Definition of Oracle Linux 10 Security Technical Implementation Guide for ol10
based on https://www.cyber.mil/stigs/downloads/
OL10-DRAFT-00219: OL10 debug-shell systemd service must be disabled.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00254: OL10 must ensure cryptographic verification of vendor software packages.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00252: OL10 must check the GPG signature of software packages originating from external software repositories before installation.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00251: OL10 must check the GPG signature of locally installed software packages before installation.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00253: OL10 must have GPG signature verification enabled for all software repositories.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00184: OL10 local disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at rest protection.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00230: OL10 must use a separate file system for the system audit data path.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00326: OL10 must be configured so that a separate file system must be used for user home directories (such as /home or an equivalent).
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00327: OL10 must use a separate file system for /tmp.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00328: OL10 must use a separate file system for /var.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00329: OL10 must use a separate file system for /var/log.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00330: OL10 must use a separate file system for /var/tmp.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00312: OL10 must remove all software components after updated versions have been installed.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00138: OL10 must not have the nfs-utils package installed.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00139: OL10 must not have the telnet-server package installed.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00140: OL10 must not have the gssproxy package installed.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00141: OL10 must not have the tuned package installed.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00121: OL10 must not have a File Transfer Protocol (FTP) server package installed.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00348: OL10 must have the nss-tools package installed.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00246: OL10 must have the s-nail package installed.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00144: OL10 must have the firewalld package installed.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00145: OL10 must be configured so that the firewalld service is active.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00337: OL10 must be configured so that the firewall employs a deny-all, allow-by-exception policy for allowing connections to other systems.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00243: OL10 must have the chrony package installed.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00244: OL10 must enable the chronyd service.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00148: OL10 must disable the chrony daemon from acting as a server.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00149: OL10 must disable network management of the chrony daemon.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00291: OL10 must have the USBGuard package installed.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00292: OL10 must enable the USBGuard package.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00293: OL10 must block unauthorized peripherals before establishing a connection.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00093: OL10 must enable Linux audit logging for the USBGuard daemon.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00176: OL10 must have policycoreutils package installed.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00336: OL10 policycoreutils-python-utils package must be installed.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00218: OL10 must have the sudo package installed.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00278: OL10 must have the fapolicy module installed.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00279: OL10 must enable the fapolicy module.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00280: The OL10 fapolicy module must be configured to employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs.
Description: None
Levels:
Automated: yes
Selections:
- fapolicy_default_deny: Configure Fapolicy Module to Employ a Deny-all, Permit-by-exception Policy to Allow the Execution of Authorized Software Programs.
OL10-DRAFT-00286: OL10 must have the pcsc-lite package installed.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00288: OL10 must be configured so that the pcscd service is active.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00287: OL10 must have the opensc package installed.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00150: OL10 must use the CAC smart card driver.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00247: OL10 must have the Advanced Intrusion Detection Environment (AIDE) package installed.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00198: OL10 must use cryptographic mechanisms to protect the integrity of audit tools.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00342: OL10 must use a file integrity tool that is configured to use FIPS 140-3-approved cryptographic hashes for validating file contents and directories.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00248: OL10 must routinely check the baseline configuration for unauthorized changes and notify the system administrator (SA) when anomalies in the operation of any security functions are discovered.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00343: OL10 must be configured so that the file integrity tool verifies Access Control Lists (ACLs).
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00344: OL10 must be configured so that the file integrity tool verifies extended attributes.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00231: OL10 must have the rsyslog package installed.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00345: OL10 must be configured so that the rsyslog service is active.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00235: OL10 must be configured to forward audit records via TCP to a different system or media from the system being audited via rsyslog.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00443: OL10 must be configured so that the rsyslog daemon does not accept log messages from other servers unless the server is being used for log aggregation.
Description: None
Levels:
Automated: yes
Selections:
- rsyslog_nolisten: Ensure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
OL10-DRAFT-00236: OL10 must authenticate the remote logging server for offloading audit logs via rsyslog.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00237: OL10 must encrypt the transfer of audit records offloaded onto a different system or media from the system being audited via rsyslog.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00238: OL10 must encrypt via the gtls driver the transfer of audit records offloaded onto a different system or media from the system being audited via rsyslog.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00030: OL10 must monitor remote access methods.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00442: OL10 must use cron logging.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00165: OL10 must have the packages required for encrypting offloaded audit logs installed.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00087: OL10 must have the audit package installed.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00088: OL10 audit service must be enabled.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00232: OL10 must have the audispd-plugins package installed.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00166: OL10 must have the libreswan package installed.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00081: OL10 must have mail aliases to notify the information system security officer (ISSO) and system administrator (SA) (at a minimum) in the event of an audit processing failure.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00389: OL10 must be configured to prevent unrestricted mail relaying.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00306: OL10 networked systems must have SSH installed.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00307: OL10 networked systems must have and implement SSH to protect the confidentiality and integrity of transmitted and received information, as well as information during preparation for transmission.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00341: OL10 must have the openssh-clients package installed.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00154: OL10 must have the pkcs11-provider package installed.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00349: OL10 must have the gnutls-utils package installed.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00297: OL10 must have the crypto-policies package installed.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00298: OL10 must implement a FIPS 140-3 compliant system-wide cryptographic policy.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00032: OL10 must be installed with kernel parameter "fips=1" at initial installation time to enable FIPS mode.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00194: OL10 SSH client must be configured to use only DOD-approved encryption ciphers employing FIPS 140-3 validated cryptographic hash algorithms to protect the confidentiality of SSH client connections.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00192: OL10 SSH server must be configured to use only ciphers employing FIPS 140-3 validated cryptographic hash algorithms to protect the confidentiality of SSH server connections.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00195: OL10 SSH client must be configured to use only DOD-approved Message Authentication Codes (MACs) employing FIPS 140-3 validated cryptographic hash algorithms to protect the confidentiality of SSH client connections.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00193: OL10 SSH server must be configured to use only Message Authentication Codes (MACs) employing FIPS 140-3 validated cryptographic hash algorithms to protect the confidentiality of SSH server connections.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00033: OL10 IP tunnels must use 140-3 approved cryptographic algorithms.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00309: OL10 must implement DOD-approved encryption in the bind package.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00300: OL10 must not allow the cryptographic policy to be overridden.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00409: OL10 /etc/group file must be owned by root.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00407: OL10 /etc/group file must be group-owned by root.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00410: OL10 /etc/group- file must be owned by root.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00408: OL10 /etc/group- file must be group-owned by root.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00415: OL10 /etc/gshadow file must be owned by root.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00413: OL10 /etc/gshadow file must be group-owned by root.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00416: OL10 /etc/gshadow- file must be owned by root.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00414: OL10 /etc/gshadow- file must be group-owned by root.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00421: OL10 /etc/passwd file must be owned by root.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00419: OL10 /etc/passwd file must be group-owned by root.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00422: OL10 /etc/passwd- file must be owned by root.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00420: OL10 /etc/passwd- file must be group-owned by root.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00427: OL10 /etc/shadow file must be owned by root.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00425: OL10 /etc/shadow file must be group-owned by root.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00428: OL10 /etc/shadow- file must be owned by root.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00426: OL10 /etc/shadow- file must be group-owned by root.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00186: OL10 /var/log directory must be owned by root.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00185: OL10 /var/log directory must be group-owned by root.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00189: OL10 /var/log/messages file must be owned by root.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00188: OL10 /var/log/messages file must be group-owned by root.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00205: OL10 system commands must be owned by root.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00204: OL10 system commands must be group-owned by root or a system account.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00211: OL10 library files must be owned by root.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00210: OL10 library files must be group-owned by root or a system account.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00208: OL10 library directories must be owned by root.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00207: OL10 library directories must be group-owned by root or a system account.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00433: OL10 cron configuration files directory must be owned by root.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00432: OL10 cron configuration files directory must be group-owned by root.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00180: OL10 world-writable directories must be owned by root, sys, bin, or an application user.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00393: OL10 must be configured so that all system device files are correctly labeled to prevent unauthorized modification.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00397: OL10 SSH server configuration file must be group-owned by root.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00398: OL10 SSH server configuration file must be owned by root.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00403: OL10 local interactive user home directories must be group-owned by the home directory owner's primary group.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00083: OL10 audit logs must be group-owned by root or by a restricted logging group to prevent unauthorized read access.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00084: OL10 audit log directory must be owned by root to prevent unauthorized read access.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00085: OL10 audit logs file must have mode 0600 or less permissive to prevent unauthorized access to the audit log.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00206: OL10 system commands must have mode 755 or less permissive.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00209: OL10 library directories must have mode 755 or less permissive.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00212: OL10 library files must have mode 755 or less permissive.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00187: OL10 /var/log directory must have mode 0755 or less permissive.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00190: OL10 /var/log/messages file must have mode 0640 or less permissive.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00402: OL10 local initialization files must have mode 0740 or less permissive.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00404: OL10 local interactive user home directories must have mode 0750 or less permissive.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00411: OL10 /etc/group file must have mode 0644 or less permissive to prevent unauthorized access.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00412: OL10 /etc/group- file must have mode 0644 or less permissive to prevent unauthorized access.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00417: OL10 /etc/gshadow file must have mode 0000 or less permissive to prevent unauthorized access.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00418: OL10 /etc/gshadow- file must have mode 0000 or less permissive to prevent unauthorized access.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00423: OL10 /etc/passwd file must have mode 0644 or less permissive to prevent unauthorized access.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00424: OL10 /etc/passwd- file must have mode 0644 or less permissive to prevent unauthorized access.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00429: OL10 /etc/shadow- file must have mode 0000 or less permissive to prevent unauthorized access.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00179: OL10 must be configured so that a sticky bit must be set on all public directories.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00400: OL10 local files and directories must have a valid group owner.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00401: OL10 local files and directories must have a valid owner.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00430: OL10 /etc/shadow file must have mode 0000 to prevent unauthorized access.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00200: OL10 audit tools must be owned by root.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00199: OL10 audit tools must be group-owned by root.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00441: OL10 must set the umask value to 077 for all local interactive user accounts.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00369: OL10 must define default permissions for the bash shell.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00370: OL10 must define default permissions for the c shell.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00468: OL10 must define default permissions for all authenticated users in such a way that the user can only read and modify their own files.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00371: OL10 must define default permissions for the system default profile.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00399: OL10 SSH server configuration file must have mode 0600 or less permissive.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00395: OL10 SSH private host key files must have mode 0640 or less permissive.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00405: OL10 /boot/grub2/grub.cfg file must be group-owned by root.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00275: OL10 must prevent device files from being interpreted on file systems that contain user home directories.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00276: OL10 must prevent files with the setuid and setgid bit set from being executed on file systems that contain user home directories.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00361: OL10 must prevent code from being executed on file systems that contain user home directories.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00269: OL10 must mount /var/log/audit with the nodev option.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00270: OL10 must mount /var/log/audit with the noexec option.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00271: OL10 must mount /var/log/audit with the nosuid option.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00201: OL10 audit tools must have a mode of 0755 or less permissive.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00391: OL10 must be configured so that local initialization files do not execute world-writable programs.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00214: OL10 systemd-journald service must be enabled.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00069: OL10 must enable auditing of processes that start prior to the audit daemon.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00092: OL10 audit system must audit local events.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00350: OL10 must write audit records to disk.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00013: OL10 must log username information when unsuccessful logon attempts occur.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00094: OL10 must allow only the information system security manager (ISSM) (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00196: OL10 must allocate an audit_backlog_limit of sufficient size to capture processes that start prior to the audit daemon.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00079: OL10 must take appropriate action when a critical audit processing failure occurs.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00239: OL10 must take action when allocated audit record storage volume reaches 75 percent of the repository maximum audit record storage capacity.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00073: OL10 must label all offloaded audit logs before sending them to the central log server.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00241: OL10 must take action when allocated audit record storage volume reaches 95 percent of the audit record storage capacity.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00242: OL10 must act when allocated audit record storage volume reaches 95 percent of the repository maximum audit record storage capacity.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00234: OL10 must take appropriate action when the internal event queue is full.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00197: OL10 must produce audit records containing information to establish the identity of any individual or process associated with the event.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00082: OL10 must periodically flush audit records to disk to prevent the loss of audit records.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00240: OL10 must notify the system administrator (SA) and information system security officer (ISSO) (at a minimum) when allocated audit record storage volume 75 percent utilization.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00080: The OL10 system administrator (SA) and/or information system security officer (ISSO) (at a minimum) must be alerted of an audit processing failure event.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00031: OL10 must log SSH connection attempts and failures to the server.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00222: OL10 must audit uses of the execve system call.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00036: OL10 must audit all uses of the setxattr, fsetxattr, lsetxattr, removexattr, fremovexattr, and lremovexattr system calls.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00068: OL10 must audit all uses of umount system calls.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00060: OL10 must audit all uses of the chacl command.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00039: OL10 must audit all uses of the setfacl command.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00038: OL10 must audit all uses of the chcon command.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00057: OL10 must audit all uses of the semanage command.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00058: OL10 must audit all uses of the setfiles command.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00059: OL10 must audit all uses of the setsebool command.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00054: OL10 must audit all uses of the truncate, ftruncate, creat, open, openat, and open_by_handle_at system calls.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00064: OL10 must audit all uses of the delete_module system call.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00065: OL10 must audit all uses of the init_module and finit_module system calls.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00037: OL10 must audit all uses of the chage command.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00040: OL10 must audit all uses of the chsh command.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00041: OL10 must audit all uses of the crontab command.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00042: OL10 must audit all uses of the gpasswd command.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00066: OL10 must audit all uses of the kmod command.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00043: OL10 must audit all uses of the newgrp command.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00044: OL10 must audit all uses of the pam_timestamp_check command.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00045: OL10 must audit all uses of the passwd command.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00046: OL10 must audit all uses of the postdrop command.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00047: OL10 must audit all uses of the postqueue command.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00048: OL10 must audit all uses of the ssh-agent command.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00049: OL10 must audit all uses of the ssh-keysign command.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00035: OL10 must audit all uses of the su command.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00061: OL10 must audit all uses of the sudo command.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00050: OL10 must audit all uses of the sudoedit command.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00051: OL10 must audit all uses of the unix_chkpwd command.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00034: OL10 must audit all uses of the unix_update command.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00052: OL10 must audit all uses of the userhelper command.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00062: OL10 must audit all uses of the usermod command.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00053: OL10 must audit all uses of the mount command.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00096: OL10 must be configured so that successful/unsuccessful uses of the init command generate an audit record.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00097: OL10 must be configured so that successful/unsuccessful uses of the poweroff command generate an audit record.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00098: OL10 must be configured so that successful/unsuccessful uses of the reboot command generate an audit record.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00099: OL10 must be configured so that successful/unsuccessful uses of the shutdown command generate an audit record.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00070: OL10 must be configured so that successful/unsuccessful uses of the umount system call generate an audit record.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00071: OL10 must be configured so that successful/unsuccessful uses of the umount2 system call generate an audit record.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00002: OL10 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/sudoers.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00003: OL10 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/sudoers.d/ directory.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00004: OL10 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/group.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00005: OL10 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/gshadow.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00006: OL10 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/opasswd.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00007: OL10 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/passwd.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00008: OL10 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/shadow.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00295: OL10 must generate audit records for all account creations, modifications, disabling, and termination events that affect /var/log/faillock.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00067: OL10 must generate audit records for all account creations, modifications, disabling, and termination events that affect /var/log/lastlog.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00055: OL10 must audit all uses of the chmod, fchmod, and fchmodat system calls.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00056: OL10 must audit all uses of the chown, fchown, fchownat, and lchown system calls.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00063: OL10 must audit all uses of the rename, unlink, rmdir, renameat, and unlinkat system calls.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00130: OL10 must require a boot loader superuser password.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00129: OL10 must require a unique superuser's name upon booting into single-user and maintenance modes.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00438: OL10 system accounts must not have an interactive login shell.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00124: OL10 user account passwords for new users or password changes must have a 60-day maximum password lifetime restriction in /etc/login.defs.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00125: OL10 user account passwords must have a 60-day maximum password lifetime restriction.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00439: OL10 local interactive user accounts must be assigned a home directory upon creation.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00151: OL10 duplicate User IDs (UIDs) must not exist for interactive users.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00001: OL10 system must automatically remove or disable temporary user accounts after 72 hours.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00152: OL10 interactive users must have a primary group that exists.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00164: OL10 must disable account identifiers (individuals, groups, roles, and devices) after 35 days of inactivity.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00440: OL10 must be configured so that executable search paths within the initialization files of all local interactive users must only contain paths that resolve to the system default or the users home directory.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00436: OL10 local interactive users must have a home directory assigned in the /etc/passwd file.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00437: OL10 local interactive user home directories defined in the /etc/passwd file must exist.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00325: OL10 must enforce a delay of at least four seconds between logon prompts following a failed logon attempt.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00122: OL10 passwords for new users or password changes must have a 24-hour minimum password lifetime restriction in /etc/login.defs.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00126: OL10 passwords must be created with a minimum of 15 characters.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00213: OL10 must enforce password complexity by requiring that at least one special character be used.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00107: OL10 must enforce password complexity by requiring that at least one lowercase character be used.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00104: OL10 must enforce password complexity by requiring that at least one uppercase character be used.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00109: OL10 must require the change of at least eight characters when passwords are changed.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00123: OL10 passwords must have a 24-hour minimum password lifetime restriction in /etc/shadow.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00110: OL10 must require the maximum number of repeating characters of the same character class be limited to four when passwords are changed.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00111: OL10 must require the maximum number of repeating characters be limited to three when passwords are changed.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00112: OL10 must require the change of at least four character classes when passwords are changed.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00108: OL10 must enforce password complexity by requiring that at least one numeric character be used.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00324: OL10 must prevent the use of dictionary words for passwords.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00435: OL10 must be configured so that the root account is the only account having unrestricted access to the system.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00113: OL10 must enforce password complexity rules for the root account.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00228: OL10 must automatically lock an account when three unsuccessful logon attempts occur.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00229: OL10 must automatically lock the root account until the root account is released by an administrator when three unsuccessful logon attempts occur during a 15-minute time period.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00009: OL10 system must enforce the limit of three consecutive invalid logon attempts by a user during a 15-minute time period.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00227: OL10 must maintain an account lock until the locked account is released by an administrator.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00014: OL10 must ensure account lockouts persist.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00394: OL10 must not have unauthorized accounts.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00352: OL10 must not allow blank or null passwords.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00353: OL10 must not have accounts configured with blank or null passwords.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00153: OL10 groups must have unique Group ID (GID).
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00020: OL10 must limit the number of concurrent sessions to ten for all accounts and/or account types.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00105: OL10 must ensure the password complexity module in the system-auth file is configured for three retries or less.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00217: OL10 must restrict the use of the su command.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00225: OL10 must not be configured to bypass password requirements for privilege escalation.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00339: OL10 must restrict privilege elevation to authorized personnel.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00223: OL10 must require users to reauthenticate for privilege escalation.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00281: OL10 must require reauthentication when using the "sudo" command.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00338: OL10 must use the invoking user's password for privilege escalation when using sudo.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00224: OL10 must require users to provide a password for privilege escalation.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00011: OL10 must configure the use of the pam_faillock.so module in the /etc/pam.d/system-auth file.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00012: OL10 must configure the use of the pam_faillock.so module in the /etc/pam.d/password-auth file.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00106: OL10 must ensure the password complexity module is enabled in the password-auth file.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00351: OL10 must ensure the password complexity module is enabled in the system-auth file.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00170: OL10 must enable the Pluggable Authentication Module (PAM) interface for SSHD.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00116: OL10 pam_unix.so module must be configured in the password-auth file to use a FIPS 140-3 approved cryptographic hashing algorithm for system authentication.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00119: OL10 shadow password suite must be configured to use a sufficient number of hashing rounds.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00117: OL10 password-auth must be configured to use a sufficient number of hashing rounds.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00120: OL10 must employ FIPS 140-3 approved cryptographic hashing algorithms for all stored passwords.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00114: OL10 must be configured to use the shadow file to store only encrypted representations of passwords.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00016: OL10 must display the Standard Mandatory DOD Notice and Consent Banner before granting local or remote access to the system via a SSH logon.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00019: OL10 must display the Standard Mandatory DOD Notice and Consent Banner before granting local or remote access to the system via a graphical user logon.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00017: OL10 must prevent a user from overriding the banner-message-enable setting for the graphical user interface.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00015: OL10 must display the Standard Mandatory DOD Notice and Consent Banner before granting local or remote access to the system via a command line user logon.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00355: OL10 must prevent special devices on file systems that are imported via Network File System (NFS).
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00356: OL10 must prevent code from being executed on file systems that are imported via Network File System (NFS).
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00357: OL10 must prevent files with the setuid and setgid bit set from being executed on file systems that are imported via Network File System (NFS).
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00354: OL10 must be configured so that the Network File System (NFS) is configured to use RPCSEC_GSS.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00256: OL10 must mount /boot with the nodev option.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00257: OL10 must prevent files with the setuid and setgid bit set from being executed on the /boot directory.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00258: OL10 must prevent files with the setuid and setgid bit set from being executed on the /boot/efi directory.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00259: OL10 must mount /dev/shm with the nodev option.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00260: OL10 must mount /dev/shm with the noexec option.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00261: OL10 must mount /dev/shm with the nosuid option.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00262: OL10 must mount /tmp with the nodev option.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00263: OL10 must mount /tmp with the noexec option.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00264: OL10 must mount /tmp with the nosuid option.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00265: OL10 must mount /var with the nodev option.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00266: OL10 must mount /var/log with the nodev option.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00267: OL10 must mount /var/log with the noexec option.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00268: OL10 must mount /var/log with the nosuid option.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00272: OL10 must mount /var/tmp with the nodev option.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00273: OL10 must mount /var/tmp with the noexec option.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00274: OL10 must mount /var/tmp with the nosuid option.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00362: OL10 must prevent special devices on nonroot local partitions.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00315: OL10 must enable the SELinux targeted policy.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00314: OL10 must use a Linux Security Module configured to enforce limits on system services.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00010: OL10 must configure SELinux context type to allow the use of a nondefault faillock tally directory.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00396: OL10 SSH public host key files must have mode 0644 or less permissive.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00249: OL10 SSH daemon must not allow Generic Security Service Application Program Interface (GSSAPI) authentication.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00250: OL10 SSH daemon must not allow Kerberos authentication.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00372: OL10 SSH daemon must not allow rhosts authentication.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00373: OL10 SSH daemon must not allow known hosts authentication.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00374: OL10 SSH daemon must disable remote X connections for interactive users.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00375: OL10 SSH daemon must perform strict mode checking of home directory configuration files.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00376: OL10 SSH daemon must display the date and time of the last successful account logon upon an SSH logon.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00377: OL10 SSH daemon must prevent remote hosts from connecting to the proxy display.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00155: OL10 SSHD must accept public key authentication.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00156: OL10 SSHD must not allow blank passwords.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00158: OL10 must not permit direct logons to the root account using remote access via SSH.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00470: OL10 must not allow a noncertificate trusted host SSH logon to the system.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00471: OL10 must not allow users to override SSH environment variables.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00308: OL10 must force a frequent session key renegotiation for SSH connections to the server.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00181: OL10 must be configured so that all network connections associated with SSH traffic terminate after becoming unresponsive.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00078: OL10 must forward mail from postmaster to the root account using a postfix alias.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00387: OL10 file systems must not contain shosts.equiv files.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00388: OL10 file systems must not contain .shosts files.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00162: OL10 must prevent a user from overriding the disabling of the graphical user interface automount function.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00469: OL10 must not allow unattended or automatic logon via the graphical user interface.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00022: OL10 must prevent a user from overriding the disabling of the graphical user smart card removal action.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00021: OL10 must prevent a user from overriding the screensaver lock-enabled setting for the graphical user interface.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00025: OL10 must automatically lock graphical user sessions after 15 minutes of inactivity.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00026: OL10 must prevent a user from overriding the session idle-delay setting for the graphical user interface.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00024: OL10 must initiate a session lock for graphical user interfaces when the screensaver is activated.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00027: OL10 must prevent a user from overriding the session lock-delay setting for the graphical user interface.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00028: OL10 must conceal, via the session lock, information previously visible on the display with a publicly viewable image.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00368: OL10 effective dconf policy must match the policy keyfiles.
Description: None
Levels:
Automated: yes
Selections:
- dconf_db_up_to_date: Make sure that the dconf databases are up-to-date with regards to respective keyfiles
OL10-DRAFT-00366: OL10 must prevent a user from overriding the disable-restart-buttons setting for the graphical user interface.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00367: OL10 must prevent a user from overriding the Ctrl-Alt-Del sequence settings for the graphical user interface.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00364: OL10 must disable the ability of a user to accidentally press Ctrl-Alt-Del and cause a system to shut down or reboot.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00363: OL10 must disable the user list at logon for graphical user interfaces.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00159: OL10 must be configured to disable USB mass storage.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00137: OL10 Bluetooth must be disabled.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00216: OL10 wireless network adapters must be disabled.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00161: OL10 must disable the graphical user interface automount function unless required.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00277: OL10 must disable the graphical user interface autorun function unless required.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00183: OL10 must automatically exit interactive command shell user sessions after 10 minutes of inactivity.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00332: OL10 must be configured so that the graphical display manager is not the default target unless approved.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00220: OL10 must be configured so that the systemd Ctrl-Alt-Delete burst key sequence is disabled.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00221: OL10 must be configured so that the x86 Ctrl-Alt-Delete key sequence is disabled.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00386: OL10 must disable the ability of systemd to spawn an interactive boot process.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00177: OL10 must disable virtual system calls.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00178: OL10 must clear the page allocator to prevent use-after-free attacks.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00171: OL10 must restrict access to the kernel message buffer.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00172: OL10 must prevent kernel profiling by nonprivileged users.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00255: OL10 must prevent the loading of a new kernel for later execution.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00173: OL10 must restrict exposed kernel pointer addresses access.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00380: OL10 must disable the kernel.core_pattern.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00132: OL10 must be configured to disable the Controller Area Network (CAN) kernel module.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00134: OL10 must disable the Stream Control Transmission Protocol (SCTP) kernel module.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00135: OL10 must disable the Transparent Inter Process Communication (TIPC) kernel module.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00175: OL10 must restrict usage of ptrace to descendant processes.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00381: OL10 must disable core dump backtraces.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00382: OL10 must disable storing core dumps.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00383: OL10 must disable core dumps for all users.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00384: OL10 must disable acquiring, saving, and processing core dumps.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00311: OL10 must implement nonexecutable data to protect its memory from unauthorized code execution.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00385: OL10 must be configured so that the kdump service is disabled.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00160: OL10 file system automount function must be disabled unless required.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00289: OL10 must enable certificate-based smart card authentication.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00290: OL10 must implement certificate status checking for multifactor authentication (MFA).
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00102: For OL10, for PKI-based authentication, must enforce authorized access to the corresponding private key.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00127: OL10 must require authentication to access emergency mode.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00128: OL10 must require authentication to access single-user mode.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00101: OL10 , for PKI-based authentication, must validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor.
Description: None
Levels:
Automated: no
Selections:
OL10-DRAFT-00103: OL10 must map the authenticated identity to the user or group account for PKI-based authentication.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00294: OL10 must prohibit the use of cached authenticators after one day.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00147: OL10 must control remote access methods.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00146: OL10 must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services, as defined in the Ports, Protocols, and Services Management (PPSM) Category Assignments List (CAL) and vulnerability assessments.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00446: OL10 network interfaces must not be in promiscuous mode.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00174: OL10 must disable access to network bpf system call from nonprivileged processes.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00245: OL10 must securely compare internal information system clocks at least every 24 hours.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00392: OL10 must enable hardening for the Berkeley Packet Filter (BPF) just-in-time compiler.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00445: OL10 systems using Domain Name Servers (DNS) resolution must have at least two name servers configured.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00447: OL10 must not have unauthorized IP tunnels configured.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00305: OL10 must be configured to use TCP syncookies.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00448: OL10 must ignore Internet Protocol version 4 (IPv4) Internet Control Message Protocol (ICMP) redirect messages.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00449: OL10 must not forward Internet Protocol version 4 (IPv4) source-routed packets.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00450: OL10 must log IPv4 packets with impossible addresses.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00451: OL10 must log IPv4 packets with impossible addresses by default.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00452: OL10 must use reverse path filtering on all IPv4 interfaces.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00453: OL10 must prevent IPv4 Internet Control Message Protocol (ICMP) redirect messages from being accepted.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00454: OL10 must not forward IPv4 source-routed packets by default.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00455: OL10 must use a reverse-path filter for IPv4 network traffic, when possible, by default.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00457: OL10 must not respond to Internet Control Message Protocol (ICMP) echoes sent to a broadcast address.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00458: OL10 must limit the number of bogus Internet Control Message Protocol (ICMP) response errors logs.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00459: OL10 must not send Internet Control Message Protocol (ICMP) redirects.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00460: OL10 must not allow interfaces to perform Internet Control Message Protocol (ICMP) redirects by default.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00456: OL10 must not enable IPv4 packet forwarding unless the system is a router.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00461: OL10 must not accept router advertisements on all IPv6 interfaces.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00462: OL10 must ignore IPv6 Internet Control Message Protocol (ICMP) redirect messages.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00463: OL10 must not forward IPv6 source-routed packets.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00464: OL10 must not enable IPv6 packet forwarding unless the system is a router.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00465: OL10 must not accept router advertisements on all IPv6 interfaces by default.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00466: OL10 must prevent IPv6 Internet Control Message Protocol (ICMP) redirect messages from being accepted.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00467: OL10 must not forward IPv6 source-routed packets by default.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00304: OL10 must protect against or limit the effects of denial-of-service (DoS) attacks by ensuring rate-limiting measures on impacted network interfaces are implemented.
Description: None
Levels:
Automated: no
Selections:
OL10-DRAFT-00444: OL10 must configure a DNS processing mode set be Network Manager.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00390: OL10 Trivial File Transfer Protocol (TFTP) daemon must be configured to operate in secure mode if the TFTP server is required.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00095: OL10 /etc/audit/auditd.conf file must have 0640 or less permissive to prevent unauthorized access.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00086: OL10 audit system must protect auditing rules from unauthorized change.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00313: OL10 must be a vendor supported release.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00018: OL10 must be configured to enable the display of the Standard Mandatory DOD Notice and Consent Banner before granting local or remote access to the system via a graphical user logon.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00023: OL10 must be able to directly initiate a session lock for all connection types using smart card when the smart card is removed.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00029: OL10 must conceal, via the session lock, information previously visible on the display with a publicly viewable image. The session lock mustbe set to to prevent from being modified by users.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00072: OL10 must produce audit records containing information to establish when (date and time) the events occurred.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00074: OL10 must produce audit records containing information to establish the source of the events.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00075: OL10 must produce audit records containing information to establish the outcome of the events.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00076: OL10 must generate audit records containing the full-text recording of privileged commands.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00077: OL10 must produce audit records containing the individual identities of group account users.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00089: OL10 audit system must take appropriate action when an error writing to the audit storage volume occurs.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00090: OL10 audit system must take appropriate action when the audit storage volume is full.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00091: OL10 audit system must take appropriate action when the audit files have reached maximum size.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00100: OL10 audit system must protect logon UIDs from unauthorized change.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00118: OL10 system-auth must be configured to use a sufficient number of hashing rounds.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00131: OL10 must be configured to disable the Asynchronous Transfer Mode (ATM) kernel module.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00136: OL10 must disable mounting of cramfs.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00142: OL10 must not have the sendmail package installed.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00143: OL10 must not have a graphical display manager installed unless approved.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00157: OL10 must implement multifactor authentication for access to interactive accounts.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00167: OL10 must use mechanisms meeting the requirements of applicable federal laws, executive orders, directives, policies, regulations, standards, and guidance for authentication to a cryptographic module.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00168: OL10 must prevent system daemons from using Kerberos for authentication.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00182: OL10 must be configured so that all network connections associated with SSH traffic are terminated after 10 minutes of becoming unresponsive.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00191: OL10 SSH daemon must be configured to use system-wide cryptographic policies.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00226: OL10 must automatically lock an account when three unsuccessful logon attempts occur during a 10-minute time period.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00233: OL10 must be configured to offload audit records onto a different system from the system being audited via syslog.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00299: OL10 must implement FIPS 140-3 compliant hash algorithms.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00301: OL10 must configure crypto policies to utilize FIPS 140-3 backends.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00302: OL10 must only allow the use of DOD PKI-established certificate authorities for authentication in the establishment of protected sessions to OL10.
Description: None
Levels:
Automated: no
Selections:
OL10-DRAFT-00310: OL10 must clear SLUB/SLAB objects to prevent use-after-free attacks.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00321: OL10 cryptographic policy files must match files shipped with the operating system.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00331: OL10 vendor packaged system security patches and updates must be installed and up to date.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00333: OL10 must not have a Trivial File Transfer Protocol (TFTP) server package installed.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00340: OL10 must be configured so that the cryptographic hashes of system files match vendor values.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00346: OL10 must enable the hardware random number generator entropy gatherer service.
Description: None
Levels:
Automated: no
Selections:
OL10-DRAFT-00347: OL10 must have the rng-tools package installed.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00358: OL10 must prevent code from being executed on file systems that are used with removable media.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00359: OL10 must prevent special devices on file systems that are used with removable media.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00360: OL10 must prevent files with the setuid and setgid bit set from being executed on file systems that are used with removable media.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00365: OL10 must disable the ability of a user to restart the system from the login screen.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00379: OL10 must disable the use of user namespaces.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00406: OL10 /boot/grub2/grub.cfg file must be owned by root.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00431: OL10 cron configuration directories must have a mode of 0700 or less permissive.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00434: OL10 /etc/crontab file must have mode 0600.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00472: OL10 must disable automatic mounting of Universal Serial Bus (USB) mass storage driver.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00473: OL10 must implement multifactor authentication for remote access to privileged accounts in such a way that one of the factors is provided by a device separate from the system gaining access.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00474: OL10 must have the SSSD package installed.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00475: OL10 must use the SSSD package for multifactor authentication services.
Description: None
Levels:
Automated: yes
Selections:
OL10-DRAFT-00476: OL10 must verify that user-created or modified passwords are not found on a list of commonly-used, expected, or compromised passwords.
Description: None
Levels:
Automated: yes
Selections: