Definition of Cloud Linux AlmaLinux OS 9 Security Technical Implementation Guide for almalinux9

needed_rules: None

Description: None

• medium

Automated: no

• enable_authselect: Enable authselect
• var_authselect_profile = sssd

ALMA-09-001010: AlmaLinux OS 9 must limit the number of concurrent sessions to ten for all accounts and/or account types.

Description: None

• low

Automated: yes

• accounts_max_concurrent_login_sessions: Limit the Number of Concurrent Login Sessions Allowed Per User
• var_accounts_max_concurrent_login_sessions = 10

ALMA-09-001120: AlmaLinux OS 9 must automatically lock graphical user sessions after 10 minutes of inactivity.

Description: None

• medium

Automated: yes

• dconf_gnome_screensaver_idle_delay: Set GNOME3 Screensaver Inactivity Timeout
• inactivity_timeout_value = 10_minutes

ALMA-09-001230: AlmaLinux OS 9 must conceal, via the session lock, information previously visible on the display with a publicly viewable image.

Description: None

• medium

Automated: yes

• dconf_gnome_screensaver_mode_blank: Implement Blank Screensaver

ALMA-09-001340: AlmaLinux OS 9 must prevent a user from overriding the session idle-delay setting for the graphical user interface.

Description: None

• medium

Automated: yes

• dconf_gnome_session_idle_user_locks: Ensure Users Cannot Change GNOME3 Session Idle Settings

ALMA-09-001450: AlmaLinux OS 9 must initiate a session lock for graphical user interfaces when the screensaver is activated.

Description: None

• medium

Automated: yes

• dconf_gnome_screensaver_lock_delay: Set GNOME3 Screensaver Lock Delay After Activation Period
• var_screensaver_lock_delay = 5_seconds

ALMA-09-001560: AlmaLinux OS 9 must prevent a user from overriding the session lock-delay setting for the graphical user interface.

Description: None

• medium

Automated: yes

• dconf_gnome_screensaver_user_locks: Ensure Users Cannot Change GNOME3 Screensaver Settings

ALMA-09-001890: AlmaLinux OS 9 must automatically exit interactive command shell user sessions after 10 minutes of inactivity.

Description: None

• medium

Automated: yes

• accounts_tmout: Set Interactive Session Timeout
• var_accounts_tmout = 10_min

ALMA-09-002000: AlmaLinux OS 9 must be able to directly initiate a session lock for all connection types using smart card when the smart card is removed.

Description: None

• medium

Automated: yes

• dconf_gnome_lock_screen_on_smartcard_removal: Enable the GNOME3 Screen Locking On Smartcard Removal

ALMA-09-002110: AlmaLinux OS 9 must prevent a user from overriding the disabling of the graphical user smart card removal action.

Description: None

• medium

Automated: yes

• dconf_gnome_lock_screen_on_smartcard_removal: Enable the GNOME3 Screen Locking On Smartcard Removal

ALMA-09-002770: AlmaLinux OS 9 must log SSH connection attempts and failures to the server.

Description: None

• medium

Automated: yes

• sshd_set_loglevel_verbose: Set SSH Daemon LogLevel to VERBOSE

ALMA-09-002880: All AlmaLinux OS 9 remote access methods must be monitored.

Description: None

• medium

Automated: yes

• rsyslog_remote_access_monitoring: Ensure remote access methods are monitored in Rsyslog

ALMA-09-002990: AlmaLinux OS 9 SSH client must be configured to use only encryption ciphers employing FIPS 140-3-validated cryptographic hash algorithms to protect the confidentiality of SSH client connections.

Description: None

• high

Automated: yes

• harden_sshd_ciphers_openssh_conf_crypto_policy: Configure SSH Client to Use FIPS 140 Validated Ciphers: openssh.config
• sshd_approved_ciphers = stig_almalinux9

ALMA-09-003210: AlmaLinux OS 9 SSH client must be configured to use only Message Authentication Codes (MACs) employing FIPS 140-3-validated cryptographic hash algorithms.

Description: None

• high

Automated: yes

• harden_sshd_macs_openssh_conf_crypto_policy: Configure SSH Client to Use FIPS 140-2 Validated MACs: openssh.config
• sshd_approved_macs = stig_almalinux9

ALMA-09-003320: The AlmaLinux 9 SSH server must be configured to use only DoW-approved encryption ciphers employing FIPS 140-3-validated cryptographic hash algorithms to protect the confidentiality of SSH server connections.

Description: None

• high

Automated: yes

• harden_sshd_ciphers_opensshserver_conf_crypto_policy: Configure SSH Server to Use FIPS 140-2 Validated Ciphers: opensshserver.config
• sshd_approved_ciphers = stig_almalinux9

ALMA-09-003430: AlmaLinux OS 9 must implement DoW-approved systemwide cryptographic policies to protect the confidentiality of SSH server connections.

Description: None

• medium

Automated: yes

• file_sshd_50_redhat_exists: The File /etc/ssh/sshd_config.d/50-redhat.conf Must Exist
• sshd_include_crypto_policy: SSHD Must Include System Crypto Policy Config File

ALMA-09-003540: The AlmaLinux OS 9 SSH server must be configured to use only Message Authentication Codes (MACs) employing FIPS 140-3-validated cryptographic hash algorithms to protect the confidentiality of SSH server connections.

Description: None

• high

Automated: yes

• harden_sshd_macs_opensshserver_conf_crypto_policy: Configure SSH Server to Use FIPS 140-2 Validated MACs: opensshserver.config
• sshd_approved_macs = stig_almalinux9

ALMA-09-003650: AlmaLinux OS 9 must force a frequent session key renegotiation for SSH connections to the server.

Description: None

• medium

Automated: yes

• sshd_rekey_limit: Force frequent session key renegotiation
• var_rekey_limit_size = 1G
• var_rekey_limit_time = 1hour

ALMA-09-003870: AlmaLinux OS 9 IP tunnels must use FIPS 140-3 approved cryptographic algorithms.

Description: None

• high

Automated: yes

• configure_libreswan_crypto_policy: Configure Libreswan to use System Crypto Policy

ALMA-09-004310: AlmaLinux OS 9 must use the TuxCare ESU repository.

Description: None

• high

Automated: yes

• ensure_tuxcare_esu_repo_enabled: Ensure the TuxCare ESU Repository is Enabled

ALMA-09-004320: AlmaLinux OS 9 must use the TuxCare FIPS packages and not the default encryption packages.

Description: None

• high

Automated: yes

• ensure_tuxcare_fips_packages_installed: Ensure the TuxCare FIPS-Validated Cryptographic Packages are Installed

ALMA-09-004420: AlmaLinux OS 9 must enable FIPS mode.

Description: None

• high

Automated: yes

• configure_crypto_policy: Configure System Cryptography Policy
• enable_dracut_fips_module: Enable Dracut FIPS Module
• enable_fips_mode: Enable FIPS Mode
• sysctl_crypto_fips_enabled: Set kernel parameter 'crypto.fips_enabled' to 1
• var_system_crypto_policy = fips

ALMA-09-004750: AlmaLinux OS 9 must automatically expire temporary accounts within 72 hours.

Description: None

• medium

Automated: no

• account_temp_expire_date: Assign Expiration Date to Temporary Accounts

ALMA-09-004970: AlmaLinux OS 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/sudoers.

Description: None

• medium

Automated: yes

• audit_rules_sudoers: Ensure auditd Collects System Administrator Actions - /etc/sudoers

ALMA-09-005080: AlmaLinux OS 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/group.

Description: None

• medium

Automated: yes

• audit_rules_usergroup_modification_group: Record Events that Modify User/Group Information - /etc/group

ALMA-09-005190: AlmaLinux OS 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/gshadow.

Description: None

• medium

Automated: yes

• audit_rules_usergroup_modification_gshadow: Record Events that Modify User/Group Information - /etc/gshadow

ALMA-09-005300: AlmaLinux OS 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/security/opasswd.

Description: None

• medium

Automated: yes

• audit_rules_usergroup_modification_opasswd: Record Events that Modify User/Group Information - /etc/security/opasswd

ALMA-09-005410: AlmaLinux OS 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/passwd.

Description: None

• medium

Automated: yes

• audit_rules_usergroup_modification_passwd: Record Events that Modify User/Group Information - /etc/passwd

ALMA-09-005960: AlmaLinux OS 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/shadow.

Description: None

• medium

Automated: yes

• audit_rules_usergroup_modification_shadow: Record Events that Modify User/Group Information - /etc/shadow

ALMA-09-006070: AlmaLinux OS 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect the files within /etc/sudoers.d/

Description: None

• medium

Automated: yes

• audit_rules_sudoers_d: Ensure auditd Collects System Administrator Actions - /etc/sudoers.d/

ALMA-09-006180: AlmaLinux OS 9 must require authentication to access emergency mode.

Description: None

• medium

Automated: yes

• require_emergency_target_auth: Require Authentication for Emergency Systemd Target

ALMA-09-006290: ALMA 9 must require authentication upon booting into single-user and maintenance modes.

Description: None

• medium

Automated: yes

• grub2_password: Set Boot Loader Password in grub2

ALMA-09-006400: AlmaLinux OS 9 must require a unique superuser's name upon booting into single-user and maintenance modes.

Description: None

• medium

Automated: yes

• grub2_admin_username: Set the Boot Loader Admin Username to a Non-Default Value

ALMA-09-006510: AlmaLinux OS 9 must require authentication to access single-user mode.

Description: None

• medium

Automated: yes

• require_singleuser_auth: Require Authentication for Single User Mode

ALMA-09-006620: The systemd Ctrl-Alt-Delete burst key sequence in AlmaLinux OS 9 must be disabled.

Description: None

• high

Automated: yes

• disable_ctrlaltdel_burstaction: Disable Ctrl-Alt-Del Burst Action

ALMA-09-006730: The Ctrl-Alt-Delete key sequence must be disabled on AlmaLinux OS 9.

Description: None

• high

Automated: yes

• disable_ctrlaltdel_reboot: Disable Ctrl-Alt-Del Reboot Activation

ALMA-09-006840: AlmaLinux OS 9 must have the sudo package installed.

Description: None

• medium

Automated: yes

• package_sudo_installed: Install sudo Package

ALMA-09-006950: The AlmaLinux OS 9 debug-shell systemd service must be disabled.

Description: None

• medium

Automated: yes

• service_debug-shell_disabled: Disable debug-shell SystemD Service

ALMA-09-007060: AlmaLinux OS 9 must enable kernel parameters to enforce discretionary access control on hardlinks.

Description: None

• medium

Automated: yes

• sysctl_fs_protected_hardlinks: Enable Kernel Parameter to Enforce DAC on Hardlinks

ALMA-09-007170: AlmaLinux OS 9 must enable kernel parameters to enforce discretionary access control (DAC) on symlinks.

Description: None

• medium

Automated: yes

• sysctl_fs_protected_symlinks: Enable Kernel Parameter to Enforce DAC on Symlinks

ALMA-09-007280: AlmaLinux OS 9 must audit uses of the "execve" system call.

Description: None

• medium

Automated: yes

• audit_rules_suid_privilege_function: Record Events When Privileged Executables Are Run

ALMA-09-007500: AlmaLinux OS 9 must automatically lock an account when three unsuccessful logon attempts occur.

Description: None

• medium

Automated: yes

• accounts_passwords_pam_faillock_deny: Lock Accounts After Failed Password Attempts
• var_accounts_passwords_pam_faillock_deny = 3

ALMA-09-007610: AlmaLinux OS 9 must automatically lock the root account until the root account is released by an administrator when three unsuccessful logon attempts occur during a 15-minute time period.

Description: None

• medium

Automated: yes

• accounts_passwords_pam_faillock_deny_root: Configure the root Account for Failed Password Attempts

ALMA-09-007720: AlmaLinux OS 9 must automatically lock an account when three unsuccessful logon attempts occur during a 15-minute time period.

Description: None

• medium

Automated: yes

• accounts_passwords_pam_faillock_interval: Set Interval For Counting Failed Password Attempts
• var_accounts_passwords_pam_faillock_fail_interval = 900

ALMA-09-007830: AlmaLinux OS 9 must configure the use of the pam_faillock.so module in the /etc/pam.d/system-auth file.

Description: None

• medium

Automated: yes

• account_password_pam_faillock_system_auth: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/system-auth File.

ALMA-09-007940: AlmaLinux OS 9 must configure the use of the pam_faillock.so module in the /etc/pam.d/password-auth file.

Description: None

• medium

Automated: yes

• account_password_pam_faillock_password_auth: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/password-auth File.

ALMA-09-008050: AlmaLinux OS 9 must log username information when unsuccessful logon attempts occur.

Description: None

• medium

Automated: yes

• accounts_passwords_pam_faillock_audit: Account Lockouts Must Be Logged

ALMA-09-008160: AlmaLinux OS 9 must maintain an account lock until the locked account is manually released by an administrator; and not automatically after a set time.

Description: None

• medium

Automated: yes

• accounts_passwords_pam_faillock_unlock_time: Set Lockout Time for Failed Password Attempts
• var_accounts_passwords_pam_faillock_unlock_time = never

ALMA-09-008270: AlmaLinux OS 9 must ensure account locks persist across reboots.

Description: None

• medium

Automated: yes

• accounts_passwords_pam_faillock_dir: Lock Accounts Must Persist

ALMA-09-008380: AlmaLinux OS 9 must configure the appropriate SELinux context on the nondefault faillock tally directory.

Description: None

• medium

Automated: yes

• account_password_selinux_faillock_dir: An SELinux Context must be configured for the pam_faillock.so records directory

ALMA-09-008490: AlmaLinux OS 9 must prevent users from disabling the Standard Mandatory DoW Notice and Consent Banner for graphical user interfaces.

Description: None

• medium

Automated: yes

• dconf_gnome_banner_enabled: Enable GNOME3 Login Warning Banner

ALMA-09-008600: AlmaLinux OS 9 must display the Standard Mandatory DoW Notice and Consent Banner before granting local or remote access to the system via a graphical user logon.

Description: None

• medium

Automated: yes

• dconf_gnome_banner_enabled: Enable GNOME3 Login Warning Banner
• dconf_gnome_login_banner_text: Set the GNOME3 Login Warning Banner Text
• dconf_login_banner_contents = dod_default
• dconf_login_banner_text = dod_banners

ALMA-09-008710: AlmaLinux OS 9 must display the Standard Mandatory DoW Notice and Consent Banner before granting local or remote access to the system via a command line user logon.

Description: None

• medium

Automated: yes

• banner_etc_issue: Modify the System Login Banner
• login_banner_contents = dod_default
• login_banner_text = dod_banners

ALMA-09-008820: AlmaLinux OS 9 must display the Standard Mandatory DoW Notice and Consent Banner before granting local or remote access to the system via an SSH user logon.

Description: None

• medium

Automated: yes

• banner_etc_issue_net: Modify the System Login Banner for Remote Connections
• login_banner_contents = dod_default
• login_banner_text = dod_banners
• sshd_enable_warning_banner_net: Enable SSH Warning Banner

ALMA-09-009260: AlmaLinux OS 9 must have the s-nail package installed.

Description: None

• medium

Automated: yes

• package_s-nail_installed: The s-nail Package Is Installed

ALMA-09-009370: AlmaLinux OS 9 SSH daemon must not allow Generic Security Service Application Program Interface (GSSAPI) authentication.

Description: None

• medium

Automated: yes

• sshd_disable_gssapi_auth: Disable GSSAPI Authentication

ALMA-09-009480: AlmaLinux OS 9 SSH daemon must not allow Kerberos authentication.

Description: None

• medium

Automated: yes

• sshd_disable_kerb_auth: Disable Kerberos Authentication

ALMA-09-009590: AlmaLinux OS 9 must check the GPG signature of software packages originating from external software repositories before installation.

Description: None

• high

Automated: yes

• ensure_gpgcheck_globally_activated: Ensure gpgcheck Enabled In Main dnf Configuration

ALMA-09-009700: AlmaLinux OS 9 must ensure cryptographic verification of vendor software packages.

Description: None

• high

Automated: yes

• ensure_almalinux_gpgkey_installed: Ensure AlmaLinux GPG Key Installed

ALMA-09-009810: AlmaLinux OS 9 must check the GPG signature of locally installed software packages before installation.

Description: None

• high

Automated: yes

• ensure_gpgcheck_local_packages: Ensure gpgcheck Enabled for Local Packages

ALMA-09-009920: AlmaLinux OS 9 must check the GPG signature of repository metadata before package installation.

Description: None

• high

Automated: yes

• ensure_gpgcheck_repo_metadata: Ensure gpgcheck Enabled for Repository Metadata

ALMA-09-010030: AlmaLinux OS 9 must have GPG signature verification enabled for all software repositories.

Description: None

• high

Automated: yes

• ensure_gpgcheck_never_disabled: Ensure gpgcheck Enabled for All dnf Package Repositories

ALMA-09-010140: AlmaLinux OS 9 must prevent the loading of a new kernel for later execution.

Description: None

• medium

Automated: yes

• sysctl_kernel_kexec_load_disabled: Disable Kernel Image Loading

ALMA-09-010250: AlmaLinux OS 9 system commands must be group-owned by root or a system account.

Description: None

• medium

Automated: yes

• file_groupownership_system_commands_dirs: Verify that system commands files are group owned by root or a system account

ALMA-09-010360: AlmaLinux OS 9 system commands must be owned by root.

Description: None

• medium

Automated: yes

• file_ownership_binary_dirs: Verify that System Executables Have Root Ownership

ALMA-09-010470: AlmaLinux OS 9 system commands must have mode 755 or less permissive.

Description: None

• medium

Automated: yes

• file_permissions_binary_dirs: Verify that System Executables Have Restrictive Permissions

ALMA-09-010580: AlmaLinux OS 9 library directories must be group-owned by root or a system account.

Description: None

• medium

Automated: yes

• dir_group_ownership_library_dirs: Verify that Shared Library Directories Have Root Group Ownership

ALMA-09-010690: AlmaLinux OS 9 library directories must be owned by root.

Description: None

• medium

Automated: yes

• dir_ownership_library_dirs: Verify that Shared Library Directories Have Root Ownership

ALMA-09-010800: AlmaLinux OS 9 library directories must have mode 755 or less permissive.

Description: None

• medium

Automated: yes

• dir_permissions_library_dirs: Verify that Shared Library Directories Have Restrictive Permissions

ALMA-09-010910: AlmaLinux OS 9 library files must be group-owned by root or a system account.

Description: None

• medium

Automated: yes

• root_permissions_syslibrary_files: Verify the system-wide library files in directories "/lib", "/lib64", "/usr/lib/" and "/usr/lib64" are group-owned by root.

ALMA-09-011020: AlmaLinux OS 9 library files must be owned by root.

Description: None

• medium

Automated: yes

• file_ownership_library_dirs: Verify that Shared Library Files Have Root Ownership

ALMA-09-011130: AlmaLinux OS 9 library files must have mode 755 or less permissive.

Description: None

• medium

Automated: yes

• file_permissions_library_dirs: Verify that Shared Library Files Have Restrictive Permissions

ALMA-09-011240: AlmaLinux OS 9 must disable core dumps for all users.

Description: None

• medium

Automated: yes

• disable_users_coredumps: Disable Core Dumps for All Users

ALMA-09-011350: AlmaLinux OS 9 must disable acquiring, saving, and processing core dumps.

Description: None

• medium

Automated: yes

• service_systemd-coredump_disabled: Disable acquiring, saving, and processing core dumps

ALMA-09-011460: AlmaLinux OS 9 must disable storing core dumps.

Description: None

• medium

Automated: yes

• coredump_disable_storage: Disable storing core dump

ALMA-09-011570: AlmaLinux OS 9 must disable core dump backtraces.

Description: None

• medium

Automated: yes

• coredump_disable_backtraces: Disable core dump backtraces

ALMA-09-011680: AlmaLinux OS 9 must disable the kernel.core_pattern.

Description: None

• medium

Automated: yes

• sysctl_kernel_core_pattern: Disable storing core dumps

ALMA-09-011790: AlmaLinux OS 9 cron configuration files directory must be group-owned by root.

Description: None

• medium

Automated: yes

• file_groupowner_cron_d: Verify Group Who Owns cron.d
• file_groupowner_cron_daily: Verify Group Who Owns cron.daily
• file_groupowner_cron_deny: Verify Group Who Owns cron.deny
• file_groupowner_cron_hourly: Verify Group Who Owns cron.hourly
• file_groupowner_cron_monthly: Verify Group Who Owns cron.monthly
• file_groupowner_cron_weekly: Verify Group Who Owns cron.weekly
• file_groupowner_crontab: Verify Group Who Owns Crontab

ALMA-09-011900: AlmaLinux OS 9 cron configuration files directory must be owned by root.

Description: None

• medium

Automated: yes

• file_owner_cron_d: Verify Owner on cron.d
• file_owner_cron_daily: Verify Owner on cron.daily
• file_owner_cron_deny: Verify Owner on cron.deny
• file_owner_cron_hourly: Verify Owner on cron.hourly
• file_owner_cron_monthly: Verify Owner on cron.monthly
• file_owner_cron_weekly: Verify Owner on cron.weekly
• file_owner_crontab: Verify Owner on crontab

ALMA-09-012010: AlmaLinux OS 9 cron configuration directories must have a mode of 0700 or less permissive.

Description: None

• medium

Automated: yes

• file_permissions_cron_d: Verify Permissions on cron.d
• file_permissions_cron_daily: Verify Permissions on cron.daily
• file_permissions_cron_hourly: Verify Permissions on cron.hourly
• file_permissions_cron_monthly: Verify Permissions on cron.monthly
• file_permissions_cron_weekly: Verify Permissions on cron.weekly

ALMA-09-012120: AlmaLinux OS 9 /etc/crontab file must have mode 0600.

Description: None

• medium

Automated: yes

• file_permissions_crontab: Verify Permissions on crontab

ALMA-09-012230: AlmaLinux OS 9 must disable the ability of a user to accidentally press Ctrl-Alt-Del and cause a system to shut down or reboot.

Description: None

• medium

Automated: yes

• dconf_gnome_disable_ctrlaltdel_reboot: Disable Ctrl-Alt-Del Reboot Key Sequence in GNOME3

ALMA-09-012340: AlmaLinux OS 9 must prevent a user from overriding the Ctrl-Alt-Del sequence settings for the graphical user interface.

Description: None

• medium

Automated: yes

• dconf_gnome_disable_ctrlaltdel_reboot: Disable Ctrl-Alt-Del Reboot Key Sequence in GNOME3

ALMA-09-012450: All AlmaLinux OS 9 local files and directories must have a valid group owner.

Description: None

• medium

Automated: yes

• file_permissions_ungroupowned: Ensure All Files Are Owned by a Group

ALMA-09-012560: All AlmaLinux OS 9 local files and directories must have a valid owner.

Description: None

• medium

Automated: yes

• no_files_unowned_by_user: Ensure All Files Are Owned by a User

ALMA-09-012670: AlmaLinux OS 9 /etc/group- file must be group owned by root.

Description: None

• medium

Automated: yes

• file_groupowner_backup_etc_group: Verify Group Who Owns Backup group File

ALMA-09-012780: AlmaLinux OS 9 /etc/group- file must be owned by root.

Description: None

• medium

Automated: yes

• file_owner_backup_etc_group: Verify User Who Owns Backup group File

ALMA-09-012890: AlmaLinux OS 9 /etc/group- file must have mode 0644 or less permissive to prevent unauthorized access.

Description: None

• medium

Automated: yes

• file_permissions_backup_etc_group: Verify Permissions on Backup group File

ALMA-09-013000: AlmaLinux OS 9 /etc/group file must be group owned by root.

Description: None

• medium

Automated: yes

• file_groupowner_etc_group: Verify Group Who Owns group File

ALMA-09-013110: AlmaLinux OS 9 /etc/group file must be owned by root.

Description: None

• medium

Automated: yes

• file_owner_etc_group: Verify User Who Owns group File

ALMA-09-013220: AlmaLinux OS 9 /etc/group file must have mode 0644 or less permissive to prevent unauthorized access.

Description: None

• medium

Automated: yes

• file_permissions_etc_group: Verify Permissions on group File

ALMA-09-013330: The /boot/grub2/grub.cfg file must be group-owned by root.

Description: None

• medium

Automated: yes

• file_groupowner_grub2_cfg: Verify /boot/grub2/grub.cfg Group Ownership

ALMA-09-013440: The /boot/grub2/grub.cfg file must be owned by root.

Description: None

• medium

Automated: yes

• file_owner_grub2_cfg: Verify /boot/grub2/grub.cfg User Ownership

ALMA-09-013550: AlmaLinux OS 9 must disable the ability of systemd to spawn an interactive boot process.

Description: None

• medium

Automated: yes

• grub2_disable_interactive_boot: Verify that Interactive Boot is Disabled

ALMA-09-013660: AlmaLinux OS 9 /etc/gshadow- file must be group-owned by root.

Description: None

• medium

Automated: yes

• file_groupowner_backup_etc_gshadow: Verify Group Who Owns Backup gshadow File

ALMA-09-013770: AlmaLinux OS 9 /etc/gshadow- file must be owned by root.

Description: None

• medium

Automated: yes

• file_owner_backup_etc_gshadow: Verify User Who Owns Backup gshadow File

ALMA-09-013880: AlmaLinux OS 9 /etc/gshadow- file must have mode 0000 or less permissive to prevent unauthorized access.

Description: None

• medium

Automated: yes

• file_permissions_backup_etc_gshadow: Verify Permissions on Backup gshadow File

ALMA-09-013990: AlmaLinux OS 9 /etc/gshadow file must be group-owned by root.

Description: None

• medium

Automated: yes

• file_groupowner_etc_gshadow: Verify Group Who Owns gshadow File

ALMA-09-014100: AlmaLinux OS 9 /etc/gshadow file must be owned by root.

Description: None

• medium

Automated: yes

• file_owner_etc_gshadow: Verify User Who Owns gshadow File

ALMA-09-014210: AlmaLinux OS 9 /etc/gshadow file must have mode 0000 or less permissive to prevent unauthorized access.

Description: None

• medium

Automated: yes

• file_permissions_etc_gshadow: Verify Permissions on gshadow File

ALMA-09-014320: The graphical display manager must not be the default target on AlmaLinux OS 9 unless approved.

Description: None

• medium

Automated: yes

• xwindows_runlevel_target: Disable Graphical Environment Startup By Setting Default Target

ALMA-09-014430: AlmaLinux OS 9 must disable the user list at logon for graphical user interfaces.

Description: None

• medium

Automated: yes

• dconf_gnome_disable_user_list: Disable the GNOME3 Login User List

ALMA-09-014540: All AlmaLinux OS 9 local interactive user accounts must be assigned a home directory upon creation.

Description: None

• medium

Automated: yes

• accounts_have_homedir_login_defs: Ensure Home Directories are Created for New Users

ALMA-09-014650: All AlmaLinux OS 9 local interactive user home directories defined in the /etc/passwd file must exist.

Description: None

• medium

Automated: yes

• accounts_user_interactive_home_directory_exists: All Interactive Users Home Directories Must Exist

ALMA-09-014760: All AlmaLinux OS 9 local interactive user home directories must be group-owned by the home directory owner's primary group.

Description: None

• medium

Automated: yes

• file_groupownership_home_directories: All Interactive User Home Directories Must Be Group-Owned By The Primary Group

ALMA-09-014870: AlmaLinux OS 9 must prevent code from being executed on file systems that contain user home directories.

Description: None

• medium

Automated: yes

• mount_option_home_noexec: Add noexec Option to /home

ALMA-09-014980: A separate file system must be used for user home directories (such as /home or an equivalent).

Description: None

• medium

Automated: yes

• partition_for_home: Ensure /home Located On Separate Partition

ALMA-09-015090: All AlmaLinux OS 9 local interactive users must have a home directory assigned in the /etc/passwd file.

Description: None

• medium

Automated: yes

• accounts_user_interactive_home_directory_defined: All Interactive Users Must Have A Home Directory Defined

ALMA-09-015200: Executable search paths within the initialization files of all local interactive AlmaLinux OS 9 users must only contain paths that resolve to the system default or the users home directory.

Description: None

• medium

Automated: yes

• accounts_user_home_paths_only: Ensure that Users Path Contains Only Local Directories

ALMA-09-015310: All AlmaLinux OS 9 local interactive user home directories must have mode 0750 or less permissive.

Description: None

• medium

Automated: yes

• file_permissions_home_directories: All Interactive User Home Directories Must Have mode 0750 Or Less Permissive

ALMA-09-015420: AlmaLinux OS 9 must not allow unattended or automatic logon via the graphical user interface.

Description: None

• high

Automated: yes

• gnome_gdm_disable_automatic_login: Disable GDM Automatic Login

ALMA-09-015640: AlmaLinux OS 9 must enforce a delay of at least four seconds between logon prompts following a failed logon attempt.

Description: None

• medium

Automated: yes

• accounts_logon_fail_delay: Ensure the Logon Failure Delay is Set Correctly in login.defs
• var_accounts_fail_delay = 4

ALMA-09-015750: AlmaLinux OS 9 must not allow blank or null passwords.

Description: None

• medium

Automated: yes

• no_empty_passwords: Prevent Login to Accounts With Empty Password

ALMA-09-015860: AlmaLinux OS 9 must not have accounts configured with blank or null passwords.

Description: None

• medium

Automated: yes

• no_empty_passwords_etc_shadow: Ensure There Are No Accounts With Blank or Null Passwords

ALMA-09-015970: AlmaLinux OS 9 /etc/passwd- file must be group-owned by root.

Description: None

• medium

Automated: yes

• file_groupowner_backup_etc_passwd: Verify Group Who Owns Backup passwd File

ALMA-09-016080: AlmaLinux OS 9 /etc/passwd- file must be owned by root.

Description: None

• medium

Automated: yes

• file_owner_backup_etc_passwd: Verify User Who Owns Backup passwd File

ALMA-09-016190: AlmaLinux OS 9 /etc/passwd- file must have mode 0644 or less permissive to prevent unauthorized access.

Description: None

• medium

Automated: yes

• file_permissions_backup_etc_passwd: Verify Permissions on Backup passwd File

ALMA-09-016300: AlmaLinux OS 9 /etc/passwd file must be group-owned by root.

Description: None

• medium

Automated: yes

• file_groupowner_etc_passwd: Verify Group Who Owns passwd File

ALMA-09-016410: AlmaLinux OS 9 /etc/passwd file must be owned by root.

Description: None

• medium

Automated: yes

• file_owner_etc_passwd: Verify User Who Owns passwd File

ALMA-09-016520: AlmaLinux OS 9 /etc/passwd file must have mode 0644 or less permissive to prevent unauthorized access.

Description: None

• medium

Automated: yes

• file_permissions_etc_passwd: Verify Permissions on passwd File

ALMA-09-016630: AlmaLinux OS 9 /etc/shadow- file must be group-owned by root.

Description: None

• medium

Automated: yes

• file_groupowner_backup_etc_shadow: Verify User Who Owns Backup shadow File

ALMA-09-016740: AlmaLinux OS 9 /etc/shadow- file must be owned by root.

Description: None

• medium

Automated: yes

• file_owner_backup_etc_shadow: Verify Group Who Owns Backup shadow File

ALMA-09-016850: AlmaLinux OS 9 /etc/shadow- file must have mode 0000 or less permissive to prevent unauthorized access.

Description: None

• medium

Automated: yes

• file_permissions_backup_etc_shadow: Verify Permissions on Backup shadow File

ALMA-09-016960: AlmaLinux OS 9 /etc/shadow file must be group-owned by root.

Description: None

• medium

Automated: yes

• file_groupowner_etc_shadow: Verify Group Who Owns shadow File

ALMA-09-017070: AlmaLinux OS 9 /etc/shadow file must be owned by root.

Description: None

• medium

Automated: yes

• file_owner_etc_shadow: Verify User Who Owns shadow File

ALMA-09-017180: AlmaLinux OS 9 /etc/shadow file must have mode 0000 to prevent unauthorized access.

Description: None

• medium

Automated: yes

• file_permissions_etc_shadow: Verify Permissions on shadow File

ALMA-09-017290: AlmaLinux OS 9 must restrict privilege elevation to authorized personnel.

Description: None

• medium

Automated: yes

• sudo_restrict_privilege_elevation_to_authorized: The operating system must restrict privilege elevation to authorized personnel

ALMA-09-017400: AlmaLinux OS 9 must use the invoking user's password for privilege escalation when using "sudo".

Description: None

• medium

Automated: yes

• sudoers_validate_passwd: Ensure invoking users password for privilege escalation when using sudo

ALMA-09-017510: AlmaLinux OS 9 must set the umask value to 077 for all local interactive user accounts.

Description: None

• medium

Automated: yes

• accounts_umask_interactive_users: Ensure the Default Umask is Set Correctly For Interactive Users
• var_accounts_user_umask = 077

ALMA-09-017620: AlmaLinux OS 9 must define default permissions for all authenticated users in such a way that the user can only read and modify their own files.

Description: None

• medium

Automated: yes

• accounts_umask_etc_login_defs: Ensure the Default Umask is Set Correctly in login.defs
• var_accounts_user_umask = 077

ALMA-09-017730: AlmaLinux OS 9 must define default permissions for PAM users.

Description: None

• medium

Automated: yes

• accounts_umask_pam_postlogin: Ensure the Default Umask is Set Through pam_umask

ALMA-09-017840: AlmaLinux OS 9 must define default permissions for logon and nonlogon shells.

Description: None

• medium

Automated: yes

• accounts_umask_etc_bashrc: Ensure the Default Bash Umask is Set Correctly
• accounts_umask_etc_csh_cshrc: Ensure the Default C Shell Umask is Set Correctly
• accounts_umask_etc_profile: Ensure the Default Umask is Set Correctly in /etc/profile
• var_accounts_user_umask = 077

ALMA-09-017950: AlmaLinux OS 9 must not have unauthorized accounts.

Description: None

• medium

Automated: yes

• accounts_authorized_local_users: Only Authorized Local User Accounts Exist on Operating System
• var_accounts_authorized_local_users_regex = almalinux9

ALMA-09-018060: AlmaLinux OS 9 must be configured so that the file integrity tool verifies Access Control Lists (ACLs).

Description: None

• medium

Automated: yes

• aide_verify_acls: Configure AIDE to Verify Access Control Lists (ACLs)

ALMA-09-018170: AlmaLinux OS 9 must use a file integrity tool that is configured to use FIPS 140-3-approved cryptographic hashes for validating file contents and directories.

Description: None

• medium

Automated: yes

• aide_use_fips_hashes: Configure AIDE to Use FIPS 140-2 for Validating Hashes

ALMA-09-018280: AlmaLinux OS 9 must be configured so that the file integrity tool verifies extended attributes.

Description: None

• medium

Automated: yes

• aide_verify_ext_attributes: Configure AIDE to Verify Extended Attributes

ALMA-09-018390: AlmaLinux OS 9 must prevent the use of dictionary words for passwords.

Description: None

• medium

Automated: yes

• accounts_password_pam_dictcheck: Ensure PAM Enforces Password Requirements - Prevent the Use of Dictionary Words
• var_password_pam_dictcheck = 1

ALMA-09-018500: AlmaLinux OS 9 must not accept router advertisements on all IPv6 interfaces.

Description: None

• medium

Automated: yes

• sysctl_net_ipv6_conf_all_accept_ra: Configure Accepting Router Advertisements on All IPv6 Interfaces
• sysctl_net_ipv6_conf_default_accept_ra: Disable Accepting Router Advertisements on all IPv6 Interfaces by Default

ALMA-09-018610: AlmaLinux OS 9 must ignore Internet Control Message Protocol (ICMP) redirect messages.

Description: None

• medium

Automated: yes

• sysctl_net_ipv4_conf_all_accept_redirects: Disable Accepting ICMP Redirects for All IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirects: Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_redirects: Disable Accepting ICMP Redirects for All IPv6 Interfaces
• sysctl_net_ipv6_conf_default_accept_redirects: Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces

ALMA-09-018720: The firewalld service on AlmaLinux OS 9 must be active.

Description: None

• medium

Automated: yes

• service_firewalld_enabled: Verify firewalld Enabled

ALMA-09-018830: AlmaLinux OS 9 firewall must employ a deny-all, allow-by-exception policy for allowing connections to other systems.

Description: None

• medium

Automated: yes

• configured_firewalld_default_deny: Firewalld Must Employ a Deny-all, Allow-by-exception Policy for Allowing Connections to Other Systems

ALMA-09-018940: AlmaLinux OS 9 must limit the number of bogus Internet Control Message Protocol (ICMP) response errors logs.

Description: None

• medium

Automated: yes

• sysctl_net_ipv4_icmp_ignore_bogus_error_responses: Enable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces

ALMA-09-019050: AlmaLinux OS 9 must not respond to Internet Control Message Protocol (ICMP) echoes sent to a broadcast address.

Description: None

• medium

Automated: yes

• sysctl_net_ipv4_icmp_echo_ignore_broadcasts: Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces

ALMA-09-019160: AlmaLinux OS 9 must not enable IP packet forwarding unless the system is a router.

Description: None

• medium

Automated: yes

• sysctl_net_ipv4_conf_all_forwarding: Disable Kernel Parameter for IPv4 Forwarding on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_forwarding: Disable Kernel Parameter for IPv4 Forwarding By Default
• sysctl_net_ipv6_conf_all_forwarding: Disable Kernel Parameter for IPv6 Forwarding
• sysctl_net_ipv6_conf_default_forwarding: Disable Kernel Parameter for IPv6 Forwarding by default

ALMA-09-019270: AlmaLinux OS 9 must not have unauthorized IP tunnels configured.

Description: None

• medium

Automated: yes

• libreswan_approved_tunnels: Verify Any Configured IPSec Tunnel Connections

ALMA-09-019380: AlmaLinux OS 9 must log packets with impossible addresses.

Description: None

• medium

Automated: yes

• sysctl_net_ipv4_conf_all_log_martians: Enable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_log_martians: Enable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces by Default

ALMA-09-019490: AlmaLinux OS 9 must be configured to prevent unrestricted mail relaying.

Description: None

• medium

Automated: yes

• postfix_prevent_unrestricted_relay: Prevent Unrestricted Mail Relaying

ALMA-09-019600: AlmaLinux OS 9 must have the nss-tools package installed.

Description: None

• medium

Automated: yes

• package_nss-tools_installed: Ensure nss-tools is installed

ALMA-09-019710: AlmaLinux OS 9 network interfaces must not be in promiscuous mode.

Description: None

• medium

Automated: yes

• network_sniffer_disabled: Ensure System is Not Acting as a Network Sniffer

ALMA-09-019820: AlmaLinux OS 9 must use reverse path filtering on all IP interfaces.

Description: None

• medium

Automated: yes

• sysctl_net_ipv4_conf_all_rp_filter: Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_rp_filter: Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default

ALMA-09-019930: AlmaLinux OS 9 must not send Internet Control Message Protocol (ICMP) redirects.

Description: None

• medium

Automated: yes

• sysctl_net_ipv4_conf_all_send_redirects: Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_send_redirects: Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default

ALMA-09-020040: There must be no .shosts files on AlmaLinux OS 9.

Description: None

• medium

Automated: yes

• no_user_host_based_files: Remove User Host-Based Authentication Files

ALMA-09-020150: There must be no shosts.equiv files on AlmaLinux OS 9.

Description: None

• medium

Automated: yes

• no_host_based_files: Remove Host-Based Authentication Files

ALMA-09-020260: Alma Linux OS 9 must not accept IPv4 source-routed packets by default.

Description: None

• medium

Automated: yes

• sysctl_net_ipv4_conf_all_accept_source_route: Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_route: Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv6_conf_all_accept_source_route: Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces
• sysctl_net_ipv6_conf_default_accept_source_route: Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default

ALMA-09-020480: The AlmaLinux OS 9 SSH server configuration file must be group-owned by root.

Description: None

• medium

Automated: yes

• directory_groupowner_sshd_config_d: Verify Group Who Owns SSH Server Configuration Files
• file_groupowner_sshd_config: Verify Group Who Owns SSH Server config file
• file_groupowner_sshd_drop_in_config: Verify Group Who Owns SSH Server Configuration Files

ALMA-09-020590: The AlmaLinux OS 9 SSH server configuration file must be owned by root.

Description: None

• medium

Automated: yes

• directory_owner_sshd_config_d: Verify Owner on SSH Server Configuration Files
• file_owner_sshd_config: Verify Owner on SSH Server config file
• file_owner_sshd_drop_in_config: Verify Owner on SSH Server Configuration Files

ALMA-09-020700: AlmaLinux OS 9 SSH server configuration files must have mode 0600 or less permissive.

Description: None

• medium

Automated: yes

• directory_permissions_sshd_config_d: Verify Permissions on SSH Server Config File
• file_permissions_sshd_config: Verify Permissions on SSH Server config file
• file_permissions_sshd_drop_in_config: Verify Permissions on SSH Server Config File

ALMA-09-020810: AlmaLinux OS 9 must not allow a noncertificate trusted host SSH logon to the system.

Description: None

• medium

Automated: yes

• disable_host_auth: Disable Host-Based Authentication

ALMA-09-020920: AlmaLinux OS 9 SSH private host key files must have mode 0600 or less permissive.

Description: None

• medium

Automated: yes

• file_permissions_sshd_private_key: Verify Permissions on SSH Server Private *_key Key Files

ALMA-09-021030: AlmaLinux OS 9 SSH public host key files must have mode 0644 or less permissive.

Description: None

• medium

Automated: yes

• file_permissions_sshd_pub_key: Verify Permissions on SSH Server Public *.pub Key Files

ALMA-09-021140: AlmaLinux OS 9 SSH daemon must not allow known hosts authentication.

Description: None

• medium

Automated: yes

• sshd_disable_user_known_hosts: Disable SSH Support for User Known Hosts

ALMA-09-021250: AlmaLinux OS 9 SSH daemon must display the date and time of the last successful account logon upon an SSH logon.

Description: None

• medium

Automated: yes

• sshd_print_last_log: Enable SSH Print Last Log

ALMA-09-021360: AlmaLinux OS 9 SSH daemon must not allow rhosts authentication.

Description: None

• medium

Automated: yes

• sshd_disable_rhosts: Disable SSH Support for .rhosts Files

ALMA-09-021470: AlmaLinux OS 9 SSH daemon must disable remote X connections for interactive users.

Description: None

• medium

Automated: yes

• sshd_disable_x11_forwarding: Disable X11 Forwarding

ALMA-09-021580: AlmaLinux OS 9 SSH daemon must prevent remote hosts from connecting to the proxy display.

Description: None

• medium

Automated: yes

• sshd_x11_use_localhost: Prevent remote hosts from connecting to the proxy display

ALMA-09-021690: If the Trivial File Transfer Protocol (TFTP) server is required, the TFTP daemon must be configured to operate in secure mode.

Description: None

• medium

Automated: yes

• tftp_uses_secure_mode_systemd: Ensure tftp systemd Service Uses Secure Mode

ALMA-09-021800: AlmaLinux OS 9 must enable hardening for the Berkeley Packet Filter (BPF) just-in-time (JIT) compiler.

Description: None

• medium

Automated: yes

• sysctl_net_core_bpf_jit_harden: Harden the operation of the BPF just-in-time compiler

ALMA-09-021910: AlmaLinux OS 9 effective dconf policy must match the policy keyfiles.

Description: None

• medium

Automated: yes

• dconf_db_up_to_date: Make sure that the dconf databases are up-to-date with regards to respective keyfiles

ALMA-09-022020: AlmaLinux OS 9 must be configured so that all system device files are correctly labeled to prevent unauthorized modification.

Description: None

• medium

Automated: yes

• selinux_all_devicefiles_labeled: Ensure No Device Files are Unlabeled by SELinux

ALMA-09-022130: All AlmaLinux OS 9 local initialization files must have mode 0740 or less permissive.

Description: None

• medium

Automated: yes

• file_permission_user_init_files_root: Ensure All User Initialization Files Have Mode 0740 Or Less Permissive
• rootfiles_configured: Ensure rootfiles tmpfile.d is Configured Correctly
• var_user_initialization_files_regex = all_dotfiles

ALMA-09-022240: AlmaLinux OS 9 must have the gnutls-utils package installed.

Description: None

• medium

Automated: yes

• package_gnutls-utils_installed: Ensure gnutls-utils is installed

ALMA-09-022350: The kdump service on AlmaLinux OS 9 must be disabled.

Description: None

• medium

Automated: yes

• service_kdump_disabled: Disable KDump Kernel Crash Analyzer (kdump)

ALMA-09-022460: AlmaLinux OS 9 must disable the ability of a user to restart the system from the login screen.

Description: None

• medium

Automated: yes

• dconf_gnome_disable_restart_shutdown: Disable the GNOME3 Login Restart and Shutdown Buttons

ALMA-09-022570: AlmaLinux OS 9 must prevent a user from overriding the disable-restart-buttons setting for the graphical user interface.

Description: None

• medium

Automated: yes

• dconf_gnome_disable_restart_shutdown: Disable the GNOME3 Login Restart and Shutdown Buttons

ALMA-09-022680: AlmaLinux OS 9 must prevent special devices on file systems that are used with removable media.

Description: None

• medium

Automated: yes

• mount_option_nodev_removable_partitions: Add nodev Option to Removable Media Partitions

ALMA-09-022790: AlmaLinux OS 9 must prevent code from being executed on file systems that are used with removable media.

Description: None

• medium

Automated: yes

• mount_option_noexec_removable_partitions: Add noexec Option to Removable Media Partitions

ALMA-09-022900: AlmaLinux OS 9 must prevent files with the setuid and setgid bit set from being executed on file systems that are used with removable media.

Description: None

• medium

Automated: yes

• mount_option_nosuid_removable_partitions: Add nosuid Option to Removable Media Partitions

ALMA-09-023010: AlmaLinux OS 9 must disable the use of user namespaces.

Description: None

• medium

Automated: yes

• sysctl_user_max_user_namespaces_no_remediation: Disable the use of user namespaces

ALMA-09-023120: AlmaLinux OS 9 must prevent special devices on file systems that are imported via Network File System (NFS).

Description: None

• medium

Automated: yes

• mount_option_nodev_remote_filesystems: Mount Remote Filesystems with nodev

ALMA-09-023230: AlmaLinux OS 9 must prevent code execution on file systems that are imported via Network File System (NFS).

Description: None

• medium

Automated: yes

• mount_option_noexec_remote_filesystems: Mount Remote Filesystems with noexec

ALMA-09-023450: AlmaLinux OS 9 must prevent files with the setuid and setgid bit set from being executed on file systems that are imported via Network File System (NFS).

Description: None

• medium

Automated: yes

• mount_option_nosuid_remote_filesystems: Mount Remote Filesystems with nosuid

ALMA-09-023560: AlmaLinux OS 9 must configure a DNS processing mode in Network Manager.

Description: None

• medium

Automated: yes

• networkmanager_dns_mode: NetworkManager DNS Mode Must Be Must Configured
• var_networkmanager_dns_mode = none

ALMA-09-023670: AlmaLinux OS 9 systems using Domain Name Servers (DNS) resolution must have at least two name servers configured.

Description: None

• medium

Automated: yes

• network_configure_name_resolution: Configure Multiple DNS Servers in /etc/resolv.conf

ALMA-09-023780: AlmaLinux OS 9 must prevent special devices on nonroot local partitions.

Description: None

• medium

Automated: yes

• mount_option_nodev_nonroot_local_partitions: Add nodev Option to Non-Root Local Partitions

ALMA-09-023890: The root account must be the only account having unrestricted access to an AlmaLinux OS 9 system.

Description: None

• medium

Automated: yes

• accounts_no_uid_except_zero: Verify Only Root Has UID 0

ALMA-09-024000: AlmaLinux OS 9 must be configured so that the cryptographic hashes of system files match vendor values.

Description: None

• medium

Automated: yes

• rpm_verify_hashes: Verify File Hashes with RPM

ALMA-09-024110: AlmaLinux OS 9 must clear the page allocator to prevent use-after-free attacks.

Description: None

• medium

Automated: yes

• grub2_page_poison_argument: Enable page allocator poisoning

ALMA-09-024330: AlmaLinux OS 9 security patches and updates must be installed and up to date.

Description: None

• medium

Automated: yes

• security_patches_up_to_date: Ensure Software Patches Installed

ALMA-09-024440: AlmaLinux OS 9 policycoreutils-python-utils package must be installed.

Description: None

• medium

Automated: yes

• package_policycoreutils-python-utils_installed: Install policycoreutils-python-utils package

ALMA-09-024550: AlmaLinux OS 9 must enable the hardware random number generator entropy gatherer service.

Description: None

• medium

Automated: no

No rules selected

ALMA-09-024660: AlmaLinux OS 9 must have the rng-tools package installed.

Description: None

• medium

Automated: yes

• package_rng-tools_installed: Install rng-tools Package

ALMA-09-024770: The SSH daemon must perform strict mode checking of home directory configuration files.

Description: None

• medium

Automated: yes

• sshd_enable_strictmodes: Enable Use of Strict Mode Checking

ALMA-09-024990: AlmaLinux OS 9 system accounts must not have an interactive login shell.

Description: None

• medium

Automated: yes

• no_shelllogin_for_systemaccounts: Ensure that System Accounts Do Not Run a Shell Upon Login

ALMA-09-025100: AlmaLinux OS 9 must use a separate file system for /tmp.

Description: None

• medium

Automated: yes

• partition_for_tmp: Ensure /tmp Located On Separate Partition

ALMA-09-025320: AlmaLinux OS 9 must use a separate file system for /var/log.

Description: None

• medium

Automated: yes

• partition_for_var_log: Ensure /var/log Located On Separate Partition

ALMA-09-025430: AlmaLinux OS 9 must use a separate file system for /var.

Description: None

• medium

Automated: yes

• partition_for_var: Ensure /var Located On Separate Partition

ALMA-09-025540: AlmaLinux OS 9 must use a separate file system for /var/tmp.

Description: None

• medium

Automated: yes

• partition_for_var_tmp: Ensure /var/tmp Located On Separate Partition

ALMA-09-025650: AlmaLinux OS 9 must disable virtual system calls.

Description: None

• medium

Automated: yes

• grub2_vsyscall_argument: Disable vsyscalls

ALMA-09-025760: AlmaLinux OS 9 must use cron logging.

Description: None

• medium

Automated: yes

• rsyslog_cron_logging: Ensure cron Is Logging To Rsyslog

ALMA-09-025870: AlmaLinux OS 9 must be configured so that the rsyslog daemon does not accept log messages from other servers unless the server is being used for log aggregation.

Description: None

• medium

Automated: yes

• rsyslog_nolisten: Ensure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server

ALMA-09-025980: AlmaLinux OS 9 must prevent files with the setuid and setgid bit set from being executed on file systems that contain user home directories.

Description: None

• medium

Automated: yes

• mount_option_home_nosuid: Add nosuid Option to /home

ALMA-09-026090: AlmaLinux OS 9 must prevent device files from being interpreted on file systems that contain user home directories.

Description: None

• medium

Automated: yes

• mount_option_home_nodev: Add nodev Option to /home

ALMA-09-026200: AlmaLinux OS 9 must prevent files with the setuid and setgid bit set from being executed on the /boot/efi directory.

Description: None

• medium

Automated: yes

• mount_option_boot_efi_nosuid: Add nosuid Option to /boot/efi

ALMA-09-026310: AlmaLinux OS 9 must mount /boot with the nodev option.

Description: None

• medium

Automated: yes

• mount_option_boot_nodev: Add nodev Option to /boot

ALMA-09-026420: AlmaLinux OS 9 must prevent files with the setuid and setgid bit set from being executed on the /boot directory.

Description: None

• medium

Automated: yes

• mount_option_boot_nosuid: Add nosuid Option to /boot

ALMA-09-026530: AlmaLinux OS 9 must mount /dev/shm with the nodev option.

Description: None

• medium

Automated: yes

• mount_option_dev_shm_nodev: Add nodev Option to /dev/shm

ALMA-09-026640: AlmaLinux OS 9 must mount /dev/shm with the noexec option.

Description: None

• medium

Automated: yes

• mount_option_dev_shm_noexec: Add noexec Option to /dev/shm

ALMA-09-026750: AlmaLinux OS 9 must mount /dev/shm with the nosuid option.

Description: None

• medium

Automated: yes

• mount_option_dev_shm_nosuid: Add nosuid Option to /dev/shm

ALMA-09-026860: AlmaLinux OS 9 must mount /tmp with the nodev option.

Description: None

• medium

Automated: yes

• mount_option_tmp_nodev: Add nodev Option to /tmp

ALMA-09-026970: AlmaLinux OS 9 must mount /tmp with the noexec option.

Description: None

• medium

Automated: yes

• mount_option_tmp_noexec: Add noexec Option to /tmp

ALMA-09-027080: AlmaLinux OS 9 must mount /tmp with the nosuid option.

Description: None

• medium

Automated: yes

• mount_option_tmp_nosuid: Add nosuid Option to /tmp

ALMA-09-027190: AlmaLinux OS 9 must mount /var/log/audit with the nodev option.

Description: None

• medium

Automated: yes

• mount_option_var_log_audit_nodev: Add nodev Option to /var/log/audit

ALMA-09-027300: AlmaLinux OS 9 must mount /var/log/audit with the noexec option.

Description: None

• medium

Automated: yes

• mount_option_var_log_audit_noexec: Add noexec Option to /var/log/audit

ALMA-09-027410: AlmaLinux OS 9 must mount /var/log/audit with the nosuid option.

Description: None

• medium

Automated: yes

• mount_option_var_log_audit_nosuid: Add nosuid Option to /var/log/audit

ALMA-09-027520: AlmaLinux OS 9 must mount /var/log with the nodev option.

Description: None

• medium

Automated: yes

• mount_option_var_log_nodev: Add nodev Option to /var/log

ALMA-09-027630: AlmaLinux OS 9 must mount /var/log with the noexec option.

Description: None

• medium

Automated: yes

• mount_option_var_log_noexec: Add noexec Option to /var/log

ALMA-09-027740: AlmaLinux OS 9 must mount /var/log with the nosuid option.

Description: None

• medium

Automated: yes

• mount_option_var_log_nosuid: Add nosuid Option to /var/log

ALMA-09-027850: AlmaLinux OS 9 must mount /var with the nodev option.

Description: None

• medium

Automated: yes

• mount_option_var_nodev: Add nodev Option to /var

ALMA-09-027960: AlmaLinux OS 9 must mount /var/tmp with the nodev option.

Description: None

• medium

Automated: yes

• mount_option_var_tmp_nodev: Add nodev Option to /var/tmp

ALMA-09-028070: AlmaLinux OS 9 must mount /var/tmp with the noexec option.

Description: None

• medium

Automated: yes

• mount_option_var_tmp_noexec: Add noexec Option to /var/tmp

ALMA-09-028180: AlmaLinux OS 9 must mount /var/tmp with the nosuid option.

Description: None

• medium

Automated: yes

• mount_option_var_tmp_nosuid: Add nosuid Option to /var/tmp

ALMA-09-028290: AlmaLinux OS 9 fapolicy module must be enabled.

Description: None

• medium

Automated: yes

• service_fapolicyd_enabled: Enable the File Access Policy Service

ALMA-09-028400: AlmaLinux OS 9 fapolicy module must be installed.

Description: None

• medium

Automated: yes

• package_fapolicyd_installed: Install fapolicyd Package

ALMA-09-028510: AlmaLinux OS 9 must disable remote management of the chrony daemon.

Description: None

• medium

Automated: yes

• chronyd_configure_local_socket: Configure chrony-wait.service to use Unix socket
• chronyd_no_chronyc_network: Disable network management of chrony daemon

ALMA-09-028620: AlmaLinux OS 9 must prevent the chrony daemon from acting as a server.

Description: None

• medium

Automated: yes

• chronyd_client_only: Disable chrony daemon from acting as server

ALMA-09-028730: AlmaLinux OS 9 must not have the iprutils package installed.

Description: None

• medium

Automated: yes

• package_iprutils_removed: Uninstall iprutils Package

ALMA-09-028840: AlmaLinux OS 9 must not have the quagga package installed.

Description: None

• medium

Automated: no

No rules selected

ALMA-09-028950: AlmaLinux OS 9 must not have the sendmail package installed.

Description: None

• medium

Automated: yes

• package_sendmail_removed: Uninstall Sendmail Package

ALMA-09-029170: AlmaLinux OS 9 must not have a Trivial File Transfer Protocol (TFTP) client package installed.

Description: None

• medium

Automated: yes

• package_tftp_removed: Remove tftp Daemon

ALMA-09-029390: AlmaLinux OS 9 must not have the cups package installed.

Description: None

• medium

Automated: yes

• package_cups_removed: Uninstall CUPS Package

ALMA-09-029500: AlmaLinux OS 9 must not have the gssproxy package installed.

Description: None

• medium

Automated: yes

• package_gssproxy_removed: Uninstall gssproxy Package

ALMA-09-029610: AlmaLinux OS 9 must disable the Asynchronous Transfer Mode (ATM) kernel module.

Description: None

• medium

Automated: yes

• kernel_module_atm_disabled: Disable ATM Support

ALMA-09-029720: AlmaLinux OS 9 must be configured to disable Bluetooth.

Description: None

• medium

Automated: yes

• kernel_module_bluetooth_disabled: Disable Bluetooth Kernel Module

ALMA-09-029830: AlmaLinux OS 9 must disable the Controller Area Network (CAN) kernel module.

Description: None

• medium

Automated: yes

• kernel_module_can_disabled: Disable CAN Support

ALMA-09-029940: AlmaLinux OS 9 must disable mounting of cramfs.

Description: None

• medium

Automated: yes

• kernel_module_cramfs_disabled: Disable Mounting of cramfs

ALMA-09-030050: AlmaLinux OS 9 must disable the Stream Control Transmission Protocol (SCTP) kernel module.

Description: None

• medium

Automated: yes

• kernel_module_sctp_disabled: Disable SCTP Support

ALMA-09-030160: AlmaLinux OS 9 must disable mounting of squashfs.

Description: None

• medium

Automated: yes

• kernel_module_squashfs_disabled: Disable Mounting of squashfs

ALMA-09-030270: AlmaLinux OS 9 must disable the Transparent Inter Process Communication (TIPC) kernel module.

Description: None

• medium

Automated: yes

• kernel_module_tipc_disabled: Disable TIPC Support

ALMA-09-030380: AlmaLinux OS 9 must disable mounting of udf.

Description: None

• medium

Automated: yes

• kernel_module_udf_disabled: Disable Mounting of udf

ALMA-09-030490: Cameras must be disabled or covered when not in use.

Description: None

• medium

Automated: yes

• kernel_module_uvcvideo_disabled: Disable the uvcvideo module

ALMA-09-030600: AlmaLinux OS 9 must not have the nfs-utils package installed.

Description: None

• medium

Automated: yes

• package_nfs-utils_removed: Uninstall nfs-utils Package

ALMA-09-030710: AlmaLinux OS 9 must not have the rsh package installed.

Description: None

• medium

Automated: yes

• package_rsh_removed: Uninstall rsh Package

ALMA-09-030820: AlmaLinux OS 9 must not install packages from the Extra Packages for Enterprise Linux (EPEL) repository.

Description: None

• medium

Automated: yes

• ensure_epel_repos_disabled: Ensure EPEL Repository is Disabled

ALMA-09-030930: AlmaLinux OS 9 must not have the tuned package installed.

Description: None

• medium

Automated: yes

• package_tuned_removed: Uninstall tuned Package

ALMA-09-031040: A graphical display manager must not be installed on AlmaLinux OS 9 unless approved.

Description: None

• medium

Automated: yes

• xwindows_remove_packages: Disable graphical user interface

ALMA-09-031150: AlmaLinux OS 9 must not have the ypserv package installed.

Description: None

• medium

Automated: no

No rules selected

ALMA-09-031260: AlmaLinux OS 9 must not have the avahi package installed.

Description: None

• medium

Automated: yes

• package_avahi_removed: Uninstall avahi Server Package

ALMA-09-031370: AlmaLinux OS 9 must be configured to disable USB mass storage.

Description: None

• medium

Automated: yes

• kernel_module_usb-storage_disabled: Disable Modprobe Loading of USB Storage Driver

ALMA-09-031700: AlmaLinux OS 9 must have the firewalld package installed.

Description: None

• medium

Automated: yes

• package_firewalld_installed: Install firewalld Package

ALMA-09-031920: AlmaLinux OS 9 must require users to provide authentication for privilege escalation.

Description: None

• medium

Automated: yes

• sudo_remove_no_authenticate: Ensure Users Re-Authenticate for Privilege Escalation - sudo !authenticate

ALMA-09-032030: AlmaLinux OS 9 must require users to provide a password for privilege escalation.

Description: None

• medium

Automated: yes

• sudo_remove_nopasswd: Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD

ALMA-09-032140: AlmaLinux OS 9 must not be configured to bypass password requirements for privilege escalation.

Description: None

• medium

Automated: yes

• disallow_bypass_password_sudo: Disallow Configuration to Bypass Password Requirements for Privilege Escalation

ALMA-09-032250: AlmaLinux OS 9 must require reauthentication when using the "sudo" command.

Description: None

• medium

Automated: yes

• sudo_require_reauthentication: Require Re-Authentication When Using the sudo Command
• var_sudo_timestamp_timeout = always_prompt

ALMA-09-032470: AlmaLinux OS 9 must restrict the use of the "su" command.

Description: None

• medium

Automated: yes

• use_pam_wheel_for_su: Enforce usage of pam_wheel for su authentication

ALMA-09-032910: Groups must have unique Group IDs (GIDs).

Description: None

• medium

Automated: yes

• group_unique_id: Ensure All Groups on the System Have Unique Group ID

ALMA-09-033020: Duplicate User IDs (UIDs) must not exist for interactive users.

Description: None

• medium

Automated: yes

• account_unique_id: Ensure All Accounts on the System Have Unique User IDs

ALMA-09-033130: All AlmaLinux OS 9 interactive users must have a primary group that exists.

Description: None

• medium

Automated: yes

• gid_passwd_group_same: All GIDs referenced in /etc/passwd must be defined in /etc/group

ALMA-09-033240: AlmaLinux OS 9 SSHD must accept public key authentication.

Description: None

• medium

Automated: yes

• sshd_enable_pubkey_auth: Enable Public Key Authentication

ALMA-09-033350: AlmaLinux OS 9 must have the opensc package installed.

Description: None

• medium

Automated: yes

• package_opensc_installed: Install the opensc Package For Multifactor Authentication

ALMA-09-033460: The pcscd socket on AlmaLinux OS 9 must be active.

Description: None

• medium

Automated: yes

• socket_pcscd_enabled: Enable the pcscd Socket

ALMA-09-033570: AlmaLinux OS 9 must have the pcsc-lite package installed.

Description: None

• medium

Automated: yes

• package_pcsc-lite_installed: Install the pcsc-lite package

ALMA-09-033680: AlmaLinux OS 9 must implement certificate status checking for multifactor authentication.

Description: None

• medium

Automated: yes

• sssd_certificate_verification: Certificate status checking in SSSD
• var_sssd_certificate_verification_digest_function = sha512

ALMA-09-033790: AlmaLinux OS 9 must enable certificate based smart card authentication.

Description: None

• medium

Automated: yes

• sssd_enable_smartcards: Enable Smartcards in SSSD

ALMA-09-034010: AlmaLinux OS 9 must have the openssl-pkcs11 package installed.

Description: None

• medium

Automated: yes

• install_smartcard_packages: Install Smart Card Packages For Multifactor Authentication

ALMA-09-034120: AlmaLinux OS 9 SSHD must not allow blank passwords.

Description: None

• medium

Automated: yes

• sshd_disable_empty_passwords: Disable SSH Access via Empty Passwords

ALMA-09-034340: AlmaLinux OS 9 must use the CAC smart card driver.

Description: None

• medium

Automated: yes

• configure_opensc_card_drivers: Configure opensc Smart Card Drivers
• var_smartcard_drivers = cac

ALMA-09-034780: AlmaLinux OS 9 must not permit direct logons to the root account using remote access via SSH.

Description: None

• medium

Automated: yes

• sshd_disable_root_login: Disable SSH Root Login

ALMA-09-034890: AlmaLinux OS 9 must disable the graphical user interface automount function unless required.

Description: None

• medium

Automated: yes

• dconf_gnome_disable_automount_open: Disable GNOME3 Automount Opening

ALMA-09-035000: AlmaLinux OS 9 must prevent a user from overriding the disabling of the graphical user interface automount function.

Description: None

• medium

Automated: yes

• dconf_gnome_disable_automount_open: Disable GNOME3 Automount Opening

ALMA-09-035110: AlmaLinux OS 9 must prevent a user from overriding the disabling of the graphical user interface autorun function.

Description: None

• medium

Automated: yes

• dconf_gnome_disable_autorun: Disable GNOME3 Automount running

ALMA-09-035210: AlmaLinux OS 9 must have the USBGuard package installed.

Description: None

• medium

Automated: yes

• package_usbguard_installed: Install usbguard Package

ALMA-09-035220: AlmaLinux OS 9 must have the USBGuard package enabled.

Description: None

• medium

Automated: yes

• service_usbguard_enabled: Enable the USBGuard Service

ALMA-09-035440: AlmaLinux OS 9 must block unauthorized peripherals before establishing a connection.

Description: None

• medium

Automated: yes

• usbguard_generate_policy: Generate USBGuard Policy

ALMA-09-035550: AlmaLinux OS 9 must not have the autofs package installed.

Description: None

• medium

Automated: yes

• package_autofs_removed: Remove autofs Package

ALMA-09-035660: AlmaLinux OS 9 must disable account identifiers (individuals, groups, roles, and devices) after 35 days of inactivity.

Description: None

• medium

Automated: yes

• account_disable_post_pw_expiration: Set Account Expiration Following Inactivity
• var_account_disable_post_pw_expiration = 35

ALMA-09-035770: AlmaLinux OS 9 must enforce password complexity by requiring that at least one lowercase character be used.

Description: None

• medium

Automated: yes

• accounts_password_pam_lcredit: Ensure PAM Enforces Password Requirements - Minimum Lowercase Characters
• var_password_pam_lcredit = 1

ALMA-09-035880: AlmaLinux OS 9 must ensure the password complexity module is enabled in the password-auth file.

Description: None

• medium

Automated: yes

• accounts_password_pam_pwquality_password_auth: Ensure PAM password complexity module is enabled in password-auth
• accounts_password_pam_pwquality_system_auth: Ensure PAM password complexity module is enabled in system-auth

ALMA-09-035990: AlmaLinux OS 9 must ensure the password complexity module in the system-auth file is configured for three retries or less.

Description: None

• medium

Automated: yes

• accounts_password_pam_pwquality_retry: Ensure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session in /etc/security/pwquality.conf
• var_password_pam_retry = 3

ALMA-09-036100: AlmaLinux OS 9 must enforce password complexity rules for the root account.

Description: None

• medium

Automated: yes

• accounts_password_pam_enforce_root: Ensure PAM Enforces Password Requirements - Enforce for root User

ALMA-09-036210: AlmaLinux OS 9 must enforce password complexity by requiring that at least one uppercase character be used.

Description: None

• medium

Automated: yes

• accounts_password_pam_ucredit: Ensure PAM Enforces Password Requirements - Minimum Uppercase Characters
• var_password_pam_ucredit = 1

ALMA-09-036320: AlmaLinux OS 9 must enforce password complexity by requiring that at least one special character be used.

Description: None

• medium

Automated: yes

• accounts_password_pam_ocredit: Ensure PAM Enforces Password Requirements - Minimum Special Characters
• var_password_pam_ocredit = 1

ALMA-09-036540: AlmaLinux OS 9 passwords must be created with a minimum of 15 characters.

Description: None

• medium

Automated: yes

• accounts_password_pam_minlen: Ensure PAM Enforces Password Requirements - Minimum Length
• var_password_pam_minlen = 15

ALMA-09-036650: AlmaLinux OS 9 must enforce password complexity by requiring that at least one numeric character be used.

Description: None

• medium

Automated: yes

• accounts_password_pam_dcredit: Ensure PAM Enforces Password Requirements - Minimum Digit Characters
• var_password_pam_dcredit = 1

ALMA-09-036760: AlmaLinux OS 9 must require the change of at least four character classes when passwords are changed.

Description: None

• medium

Automated: yes

• accounts_password_pam_minclass: Ensure PAM Enforces Password Requirements - Minimum Different Categories
• var_password_pam_minclass = 4

ALMA-09-036870: AlmaLinux OS 9 must require the maximum number of repeating characters be limited to three when passwords are changed.

Description: None

• medium

Automated: yes

• accounts_password_pam_maxrepeat: Set Password Maximum Consecutive Repeating Characters
• var_password_pam_maxrepeat = 3

ALMA-09-036980: AlmaLinux OS 9 must require the maximum number of repeating characters of the same character class be limited to four when passwords are changed.

Description: None

• medium

Automated: yes

• accounts_password_pam_maxclassrepeat: Ensure PAM Enforces Password Requirements - Maximum Consecutive Repeating Characters from Same Character Class
• var_password_pam_maxclassrepeat = 4

ALMA-09-037090: AlmaLinux OS 9 must require the change of at least eight characters when passwords are changed.

Description: None

• medium

Automated: yes

• accounts_password_pam_difok: Ensure PAM Enforces Password Requirements - Minimum Different Characters
• var_password_pam_difok = 8

ALMA-09-037200: AlmaLinux OS 9 PAM must be configured to use a sufficient number of password hashing rounds.

Description: None

• high

Automated: yes

• accounts_password_pam_unix_rounds_password_auth: Set number of Password Hashing Rounds - password-auth
• accounts_password_pam_unix_rounds_system_auth: Set number of Password Hashing Rounds - system-auth
• var_password_pam_unix_rounds = 100000

ALMA-09-037310: AlmaLinux OS 9 must be configured so that libuser is configured to store only encrypted representations of passwords.

Description: None

• high

Automated: yes

• set_password_hashing_algorithm_libuserconf: Set Password Hashing Algorithm in /etc/libuser.conf
• var_password_hashing_algorithm_pam = sha512

ALMA-09-037420: AlmaLinux OS 9 must be configured so that the system's shadow file is configured to store only encrypted representations of passwords.

Description: None

• high

Automated: yes

• set_password_hashing_algorithm_logindefs: Set Password Hashing Algorithm in /etc/login.defs
• var_password_hashing_algorithm = SHA512

ALMA-09-037530: AlmaLinux OS 9 must be configured so that the Pluggable Authentication Module is configured to store only encrypted representations of passwords.

Description: None

• high

Automated: yes

• set_password_hashing_algorithm_passwordauth: Set PAM Password Hashing Algorithm - password-auth
• var_password_hashing_algorithm_pam = sha512

ALMA-09-037640: AlmaLinux OS 9 must be configured so that interactive user account passwords are using strong password hashes.

Description: None

• high

Automated: yes

• accounts_password_all_shadowed_sha512: Verify All Account Password Hashes are Shadowed with SHA512

ALMA-09-037750: AlmaLinux OS 9 must not have any File Transfer Protocol (FTP) packages installed.

Description: None

• high

Automated: yes

• package_ftp_removed: Remove ftp Package
• package_vsftpd_removed: Uninstall vsftpd Package

ALMA-09-037860: AlmaLinux OS 9 must not have any telnet packages installed.

Description: None

• high

Automated: yes

• package_telnet-server_removed: Uninstall telnet-server Package
• package_telnet_removed: Remove telnet Clients

ALMA-09-037970: Passwords for existing users must have a 180-day maximum password lifetime restriction in /etc/shadow.

Description: None

• medium

Automated: yes

• accounts_password_set_max_life_existing: Set Existing Passwords Maximum Age
• var_accounts_maximum_age_login_defs = 180

ALMA-09-038080: Passwords for new users or password changes must have a 180-day maximum password lifetime restriction in /etc/login.defs.

Description: None

• medium

Automated: yes

• accounts_maximum_age_login_defs: Set Password Maximum Age
• var_accounts_maximum_age_login_defs = 180

ALMA-09-038190: Passwords for existing users must have a 24-hour minimum password lifetime restriction in /etc/shadow.

Description: None

• medium

Automated: yes

• accounts_password_set_min_life_existing: Set Existing Passwords Minimum Age
• var_accounts_minimum_age_login_defs = 1

ALMA-09-038300: Passwords for new users or password changes must have a 24-hour minimum password lifetime restriction in /etc/login.defs.

Description: None

• medium

Automated: yes

• accounts_minimum_age_login_defs: Set Password Minimum Age
• var_accounts_minimum_age_login_defs = 1

ALMA-09-038630: AlmaLinux OS 9 must prohibit the use of cached authenticators after one day.

Description: None

• medium

Automated: yes

• sssd_offline_cred_expiration: Configure SSSD to Expire Offline Credentials

ALMA-09-038850: For PKI-based authentication, AlmaLinux OS 9 must enforce authorized access to the corresponding private key.

Description: None

• medium

Automated: yes

• ssh_keys_passphrase_protected: Verify the SSH Private Key Files Have a Passcode

ALMA-09-038960: AlmaLinux OS 9 must map the authenticated identity to the user or group account for PKI-based authentication.

Description: None

• medium

Automated: yes

• sssd_enable_certmap: Enable Certmap in SSSD

ALMA-09-039070: AlmaLinux OS 9, for PKI-based authentication, must validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor.

Description: None

• medium

Automated: yes

• sssd_has_trust_anchor: SSSD Has a Correct Trust Anchor

ALMA-09-039510: The libreswan package must be installed.

Description: None

• medium

Automated: yes

• package_libreswan_installed: Install libreswan Package

ALMA-09-039620: AlmaLinux OS 9 must have the packages required for encrypting offloaded audit logs installed.

Description: None

• medium

Automated: yes

• package_rsyslog-gnutls_installed: Ensure rsyslog-gnutls is installed

ALMA-09-040170: AlmaLinux OS 9 must be configured so that all network connections associated with SSH traffic are terminated after 10 minutes of becoming unresponsive.

Description: None

• medium

Automated: yes

• sshd_idle_timeout_value = 10_minutes
• sshd_set_idle_timeout: Set SSH Client Alive Interval
• sshd_set_keepalive: Set SSH Client Alive Count Max
• var_sshd_set_keepalive = 1

ALMA-09-040390: AlmaLinux OS 9 must enable the Pluggable Authentication Module (PAM) interface for SSHD.

Description: None

• high

Automated: yes

• sshd_enable_pam: Enable PAM

ALMA-09-040500: AlmaLinux OS 9 must terminate idle user sessions.

Description: None

• medium

Automated: yes

• logind_session_timeout: Configure Logind to terminate idle sessions after certain time of inactivity
• var_logind_session_timeout = 10_minutes

ALMA-09-040720: AlmaLinux OS 9 must disable access to network bpf system call from nonprivileged processes.

Description: None

• medium

Automated: yes

• sysctl_kernel_unprivileged_bpf_disabled: Disable Access to Network bpf() Syscall From Unprivileged Processes

ALMA-09-040830: AlmaLinux OS 9 must restrict exposed kernel pointer addresses access.

Description: None

• medium

Automated: yes

• sysctl_kernel_kptr_restrict: Restrict Exposed Kernel Pointer Addresses Access

ALMA-09-040940: AlmaLinux OS 9 must restrict usage of ptrace to descendant processes.

Description: None

• medium

Automated: yes

• sysctl_kernel_yama_ptrace_scope: Restrict usage of ptrace to descendant processes

ALMA-09-041050: AlmaLinux OS 9 must restrict access to the kernel message buffer.

Description: None

• medium

Automated: yes

• sysctl_kernel_dmesg_restrict: Restrict Access to Kernel Message Buffer

ALMA-09-041160: AlmaLinux OS 9 must prevent kernel profiling by nonprivileged users.

Description: None

• medium

Automated: yes

• sysctl_kernel_perf_event_paranoid: Disallow kernel profiling by unprivileged users

ALMA-09-041270: AlmaLinux OS 9 must only allow the use of DoW PKI-established certificate authorities for authentication in the establishment of protected sessions to the operating system.

Description: None

• medium

Automated: no

• only_allow_dod_certs: Only Allow DoD PKI-established CAs

ALMA-09-041490: AlmaLinux OS 9 systemd-journald service must be enabled.

Description: None

• medium

Automated: yes

• service_systemd-journald_enabled: Enable systemd-journald Service

ALMA-09-041600: AlmaLinux OS 9 local disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at rest protection.

Description: None

• high

Automated: yes

• encrypt_partitions: Encrypt Partitions

ALMA-09-041930: AlmaLinux OS 9 must use a Linux Security Module configured to enforce limits on system services.

Description: None

• medium

Automated: yes

• grub2_enable_selinux: Ensure SELinux Not Disabled in /etc/default/grub
• selinux_state: Ensure SELinux State is Enforcing
• var_selinux_state = enforcing

ALMA-09-042040: AlmaLinux OS 9 must have the policycoreutils package installed.

Description: None

• medium

Automated: yes

• package_policycoreutils_installed: Install policycoreutils Package

ALMA-09-042150: Any AlmaLinux OS 9 world-writable directories must be owned by root, sys, bin, or an application user.

Description: None

• medium

Automated: yes

• dir_perms_world_writable_system_owned: Ensure All World-Writable Directories Are Owned by a System Account

ALMA-09-042260: A sticky bit must be set on all AlmaLinux OS 9 public directories.

Description: None

• medium

Automated: yes

• dir_perms_world_writable_sticky_bits: Verify that All World-Writable Directories Have Sticky Bits Set

ALMA-09-042370: AlmaLinux OS 9 must protect against or limit the effects of denial-of-service (DoS) attacks by ensuring rate-limiting measures on impacted network interfaces are implemented.

Description: None

• medium

Automated: yes

• firewalld-backend: Configure Firewalld to Use the Nftables Backend

ALMA-09-042480: AlmaLinux OS 9 must be configured to use TCP syncookies.

Description: None

• medium

Automated: yes

• sysctl_net_ipv4_tcp_syncookies: Enable Kernel Parameter to Use TCP Syncookies on Network Interfaces

ALMA-09-042700: All AlmaLinux OS 9 networked systems must have the OpenSSH client package installed.

Description: None

• high

Automated: yes

• package_openssh-clients_installed: Install OpenSSH client software

ALMA-09-042810: All AlmaLinux OS 9 networked systems must implement SSH to protect the confidentiality and integrity of transmitted and received information, including information being prepared for transmission.

Description: None

• medium

Automated: yes

• service_sshd_enabled: Enable the OpenSSH Service

ALMA-09-042920: All AlmaLinux OS 9 networked systems must have the OpenSSH server installed.

Description: None

• medium

Automated: yes

• package_openssh-server_installed: Install the OpenSSH Server Package

ALMA-09-043030: AlmaLinux OS 9 must not allow users to override SSH environment variables.

Description: None

• medium

Automated: yes

• sshd_do_not_permit_user_env: Do Not Allow SSH Environment Options

ALMA-09-043250: AlmaLinux OS 9 wireless network adapters must be disabled.

Description: None

• medium

Automated: yes

• wireless_disable_interfaces: Deactivate Wireless Network Interfaces

ALMA-09-043800: AlmaLinux OS 9 must not show boot up messages.

Description: None

• medium

Automated: yes

• grub2_quiet_argument: Suppress Boot Messages via Bootloader Configuration

ALMA-09-043910: AlmaLinux OS 9 /var/log directory must be group-owned by root.

Description: None

• medium

Automated: yes

• file_groupowner_var_log: Verify Group Who Owns /var/log Directory

ALMA-09-044020: AlmaLinux OS 9 /var/log/messages file must be group-owned by root.

Description: None

• medium

Automated: yes

• file_groupowner_var_log_messages: Verify Group Who Owns /var/log/messages File

ALMA-09-044130: AlmaLinux OS 9 /var/log/messages file must be owned by root.

Description: None

• medium

Automated: yes

• file_owner_var_log_messages: Verify User Who Owns /var/log/messages File

ALMA-09-044240: AlmaLinux OS 9 /var/log/messages file must have mode 0640 or less permissive.

Description: None

• medium

Automated: yes

• file_permissions_var_log_messages: Verify Permissions on /var/log/messages File

ALMA-09-044350: AlmaLinux OS 9 /var/log directory must be owned by root.

Description: None

• medium

Automated: yes

• file_owner_var_log: Verify User Who Owns /var/log Directory

ALMA-09-044460: AlmaLinux OS 9 /var/log directory must have mode 0755 or less permissive.

Description: None

• medium

Automated: yes

• file_permissions_var_log: Verify Permissions on /var/log Directory

ALMA-09-044570: AlmaLinux OS 9 must implement nonexecutable data to protect its memory from unauthorized code execution.

Description: None

• medium

Automated: yes

• sysctl_kernel_exec_shield: Enable ExecShield via sysctl

ALMA-09-044680: AlmaLinux OS 9 must enable mitigations against processor-based vulnerabilities.

Description: None

• medium

Automated: yes

• grub2_pti_argument: Enable Kernel Page-Table Isolation (KPTI)

ALMA-09-044790: AlmaLinux OS 9 must clear memory when it is freed to prevent use-after-free attacks.

Description: None

• medium

Automated: yes

• grub2_init_on_free: The system must booted with init_on_free=1

ALMA-09-044900: AlmaLinux OS 9 must implement address space layout randomization (ASLR) to protect its memory from unauthorized code execution.

Description: None

• medium

Automated: yes

• sysctl_kernel_randomize_va_space: Enable Randomized Layout of Virtual Address Space

ALMA-09-045120: AlmaLinux OS 9 must remove all software components after updated versions have been installed.

Description: None

• medium

Automated: yes

• clean_components_post_updating: Ensure dnf Removes Previous Package Versions

ALMA-09-045125: AlmaLinux OS 9 must be a supported release.

Description: None

• high

Automated: yes

• installed_OS_is_vendor_supported: The Installed Operating System Is Vendor Supported

ALMA-09-045230: AlmaLinux OS 9 must enable the SELinux targeted policy.

Description: None

• medium

Automated: yes

• selinux_policytype: Configure SELinux Policy
• var_selinux_policy_name = targeted

ALMA-09-045340: AlmaLinux OS 9 must have the Advanced Intrusion Detection Environment (AIDE) package installed.

Description: None

• medium

Automated: yes

• aide_build_database: Build and Test AIDE Database
• package_aide_installed: Install AIDE

ALMA-09-045450: AlmaLinux OS 9 must routinely check the baseline configuration for unauthorized changes and notify the system administrator when anomalies in the operation of any security functions are discovered.

Description: None

• medium

Automated: yes

• aide_scan_notification: Configure Notification of Post-AIDE Scan Details

ALMA-09-045670: AlmaLinux OS 9 audit system must audit local events.

Description: None

• medium

Automated: yes

• auditd_local_events: Include Local Events in Audit Logs

ALMA-09-045780: AlmaLinux OS 9 /etc/audit/auditd.conf file must have 0640 or less permissive to prevent unauthorized access.

Description: None

• medium

Automated: yes

• file_permissions_etc_audit_auditd: Verify Permissions on /etc/audit/auditd.conf

ALMA-09-045890: AlmaLinux OS 9 must allow only the information system security manager (ISSM) (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited.

Description: None

• medium

Automated: yes

• file_permissions_audit_configuration_stig: Audit Configuration Files Permissions are 600 or More Restrictive

ALMA-09-046000: Successful/unsuccessful uses of the init command in AlmaLinux OS 9 must generate an audit record.

Description: None

• medium

Automated: yes

• audit_privileged_commands_init: Ensure auditd Collects Information on the Use of Privileged Commands - init

ALMA-09-046220: AlmaLinux OS 9 must generate audit records for any use of the "poweroff" command.

Description: None

• medium

Automated: yes

• audit_privileged_commands_poweroff: Ensure auditd Collects Information on the Use of Privileged Commands - poweroff

ALMA-09-046330: AlmaLinux OS 9 must generate audit records for any use of the "reboot" command.

Description: None

• medium

Automated: yes

• audit_privileged_commands_reboot: Ensure auditd Collects Information on the Use of Privileged Commands - reboot

ALMA-09-046440: AlmaLinux must generate audit records for any use of the "shutdown" command.

Description: None

• medium

Automated: yes

• audit_privileged_commands_shutdown: Ensure auditd Collects Information on the Use of Privileged Commands - shutdown

ALMA-09-046550: AlmaLinux OS 9 must enable Linux audit logging for the USBGuard daemon.

Description: None

• medium

Automated: yes

• configure_usbguard_auditbackend: Log USBGuard daemon audit events using Linux Audit

ALMA-09-046660: AlmaLinux OS 9 must audit all uses of the delete_module, init_module and finit_module system calls.

Description: None

• medium

Automated: yes

• audit_rules_kernel_module_loading_delete: Ensure auditd Collects Information on Kernel Module Unloading - delete_module
• audit_rules_kernel_module_loading_finit: Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
• audit_rules_kernel_module_loading_init: Ensure auditd Collects Information on Kernel Module Loading - init_module

ALMA-09-046770: AlmaLinux OS 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /var/log/tallylog.

Description: None

• medium

Automated: yes

• audit_rules_login_events_tallylog: Record Attempts to Alter Logon and Logout Events - tallylog

ALMA-09-046880: AlmaLinux OS 9 must produce audit records containing information to establish the identity of any individual or process associated with the event.

Description: None

• medium

Automated: yes

• auditd_log_format: Resolve information before writing to audit logs

ALMA-09-047100: The audit package must be installed on AlmaLinux OS 9.

Description: None

• medium

Automated: yes

• package_audit_installed: Ensure the audit Subsystem is Installed

ALMA-09-047540: AlmaLinux OS 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /var/log/lastlog.

Description: None

• medium

Automated: yes

• audit_rules_login_events_lastlog: Record Attempts to Alter Logon and Logout Events - lastlog

ALMA-09-047650: AlmaLinux OS 9 must generate audit records for any use of the "mount" command.

Description: None

• medium

Automated: yes

• audit_rules_privileged_commands_mount: Ensure auditd Collects Information on the Use of Privileged Commands - mount

ALMA-09-047760: AlmaLinux OS 9 must generate audit records for any use of the "umount" command.

Description: None

• medium

Automated: yes

• audit_rules_privileged_commands_umount: Ensure auditd Collects Information on the Use of Privileged Commands - umount

ALMA-09-047870: Successful/unsuccessful uses of the umount2 system call in AlmaLinux OS 9 must generate an audit record.

Description: None

• medium

Automated: yes

• audit_rules_dac_modification_umount2: Record Events that Modify the System's Discretionary Access Controls - umount2

ALMA-09-047980: AlmaLinux OS 9 must enable auditing of processes that start prior to the audit daemon.

Description: None

• medium

Automated: yes

• grub2_audit_argument: Enable Auditing for Processes Which Start Prior to the Audit Daemon

ALMA-09-048090: AlmaLinux OS 9 must audit all uses of the truncate, ftruncate, creat, open, openat, and open_by_handle_at system calls.

Description: None

• medium

Automated: yes

• audit_rules_unsuccessful_file_modification_creat: Record Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncate: Record Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_open: Record Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_at: Record Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_openat: Record Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_truncate: Record Unsuccessful Access Attempts to Files - truncate

ALMA-09-048200: AlmaLinux OS 9 must generate audit records for any use of the "chacl" command.

Description: None

• medium

Automated: yes

• audit_rules_execution_chacl: Record Any Attempts to Run chacl

ALMA-09-048310: AlmaLinux OS 9 must generate audit records for any use of the "chage" command.

Description: None

• medium

Automated: yes

• audit_rules_privileged_commands_chage: Ensure auditd Collects Information on the Use of Privileged Commands - chage

ALMA-09-048420: AlmaLinux OS 9 must generate audit records for any use of the "chcon" command.

Description: None

• medium

Automated: yes

• audit_rules_execution_chcon: Record Any Attempts to Run chcon

ALMA-09-048530: AlmaLinux OS 9 must audit all uses of the chmod, fchmod, and fchmodat system calls.

Description: None

• medium

Automated: yes

• audit_rules_dac_modification_chmod: Record Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_fchmod: Record Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodat: Record Events that Modify the System's Discretionary Access Controls - fchmodat

ALMA-09-048640: AlmaLinux OS 9 must audit all uses of the chown, fchown, fchownat, and lchown system calls.

Description: None

• medium

Automated: yes

• audit_rules_dac_modification_chown: Record Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchown: Record Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownat: Record Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_lchown: Record Events that Modify the System's Discretionary Access Controls - lchown

ALMA-09-048750: AlmaLinux OS 9 must generate audit records for any use of the "chsh" command.

Description: None

• medium

Automated: yes

• audit_rules_privileged_commands_chsh: Ensure auditd Collects Information on the Use of Privileged Commands - chsh

ALMA-09-048860: AlmaLinux OS 9 must generate audit records for any use of the "crontab" command.

Description: None

• medium

Automated: yes

• audit_rules_privileged_commands_crontab: Ensure auditd Collects Information on the Use of Privileged Commands - crontab

ALMA-09-048970: AlmaLinux OS 9 must audit all uses of the rename, unlink, rmdir, renameat, and unlinkat system calls.

Description: None

• medium

Automated: yes

• audit_rules_file_deletion_events_rename: Ensure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameat: Ensure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdir: Ensure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlink: Ensure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkat: Ensure auditd Collects File Deletion Events by User - unlinkat

ALMA-09-049080: AlmaLinux OS 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /var/log/faillock.

Description: None

• medium

Automated: yes

• audit_rules_login_events_faillock: Record Attempts to Alter Logon and Logout Events - faillock

ALMA-09-049190: AlmaLinux OS 9 must generate audit records for any use of the "gpasswd" command.

Description: None

• medium

Automated: yes

• audit_rules_privileged_commands_gpasswd: Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd

ALMA-09-049300: AlmaLinux OS 9 must audit all uses of the kmod command.

Description: None

• medium

Automated: yes

• audit_rules_privileged_commands_kmod: Ensure auditd Collects Information on the Use of Privileged Commands - kmod

ALMA-09-049410: AlmaLinux OS 9 must generate audit records for any use of the "newgrp" command.

Description: None

• medium

Automated: yes

• audit_rules_privileged_commands_newgrp: Ensure auditd Collects Information on the Use of Privileged Commands - newgrp

ALMA-09-049520: AlmaLinux OS 9 must generate audit records for any use of the "passwd" command.

Description: None

• medium

Automated: yes

• audit_rules_privileged_commands_passwd: Ensure auditd Collects Information on the Use of Privileged Commands - passwd

ALMA-09-049630: AlmaLinux OS 9 must generate audit records for any use of the "postdrop" command.

Description: None

• medium

Automated: yes

• audit_rules_privileged_commands_postdrop: Ensure auditd Collects Information on the Use of Privileged Commands - postdrop

ALMA-09-049740: AlmaLinux OS 9 must generate audit records for any use of the "postqueue" command.

Description: None

• medium

Automated: yes

• audit_rules_privileged_commands_postqueue: Ensure auditd Collects Information on the Use of Privileged Commands - postqueue

ALMA-09-049850: AlmaLinux OS 9 must generate audit records for any use of the "su" command.

Description: None

• medium

Automated: yes

• audit_rules_privileged_commands_su: Ensure auditd Collects Information on the Use of Privileged Commands - su

ALMA-09-049960: AlmaLinux OS 9 must generate audit records for any use of the "sudo" command.

Description: None

• medium

Automated: yes

• audit_rules_privileged_commands_sudo: Ensure auditd Collects Information on the Use of Privileged Commands - sudo

ALMA-09-050070: AlmaLinux OS 9 must generate audit records for any use of the "semanage" command.

Description: None

• medium

Automated: yes

• audit_rules_execution_semanage: Record Any Attempts to Run semanage

ALMA-09-050180: AlmaLinux OS 9 must generate audit records for any use of the "setfacl" command.

Description: None

• medium

Automated: yes

• audit_rules_execution_setfacl: Record Any Attempts to Run setfacl

ALMA-09-050290: AlmaLinux OS 9 must generate audit records for any use of the "setfiles" command.

Description: None

• medium

Automated: yes

• audit_rules_execution_setfiles: Record Any Attempts to Run setfiles

ALMA-09-050400: AlmaLinux OS 9 must generate audit records for any use of the "setsebool" command.

Description: None

• medium

Automated: yes

• audit_rules_execution_setsebool: Record Any Attempts to Run setsebool

ALMA-09-050510: AlmaLinux OS 9 must generate audit records for any use of the "ssh-agent" command.

Description: None

• medium

Automated: yes

• audit_rules_privileged_commands_ssh_agent: Record Any Attempts to Run ssh-agent

ALMA-09-050620: AlmaLinux OS 9 must generate audit records for any use of the "ssh-keysign" command.

Description: None

• medium

Automated: yes

• audit_rules_privileged_commands_ssh_keysign: Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign

ALMA-09-050730: AlmaLinux OS 9 must generate audit records for any use of the "sudoedit" command.

Description: None

• medium

Automated: yes

• audit_rules_privileged_commands_sudoedit: Ensure auditd Collects Information on the Use of Privileged Commands - sudoedit

ALMA-09-050840: AlmaLinux OS 9 must generate audit records for any use of the "pam_timestamp_check" command.

Description: None

• medium

Automated: yes

• audit_rules_privileged_commands_pam_timestamp_check: Ensure auditd Collects Information on the Use of Privileged Commands - pam_timestamp_check

ALMA-09-050950: AlmaLinux OS 9 must generate audit records for any use of the "unix_chkpwd" command.

Description: None

• medium

Automated: yes

• audit_rules_privileged_commands_unix_chkpwd: Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd

ALMA-09-051060: AlmaLinux OS 9 must generate audit records for any use of the "unix_update" command.

Description: None

• medium

Automated: yes

• audit_rules_privileged_commands_unix_update: Ensure auditd Collects Information on the Use of Privileged Commands - unix_update

ALMA-09-051170: AlmaLinux OS 9 must generate audit records for any use of the "userhelper" command.

Description: None

• medium

Automated: yes

• audit_rules_privileged_commands_userhelper: Ensure auditd Collects Information on the Use of Privileged Commands - userhelper

ALMA-09-051280: AlmaLinux OS 9 must generate audit records for any use of the "usermod" command.

Description: None

• medium

Automated: yes

• audit_rules_privileged_commands_usermod: Ensure auditd Collects Information on the Use of Privileged Commands - usermod

ALMA-09-051390: AlmaLinux OS 9 must audit all uses of the setxattr, fsetxattr, lsetxattr, removexattr, fremovexattr, and lremovexattr system calls.

Description: None

• medium

Automated: yes

• audit_rules_dac_modification_fremovexattr: Record Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattr: Record Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lremovexattr: Record Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattr: Record Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattr: Record Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattr: Record Events that Modify the System's Discretionary Access Controls - setxattr

ALMA-09-051830: AlmaLinux OS 9 must allocate an audit_backlog_limit of sufficient size to capture processes that start prior to the audit daemon.

Description: None

• low

Automated: yes

• grub2_audit_backlog_limit_argument: Extend Audit Backlog Limit for the Audit Daemon
• var_audit_backlog_limit = 8192

ALMA-09-051940: AlmaLinux OS 9 must use a separate file system for the system audit data path.

Description: None

• low

Automated: yes

• partition_for_var_log_audit: Ensure /var/log/audit Located On Separate Partition

ALMA-09-052050: AlmaLinux OS 9 must allocate audit record storage capacity to store at least one week's worth of audit records.

Description: None

• medium

Automated: yes

• auditd_audispd_configure_sufficiently_large_partition: Configure a Sufficiently Large Partition for Audit Logs

ALMA-09-052160: AlmaLinux OS 9 audispd-plugins package must be installed.

Description: None

• medium

Automated: yes

• package_audispd-plugins_installed: Install audispd-plugins Package

ALMA-09-052270: AlmaLinux OS 9 must label all offloaded audit logs before sending them to the central log server.

Description: None

• medium

Automated: yes

• auditd_name_format: Set type of computer node name logging in audit logs
• var_auditd_name_format = stig

ALMA-09-052380: AlmaLinux OS 9 must take appropriate action when the internal event queue is full.

Description: None

• medium

Automated: yes

• auditd_overflow_action: Appropriate Action Must be Setup When the Internal Audit Event Queue is Full

ALMA-09-052490: AlmaLinux OS 9 must be configured to offload audit records onto a different system from the system being audited via syslog.

Description: None

• medium

Automated: yes

• auditd_audispd_syslog_plugin_activated: Configure auditd to use audispd's syslog plugin

ALMA-09-052600: AlmaLinux OS 9 must authenticate the remote logging server for offloading audit logs via rsyslog.

Description: None

• medium

Automated: yes

• rsyslog_encrypt_offload_actionsendstreamdriverauthmode: Ensure Rsyslog Authenticates Off-Loaded Audit Records

ALMA-09-052710: AlmaLinux OS 9 must encrypt the transfer of audit records offloaded onto a different system or media from the system being audited via rsyslog.

Description: None

• medium

Automated: yes

• rsyslog_encrypt_offload_actionsendstreamdrivermode: Ensure Rsyslog Encrypts Off-Loaded Audit Records

ALMA-09-052820: AlmaLinux OS 9 must encrypt, via the gtls driver, the transfer of audit records offloaded onto a different system or media from the system being audited via rsyslog.

Description: None

• medium

Automated: yes

• rsyslog_encrypt_offload_defaultnetstreamdriver: Ensure Rsyslog Encrypts Off-Loaded Audit Records

ALMA-09-052930: AlmaLinux OS 9 must have the rsyslog package installed.

Description: None

• medium

Automated: yes

• package_rsyslog_installed: Ensure rsyslog is Installed

ALMA-09-053040: AlmaLinux OS 9 must be configured to forward audit records via TCP to a different system or media from the system being audited via rsyslog.

Description: None

• low

Automated: yes

• rsyslog_remote_loghost: Ensure Logs Sent To Remote Host

ALMA-09-053150: The rsyslog service on AlmaLinux OS 9 must be active.

Description: None

• medium

Automated: yes

• service_rsyslog_enabled: Enable rsyslog Service

ALMA-09-053260: AlmaLinux OS 9 must take action when allocated audit record storage volume reaches 95 percent of the audit record storage capacity.

Description: None

• medium

Automated: yes

• auditd_data_retention_admin_space_left_percentage: Configure auditd admin_space_left on Low Disk Space
• var_auditd_admin_space_left_percentage = 5pc

ALMA-09-053370: AlmaLinux OS 9 must take action when allocated audit record storage volume reaches 95 percent of the repository maximum audit record storage capacity.

Description: None

• medium

Automated: yes

• auditd_data_retention_admin_space_left_action: Configure auditd admin_space_left Action on Low Disk Space
• var_auditd_admin_space_left_action = single

ALMA-09-053480: AlmaLinux OS 9 must take action when allocated audit record storage volume reaches 75 percent of the repository maximum audit record storage capacity.

Description: None

• medium

Automated: yes

• auditd_data_retention_space_left_percentage: Configure auditd space_left on Low Disk Space
• var_auditd_space_left_percentage = 25pc

ALMA-09-053590: AlmaLinux OS 9 must notify the system administrator (SA) and information system security officer (ISSO) (at a minimum) when allocated audit record storage volume reaches 75 percent usage.

Description: None

• medium

Automated: yes

• auditd_data_retention_space_left_action: Configure auditd space_left Action on Low Disk Space
• var_auditd_space_left_action = email

ALMA-09-053810: AlmaLinux OS 9 System Administrator (SA) and/or information system security officer (ISSO) (at a minimum) must be alerted of an audit processing failure event.

Description: None

• medium

Automated: yes

• auditd_data_retention_action_mail_acct: Configure auditd mail_acct Action on Low Disk Space
• var_auditd_action_mail_acct = root

ALMA-09-053920: AlmaLinux OS 9 must have mail aliases to notify the information system security officer (ISSO) and system administrator (SA) (at a minimum) in the event of an audit processing failure.

Description: None

• medium

Automated: yes

• postfix_client_configure_mail_alias: Configure System to Forward All Mail For The Root Account

ALMA-09-054030: AlmaLinux OS 9 audit system must take appropriate action when an error writing to the audit storage volume occurs.

Description: None

• medium

Automated: yes

• auditd_data_disk_error_action_stig: Configure auditd Disk Error Action on Disk Error
• var_auditd_disk_error_action = halt

ALMA-09-054140: AlmaLinux OS 9 audit system must take appropriate action when the audit storage volume is full.

Description: None

• medium

Automated: yes

• auditd_data_disk_full_action_stig: Configure auditd Disk Full Action when Disk Space Is Full
• var_auditd_disk_full_action = halt

ALMA-09-054250: AlmaLinux OS 9 must take appropriate action when a critical audit processing failure occurs.

Description: None

• medium

Automated: yes

• audit_rules_system_shutdown: Shutdown System When Auditing Failures Occur

ALMA-09-054360: AlmaLinux OS 9 audit system must make full use of the audit storage space.

Description: None

• medium

Automated: yes

• auditd_data_retention_max_log_file: Configure auditd Max Log File Size
• var_auditd_max_log_file = 8

ALMA-09-054470: AlmaLinux OS 9 audit system must take appropriate action when the audit files have reached maximum size.

Description: None

• medium

Automated: yes

• auditd_data_retention_max_log_file_action_stig: Configure auditd max_log_file_action Upon Reaching Maximum Log Size
• var_auditd_max_log_file_action = rotate

ALMA-09-054580: AlmaLinux OS 9 audit system must retain an optimal number of audit records.

Description: None

• medium

Automated: yes

• auditd_data_retention_num_logs: Configure auditd Number of Logs Retained
• var_auditd_num_logs = 5

ALMA-09-054690: AlmaLinux OS 9 must periodically flush audit records to disk to prevent the loss of audit records.

Description: None

• medium

Automated: yes

• auditd_freq: Set number of records to cause an explicit flush to audit logs
• var_auditd_freq = 100

ALMA-09-054910: The auditd service must be enabled on AlmaLinux OS 9.

Description: None

• medium

Automated: yes

• service_auditd_enabled: Enable auditd Service

ALMA-09-055130: The chronyd service must be enabled.

Description: None

• medium

Automated: yes

• service_chronyd_enabled: The Chronyd service is enabled

ALMA-09-055240: AlmaLinux OS 9 must have the chrony package installed.

Description: None

• medium

Automated: yes

• package_chrony_installed: The Chrony package is installed

ALMA-09-055350: AlmaLinux OS 9 must securely compare internal information system clocks at least every 24 hours.

Description: None

• medium

Automated: yes

• chronyd_or_ntpd_set_maxpoll: Configure Time Service Maxpoll Interval
• chronyd_server_directive: Ensure Chrony is only configured with the server directive
• chronyd_specify_remote_server: A remote time server for Chrony is configured
• var_multiple_time_servers = stig
• var_time_service_set_maxpoll = 18_hours

ALMA-09-055680: AlmaLinux OS 9 audit log directory must be owned by root to prevent unauthorized read access.

Description: None

• medium

Automated: yes

• directory_group_ownership_var_log_audit: System Audit Directories Must Be Group Owned By Root
• directory_ownership_var_log_audit: System Audit Directories Must Be Owned By Root

ALMA-09-055790: AlmaLinux OS 9 audit log directory must have 0700 permissions to prevent unauthorized read access.

Description: None

• medium

Automated: yes

• directory_permissions_var_log_audit: System Audit Logs Must Have Mode 0750 or Less Permissive

ALMA-09-055900: AlmaLinux OS 9 audit logs must be owned by the root group to prevent unauthorized read access.

Description: None

• medium

Automated: yes

• file_group_ownership_var_log_audit_stig: System Audit Logs Must Be Group Owned By Root

ALMA-09-056010: AlmaLinux OS 9 audit logs must be owned by root to prevent unauthorized read access.

Description: None

• medium

Automated: yes

• file_ownership_var_log_audit_stig: System Audit Logs Must Be Owned By Root

ALMA-09-056120: AlmaLinux OS 9 audit logs must have 0600 permissions to prevent unauthorized read access.

Description: None

• medium

Automated: yes

• file_permissions_var_log_audit: System Audit Logs Must Have Mode 0640 or Less Permissive

ALMA-09-056230: AlmaLinux OS 9 audit tools must be group-owned by root.

Description: None

• medium

Automated: yes

• file_audit_tools_group_ownership: Audit Tools Must Be Group-owned by Root

ALMA-09-056340: AlmaLinux OS 9 audit tools must be owned by root.

Description: None

• medium

Automated: yes

• file_audit_tools_ownership: Audit Tools Must Be Owned by Root

ALMA-09-056560: AlmaLinux OS 9 audit tools must have a mode of 0755 or less permissive.

Description: None

• medium

Automated: yes

• file_audit_tools_permissions: Audit Tools Must Have a Mode of 0755 or Less Permissive

ALMA-09-056780: AlmaLinux OS 9 audit system must protect logon UIDs from unauthorized change.

Description: None

• medium

Automated: yes

• audit_rules_immutable_login_uids: Configure immutable Audit login UIDs

ALMA-09-056890: AlmaLinux OS 9 must use cryptographic mechanisms to protect the integrity of audit tools.

Description: None

• medium

Automated: yes

• aide_check_audit_tools: Configure AIDE to Verify the Audit Tools

ALMA-09-057110: AlmaLinux OS 9 audit system must protect auditing rules from unauthorized change.

Description: None

• medium

Automated: yes

• audit_rules_immutable: Make the auditd Configuration Immutable

ALMA-09-006845: AlmaLinux OS 9 must have the postfix package installed.

Description: None

• medium

Automated: yes

• package_postfix_installed: The Postfix package is installed

ALMA-09-048865: AlmaLinux OS 9 must audit any script or executable called by cron as root or by any privileged user.

Description: None

• medium

Automated: yes

• audit_rules_cron_execution: Audit Any Script or Executable Called by Cron as Root or by Any Privileged User

ALMA-09-039290: AlmaLinux 9 cryptographic policy must not be overridden.

Description: None

• high

Automated: yes

• crypto_policy_not_overridden: Ensure System Cryptographic Policy Is Not Overridden

ALMA-09-039840: AlmaLinux OS 9 must have the crypto-policies package installed.

Description: None

• high

Automated: yes

• package_crypto-policies_installed: Install crypto-policies package

ALMA-09-040060: AlmaLinux OS 9 must implement a FIPS 140-3-compliant systemwide cryptographic policy.

Description: None

• high

Automated: yes

• configure_crypto_policy: Configure System Cryptography Policy
• var_system_crypto_policy = fips

ALMA-09-043140: AlmaLinux OS 9 must implement DoW-approved encryption in the bind package.

Description: None

• high

Automated: yes

• configure_bind_crypto_policy: Configure BIND to use System Crypto Policy

ALMA-09-003100: AlmaLinux OS 9 must implement DoW-approved encryption ciphers to protect the confidentiality of SSH connections.

Description: None

• high

Automated: yes

• file_sshd_50_redhat_exists: The File /etc/ssh/sshd_config.d/50-redhat.conf Must Exist
• sshd_include_crypto_policy: SSHD Must Include System Crypto Policy Config File

ALMA-09-003980: AlmaLinux OS 9 must implement DoW-approved encryption in the OpenSSL package.

Description: None

• high

Automated: yes

• configure_openssl_crypto_policy: Configure OpenSSL library to use System Crypto Policy

ALMA-09-051285: AlmaLinux OS 9 must generate audit records for any use of the "useradd" command.

Description: None

• medium

Automated: yes

• audit_rules_privileged_commands_useradd: Ensure auditd Collects Information on the Use of Privileged Commands - useradd