since plaintext passwords are a security risk, generate a hash for the password by running the following command: $ grub2-setpassword When prompted, enter the password that was selected. Once the superuser password has been added, update the `grub.cfg` file by running: grub2-mkconfig -o /boot/efi/EFI/redhat/grub.cfg
Rationale	Password protection on the boot loader configuration ensures users with physical access cannot trivially alter important bootloader settings. These include which kernel to use, and whether to enter single-user mode.
Warnings	warning To prevent hard-coded passwords, automatic remediation of this control is not available. Remediation must be automated as a component of machine provisioning, or followed manually as outlined above. Also, do NOT manually add the superuser account and password to the `grub.cfg` file as the grub2-mkconfig command overwrites this file.

Enable Kernel Page-Table Isolation (KPTI)

Rule ID	xccdf_org.ssgproject.content_rule_grub2_pti_argument
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	high
Identifiers and References	Identifiers: CCE-82194-2 References: SRG-OS-000433-GPOS-00193, SI-16
Description	To enable Kernel page-table isolation, add the argument `pti=on` to the default GRUB 2 command line for the Linux operating system in `/etc/default/grub`, in the manner below: GRUB_CMDLINE_LINUX="pti=on"
Rationale	Kernel page-table isolation is a kernel feature that mitigates the Meltdown security vulnerability and hardens the kernel against attempts to bypass kernel address space layout randomization (KASLR).
Warnings	warning The GRUB 2 configuration file, `grub.cfg`, is automatically updated each time a new kernel is installed. Note that any changes to `/etc/default/grub` require rebuilding the `grub.cfg` file. To update the GRUB 2 configuration file manually, use the grub2-mkconfig -o command as follows: On BIOS-based machines, issue the following command as `root`: ~]# grub2-mkconfig -o /boot/grub2/grub.cfg On UEFI-based machines, issue the following command as `root`: ~]# grub2-mkconfig -o /boot/efi/EFI/redhat/grub.cfg

Disable vsyscalls

Rule ID	xccdf_org.ssgproject.content_rule_grub2_vsyscall_argument
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	info
Identifiers and References	Identifiers: CCE-80946-7 References: SRG-OS-000480-GPOS-00227, CM-7(a)
Description	To disable use of virtual syscalls, add the argument `vsyscall=none` to the default GRUB 2 command line for the Linux operating system in `/etc/default/grub`, in the manner below: GRUB_CMDLINE_LINUX="vsyscall=none"
Rationale	Virtual Syscalls provide an opportunity of attack for a user who has control of the return instruction pointer.
Warnings	warning The GRUB 2 configuration file, `grub.cfg`, is automatically updated each time a new kernel is installed. Note that any changes to `/etc/default/grub` require rebuilding the `grub.cfg` file. To update the GRUB 2 configuration file manually, use the grub2-mkconfig -o command as follows: On BIOS-based machines, issue the following command as `root`: ~]# grub2-mkconfig -o /boot/grub2/grub.cfg On UEFI-based machines, issue the following command as `root`: ~]# grub2-mkconfig -o /boot/efi/EFI/redhat/grub.cfg

Configure kernel to trust the CPU random number generator

Rule ID	xccdf_org.ssgproject.content_rule_grub2_kernel_trust_cpu_rng
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-83314-5 References: FCS_RBG_EXT.1.1, SRG-OS-000480-GPOS-00227
Description	There exist two ways how to ensure that the Linux kernel trusts the CPU hardware random number generator. If the option is configured during kernel compilation, e.g. the option `CONFIG_RANDOM_TRUST_CPU` is set to `Y`, make sure that it is not overridden with the boot parameter. There must not exist the boot parameter `random.trust_cpu=off`. If the option is not compiled in, make sure that `random.trust_cpu=on` is configured as a boot parameter by running the following command: sudo grub2-editenv - set "$(grub2-editenv - list \| grep kernelopts) random.trust_cpu=on"
Rationale	The Linux kernel offers an option which signifies if the kernel should trust data provided by CPU hardware random number generator. Hardware random number generators can provide random data very quickly and are used to generate random cryptographic keys. They can be useful during boot time when other means of getting random data can be slow because there is not yet enough entropy in the system.

Configure TLS for rsyslog remote logging

Rule ID	xccdf_org.ssgproject.content_rule_rsyslog_remote_tls
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-82457-3 References: AU-9(3), CM-6(a), FCS_TLSC_EXT.1, FTP_ITC_EXT.1.1, SRG-OS-000480-GPOS-00227, SRG-OS-000120-GPOS-00061, 0988, 1405
Description	Configure `rsyslog` to use Transport Layer Security (TLS) support for logging to remote server for the Forwarding Output Module in `/etc/rsyslog.conf` using action. You can use the following command: echo 'action(type="omfwd" protocol="tcp" Target="<remote system>" port="6514" StreamDriver="gtls" StreamDriverMode="1" StreamDriverAuthMode="x509/name" streamdriver.CheckExtendedKeyPurpose="on")' >> /etc/rsyslog.conf Replace the `<remote system>` in the above command with an IP address or a host name of the remote logging server.
Rationale	For protection of data being logged, the connection to the remote logging server needs to be authenticated and encrypted.

Configure CA certificate for rsyslog remote logging

Rule ID	xccdf_org.ssgproject.content_rule_rsyslog_remote_tls_cacert
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-82458-1 References: FCS_TLSC_EXT.1, FTP_ITC_EXT.1.1, SRG-OS-000480-GPOS-00227, 0988, 1405
Description	Configure CA certificate for `rsyslog` logging to remote server using Transport Layer Security (TLS) using correct path for the `DefaultNetstreamDriverCAFile` global option in `/etc/rsyslog.conf`, for example with the following command: echo 'global(DefaultNetstreamDriverCAFile="/etc/pki/tls/cert.pem")' >> /etc/rsyslog.conf Replace the `/etc/pki/tls/cert.pem` in the above command with the path to the file with CA certificate generated for the purpose of remote logging.
Rationale	The CA certificate needs to be set or `rsyslog.service` fails to start with error: ca certificate is not set, cannot continue

Ensure rsyslog-gnutls is installed

Rule ID	xccdf_org.ssgproject.content_rule_package_rsyslog-gnutls_installed
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-82859-0 References: FTP_ITC_EXT.1.1, SRG-OS-000480-GPOS-00227, SRG-OS-000120-GPOS-00061
Description	TLS protocol support for rsyslog is installed. The `rsyslog-gnutls` package can be installed with the following command: $ sudo yum install rsyslog-gnutls
Rationale	The rsyslog-gnutls package provides Transport Layer Security (TLS) support for the rsyslog daemon, which enables secure remote logging.

Ensure rsyslog is Installed

Rule ID	xccdf_org.ssgproject.content_rule_package_rsyslog_installed
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-80847-7 References: BP28(R5), NT28(R46), 4.2.1.1, CCI-001311, CCI-001312, 164.312(a)(2)(ii), A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, 1, 14, 15, 16, 3, 5, 6, SRG-OS-000479-GPOS-00224, SRG-OS-000051-GPOS-00024
Description	Rsyslog is installed by default. The `rsyslog` package can be installed with the following command: $ sudo yum install rsyslog
Rationale	The rsyslog package provides the rsyslog daemon, which provides system logging services.

Disable Bluetooth Kernel Module

Rule ID	xccdf_org.ssgproject.content_rule_kernel_module_bluetooth_disabled
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-80832-9 References: 5.13.1.3, 3.1.16, CCI-000085, CCI-001551, AC-18(a), AC-18(3), CM-7(a), CM-7(b), CM-6(a), MP-7, PR.AC-3, PR.IP-1, PR.PT-3, PR.PT-4, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.04, DSS05.02, DSS05.03, DSS05.05, DSS06.06, A.11.2.6, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.2.1, A.6.2.2, A.9.1.2, 11, 12, 14, 15, 3, 8, 9, SRG-OS-000095-GPOS-00049
Description	The kernel's module loading system can be configured to prevent loading of the Bluetooth module. Add the following to the appropriate `/etc/modprobe.d` configuration file to prevent the loading of the Bluetooth module: install bluetooth /bin/true
Rationale	If Bluetooth functionality must be disabled, preventing the kernel from loading the kernel module provides an additional safeguard against its activation.

Disable CAN Support

Rule ID	xccdf_org.ssgproject.content_rule_kernel_module_can_disabled
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-82059-7 References: FMT_SMF_EXT.1, SRG-OS-000095-GPOS-00049
Description	The Controller Area Network (CAN) is a serial communications protocol which was initially developed for automotive and is now also used in marine, industrial, and medical applications. To configure the system to prevent the `can` kernel module from being loaded, add the following line to a file in the directory `/etc/modprobe.d`: install can /bin/true
Rationale	Disabling CAN protects the system against exploitation of any flaws in its implementation.

Disable IEEE 1394 (FireWire) Support

Rule ID	xccdf_org.ssgproject.content_rule_kernel_module_firewire-core_disabled
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-82005-0 References: FMT_SMF_EXT.1, SRG-OS-000095-GPOS-00049
Description	The IEEE 1394 (FireWire) is a serial bus standard for high-speed real-time communication. To configure the system to prevent the `firewire-core` kernel module from being loaded, add the following line to a file in the directory `/etc/modprobe.d`: install firewire-core /bin/true
Rationale	Disabling FireWire protects the system against exploitation of any flaws in its implementation.

Disable TIPC Support

Rule ID	xccdf_org.ssgproject.content_rule_kernel_module_tipc_disabled
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-82297-3 References: CM-7(a), CM-7(b), CM-6(a), PR.IP-1, PR.PT-3, 3.3.4, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2, 11, 14, 3, 9, FMT_SMF_EXT.1, SRG-OS-000095-GPOS-00049
Description	The Transparent Inter-Process Communication (TIPC) protocol is designed to provide communications between nodes in a cluster. To configure the system to prevent the `tipc` kernel module from being loaded, add the following line to a file in the directory `/etc/modprobe.d`: install tipc /bin/true
Rationale	Disabling TIPC protects the system against exploitation of any flaws in its implementation.
Warnings	warning This configuration baseline was created to deploy the base operating system for general purpose workloads. When the operating system is configured for certain purposes, such as a node in High Performance Computing cluster, it is expected that the `tipc` kernel module will be loaded.

Disable ATM Support

Rule ID	xccdf_org.ssgproject.content_rule_kernel_module_atm_disabled
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-82028-2 References: FMT_SMF_EXT.1, SRG-OS-000095-GPOS-00049
Description	The Asynchronous Transfer Mode (ATM) is a protocol operating on network, data link, and physical layers, based on virtual circuits and virtual paths. To configure the system to prevent the `atm` kernel module from being loaded, add the following line to a file in the directory `/etc/modprobe.d`: install atm /bin/true
Rationale	Disabling ATM protects the system against exploitation of any flaws in its implementation.

Disable SCTP Support

Rule ID	xccdf_org.ssgproject.content_rule_kernel_module_sctp_disabled
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-80834-5 References: 3.5.2, 5.10.1, 3.4.6, CM-7(a), CM-7(b), CM-6(a), PR.IP-1, PR.PT-3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2, 11, 14, 3, 9, SRG-OS-000095-GPOS-00049
Description	The Stream Control Transmission Protocol (SCTP) is a transport layer protocol, designed to support the idea of message-oriented communication, with several streams of messages within one connection. To configure the system to prevent the `sctp` kernel module from being loaded, add the following line to a file in the directory `/etc/modprobe.d`: install sctp /bin/true
Rationale	Disabling SCTP protects the system against exploitation of any flaws in its implementation.

Install firewalld Package

Rule ID	xccdf_org.ssgproject.content_rule_package_firewalld_installed
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-82998-6 References: CM-6(a), SRG-OS-000480-GPOS-00227, SRG-OS-000298-GPOS-00116, 3.4.1.1
Description	The `firewalld` package can be installed with the following command: $ sudo yum install firewalld
Rationale	The firewalld package should be installed to provide access control methods.

Verify firewalld Enabled

Rule ID	xccdf_org.ssgproject.content_rule_service_firewalld_enabled
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-80877-4 References: 3.4.2.1, 3.1.3, 3.4.7, CCI-000366, AC-4, CM-7(b), CA-3(5), SC-7(21), CM-6(a), PR.IP-1, FMT_MOF_EXT.1, SRG-OS-000480-GPOS-00227, SRG-OS-000480-GPOS-00231, SRG-OS-000480-GPOS-00232, SR 7.6, 4.3.4.3.2, 4.3.4.3.3, BAI10.01, BAI10.02, BAI10.03, BAI10.05, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, 11, 3, 9
Description	The `firewalld` service can be enabled with the following command: $ sudo systemctl enable firewalld.service
Rationale	Access control methods provide the ability to enhance system security posture by restricting services and known good IP addresses and address ranges. This prevents connections from unknown hosts and protocols.

Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces

Rule ID	xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_accept_source_route
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-81013-5 References: BP28(R22), 3.1.20, 3.2.1, CCI-000366, CM-7(a), CM-7(b), CM-6(a), DE.AE-1, ID.AM-3, PR.AC-5, PR.DS-5, PR.PT-4, SRG-OS-000480-GPOS-00227, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, 4.2.3.4, 4.3.3.4, 4.4.3.3, APO01.06, APO13.01, DSS01.05, DSS03.01, DSS05.02, DSS05.04, DSS05.07, DSS06.02, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.1.1, A.12.1.2, A.13.1.1, A.13.1.2, A.13.1.3, A.13.2.1, A.13.2.2, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, 1, 12, 13, 14, 15, 16, 18, 4, 6, 8, 9
Description	To set the runtime status of the `net.ipv6.conf.all.accept_source_route` kernel parameter, run the following command: $ sudo sysctl -w net.ipv6.conf.all.accept_source_route=0 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: net.ipv6.conf.all.accept_source_route = 0
Rationale	Source-routed packets allow the source of the packet to suggest routers forward the packet along a different path than configured on the router, which can be used to bypass network security measures. This requirement applies only to the forwarding of source-routerd traffic, such as when IPv6 forwarding is enabled and the system is functioning as a router. Accepting source-routed packets in the IPv6 protocol has few legitimate uses. It should be disabled unless it is absolutely required.

Disable Accepting ICMP Redirects for All IPv6 Interfaces

Rule ID	xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_accept_redirects
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-81009-3 References: BP28(R22), 3.3.2, 3.1.20, CCI-001551, CM-7(a), CM-7(b), CM-6(a), PR.IP-1, PR.PT-3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2, 11, 14, 3, 9, SRG-OS-000480-GPOS-00227
Description	To set the runtime status of the `net.ipv6.conf.all.accept_redirects` kernel parameter, run the following command: $ sudo sysctl -w net.ipv6.conf.all.accept_redirects=0 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: net.ipv6.conf.all.accept_redirects = 0
Rationale	An illicit ICMP redirect message could result in a man-in-the-middle attack.

Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces

Rule ID	xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_redirects
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-81010-1 References: BP28(R22), 3.3.2, 3.1.20, CCI-001551, CM-7(a), CM-7(b), CM-6(a), PR.IP-1, PR.PT-3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2, 11, 14, 3, 9, SRG-OS-000480-GPOS-00227
Description	To set the runtime status of the `net.ipv6.conf.default.accept_redirects` kernel parameter, run the following command: $ sudo sysctl -w net.ipv6.conf.default.accept_redirects=0 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: net.ipv6.conf.default.accept_redirects = 0
Rationale	An illicit ICMP redirect message could result in a man-in-the-middle attack.

Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default

Rule ID	xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_source_route
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-81015-0 References: BP28(R22), 3.1.20, CCI-000366, CM-7(a), CM-7(b), CM-6(a), DE.AE-1, ID.AM-3, PR.AC-5, PR.DS-5, PR.PT-4, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, 4.2.3.4, 4.3.3.4, 4.4.3.3, APO01.06, APO13.01, DSS01.05, DSS03.01, DSS05.02, DSS05.04, DSS05.07, DSS06.02, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.1.1, A.12.1.2, A.13.1.1, A.13.1.2, A.13.1.3, A.13.2.1, A.13.2.2, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, 1, 12, 13, 14, 15, 16, 18, 4, 6, 8, 9, SRG-OS-000480-GPOS-00227, 3.2.1
Description	To set the runtime status of the `net.ipv6.conf.default.accept_source_route` kernel parameter, run the following command: $ sudo sysctl -w net.ipv6.conf.default.accept_source_route=0 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: net.ipv6.conf.default.accept_source_route = 0
Rationale	Source-routed packets allow the source of the packet to suggest routers forward the packet along a different path than configured on the router, which can be used to bypass network security measures. This requirement applies only to the forwarding of source-routerd traffic, such as when IPv6 forwarding is enabled and the system is functioning as a router. Accepting source-routed packets in the IPv6 protocol has few legitimate uses. It should be disabled unless it is absolutely required.

Configure Accepting Router Advertisements on All IPv6 Interfaces

Rule ID	xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_accept_ra
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	unknown
Identifiers and References	Identifiers: CCE-81006-9 References: 3.2.9, 3.1.20, CM-7(a), CM-7(b), CM-6(a), PR.IP-1, PR.PT-3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2, 11, 14, 3, 9, SRG-OS-000480-GPOS-00227
Description	To set the runtime status of the `net.ipv6.conf.all.accept_ra` kernel parameter, run the following command: $ sudo sysctl -w net.ipv6.conf.all.accept_ra=0 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: net.ipv6.conf.all.accept_ra = 0
Rationale	An illicit router advertisement message could result in a man-in-the-middle attack.

Disable Accepting Router Advertisements on all IPv6 Interfaces by Default

Rule ID	xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_ra
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	unknown
Identifiers and References	Identifiers: CCE-81007-7 References: 3.2.9, 3.1.20, CM-7(a), CM-7(b), CM-6(a), PR.IP-1, PR.PT-3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2, 11, 14, 3, 9, SRG-OS-000480-GPOS-00227
Description	To set the runtime status of the `net.ipv6.conf.default.accept_ra` kernel parameter, run the following command: $ sudo sysctl -w net.ipv6.conf.default.accept_ra=0 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: net.ipv6.conf.default.accept_ra = 0
Rationale	An illicit router advertisement message could result in a man-in-the-middle attack.

Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default

Rule ID	xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_rp_filter
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-81022-6 References: CCI-000366, BP28(R22), 3.2.7, 3.1.20, CM-7(a), CM-7(b), CM-6(a), SC-7(a), DE.AE-1, DE.CM-1, ID.AM-3, PR.AC-5, PR.DS-4, PR.DS-5, PR.PT-4, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.2, SR 7.1, SR 7.2, SR 7.6, 4.2.3.4, 4.3.3.4, 4.4.3.3, APO01.06, APO13.01, BAI04.04, DSS01.03, DSS01.05, DSS03.01, DSS03.05, DSS05.02, DSS05.04, DSS05.07, DSS06.02, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.1.1, A.12.1.2, A.12.1.3, A.13.1.1, A.13.1.2, A.13.1.3, A.13.2.1, A.13.2.2, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.17.2.1, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, 1, 12, 13, 14, 15, 16, 18, 2, 4, 6, 7, 8, 9, SRG-OS-000480-GPOS-00227
Description	To set the runtime status of the `net.ipv4.conf.default.rp_filter` kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.default.rp_filter=1 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: net.ipv4.conf.default.rp_filter = 1
Rationale	Enabling reverse path filtering drops packets with source addresses that should not have been able to be received on the interface they were received on. It should not be used on systems which are routers for complicated networks, but is helpful for end hosts and routers serving small networks.

Disable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces

Rule ID	xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_secure_redirects
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-81016-8 References: BP28(R22), 3.2.3, 3.1.20, CCI-001503, CCI-001551, CM-7(a), CM-7(b), CM-6(a), SC-7(a), DE.AE-1, DE.CM-1, ID.AM-3, PR.AC-5, PR.DS-4, PR.DS-5, PR.IP-1, PR.PT-3, PR.PT-4, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.2, SR 7.1, SR 7.2, SR 7.6, 4.2.3.4, 4.3.3.4, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, 4.4.3.3, APO01.06, APO13.01, BAI04.04, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS01.05, DSS03.01, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, DSS06.02, DSS06.06, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.1.1, A.12.1.2, A.12.1.3, A.12.5.1, A.12.6.2, A.13.1.1, A.13.1.2, A.13.1.3, A.13.2.1, A.13.2.2, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.17.2.1, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, 1, 11, 12, 13, 14, 15, 16, 18, 2, 3, 4, 6, 7, 8, 9, SRG-OS-000480-GPOS-00227
Description	To set the runtime status of the `net.ipv4.conf.all.secure_redirects` kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.all.secure_redirects=0 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: net.ipv4.conf.all.secure_redirects = 0
Rationale	Accepting "secure" ICMP redirects (from those gateways listed as default gateways) has few legitimate uses. It should be disabled unless it is absolutely required.

Configure Kernel Parameter for Accepting Secure Redirects By Default

Rule ID	xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_secure_redirects
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-81017-6 References: BP28(R22), 3.2.3, 3.1.20, CCI-001551, CM-7(a), CM-7(b), SC-5, SC-7(a), DE.AE-1, DE.CM-1, ID.AM-3, PR.AC-5, PR.DS-4, PR.DS-5, PR.IP-1, PR.PT-3, PR.PT-4, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.2, SR 7.1, SR 7.2, SR 7.6, 4.2.3.4, 4.3.3.4, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, 4.4.3.3, APO01.06, APO13.01, BAI04.04, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS01.05, DSS03.01, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, DSS06.02, DSS06.06, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.1.1, A.12.1.2, A.12.1.3, A.12.5.1, A.12.6.2, A.13.1.1, A.13.1.2, A.13.1.3, A.13.2.1, A.13.2.2, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.17.2.1, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, 1, 11, 12, 13, 14, 15, 16, 18, 2, 3, 4, 6, 7, 8, 9, SRG-OS-000480-GPOS-00227
Description	To set the runtime status of the `net.ipv4.conf.default.secure_redirects` kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.default.secure_redirects=0 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: net.ipv4.conf.default.secure_redirects = 0
Rationale	Accepting "secure" ICMP redirects (from those gateways listed as default gateways) has few legitimate uses. It should be disabled unless it is absolutely required.

Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces

Rule ID	xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_accept_redirects
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-80919-4 References: BP28(R22), 3.2.2, 5.10.1.1, 3.1.20, CCI-000366, CCI-001551, CM-7(a), CM-7(b), CM-6(a), SC-7(a), DE.AE-1, DE.CM-1, ID.AM-3, PR.AC-5, PR.DS-4, PR.DS-5, PR.IP-1, PR.PT-3, PR.PT-4, SRG-OS-000480-GPOS-00227, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.2, SR 7.1, SR 7.2, SR 7.6, 4.2.3.4, 4.3.3.4, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, 4.4.3.3, APO01.06, APO13.01, BAI04.04, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS01.05, DSS03.01, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, DSS06.02, DSS06.06, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.1.1, A.12.1.2, A.12.1.3, A.12.5.1, A.12.6.2, A.13.1.1, A.13.1.2, A.13.1.3, A.13.2.1, A.13.2.2, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.17.2.1, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, 1, 11, 12, 13, 14, 15, 16, 18, 2, 3, 4, 6, 7, 8, 9
Description	To set the runtime status of the `net.ipv4.conf.default.accept_redirects` kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.default.accept_redirects=0 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: net.ipv4.conf.default.accept_redirects = 0
Rationale	ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular destination. These messages modify the host's route table and are unauthenticated. An illicit ICMP redirect message could result in a man-in-the-middle attack. This feature of the IPv4 protocol has few legitimate uses. It should be disabled unless absolutely required.

Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces

Rule ID	xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_icmp_echo_ignore_broadcasts
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-80922-8 References: 3.2.5, 5.10.1.1, 3.1.20, CCI-000366, CM-7(a), CM-7(b), SC-5, DE.AE-1, DE.CM-1, ID.AM-3, PR.AC-5, PR.DS-4, PR.DS-5, PR.IP-1, PR.PT-3, PR.PT-4, SRG-OS-000480-GPOS-00227, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.2, SR 7.1, SR 7.2, SR 7.6, 4.2.3.4, 4.3.3.4, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, 4.4.3.3, APO01.06, APO13.01, BAI04.04, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS01.05, DSS03.01, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, DSS06.02, DSS06.06, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.1.1, A.12.1.2, A.12.1.3, A.12.5.1, A.12.6.2, A.13.1.1, A.13.1.2, A.13.1.3, A.13.2.1, A.13.2.2, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.17.2.1, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, 1, 11, 12, 13, 14, 15, 16, 18, 2, 3, 4, 6, 7, 8, 9
Description	To set the runtime status of the `net.ipv4.icmp_echo_ignore_broadcasts` kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.icmp_echo_ignore_broadcasts=1 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: net.ipv4.icmp_echo_ignore_broadcasts = 1
Rationale	Responding to broadcast (ICMP) echoes facilitates network mapping and provides a vector for amplification attacks. Ignoring ICMP echo requests (pings) sent to broadcast or multicast addresses makes the system slightly more difficult to enumerate on the network.

Disable Accepting ICMP Redirects for All IPv4 Interfaces

Rule ID	xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_accept_redirects
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-80917-8 References: BP28(R22), 3.2.2, 5.10.1.1, 3.1.20, CCI-000366, CCI-001503, CCI-001551, CM-7(a), CM-7(b), CM-6(a), SC-7(a), DE.CM-1, PR.DS-4, PR.IP-1, PR.PT-3, SRG-OS-000480-GPOS-00227, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 6.2, SR 7.1, SR 7.2, SR 7.6, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, APO13.01, BAI04.04, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS05.02, DSS05.05, DSS05.07, DSS06.06, A.12.1.2, A.12.1.3, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.17.2.1, A.9.1.2, 1, 11, 12, 13, 14, 15, 16, 2, 3, 7, 8, 9
Description	To set the runtime status of the `net.ipv4.conf.all.accept_redirects` kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.all.accept_redirects=0 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: net.ipv4.conf.all.accept_redirects = 0
Rationale	ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular destination. These messages modify the host's route table and are unauthenticated. An illicit ICMP redirect message could result in a man-in-the-middle attack. This feature of the IPv4 protocol has few legitimate uses. It should be disabled unless absolutely required."

Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default

Rule ID	xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_accept_source_route
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-80920-2 References: BP28(R22), 3.2.1, 5.10.1.1, 3.1.20, CCI-000366, CCI-001551, CM-7(a), CM-7(b), SC-5, SC-7(a), DE.AE-1, DE.CM-1, ID.AM-3, PR.AC-5, PR.DS-4, PR.DS-5, PR.IP-1, PR.PT-3, PR.PT-4, SRG-OS-000480-GPOS-00227, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.2, SR 7.1, SR 7.2, SR 7.6, 4.2.3.4, 4.3.3.4, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, 4.4.3.3, APO01.06, APO13.01, BAI04.04, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS01.05, DSS03.01, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, DSS06.02, DSS06.06, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.1.1, A.12.1.2, A.12.1.3, A.12.5.1, A.12.6.2, A.13.1.1, A.13.1.2, A.13.1.3, A.13.2.1, A.13.2.2, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.17.2.1, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, 1, 11, 12, 13, 14, 15, 16, 18, 2, 3, 4, 6, 7, 8, 9
Description	To set the runtime status of the `net.ipv4.conf.default.accept_source_route` kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.default.accept_source_route=0 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: net.ipv4.conf.default.accept_source_route = 0
Rationale	Source-routed packets allow the source of the packet to suggest routers forward the packet along a different path than configured on the router, which can be used to bypass network security measures. Accepting source-routed packets in the IPv4 protocol has few legitimate uses. It should be disabled unless it is absolutely required, such as when IPv4 forwarding is enabled and the system is legitimately functioning as a router.

Enable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces

Rule ID	xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_log_martians
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	unknown
Identifiers and References	Identifiers: CCE-81018-4 References: BP28(R22), 3.2.4, 3.1.20, CCI-000126, CM-7(a), CM-7(b), SC-5(3)(a), DE.CM-1, PR.AC-3, PR.DS-4, PR.IP-1, PR.PT-3, PR.PT-4, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.2, SR 7.1, SR 7.2, SR 7.6, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, APO13.01, BAI04.04, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS01.04, DSS03.05, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.06, A.11.2.6, A.12.1.2, A.12.1.3, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.17.2.1, A.6.2.1, A.6.2.2, A.9.1.2, 1, 11, 12, 13, 14, 15, 16, 2, 3, 7, 8, 9, SRG-OS-000480-GPOS-00227
Description	To set the runtime status of the `net.ipv4.conf.all.log_martians` kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.all.log_martians=1 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: net.ipv4.conf.all.log_martians = 1
Rationale	The presence of "martian" packets (which have impossible addresses) as well as spoofed packets, source-routed packets, and redirects could be a sign of nefarious network activity. Logging these packets enables this activity to be detected.

Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces

Rule ID	xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_tcp_syncookies
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-80923-6 References: BP28(R22), 3.2.8, 5.10.1.1, 3.1.20, CCI-000366, CM-7(a), CM-7(b), SC-5(1), SC-5(2), SC-5(3)(a), CM-6(a), DE.AE-1, DE.CM-1, ID.AM-3, PR.AC-5, PR.DS-4, PR.DS-5, PR.PT-4, SRG-OS-000480-GPOS-00227, SRG-OS-000420-GPOS-00186, SRG-OS-000142-GPOS-00071, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.2, SR 7.1, SR 7.2, SR 7.6, 4.2.3.4, 4.3.3.4, 4.4.3.3, APO01.06, APO13.01, BAI04.04, DSS01.03, DSS01.05, DSS03.01, DSS03.05, DSS05.02, DSS05.04, DSS05.07, DSS06.02, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.1.1, A.12.1.2, A.12.1.3, A.13.1.1, A.13.1.2, A.13.1.3, A.13.2.1, A.13.2.2, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.17.2.1, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, 1, 12, 13, 14, 15, 16, 18, 2, 4, 6, 7, 8, 9
Description	To set the runtime status of the `net.ipv4.tcp_syncookies` kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.tcp_syncookies=1 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: net.ipv4.tcp_syncookies = 1
Rationale	A TCP SYN flood attack can cause a denial of service by filling a system's TCP connection table with connections in the SYN_RCVD state. Syncookies can be used to track a connection when a subsequent ACK is received, verifying the initiator is attempting a valid connection and is not a flood source. This feature is activated when a flood condition is detected, and enables the system to continue servicing valid connection requests.

Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces

Rule ID	xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_accept_source_route
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-81011-9 References: BP28(R22), 3.2.1, 3.1.20, CCI-000366, CM-7(a), CM-7(b), SC-5, CM-6(a), SC-7(a), DE.AE-1, DE.CM-1, ID.AM-3, PR.AC-5, PR.DS-4, PR.DS-5, PR.IP-1, PR.PT-3, PR.PT-4, SRG-OS-000480-GPOS-00227, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.2, SR 7.1, SR 7.2, SR 7.6, 4.2.3.4, 4.3.3.4, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, 4.4.3.3, APO01.06, APO13.01, BAI04.04, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS01.05, DSS03.01, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, DSS06.02, DSS06.06, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.1.1, A.12.1.2, A.12.1.3, A.12.5.1, A.12.6.2, A.13.1.1, A.13.1.2, A.13.1.3, A.13.2.1, A.13.2.2, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.17.2.1, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, 1, 11, 12, 13, 14, 15, 16, 18, 2, 3, 4, 6, 7, 8, 9
Description	To set the runtime status of the `net.ipv4.conf.all.accept_source_route` kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.all.accept_source_route=0 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: net.ipv4.conf.all.accept_source_route = 0
Rationale	Source-routed packets allow the source of the packet to suggest routers forward the packet along a different path than configured on the router, which can be used to bypass network security measures. This requirement applies only to the forwarding of source-routerd traffic, such as when IPv4 forwarding is enabled and the system is functioning as a router. Accepting source-routed packets in the IPv4 protocol has few legitimate uses. It should be disabled unless it is absolutely required.

Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces

Rule ID	xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_rp_filter
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-81021-8 References: BP28(R22), 3.2.7, 3.1.20, CCI-000366, CCI-001551, CM-7(a), CM-7(b), CM-6(a), SC-7(a), DE.AE-1, DE.CM-1, ID.AM-3, PR.AC-5, PR.DS-4, PR.DS-5, PR.PT-4, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.2, SR 7.1, SR 7.2, SR 7.6, 4.2.3.4, 4.3.3.4, 4.4.3.3, APO01.06, APO13.01, BAI04.04, DSS01.03, DSS01.05, DSS03.01, DSS03.05, DSS05.02, DSS05.04, DSS05.07, DSS06.02, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.1.1, A.12.1.2, A.12.1.3, A.13.1.1, A.13.1.2, A.13.1.3, A.13.2.1, A.13.2.2, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.17.2.1, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, 1, 12, 13, 14, 15, 16, 18, 2, 4, 6, 7, 8, 9, SRG-OS-000480-GPOS-00227
Description	To set the runtime status of the `net.ipv4.conf.all.rp_filter` kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.all.rp_filter=1 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: net.ipv4.conf.all.rp_filter = 1
Rationale	Enabling reverse path filtering drops packets with source addresses that should not have been able to be received on the interface they were received on. It should not be used on systems which are routers for complicated networks, but is helpful for end hosts and routers serving small networks.

Enable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces

Rule ID	xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_icmp_ignore_bogus_error_responses
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	unknown
Identifiers and References	Identifiers: CCE-81023-4 References: BP28(R22), 3.2.6, 3.1.20, CM-7(a), CM-7(b), SC-5, DE.CM-1, PR.DS-4, PR.IP-1, PR.PT-3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 6.2, SR 7.1, SR 7.2, SR 7.6, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, APO13.01, BAI04.04, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS05.02, DSS05.05, DSS05.07, DSS06.06, A.12.1.2, A.12.1.3, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.17.2.1, A.9.1.2, 1, 11, 12, 13, 14, 15, 16, 2, 3, 7, 8, 9, SRG-OS-000480-GPOS-00227
Description	To set the runtime status of the `net.ipv4.icmp_ignore_bogus_error_responses` kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.icmp_ignore_bogus_error_responses=1 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: net.ipv4.icmp_ignore_bogus_error_responses = 1
Rationale	Ignoring bogus ICMP error responses reduces log size, although some activity would not be logged.

Enable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default

Rule ID	xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_log_martians
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	unknown
Identifiers and References	Identifiers: CCE-81020-0 References: 3.2.4, 3.1.20, CCI-000126, CM-7(a), CM-7(b), SC-5(3)(a), DE.CM-1, PR.AC-3, PR.DS-4, PR.IP-1, PR.PT-3, PR.PT-4, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.2, SR 7.1, SR 7.2, SR 7.6, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, APO13.01, BAI04.04, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS01.04, DSS03.05, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.06, A.11.2.6, A.12.1.2, A.12.1.3, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.17.2.1, A.6.2.1, A.6.2.2, A.9.1.2, 1, 11, 12, 13, 14, 15, 16, 2, 3, 7, 8, 9, SRG-OS-000480-GPOS-00227
Description	To set the runtime status of the `net.ipv4.conf.default.log_martians` kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.default.log_martians=1 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: net.ipv4.conf.default.log_martians = 1
Rationale	The presence of "martian" packets (which have impossible addresses) as well as spoofed packets, source-routed packets, and redirects could be a sign of nefarious network activity. Logging these packets enables this activity to be detected.

Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces

Rule ID	xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_ip_forward
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-81024-2 References: BP28(R22), 3.1.1., 3.1.20, CCI-000366, CM-7(a), CM-7(b), SC-5, CM-6(a), SC-7(a), DE.CM-1, PR.DS-4, PR.IP-1, PR.PT-3, PR.PT-4, SRG-OS-000480-GPOS-00227, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.2, SR 7.1, SR 7.2, SR 7.6, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, APO13.01, BAI04.04, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS05.02, DSS05.05, DSS05.07, DSS06.06, A.12.1.2, A.12.1.3, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.17.2.1, A.9.1.2, 1, 11, 12, 13, 14, 15, 16, 2, 3, 7, 8, 9
Description	To set the runtime status of the `net.ipv4.ip_forward` kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.ip_forward=0 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: net.ipv4.ip_forward = 0
Rationale	Routing protocol daemons are typically used on routers to exchange network topology information with other routers. If this capability is used when not required, system network information may be unnecessarily transmitted across the network.
Warnings	warning Certain technologies such as virtual machines, containers, etc. rely on IPv4 forwarding to enable and use networking. Disabling IPv4 forwarding would cause those technologies to stop working. Therefore, this rule should not be used in profiles or benchmarks that target usage of IPv4 forwarding.

Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default

Rule ID	xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_send_redirects
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-80921-0 References: BP28(R22), 3.1.2, 5.10.1.1, 3.1.20, CCI-000366, CM-7(a), CM-7(b), SC-5, CM-6(a), SC-7(a), DE.AE-1, DE.CM-1, ID.AM-3, PR.AC-5, PR.DS-4, PR.DS-5, PR.IP-1, PR.PT-3, PR.PT-4, SRG-OS-000480-GPOS-00227, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.2, SR 7.1, SR 7.2, SR 7.6, 4.2.3.4, 4.3.3.4, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, 4.4.3.3, APO01.06, APO13.01, BAI04.04, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS01.05, DSS03.01, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, DSS06.02, DSS06.06, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.1.1, A.12.1.2, A.12.1.3, A.12.5.1, A.12.6.2, A.13.1.1, A.13.1.2, A.13.1.3, A.13.2.1, A.13.2.2, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.17.2.1, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, 1, 11, 12, 13, 14, 15, 16, 18, 2, 3, 4, 6, 7, 8, 9
Description	To set the runtime status of the `net.ipv4.conf.default.send_redirects` kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.default.send_redirects=0 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: net.ipv4.conf.default.send_redirects = 0
Rationale	ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular destination. These messages contain information from the system's route table possibly revealing portions of the network topology. The ability to send ICMP redirects is only appropriate for systems acting as routers.

Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces

Rule ID	xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_send_redirects
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-80918-6 References: BP28(R22), 3.1.2, 5.10.1.1, 3.1.20, CCI-000366, CM-7(a), CM-7(b), SC-5, CM-6(a), SC-7(a), DE.AE-1, DE.CM-1, ID.AM-3, PR.AC-5, PR.DS-4, PR.DS-5, PR.IP-1, PR.PT-3, PR.PT-4, SRG-OS-000480-GPOS-00227, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.2, SR 7.1, SR 7.2, SR 7.6, 4.2.3.4, 4.3.3.4, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, 4.4.3.3, APO01.06, APO13.01, BAI04.04, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS01.05, DSS03.01, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, DSS06.02, DSS06.06, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.1.1, A.12.1.2, A.12.1.3, A.12.5.1, A.12.6.2, A.13.1.1, A.13.1.2, A.13.1.3, A.13.2.1, A.13.2.2, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.17.2.1, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, 1, 11, 12, 13, 14, 15, 16, 18, 2, 3, 4, 6, 7, 8, 9
Description	To set the runtime status of the `net.ipv4.conf.all.send_redirects` kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.all.send_redirects=0 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: net.ipv4.conf.all.send_redirects = 0
Rationale	ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular destination. These messages contain information from the system's route table possibly revealing portions of the network topology. The ability to send ICMP redirects is only appropriate for systems acting as routers.

Install policycoreutils-python-utils package

Rule ID	xccdf_org.ssgproject.content_rule_package_policycoreutils-python-utils_installed
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-82724-6 References: SRG-OS-000480-GPOS-00227
Description	The `policycoreutils-python-utils` package can be installed with the following command: $ sudo yum install policycoreutils-python-utils
Rationale	This package is required to operate and manage an SELinux environment and its policies. It provides utilities such as semanage, audit2allow, audit2why, chcat and sandbox.

Install policycoreutils Package

Rule ID	xccdf_org.ssgproject.content_rule_package_policycoreutils_installed
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	high
Identifiers and References	Identifiers: CCE-82976-2 References: SRG-OS-000480-GPOS-00227
Description	The `policycoreutils` package can be installed with the following command: $ sudo yum install policycoreutils
Rationale	Security-enhanced Linux is a feature of the Linux kernel and a number of utilities with enhanced security functionality designed to add mandatory access controls to Linux. The Security-enhanced Linux kernel contains new architectural components originally developed to improve security of the Flask operating system. These architectural components provide general support for the enforcement of many kinds of mandatory access control policies, including those based on the concepts of Type Enforcement, Role-based Access Control, and Multi-level Security. `policycoreutils` contains the policy core utilities that are required for basic operation of an SELinux-enabled system. These utilities include `load_policy` to load SELinux policies, `setfiles` to label filesystems, `newrole` to switch roles, and `run_init` to run `/etc/init.d` scripts in the proper context.

Ensure SELinux State is Enforcing

Rule ID	xccdf_org.ssgproject.content_rule_selinux_state
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-80869-1 References: 1.7.1.4, 3.1.2, 3.7.2, CCI-002165, CCI-002696, 164.308(a)(1)(ii)(D), 164.308(a)(3), 164.308(a)(4), 164.310(b), 164.310(c), 164.312(a), 164.312(e), AC-3, AC-3(3)(a), AU-9, SC-7(21), DE.AE-1, ID.AM-3, PR.AC-4, PR.AC-5, PR.AC-6, PR.DS-5, PR.PT-1, PR.PT-3, PR.PT-4, SRG-OS-000445-GPOS-00199, SRG-OS-000445-VMM-001780, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.10, SR 2.11, SR 2.12, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, 4.2.3.4, 4.3.3.2.2, 4.3.3.3.9, 4.3.3.4, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, 4.4.3.3, APO01.06, APO11.04, APO13.01, BAI03.05, DSS01.05, DSS03.01, DSS05.02, DSS05.04, DSS05.05, DSS05.07, DSS06.02, DSS06.03, DSS06.06, MEA02.01, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.1.1, A.12.1.2, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.1.2, A.13.1.3, A.13.2.1, A.13.2.2, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.1, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, 1, 11, 12, 13, 14, 15, 16, 18, 3, 4, 5, 6, 8, 9, BP28(R4), BP28(R66)
Description	The SELinux state should be set to `enforcing` at system boot time. In the file `/etc/selinux/config`, add or correct the following line to configure the system to boot into enforcing mode: SELINUX=enforcing
Rationale	Setting the SELinux state to enforcing ensures SELinux is able to confine potentially compromised processes to the security policy, which is designed to prevent them from causing damage to the system or further elevating their privileges.

Configure SELinux Policy

Rule ID	xccdf_org.ssgproject.content_rule_selinux_policytype
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-80868-3 References: BP28(R66), 1.7.1.3, 3.1.2, 3.7.2, CCI-002696, 164.308(a)(1)(ii)(D), 164.308(a)(3), 164.308(a)(4), 164.310(b), 164.310(c), 164.312(a), 164.312(e), AC-3, AC-3(3)(a), AU-9, SC-7(21), DE.AE-1, ID.AM-3, PR.AC-4, PR.AC-5, PR.AC-6, PR.DS-5, PR.PT-1, PR.PT-3, PR.PT-4, SRG-OS-000445-GPOS-00199, SRG-OS-000445-VMM-001780, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.10, SR 2.11, SR 2.12, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, 4.2.3.4, 4.3.3.2.2, 4.3.3.3.9, 4.3.3.4, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, 4.4.3.3, APO01.06, APO11.04, APO13.01, BAI03.05, DSS01.05, DSS03.01, DSS05.02, DSS05.04, DSS05.05, DSS05.07, DSS06.02, DSS06.03, DSS06.06, MEA02.01, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.1.1, A.12.1.2, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.1.2, A.13.1.3, A.13.2.1, A.13.2.2, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.1, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, 1, 11, 12, 13, 14, 15, 16, 18, 3, 4, 5, 6, 8, 9
Description	The SELinux `targeted` policy is appropriate for general-purpose desktops and servers, as well as systems in many other roles. To configure the system to use this policy, add or correct the following line in `/etc/selinux/config`: SELINUXTYPE=targeted Other policies, such as `mls`, provide additional security labeling and greater confinement but are not compatible with many general-purpose use cases.
Rationale	Setting the SELinux policy to `targeted` or a more specialized policy ensures the system will confine processes that are likely to be targeted for exploitation, such as network or system services. Note: During the development or debugging of SELinux modules, it is common to temporarily place non-production systems in `permissive` mode. In such temporary cases, SELinux policies should be developed, and once work is completed, the system should be reconfigured to `targeted`.

Enable Smartcards in SSSD

Rule ID	xccdf_org.ssgproject.content_rule_sssd_enable_smartcards
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-80909-5 References: CCI-001954, SRG-OS-000375-GPOS-00160, SRG-OS-000107-VMM-000530, 0421, 0422, 0431, 0974, 1173, 1401, 1504, 1505, 1546, 1557, 1558, 1559, 1560, 1561
Description	SSSD should be configured to authenticate access to the system using smart cards. To enable smart cards in SSSD, set `pam_cert_auth` to `true` under the `[pam]` section in `/etc/sssd/sssd.conf`. For example: [pam] pam_cert_auth = true
Rationale	Using an authentication device, such as a CAC or token that is separate from the information system, ensures that even if the information system is compromised, that compromise will not affect credentials stored on the authentication device. Multifactor solutions that require devices separate from information systems gaining access include, for example, hardware tokens providing time-based or challenge-response authenticators and smart cards such as the U.S. Government Personal Identity Verification card and the DoD Common Access Card.

Configure SSSD to Expire Offline Credentials

Rule ID	xccdf_org.ssgproject.content_rule_sssd_offline_cred_expiration
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-82460-7 References: CCI-002007, CM-6(a), IA-5(13), PR.AC-1, PR.AC-6, PR.AC-7, SRG-OS-000383-GPOS-00166, SRG-OS-000383-VMM-001570, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10, A.18.1.4, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, 1, 12, 15, 16, 5
Description	SSSD should be configured to expire offline credentials after 1 day. To configure SSSD to expire offline credentials, set `offline_credentials_expiration` to `1` under the `[pam]` section in `/etc/sssd/sssd.conf`. For example: [pam] offline_credentials_expiration = 1
Rationale	If cached authentication information is out-of-date, the validity of the authentication information may be questionable.

Uninstall Sendmail Package

Rule ID	xccdf_org.ssgproject.content_rule_package_sendmail_removed
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-81039-0 References: CM-7(a), CM-7(b), CM-6(a), PR.IP-1, PR.PT-3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2, 11, 14, 3, 9, BP28(R1), SRG-OS-000480-GPOS-00227
Description	Sendmail is not the default mail transfer agent and is not installed by default. The `sendmail` package can be removed with the following command: $ sudo yum erase sendmail
Rationale	The sendmail software was not developed with security in mind and its design prevents it from being effectively contained by SELinux. Postfix should be used instead.

Set SSH Client Alive Count Max

Rule ID	xccdf_org.ssgproject.content_rule_sshd_set_keepalive
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-80907-9 References: 5.2.13, 5.5.6, 3.1.11, CCI-000879, CCI-001133, CCI-002361, 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.310(b), 164.312(e)(1), 164.312(e)(2)(ii), AC-2(5), AC-12, AC-17(a), SC-10, CM-6(a), DE.CM-1, DE.CM-3, PR.AC-1, PR.AC-4, PR.AC-6, PR.AC-7, PR.IP-2, SRG-OS-000163-GPOS-00072, SRG-OS-000279-GPOS-00109, SRG-OS-000480-VMM-002000, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 6.2, 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.3, APO13.01, BAI03.01, BAI03.02, BAI03.03, DSS01.03, DSS03.05, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10, A.12.4.1, A.12.4.3, A.14.1.1, A.14.2.1, A.14.2.5, A.18.1.4, A.6.1.2, A.6.1.5, A.7.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5, 1, 12, 13, 14, 15, 16, 18, 3, 5, 7, 8
Description	The SSH server sends at most `ClientAliveCountMax` messages during a SSH session and waits for a response from the SSH client. The option `ClientAliveInterval` configures timeout after each `ClientAliveCountMax` message. If the SSH server does not receive a response from the client, then the connection is considered idle and terminated. To ensure the SSH idle timeout occurs precisely when the `ClientAliveInterval` is set, set the `ClientAliveCountMax` to value of `0`.
Rationale	This ensures a user login will be terminated as soon as the `ClientAliveInterval` is reached.

Enable SSH Warning Banner

Rule ID	xccdf_org.ssgproject.content_rule_sshd_enable_warning_banner
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-80905-3 References: 5.2.15, 5.5.6, 3.1.9, CCI-000048, CCI-000050, CCI-001384, CCI-001385, CCI-001386, CCI-001387, CCI-001388, 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.310(b), 164.312(e)(1), 164.312(e)(2)(ii), AC-8(a), AC-8(c), AC-17(a), CM-6(a), PR.AC-7, FTA_TAB.1, SRG-OS-000023-GPOS-00006, SRG-OS-000024-GPOS-00007, SRG-OS-000228-GPOS-00088, SRG-OS-000023-VMM-000060, SRG-OS-000024-VMM-000070, SR 1.1, SR 1.10, SR 1.2, SR 1.5, SR 1.7, SR 1.8, SR 1.9, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, DSS05.04, DSS05.10, DSS06.10, A.18.1.4, A.9.2.1, A.9.2.4, A.9.3.1, A.9.4.2, A.9.4.3, 1, 12, 15, 16
Description	To enable the warning banner and ensure it is consistent across the system, add or correct the following line in `/etc/ssh/sshd_config`: Banner /etc/issue Another section contains information on how to create an appropriate system-wide warning banner.
Rationale	The warning message reinforces policy awareness during the logon process and facilitates possible legal action against attackers. Alternatively, systems whose ownership should not be obvious should ensure usage of a banner that does not provide easy attribution.

Disable GSSAPI Authentication

Rule ID	xccdf_org.ssgproject.content_rule_sshd_disable_gssapi_auth
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-80897-2 References: 3.1.12, CCI-000318, CCI-000368, CCI-001812, CCI-001813, CCI-001814, 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.310(b), 164.312(e)(1), 164.312(e)(2)(ii), CM-7(a), CM-7(b), CM-6(a), AC-17(a), PR.IP-1, FTP_ITC_EXT.1, SRG-OS-000364-GPOS-00151, SRG-OS-000480-VMM-002000, SR 7.6, 4.3.4.3.2, 4.3.4.3.3, BAI10.01, BAI10.02, BAI10.03, BAI10.05, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, 11, 3, 9, 0418, 1055, 1402
Description	Unless needed, SSH should not permit extraneous or unnecessary authentication mechanisms like GSSAPI. To disable GSSAPI authentication, add or correct the following line in the `/etc/ssh/sshd_config` file: GSSAPIAuthentication no
Rationale	GSSAPI authentication is used to provide additional authentication mechanisms to applications. Allowing GSSAPI authentication through SSH exposes the system's GSSAPI to remote hosts, increasing the attack surface of the system.

Disable Host-Based Authentication

Rule ID	xccdf_org.ssgproject.content_rule_disable_host_auth
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-80786-7 References: 5.2.9, 5.5.6, 3.1.12, CCI-000366, 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.310(b), 164.312(e)(1), 164.312(e)(2)(ii), AC-3, AC-17(a), CM-7(a), CM-7(b), CM-6(a), PR.AC-4, PR.AC-6, PR.IP-1, PR.PT-3, FIA_UAU.1, SRG-OS-000480-GPOS-00229, SRG-OS-000480-VMM-002000, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, DSS06.03, DSS06.06, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.6.1.2, A.7.1.1, A.9.1.2, A.9.2.1, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, 11, 12, 14, 15, 16, 18, 3, 5, 9, 0421, 0422, 0431, 0974, 1173, 1401, 1504, 1505, 1546, 1557, 1558, 1559, 1560, 1561
Description	SSH's cryptographic host-based authentication is more secure than `.rhosts` authentication. However, it is not recommended that hosts unilaterally trust one another, even within an organization. To disable host-based authentication, add or correct the following line in `/etc/ssh/sshd_config`: HostbasedAuthentication no
Rationale	SSH trust relationships mean a compromise on one host can allow an attacker to move trivially to other hosts.

Disable SSH Root Login

Rule ID	xccdf_org.ssgproject.content_rule_sshd_disable_root_login
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-80901-2 References: 5.2.10, 5.5.6, 3.1.1, 3.1.5, CCI-000366, CCI-000770, 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.310(b), 164.312(e)(1), 164.312(e)(2)(ii), AC-6(2), AC-17(a), IA-2, IA-2(5), CM-7(a), CM-7(b), CM-6(a), PR.AC-1, PR.AC-4, PR.AC-6, PR.AC-7, PR.DS-5, PR.PT-3, FIA_UAU.1, SRG-OS-000109-GPOS-00056, SRG-OS-000480-GPOS-00227, SRG-OS-000480-VMM-002000, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 5.2, 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, APO01.06, DSS05.02, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.02, DSS06.03, DSS06.06, DSS06.10, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.18.1.4, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5, 1, 11, 12, 13, 14, 15, 16, 18, 3, 5, BP28(R19), NT007(R21)
Description	The root user should never be allowed to login to a system directly over a network. To disable root login via SSH, add or correct the following line in `/etc/ssh/sshd_config`: PermitRootLogin no
Rationale	Even though the communications channel may be encrypted, an additional layer of security is gained by extending the policy of not logging directly on as root. In addition, logging in with a user-specific account provides individual accountability of actions performed on the system and also helps to minimize direct attack attempts on root's password.

Force frequent session key renegotiation

Rule ID	xccdf_org.ssgproject.content_rule_sshd_rekey_limit
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-82177-7 References: FCS_SSHS_EXT.1, SRG-OS-000480-GPOS-00227
Description	The `RekeyLimit` parameter specifies how often the session key of the is renegotiated, both in terms of amount of data that may be transmitted and the time elapsed. To decrease the default limits, put line `RekeyLimit 1G 1h` to file `/etc/ssh/sshd_config`.
Rationale	By decreasing the limit based on the amount of data and enabling time-based limit, effects of potential attacks against encryption keys are limited.

Disable SSH Access via Empty Passwords

Rule ID	xccdf_org.ssgproject.content_rule_sshd_disable_empty_passwords
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	high
Identifiers and References	Identifiers: CCE-80896-4 References: NT007(R17), 5.2.11, 5.5.6, 3.1.1, 3.1.5, CCI-000366, CCI-000766, 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.310(b), 164.312(e)(1), 164.312(e)(2)(ii), AC-17(a), CM-7(a), CM-7(b), CM-6(a), PR.AC-4, PR.AC-6, PR.DS-5, PR.IP-1, PR.PT-3, FIA_UAU.1, SRG-OS-000106-GPOS-00053, SRG-OS-000480-GPOS-00229, SRG-OS-000480-VMM-002000, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 5.2, SR 7.6, 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, APO01.06, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, DSS06.02, DSS06.03, DSS06.06, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.1, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, 11, 12, 13, 14, 15, 16, 18, 3, 5, 9
Description	To explicitly disallow SSH login from accounts with empty passwords, add or correct the following line in `/etc/ssh/sshd_config`: PermitEmptyPasswords no Any accounts with empty passwords should be disabled immediately, and PAM configuration should prevent users from being able to assign themselves empty passwords.
Rationale	Configuring this setting for the SSH daemon provides additional assurance that remote login via SSH will require a password, even in the event of misconfiguration elsewhere.

SSH server uses strong entropy to seed

Rule ID	xccdf_org.ssgproject.content_rule_sshd_use_strong_rng
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-82462-3 References: FCS_RBG_EXT.1.2, SRG-OS-000480-GPOS-00227
Description	To set up SSH server to use entropy from a high-quality source, edit the `/etc/sysconfig/sshd` file. The `SSH_USE_STRONG_RNG` configuration value determines how many bytes of entropy to use, so make sure that the file contains line SSH_USE_STRONG_RNG=32
Rationale	SSH implementation in RHEL8 uses the openssl library, which doesn't use high-entropy sources by default. Randomness is needed to generate data-encryption keys, and as plaintext padding and initialization vectors in encryption algorithms, and high-quality entropy elliminates the possibility that the output of the random number generator used by SSH would be known to potential attackers.
Warnings	warning This setting can cause problems on computers without the hardware random generator, because insufficient entropy causes the connection to be blocked until enough entropy is available.

Disable Kerberos Authentication

Rule ID	xccdf_org.ssgproject.content_rule_sshd_disable_kerb_auth
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-80898-0 References: 3.1.12, CCI-000318, CCI-000368, CCI-001812, CCI-001813, CCI-001814, 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.310(b), 164.312(e)(1), 164.312(e)(2)(ii), AC-17(a), CM-7(a), CM-7(b), CM-6(a), PR.IP-1, FTP_ITC_EXT.1, SRG-OS-000364-GPOS-00151, SRG-OS-000480-VMM-002000, SR 7.6, 4.3.4.3.2, 4.3.4.3.3, BAI10.01, BAI10.02, BAI10.03, BAI10.05, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, 11, 3, 9, 0421, 0422, 0431, 0974, 1173, 1401, 1504, 1505, 1546, 1557, 1558, 1559, 1560, 1561
Description	Unless needed, SSH should not permit extraneous or unnecessary authentication mechanisms like Kerberos. To disable Kerberos authentication, add or correct the following line in the `/etc/ssh/sshd_config` file: KerberosAuthentication no
Rationale	Kerberos authentication for SSH is often implemented using GSSAPI. If Kerberos is enabled through SSH, the SSH daemon provides a means of access to the system's Kerberos implementation. Vulnerabilities in the system's Kerberos implementations may be subject to exploitation.

Enable Use of Strict Mode Checking

Rule ID	xccdf_org.ssgproject.content_rule_sshd_enable_strictmodes
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-80904-6 References: 3.1.12, CCI-000366, 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.310(b), 164.312(e)(1), 164.312(e)(2)(ii), AC-6, AC-17(a), CM-6(a), PR.AC-4, PR.DS-5, SRG-OS-000480-GPOS-00227, SRG-OS-000480-VMM-002000, SR 2.1, SR 5.2, 4.3.3.7.3, APO01.06, DSS05.04, DSS05.07, DSS06.02, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, 12, 13, 14, 15, 16, 18, 3, 5
Description	SSHs `StrictModes` option checks file and ownership permissions in the user's home directory `.ssh` folder before accepting login. If world- writable permissions are found, logon is rejected. To enable `StrictModes` in SSH, add or correct the following line in the `/etc/ssh/sshd_config` file: StrictModes yes
Rationale	If other users have access to modify user-specific SSH configuration files, they may be able to log into the system as another user.

Set SSH Idle Timeout Interval

Rule ID	xccdf_org.ssgproject.content_rule_sshd_set_idle_timeout
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-80906-1 References: 5.2.13, 5.5.6, 3.1.11, CCI-000879, CCI-001133, CCI-002361, CM-6(a), AC-17(a), AC-2(5), AC-12, AC-17(a), SC-10, CM-6(a), DE.CM-1, DE.CM-3, PR.AC-1, PR.AC-4, PR.AC-6, PR.AC-7, PR.IP-2, Req-8.1.8, SRG-OS-000126-GPOS-00066, SRG-OS-000163-GPOS-00072, SRG-OS-000279-GPOS-00109, SRG-OS-000395-GPOS-00175, SRG-OS-000480-VMM-002000, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 6.2, 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.3, APO13.01, BAI03.01, BAI03.02, BAI03.03, DSS01.03, DSS03.05, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10, A.12.4.1, A.12.4.3, A.14.1.1, A.14.2.1, A.14.2.5, A.18.1.4, A.6.1.2, A.6.1.5, A.7.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5, 1, 12, 13, 14, 15, 16, 18, 3, 5, 7, 8, BP28(R29)
Description	SSH allows administrators to set an idle timeout interval. After this interval has passed, the idle user will be automatically logged out. To set an idle timeout interval, edit the following line in `/etc/ssh/sshd_config` as follows: ClientAliveInterval 840 The timeout interval is given in seconds. For example, have a timeout of 10 minutes, set interval to 600. If a shorter timeout has already been set for the login shell, that value will preempt any SSH setting made in `/etc/ssh/sshd_config`. Keep in mind that some processes may stop SSH from correctly detecting that the user is idle.
Rationale	Terminating an idle ssh session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled on the console or console port that has been let unattended.
Warnings	warning SSH disconnecting idle clients will not have desired effect without also configuring ClientAliveCountMax in the SSH service configuration. warning Following conditions may prevent the SSH session to time out: Remote processes on the remote machine generates output. As the output has to be transferred over the network to the client, the timeout is reset every time such transfer happens. Any `scp` or `sftp` activity by the same user to the host resets the timeout.

SSH client uses strong entropy to seed (for CSH like shells)

Rule ID	xccdf_org.ssgproject.content_rule_ssh_client_use_strong_rng_csh
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-83349-1 References: FCS_CKM.1.1, SRG-OS-000480-GPOS-00227
Description	To set up SSH client to use entropy from a high-quality source, make sure that the appropriate shell environment variable is configured. The `SSH_USE_STRONG_RNG` environment variable determines how many bytes of entropy to use. Make sure that the file `/etc/profile.d/cc-ssh-strong-rng.csh` contains line setenv SSH_USE_STRONG_RNG 32 .
Rationale	Some SSH implementations use the openssl library for entropy, which by default, doesn't use high-entropy sources. Randomness is needed to generate considerably more secure data-encryption keys. Plaintext padding, initialization vectors in encryption algorithms, and high-quality entropy eliminates the possibility that the output of the random number generator used by SSH would be known to potential attackers.

SSH client uses strong entropy to seed (Bash-like shells)

Rule ID	xccdf_org.ssgproject.content_rule_ssh_client_use_strong_rng_sh
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-83346-7 References: FCS_CKM.1.1, SRG-OS-000480-GPOS-00227
Description	To set up SSH client to use entropy from a high-quality source, make sure that the appropriate shell environment variable is configured. The `SSH_USE_STRONG_RNG` environment variable determines how many bytes of entropy to use. Make sure that the file `/etc/profile.d/cc-ssh-strong-rng.sh` contains line export SSH_USE_STRONG_RNG=32 .
Rationale	Some SSH implementations use the openssl library for entropy, which by default, doesn't use high-entropy sources. Randomness is needed to generate considerably more secure data-encryption keys. Plaintext padding, initialization vectors in encryption algorithms, and high-quality entropy eliminates the possibility that the output of the random number generator used by SSH would be known to potential attackers.

Install OpenSSH client software

Rule ID	xccdf_org.ssgproject.content_rule_package_openssh-clients_installed
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-82722-0 References: SRG-OS-000480-GPOS-00227, FIA_UAU.5, FTP_ITC_EXT.1
Description	The `openssh-clients` package can be installed with the following command: $ sudo yum install openssh-clients
Rationale	This package includes utilities to make encrypted connections and transfer files securely to SSH servers.

Install the OpenSSH Server Package

Rule ID	xccdf_org.ssgproject.content_rule_package_openssh-server_installed
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-83303-8 References: CCI-002418, CCI-002420, CCI-002421, CCI-002422, CM-6(a), PR.DS-2, PR.DS-5, SRG-OS-000423-GPOS-00187, SRG-OS-000424-GPOS-00188, SRG-OS-000425-GPOS-00189, SRG-OS-000426-GPOS-00190, SR 3.1, SR 3.8, SR 4.1, SR 4.2, SR 5.2, APO01.06, DSS05.02, DSS05.04, DSS05.07, DSS06.02, DSS06.06, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, 13, 14, FIA_UAU.5, FTP_ITC_EXT.1
Description	The `openssh-server` package should be installed. The `openssh-server` package can be installed with the following command: $ sudo yum install openssh-server
Rationale	Without protection of the transmitted information, confidentiality, and integrity may be compromised because unprotected communications can be intercepted and either read or altered.

The Chrony package is installed

Rule ID	xccdf_org.ssgproject.content_rule_package_chrony_installed
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-82874-9 References: 2.2.1.1, 0988, 1405, FMT_SMF_EXT.1, SRG-OS-000355-GPOS-00143
Description	System time should be synchronized between all systems in an environment. This is typically done by establishing an authoritative time server or set of servers and having all systems synchronize their clocks to them. The `chrony` package can be installed with the following command: $ sudo yum install chrony
Rationale	Time synchronization is important to support time sensitive security mechanisms like Kerberos and also ensures log files have consistent time records across the enterprise, which aids in forensic investigations.

Disable network management of chrony daemon

Rule ID	xccdf_org.ssgproject.content_rule_chronyd_no_chronyc_network
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	unknown
Identifiers and References	Identifiers: CCE-82840-0 References: FMT_SMF_EXT.1, SRG-OS-000096-GPOS-00050
Description	The `cmdport` option in `/etc/chrony.conf` can be set to `0` to stop chrony daemon from listening on the UDP port 323 for management connections made by chronyc.
Rationale	Not exposing the management interface of the chrony daemon on the network diminishes the attack space.

Disable chrony daemon from acting as server

Rule ID	xccdf_org.ssgproject.content_rule_chronyd_client_only
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	unknown
Identifiers and References	Identifiers: CCE-82988-7 References: FMT_SMF_EXT.1, SRG-OS-000096-GPOS-00050
Description	The `port` option in `/etc/chrony.conf` can be set to `0` to make chrony daemon to never open any listening port for server operation and to operate strictly in a client-only mode.
Rationale	Minimizing the exposure of the server functionality of the chrony daemon diminishes the attack surface.

Install fapolicyd Package

Rule ID	xccdf_org.ssgproject.content_rule_package_fapolicyd_installed
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-82191-8 References: CM-6(a), SI-4(22), SRG-OS-000370-GPOS-00155
Description	The `fapolicyd` package can be installed with the following command: $ sudo yum install fapolicyd
Rationale	`fapolicyd` (File Access Policy Daemon) implements application whitelisting to decide file access rights.

Enable the File Access Policy Service

Rule ID	xccdf_org.ssgproject.content_rule_service_fapolicyd_enabled
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-82249-4 References: CM-6(a), SI-4(22), FMT_SMF_EXT.1, SRG-OS-000370-GPOS-00155
Description	The File Access Policy service should be enabled. The `fapolicyd` service can be enabled with the following command: $ sudo systemctl enable fapolicyd.service
Rationale	The `fapolicyd` service (File Access Policy Daemon) implements application whitelisting to decide file access rights.

Uninstall Automatic Bug Reporting Tool (abrt)

Rule ID	xccdf_org.ssgproject.content_rule_package_abrt_removed
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-package_abrt_removed:def:1
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-80948-3 References: SRG-OS-000095-GPOS-00049
Description	The Automatic Bug Reporting Tool (`abrt`) collects and reports crash data when an application crash is detected. Using a variety of plugins, abrt can email crash reports to system administrators, log crash reports to files, or forward crash reports to a centralized issue tracking system such as RHTSupport. The `abrt` package can be removed with the following command: $ sudo yum erase abrt
Rationale	Mishandling crash data could expose sensitive information about vulnerabilities in software executing on the system, as well as sensitive information from within a process's address space or registers.

OVAL test results details

package abrt is removed oval:ssg-test_package_abrt_removed:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-obj_test_package_abrt_removed:obj:1 of type rpminfo_object

Name
abrt

Disable KDump Kernel Crash Analyzer (kdump)

Rule ID	xccdf_org.ssgproject.content_rule_service_kdump_disabled
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-80878-2 References: CCI-000366, 164.308(a)(1)(ii)(D), 164.308(a)(3), 164.308(a)(4), 164.310(b), 164.310(c), 164.312(a), 164.312(e), CM-7(a), CM-7(b), CM-6(a), PR.AC-3, PR.IP-1, PR.PT-3, PR.PT-4, SRG-OS-000480-GPOS-00227, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.04, DSS05.02, DSS05.03, DSS05.05, DSS06.06, A.11.2.6, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.2.1, A.6.2.2, A.9.1.2, 11, 12, 14, 15, 3, 8, 9, FMT_SMF_EXT.1.1
Description	The `kdump` service provides a kernel crash dump analyzer. It uses the `kexec` system call to boot a secondary kernel ("capture" kernel) following a system crash, which can load information from the crashed kernel for analysis. The `kdump` service can be disabled with the following command: $ sudo systemctl mask --now kdump.service
Rationale	Kernel core dumps may contain the full contents of system memory at the time of the crash. Kernel core dumps consume a considerable amount of disk space and may result in denial of service by exhausting the available space on the target file system partition. Unless the system is used for kernel development or testing, there is little need to run the kdump service.

Uninstall nfs-utils Package

Rule ID	xccdf_org.ssgproject.content_rule_package_nfs-utils_removed
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-package_nfs-utils_removed:def:1
Time	2021-02-11T19:31:22+00:00
Severity	low
Identifiers and References	Identifiers: CCE-82932-5 References: SRG-OS-000095-GPOS-00049
Description	The `nfs-utils` package can be removed with the following command: $ sudo yum erase nfs-utils
Rationale	`nfs-utils` provides a daemon for the kernel NFS server and related tools. This package also contains the `showmount` program. `showmount` queries the mount daemon on a remote host for information about the Network File System (NFS) server on the remote host. For example, `showmount` can display the clients which are mounted on that host.

OVAL test results details

package nfs-utils is removed oval:ssg-test_package_nfs-utils_removed:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-obj_test_package_nfs-utils_removed:obj:1 of type rpminfo_object

Name
nfs-utils

Disable Kerberos by removing host keytab

Rule ID	xccdf_org.ssgproject.content_rule_kerberos_disable_no_keytab
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-82175-1 References: FTP_ITC_EXT.1, SRG-OS-000120-GPOS-00061, 0418, 1055, 1402
Description	Kerberos is not an approved key distribution method for Common Criteria. To prevent using Kerberos by system daemons, remove the Kerberos keytab files, especially `/etc/krb5.keytab`.
Rationale	The key derivation function (KDF) in Kerberos is not FIPS compatible.

Install usbguard Package

Rule ID xccdf_org.ssgproject.content_rule_package_usbguard_installed

Result

fail

Multi-check rule no

OVAL Definition ID oval:ssg-package_usbguard_installed:def:1

Time 2021-02-11T19:31:22+00:00

Severity medium

Identifiers and References

Identifiers: CCE-82959-8

References: SRG-OS-000378-GPOS-00163, 1418

Description

The usbguard package can be installed with the following command:

$ sudo yum install usbguard

Rationale

usbguard is a software framework that helps to protect against rogue USB devices by implementing basic whitelisting/blacklisting capabilities based on USB device attributes.

Remediation Shell script ⇲

Complexity:	low
Disruption:	low
Strategy:	enable


if ! rpm -q --quiet "usbguard" ; then
    yum install -y "usbguard"
fi

Remediation Ansible snippet ⇲

Complexity:	low
Disruption:	low
Strategy:	enable

- name: Ensure usbguard is installed
  package:
    name: usbguard
    state: present
  tags:
    - CCE-82959-8
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_usbguard_installed

Remediation Puppet snippet ⇲

Complexity:	low
Disruption:	low
Strategy:	enable

include install_usbguard

class install_usbguard {
  package { 'usbguard':
    ensure => 'installed',
  }
}

Remediation Anaconda snippet ⇲

Complexity:	low
Disruption:	low
Strategy:	enable


package --add=usbguard

OVAL test results details

package usbguard is installed oval:ssg-test_package_usbguard_installed:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_test_package_usbguard_installed:obj:1 of type rpminfo_object

Name
usbguard

Enable the USBGuard Service

Rule ID	xccdf_org.ssgproject.content_rule_service_usbguard_enabled
Result	notapplicable
Multi-check rule	no
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-82853-3 References: FMT_SMF_EXT.1, SRG-OS-000378-GPOS-00163, 1418
Description	The USBGuard service should be enabled. The `usbguard` service can be enabled with the following command: $ sudo systemctl enable usbguard.service
Rationale	The `usbguard` service must be running in order to enforce the USB device authorization policy for all USB devices.

Authorize Human Interface Devices and USB hubs in USBGuard daemon

Rule ID	xccdf_org.ssgproject.content_rule_usbguard_allow_hid_and_hub
Result	fail
Multi-check rule	no
OVAL Definition ID	oval:ssg-usbguard_allow_hid_and_hub:def:1
Time	2021-02-11T19:31:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-82368-2 References: FMT_SMF_EXT.1, SRG-OS-000114-GPOS-00059
Description	To allow authorization of USB devices combining human interface device and hub capabilities by USBGuard daemon, add the line `allow with-interface match_all { 03:: 09:00:* }` to `/etc/usbguard/rules.conf`.
Rationale	Without allowing Human Interface Devices, it might not be possible to interact with the system. Without allowing hubs, it might not be possible to use any USB devices on the system.
Warnings	warning This rule should be understood primarily as a convenience administration feature. This rule ensures that if the USBGuard default rules.conf file is present, it will alter it so that USB human interface devices and hubs are allowed. However, if the rules.conf file is altered by system administrator, the rule does not check if USB human interface devices and hubs are allowed. This assumes that an administrator modified the file with some purpose in mind.
Remediation Shell script ⇲ `#!/bin/bash echo "allow with-interface match-all { 03:: 09:00:* }" >> /etc/usbguard/rules.conf`

OVAL test results details

Check that /etc/usbguard/rules.conf contains at least one non whitespace character and exists oval:ssg-test_usbguard_rules_nonempty:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_usbguard_rules_nonempty:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/etc/usbguard/rules.conf	^.\S+.$	1

Log USBGuard daemon audit events using Linux Audit

Rule ID xccdf_org.ssgproject.content_rule_configure_usbguard_auditbackend

Result

fail

Multi-check rule no

OVAL Definition ID oval:ssg-configure_usbguard_auditbackend:def:1

Time 2021-02-11T19:31:22+00:00

Severity medium

Identifiers and References

Identifiers: CCE-82168-6

References: FMT_SMF_EXT.1, SRG-OS-000062-GPOS-00031

Description

To configure USBGuard daemon to log via Linux Audit (as opposed directly to a file), AuditBackend option in /etc/usbguard/usbguard-daemon.conf needs to be set to LinuxAudit.

Rationale

Using the Linux Audit logging allows for centralized trace of events.

Remediation Shell script ⇲

Complexity:	low
Disruption:	low
Strategy:	restrict

if [ -e "/etc/usbguard/usbguard-daemon.conf" ] ; then
    LC_ALL=C sed -i "/^\s*AuditBackend=/d" "/etc/usbguard/usbguard-daemon.conf"
else
    touch "/etc/usbguard/usbguard-daemon.conf"
fi
cp "/etc/usbguard/usbguard-daemon.conf" "/etc/usbguard/usbguard-daemon.conf.bak"
# Insert at the end of the file
printf '%s\n' "AuditBackend=LinuxAudit" >> "/etc/usbguard/usbguard-daemon.conf"
# Clean up after ourselves.
rm "/etc/usbguard/usbguard-daemon.conf.bak"

OVAL test results details

tests the value of AuditBackend setting in the /etc/usbguard/usbguard-daemon.conf file oval:ssg-test_configure_usbguard_auditbackend:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_configure_usbguard_auditbackend:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/etc/usbguard/usbguard-daemon.conf	^[ \t]AuditBackend=(.+?)[ \t](?:$\|#)	1

The configuration file /etc/usbguard/usbguard-daemon.conf exists for configure_usbguard_auditbackend oval:ssg-test_configure_usbguard_auditbackend_config_file_exists:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_configure_usbguard_auditbackend_config_file:obj:1 of type file_object

Filepath
^/etc/usbguard/usbguard-daemon.conf

Red Hat and Red Hat Enterprise Linux are either registered trademarks or trademarks of Red Hat, Inc. in the United States and other countries. All other names are registered trademarks or trademarks of their respective companies.