Definition of Red Hat Enterprise Linux 10 Security Technical Implementation Guide for rhel10

RHEL-10-700970: RHEL 10 must disable the debug-shell systemd service.

Description: None

Levels:

medium

Automated: yes

Selections:

service_debug-shell_disabled: Disable debug-shell SystemD Service
- CCE-90212-2

RHEL-10-001020: RHEL 10 must ensure cryptographic verification of vendor software packages.

Description: None

Levels:

medium

Automated: yes

Selections:

ensure_redhat_gpgkey_installed: Ensure Red Hat GPG Key Installed
- CCE-88256-3
package_sequoia-sq_installed: Install sequoia-sq Package
- CCE-86458-7

RHEL-10-001030: RHEL 10 must check the GNU Privacy Guard (GPG) signature of software packages originating from external software repositories before installation.

Description: None

Levels:

high

Automated: yes

Selections:

ensure_gpgcheck_globally_activated: Ensure gpgcheck Enabled In Main dnf Configuration
- CCE-88404-9

RHEL-10-001040: RHEL 10 must check the GNU Privacy Guard (GPG) signature of locally installed software packages before installation.

Description: None

Levels:

high

Automated: yes

Selections:

ensure_gpgcheck_local_packages: Ensure gpgcheck Enabled for Local Packages
- CCE-89409-7

RHEL-10-001050: RHEL 10 must have GNU Privacy Guard (GPG) signature verification enabled for all software repositories.

Description: None

Levels:

high

Automated: yes

Selections:

enable_gpgcheck_for_all_repositories: Ensure gpgcheck Is Enabled for All Package Repositories
- CCE-86484-3

RHEL-10-000510: RHEL 10 must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information on local disk partitions that requires at-rest protection.

Description: None

Levels:

high

Automated: yes

Selections:

encrypt_partitions: Encrypt Partitions
- CCE-89165-5

RHEL-10-000520: RHEL 10 must use a separate file system for the system audit data path.

Description: None

Levels:

low

Automated: yes

Selections:

partition_for_var_log_audit: Ensure /var/log/audit Located On Separate Partition
- CCE-89211-7

RHEL-10-000530: RHEL 10 must use a separate file system for user home directories (such as "/home" or an equivalent).

Description: None

Levels:

medium

Automated: yes

Selections:

partition_for_home: Ensure /home Located On Separate Partition
- CCE-88231-6

RHEL-10-000540: RHEL 10 must use a separate file system for "/tmp".

Description: None

Levels:

medium

Automated: yes

Selections:

partition_for_tmp: Ensure /tmp Located On Separate Partition
- CCE-89606-8

RHEL-10-000550: RHEL 10 must use a separate file system for "/var".

Description: None

Levels:

medium

Automated: yes

Selections:

partition_for_var: Ensure /var Located On Separate Partition
- CCE-89166-3

RHEL-10-000560: RHEL 10 must use a separate file system for "/var/log".

Description: None

Levels:

medium

Automated: yes

Selections:

partition_for_var_log: Ensure /var/log Located On Separate Partition
- CCE-88355-3

RHEL-10-000570: RHEL 10 must use a separate file system for "/var/tmp".

Description: None

Levels:

medium

Automated: yes

Selections:

partition_for_var_tmp: Ensure /var/tmp Located On Separate Partition
- CCE-87694-6

RHEL-10-200000: RHEL 10 must remove all software components after updated versions have been installed.

Description: None

Levels:

medium

Automated: yes

Selections:

clean_components_post_updating: Ensure dnf Removes Previous Package Versions
- CCE-88515-2

RHEL-10-200010: RHEL 10 must not have the "nfs-utils" package installed.

Description: None

Levels:

medium

Automated: yes

Selections:

package_nfs-utils_removed: Uninstall nfs-utils Package
- CCE-88270-4

RHEL-10-200020: RHEL 10 must not have the "telnet-server" package installed.

Description: None

Levels:

high

Automated: yes

Selections:

package_telnet-server_removed: Uninstall telnet-server Package
- CCE-88105-2

RHEL-10-200030: RHEL 10 must not have the "gssproxy" package installed.

Description: None

Levels:

medium

Automated: yes

Selections:

package_gssproxy_removed: Uninstall gssproxy Package
- CCE-87596-3

RHEL-10-200040: RHEL 10 must not have the tuned package installed.

Description: None

Levels:

medium

Automated: yes

Selections:

package_tuned_removed: Uninstall tuned Package
- CCE-87654-0

RHEL-10-200050: RHEL 10 must not have a Trivial File Transfer Protocol (TFTP) server package installed unless it is required by the mission, and if required, the TFTP daemon must be configured to operate in secure mode.

Description: None

Levels:

medium

Automated: yes

Selections:

package_tftp-server_removed: Uninstall tftp-server Package
- CCE-89287-7

RHEL-10-200060: RHEL 10 must not have the unbound package installed.

Description: None

Levels:

medium

Automated: yes

Selections:

package_unbound_removed: Uninstall unbound Package
- CCE-86181-5

RHEL-10-200070: RHEL 10 must not have the "tftp" package installed.

Description: None

Levels:

high

Automated: yes

Selections:

package_tftp_removed: Remove tftp Daemon
- CCE-88586-3

RHEL-10-200080: RHEL 10 must not have the "gdm" package installed.

Description: None

Levels:

medium

Automated: yes

Selections:

package_gdm_removed: Remove the GDM Package Group
- CCE-88880-0

RHEL-10-200090: RHEL 10 must not have a File Transfer Protocol (FTP) server package installed.

Description: None

Levels:

high

Automated: yes

Selections:

package_vsftpd_removed: Uninstall vsftpd Package
- CCE-88674-7

RHEL-10-200500: RHEL 10 must have the "subscription-manager" package installed.

Description: None

Levels:

medium

Automated: yes

Selections:

package_subscription-manager_installed: Install subscription-manager Package
- CCE-88542-6

RHEL-10-200510: RHEL 10 must have the "nss-tools" package installed.

Description: None

Levels:

medium

Automated: yes

Selections:

package_nss-tools_installed: Ensure nss-tools is installed
- CCE-87829-8

RHEL-10-200520: RHEL 10 must have the "s-nail" package installed.

Description: None

Levels:

medium

Automated: yes

Selections:

package_s-nail_installed: The s-nail Package Is Installed
- CCE-89346-1

RHEL-10-200530: RHEL 10 must have the "firewalld" package installed.

Description: None

Levels:

medium

Automated: yes

Selections:

package_firewalld_installed: Install firewalld Package
- CCE-88164-9

RHEL-10-200531: RHEL 10 must have the "firewalld" service set to active.

Description: None

Levels:

medium

Automated: yes

Selections:

service_firewalld_enabled: Verify firewalld Enabled
- CCE-88110-2

RHEL-10-200532: RHEL 10 must employ a deny-all, allow-by-exception policy for allowing connections to other systems.

Description: None

Levels:

medium

Automated: yes

Selections:

configured_firewalld_default_deny: Firewalld Must Employ a Deny-all, Allow-by-exception Policy for Allowing Connections to Other Systems
- CCE-89418-8

RHEL-10-200540: RHEL 10 must have the "chrony" package installed.

Description: None

Levels:

medium

Automated: yes

Selections:

package_chrony_installed: The Chrony package is installed
- CCE-89591-2

RHEL-10-200541: RHEL 10 must enable the chronyd service.

Description: None

Levels:

medium

Automated: yes

Selections:

service_chronyd_enabled: The Chronyd service is enabled
- CCE-90511-7

RHEL-10-200542: RHEL 10 must disable the chrony daemon from acting as a server.

Description: None

Levels:

medium

Automated: yes

Selections:

chronyd_client_only: Disable chrony daemon from acting as server
- CCE-89002-0

RHEL-10-200543: RHEL 10 must disable network management of the chrony daemon.

Description: None

Levels:

medium

Automated: yes

Selections:

chronyd_no_chronyc_network: Disable network management of chrony daemon
- CCE-87066-7

RHEL-10-200560: RHEL 10 must have the USBGuard package installed.

Description: None

Levels:

medium

Automated: yes

Selections:

package_usbguard_installed: Install usbguard Package
- CCE-87756-3

RHEL-10-200561: RHEL 10 must have the USBGuard package enabled.

Description: None

Levels:

medium

Automated: yes

Selections:

service_usbguard_enabled: Enable the USBGuard Service
- CCE-87560-9

RHEL-10-200562: RHEL 10 must block unauthorized peripherals before establishing a connection.

Description: None

Levels:

medium

Automated: yes

Selections:

usbguard_generate_policy: Generate USBGuard Policy
- CCE-88632-5

RHEL-10-200563: RHEL 10 must enable audit logging for the USBGuard daemon.

Description: None

Levels:

medium

Automated: yes

Selections:

configure_usbguard_auditbackend: Log USBGuard daemon audit events using Linux Audit
- CCE-87152-5

RHEL-10-200570: RHEL 10 must have the "policycoreutils" package installed.

Description: None

Levels:

medium

Automated: yes

Selections:

package_policycoreutils_installed: Install policycoreutils Package
- CCE-88996-4

RHEL-10-200580: RHEL 10 must have the "policycoreutils-python-utils" package installed.

Description: None

Levels:

medium

Automated: yes

Selections:

package_policycoreutils-python-utils_installed: Install policycoreutils-python-utils package
- CCE-87004-8

RHEL-10-200590: RHEL 10 must have the "sudo" package installed.

Description: None

Levels:

medium

Automated: yes

Selections:

package_sudo_installed: Install sudo Package
- CCE-87100-4

RHEL-10-200600: RHEL 10 must have the "fapolicy" module installed.

Description: None

Levels:

medium

Automated: yes

Selections:

package_fapolicyd_installed: Install fapolicyd Package
- CCE-89813-0

RHEL-10-200601: RHEL 10 must enable the "fapolicy" module.

Description: None

Levels:

medium

Automated: yes

Selections:

service_fapolicyd_enabled: Enable the File Access Policy Service
- CCE-88147-4

RHEL-10-200602: RHEL 10 must be configured to employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs.

Description: None

Levels:

medium

Automated: yes

Selections:

fapolicy_default_deny: Configure Fapolicy Module to Employ a Deny-all, Permit-by-exception Policy to Allow the Execution of Authorized Software Programs.
- CCE-90343-5

RHEL-10-200610: RHEL 10 must have the "pcsc-lite" package installed.

Description: None

Levels:

medium

Automated: yes

Selections:

package_pcsc-lite_installed: Install the pcsc-lite package
- CCE-88682-0

RHEL-10-200611: RHEL 10 must have the "pcscd" service set to active.

Description: None

Levels:

medium

Automated: yes

Selections:

service_pcscd_enabled: Enable the pcscd Service
- CCE-87363-8

RHEL-10-200612: RHEL 10 must have the "pcsc-lite-ccid" package installed.

Description: None

Levels:

medium

Automated: yes

Selections:

package_pcsc-lite-ccid_installed: Install the pcsc-lite-ccid package
- CCE-86250-8

RHEL-10-200620: RHEL 10 must have the "opensc" package installed.

Description: None

Levels:

medium

Automated: yes

Selections:

package_opensc_installed: Install the opensc Package For Multifactor Authentication
- CCE-86898-4

RHEL-10-200621: RHEL 10 must use the common access card (CAC) smart card driver.

Description: None

Levels:

medium

Automated: yes

Selections:

configure_opensc_card_drivers: Configure opensc Smart Card Drivers
- CCE-90065-4
var_smartcard_drivers = cac

RHEL-10-200630: RHEL 10 must have the Advanced Intrusion Detection Environment (AIDE) package installed.

Description: None

Levels:

medium

Automated: yes

Selections:

aide_build_database: Build and Test AIDE Database
- CCE-86942-0
package_aide_installed: Install AIDE
- CCE-90477-1

RHEL-10-200631: RHEL 10 must use cryptographic mechanisms to protect the integrity of audit tools.

Description: None

Levels:

high

Automated: yes

Selections:

aide_check_audit_tools: Configure AIDE to Verify the Audit Tools
- CCE-86441-3

RHEL-10-200632: RHEL 10 must use a file integrity tool that is configured to use FIPS 140-3-approved cryptographic hashes for validating file contents and directories.

Description: None

Levels:

medium

Automated: yes

Selections:

aide_use_fips_hashes: Configure AIDE to Use FIPS 140-2 for Validating Hashes
- CCE-90260-1

RHEL-10-200633: RHEL 10 must routinely check the baseline configuration for unauthorized changes and notify the system administrator when anomalies in the operation of any security functions are discovered.

Description: None

Levels:

medium

Automated: yes

Selections:

aide_scan_notification: Configure Notification of Post-AIDE Scan Details
- CCE-90177-7

RHEL-10-200634: RHEL 10 must be configured so that the file integrity tool verifies Access Control Lists (ACLs).

Description: None

Levels:

medium

Automated: yes

Selections:

aide_verify_acls: Configure AIDE to Verify Access Control Lists (ACLs)
- CCE-89640-7

RHEL-10-200635: RHEL 10 must be configured so that the file integrity tool verifies extended attributes.

Description: None

Levels:

medium

Automated: yes

Selections:

aide_verify_ext_attributes: Configure AIDE to Verify Extended Attributes
- CCE-89625-8

RHEL-10-200640: RHEL 10 must have the "rsyslog" package installed.

Description: None

Levels:

medium

Automated: yes

Selections:

package_rsyslog_installed: Ensure rsyslog is Installed
- CCE-90353-4

RHEL-10-200641: RHEL 10 must have the rsyslog service set to active.

Description: None

Levels:

medium

Automated: yes

Selections:

service_rsyslog_enabled: Enable rsyslog Service
- CCE-90584-4

RHEL-10-200642: RHEL 10 must be configured to forward audit records via Transmission Control Protocol (TCP) to a different system or media from the system being audited via rsyslog.

Description: None

Levels:

medium

Automated: yes

Selections:

rsyslog_remote_loghost: Ensure Logs Sent To Remote Host
- CCE-90372-4

RHEL-10-200643: RHEL 10 must be configured so that the rsyslog daemon does not accept log messages from other servers unless the server is being used for log aggregation.

Description: None

Levels:

medium

Automated: yes

Selections:

rsyslog_nolisten: Ensure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- CCE-89374-3

RHEL-10-200644: RHEL 10 must authenticate the remote logging server for off-loading audit logs via "rsyslog".

Description: None

Levels:

medium

Automated: yes

Selections:

rsyslog_encrypt_offload_actionsendstreamdriverauthmode: Ensure Rsyslog Authenticates Off-Loaded Audit Records
- CCE-88521-0

RHEL-10-200645: RHEL 10 must encrypt the transfer of audit records off-loaded onto a different system or media from the system being audited via rsyslog.

Description: None

Levels:

medium

Automated: yes

Selections:

rsyslog_encrypt_offload_actionsendstreamdrivermode: Ensure Rsyslog Encrypts Off-Loaded Audit Records
- CCE-88359-5

RHEL-10-200646: RHEL 10 must encrypt, via the gtls driver, the transfer of audit records off-loaded onto a different system or media from the system being audited via rsyslog.

Description: None

Levels:

medium

Automated: yes

Selections:

rsyslog_encrypt_offload_defaultnetstreamdriver: Ensure Rsyslog Encrypts Off-Loaded Audit Records
- CCE-89018-6

RHEL-10-200647: RHEL 10 must monitor all remote access methods.

Description: None

Levels:

medium

Automated: yes

Selections:

rsyslog_remote_access_monitoring: Ensure remote access methods are monitored in Rsyslog
- CCE-87341-4

RHEL-10-200648: RHEL 10 must use cron logging.

Description: None

Levels:

medium

Automated: yes

Selections:

rsyslog_cron_logging: Ensure cron Is Logging To Rsyslog
- CCE-90383-1

RHEL-10-200650: RHEL 10 must have the packages required for encrypting off-loaded audit logs installed.

Description: None

Levels:

medium

Automated: yes

Selections:

package_rsyslog-gnutls_installed: Ensure rsyslog-gnutls is installed
- CCE-89106-9

RHEL-10-200660: RHEL 10 must have the "audit" package installed.

Description: None

Levels:

medium

Automated: yes

Selections:

package_audit_installed: Ensure the audit Subsystem is Installed
- CCE-88240-7

RHEL-10-200661: RHEL 10 must enable the audit service.

Description: None

Levels:

medium

Automated: yes

Selections:

service_auditd_enabled: Enable auditd Service
- CCE-87955-1

RHEL-10-200662: RHEL 10 must have the "audispd-plugins" package installed.

Description: None

Levels:

low

Automated: yes

Selections:

package_audispd-plugins_installed: Install audispd-plugins Package
- CCE-88547-5

RHEL-10-200680: RHEL 10 must have the "libreswan" package installed.

Description: None

Levels:

medium

Automated: yes

Selections:

package_libreswan_installed: Install libreswan Package
- CCE-87497-4

RHEL-10-200690: RHEL 10 must notify designated personnel if baseline configurations are changed in an unauthorized manner.

Description: None

Levels:

medium

Automated: yes

Selections:

package_postfix_installed: The Postfix package is installed
- CCE-86466-0

RHEL-10-200691: RHEL 10 must have mail aliases to notify the information system security officer (ISSO) and system administrator (SA) (at a minimum) of an audit processing failure.

Description: None

Levels:

medium

Automated: yes

Selections:

postfix_client_configure_mail_alias: Configure System to Forward All Mail For The Root Account
- CCE-87937-9
var_postfix_root_mail_alias = mil_sysadmin

RHEL-10-200692: RHEL 10 must be configured to prevent unrestricted mail relaying.

Description: None

Levels:

medium

Automated: yes

Selections:

postfix_prevent_unrestricted_relay: Prevent Unrestricted Mail Relaying
- CCE-87792-8

RHEL-10-200700: RHEL 10 must have the "cronie" package installed.

Description: None

Levels:

medium

Automated: yes

Selections:

package_cron_installed: Install the cron service
- CCE-86619-4

RHEL-10-200720: RHEL 10 must have a Secure Shell (SSH) server installed for all networked systems.

Description: None

Levels:

medium

Automated: yes

Selections:

package_openssh-server_installed: Install the OpenSSH Server Package
- CCE-89241-4

RHEL-10-200721: RHEL 10 must, for all networked systems, have and implement Secure Shell (SSH) to protect the confidentiality and integrity of transmitted and received information.

Description: None

Levels:

medium

Automated: yes

Selections:

service_sshd_enabled: Enable the OpenSSH Service
- CCE-88621-8

RHEL-10-200722: RHEL 10 must have the "openssh-clients" package installed.

Description: None

Levels:

medium

Automated: yes

Selections:

package_openssh-clients_installed: Install OpenSSH client software
- CCE-86852-1

RHEL-10-200730: RHEL 10 must have the "pkcs11-provider" package installed.

Description: None

Levels:

medium

Automated: yes

Selections:

install_smartcard_packages: Install Smart Card Packages For Multifactor Authentication
- CCE-86642-6

RHEL-10-200740: RHEL 10 must have the "gnutls-utils" package installed.

Description: None

Levels:

medium

Automated: yes

Selections:

package_gnutls-utils_installed: Ensure gnutls-utils is installed
- CCE-90403-7

RHEL-10-300000: RHEL 10 must have the "crypto-policies" package installed.

Description: None

Levels:

high

Automated: yes

Selections:

package_crypto-policies_installed: Install crypto-policies package
- CCE-89668-8

RHEL-10-300010: RHEL 10 must implement a FIPS 140-3-compliant systemwide cryptographic policy.

Description: None

Levels:

high

Automated: yes

Selections:

configure_crypto_policy: Configure System Cryptography Policy
- CCE-89085-5
var_system_crypto_policy = fips

RHEL-10-000500: RHEL 10 must enable FIPS mode.

Description: None

Levels:

high

Automated: yes

Selections:

sysctl_crypto_fips_enabled: Set kernel parameter 'crypto.fips_enabled' to 1
- CCE-89047-5

RHEL-10-300030: RHEL 10 must be configured so that Secure Shell (SSH) clients use only DOD-approved encryption ciphers employing FIPS 140-3-validated cryptographic hash algorithms to protect the confidentiality of SSH client connections.

Description: None

Levels:

high

Automated: yes

Selections:

harden_sshd_ciphers_openssh_conf_crypto_policy: Configure SSH Client to Use FIPS 140 Validated Ciphers: openssh.config
- CCE-87540-1
sshd_approved_ciphers = stig_rhel10

RHEL-10-300040: RHEL 10 must be configured so that Secure Shell (SSH) servers use only DOD-approved encryption ciphers employing FIPS 140-3-validated cryptographic hash algorithms to protect the confidentiality of SSH server connections.

Description: None

Levels:

high

Automated: yes

Selections:

harden_sshd_ciphers_opensshserver_conf_crypto_policy: Configure SSH Server to Use FIPS 140-2 Validated Ciphers: opensshserver.config
- CCE-88450-2
sshd_approved_ciphers = stig_rhel10

RHEL-10-300050: RHEL 10 must be configured so that Secure Shell (SSH) clients use only DOD-approved Message Authentication Codes (MACs) employing FIPS 140-3-validated cryptographic hash algorithms to protect the confidentiality of SSH client connections.

Description: None

Levels:

high

Automated: yes

Selections:

harden_sshd_macs_openssh_conf_crypto_policy: Configure SSH Client to Use FIPS 140-2 Validated MACs: openssh.config
- CCE-87151-7
sshd_approved_macs = stig_rhel10

RHEL-10-300060: RHEL 10 must be configured so that Secure Shell (SSH) servers use only DOD-approved Message Authentication Codes (MACs) employing FIPS 140-3-validated cryptographic hash algorithms to protect the confidentiality of SSH server connections.

Description: None

Levels:

high

Automated: yes

Selections:

harden_sshd_macs_opensshserver_conf_crypto_policy: Configure SSH Server to Use FIPS 140-2 Validated MACs: opensshserver.config
- CCE-87150-9
sshd_approved_macs = stig_rhel10

RHEL-10-300070: RHEL 10 must use FIPS 140-3-approved cryptographic algorithms for IP tunnels.

Description: None

Levels:

high

Automated: yes

Selections:

configure_libreswan_crypto_policy: Configure Libreswan to use System Crypto Policy
- CCE-88687-9

RHEL-10-300080: RHEL 10 must implement DOD-approved encryption in the bind package.

Description: None

Levels:

high

Automated: yes

Selections:

configure_bind_crypto_policy: Configure BIND to use System Crypto Policy
- CCE-86874-5

RHEL-10-300090: RHEL 10 cryptographic policy must not be overridden.

Description: None

Levels:

high

Automated: yes

Selections:

crypto_policy_not_overridden: Ensure System Cryptographic Policy Is Not Overridden
- CCE-86494-2

RHEL-10-400000: RHEL 10 must be configured so that the "/etc/group" file is owned by root.

Description: None

Levels:

medium

Automated: yes

Selections:

file_owner_etc_group: Verify User Who Owns group File
- CCE-86870-3

RHEL-10-400005: RHEL 10 must be configured so that the "/etc/group" file is group-owned by "root".

Description: None

Levels:

medium

Automated: yes

Selections:

file_groupowner_etc_group: Verify Group Who Owns group File
- CCE-90261-9

RHEL-10-400010: RHEL 10 must be configured so that the "/etc/group-" file is owned by "root".

Description: None

Levels:

medium

Automated: yes

Selections:

file_owner_backup_etc_group: Verify User Who Owns Backup group File
- CCE-89017-8

RHEL-10-400015: RHEL 10 must be configured so that the "/etc/group-" file is group-owned by "root".

Description: None

Levels:

medium

Automated: yes

Selections:

file_groupowner_backup_etc_group: Verify Group Who Owns Backup group File
- CCE-89477-4

RHEL-10-400020: RHEL 10 must be configured so that the "/etc/gshadow" file is owned by "root".

Description: None

Levels:

medium

Automated: yes

Selections:

file_owner_etc_gshadow: Verify User Who Owns gshadow File
- CCE-87701-9

RHEL-10-400025: RHEL 10 must be configured so that the "/etc/gshadow" file is group-owned by "root".

Description: None

Levels:

medium

Automated: yes

Selections:

file_groupowner_etc_gshadow: Verify Group Who Owns gshadow File
- CCE-90043-1

RHEL-10-400030: RHEL 10 must be configured so that the "/etc/gshadow-" file is owned by "root".

Description: None

Levels:

medium

Automated: yes

Selections:

file_owner_backup_etc_gshadow: Verify User Who Owns Backup gshadow File
- CCE-86957-8

RHEL-10-400035: RHEL 10 must be configured so that the "/etc/gshadow-" file is group-owned by "root".

Description: None

Levels:

medium

Automated: yes

Selections:

file_groupowner_backup_etc_gshadow: Verify Group Who Owns Backup gshadow File
- CCE-88453-6

RHEL-10-400040: RHEL 10 must be configured so that the "/etc/passwd" file is owned by "root".

Description: None

Levels:

medium

Automated: yes

Selections:

file_owner_etc_passwd: Verify User Who Owns passwd File
- CCE-87827-2

RHEL-10-400045: RHEL 10 must be configured so that the "/etc/passwd" file is group-owned by "root".

Description: None

Levels:

medium

Automated: yes

Selections:

file_groupowner_etc_passwd: Verify Group Who Owns passwd File
- CCE-89210-9

RHEL-10-400050: RHEL 10 must be configured so that the "/etc/passwd-" file is owned by "root".

Description: None

Levels:

medium

Automated: yes

Selections:

file_owner_backup_etc_passwd: Verify User Who Owns Backup passwd File
- CCE-90377-3

RHEL-10-400055: RHEL 10 must be configured so that the "/etc/passwd-" file is group-owned by "root".

Description: None

Levels:

medium

Automated: yes

Selections:

file_groupowner_backup_etc_passwd: Verify Group Who Owns Backup passwd File
- CCE-89914-6

RHEL-10-400060: RHEL 10 must be configured so that the "/etc/shadow" file is owned by "root".

Description: None

Levels:

medium

Automated: yes

Selections:

file_owner_etc_shadow: Verify User Who Owns shadow File
- CCE-86857-0

RHEL-10-400065: RHEL 10 must be configured so that the "/etc/shadow" file is group-owned by "root".

Description: None

Levels:

medium

Automated: yes

Selections:

file_groupowner_etc_shadow: Verify Group Who Owns shadow File
- CCE-87579-9

RHEL-10-400070: RHEL 10 must be configured so that the "/etc/shadow-" file is owned by "root".

Description: None

Levels:

medium

Automated: yes

Selections:

file_owner_backup_etc_shadow: Verify Group Who Owns Backup shadow File
- CCE-87502-1

RHEL-10-400075: RHEL 10 must be configured so that the "/etc/shadow-" file is group-owned by "root".

Description: None

Levels:

medium

Automated: yes

Selections:

file_groupowner_backup_etc_shadow: Verify User Who Owns Backup shadow File
- CCE-88235-7

RHEL-10-400080: RHEL 10 must be configured so that the "/var/log" directory is owned by "root".

Description: None

Levels:

medium

Automated: yes

Selections:

file_owner_var_log: Verify User Who Owns /var/log Directory
- CCE-86705-1

RHEL-10-400085: RHEL 10 must be configured so that the "/var/log" directory is group-owned by "root".

Description: None

Levels:

medium

Automated: yes

Selections:

file_groupowner_var_log: Verify Group Who Owns /var/log Directory
- CCE-89035-0

RHEL-10-400090: RHEL 10 must be configured so that the "/var/log/"messages file is owned by root.

Description: None

Levels:

medium

Automated: yes

Selections:

file_owner_var_log_messages: Verify User Who Owns /var/log/messages File
- CCE-89093-9

RHEL-10-400095: RHEL 10 must be configured so that the "/var/log/messages" file is group-owned by "root".

Description: None

Levels:

medium

Automated: yes

Selections:

file_groupowner_var_log_messages: Verify Group Who Owns /var/log/messages File
- CCE-86924-8

RHEL-10-400100: RHEL 10 must be configured so that system commands are owned by "root".

Description: None

Levels:

medium

Automated: yes

Selections:

file_ownership_binary_dirs: Verify that System Executables Have Root Ownership
- CCE-89620-9

RHEL-10-400105: RHEL 10 must be configured so that system commands are group-owned by root or a system account.

Description: None

Levels:

medium

Automated: yes

Selections:

file_groupownership_system_commands_dirs: Verify that system commands files are group owned by root or a system account
- CCE-89800-7

RHEL-10-400110: RHEL 10 must be configured so that library files are owned by "root".

Description: None

Levels:

medium

Automated: yes

Selections:

file_ownership_library_dirs: Verify that Shared Library Files Have Root Ownership
- CCE-87988-2

RHEL-10-400115: RHEL 10 must be configured so that library files are group-owned by "root" or a system account.

Description: None

Levels:

medium

Automated: yes

Selections:

root_permissions_syslibrary_files: Verify the system-wide library files in directories "/lib", "/lib64", "/usr/lib/" and "/usr/lib64" are group-owned by root.
- CCE-86440-5

RHEL-10-400120: RHEL 10 must be configured so that library directories are owned by "root".

Description: None

Levels:

medium

Automated: yes

Selections:

dir_ownership_library_dirs: Verify that Shared Library Directories Have Root Ownership
- CCE-89745-4

RHEL-10-400125: RHEL 10 must be configured so that library directories are group-owned by "root" or a system account.

Description: None

Levels:

medium

Automated: yes

Selections:

dir_group_ownership_library_dirs: Verify that Shared Library Directories Have Root Group Ownership
- CCE-88290-2

RHEL-10-400130: RHEL 10 must be configured so that cron configuration file directories are owned by root.

Description: None

Levels:

medium

Automated: yes

Selections:

file_owner_cron_d: Verify Owner on cron.d
- CCE-88741-4
file_owner_cron_daily: Verify Owner on cron.daily
- CCE-87499-0
file_owner_cron_deny: Verify Owner on cron.deny
- CCE-86823-2
file_owner_cron_hourly: Verify Owner on cron.hourly
- CCE-89705-8
file_owner_cron_monthly: Verify Owner on cron.monthly
- CCE-90753-5
file_owner_cron_weekly: Verify Owner on cron.weekly
- CCE-88943-6
file_owner_crontab: Verify Owner on crontab
- CCE-87294-5

RHEL-10-400135: RHEL 10 must be configured so that cron configuration files directories are group-owned by root.

Description: None

Levels:

medium

Automated: yes

Selections:

file_groupowner_cron_d: Verify Group Who Owns cron.d
- CCE-89321-4
file_groupowner_cron_daily: Verify Group Who Owns cron.daily
- CCE-90342-7
file_groupowner_cron_deny: Verify Group Who Owns cron.deny
- CCE-88060-9
file_groupowner_cron_hourly: Verify Group Who Owns cron.hourly
- CCE-88140-9
file_groupowner_cron_monthly: Verify Group Who Owns cron.monthly
- CCE-88986-5
file_groupowner_cron_weekly: Verify Group Who Owns cron.weekly
- CCE-89080-6
file_groupowner_crontab: Verify Group Who Owns Crontab
- CCE-89062-4

RHEL-10-400140: RHEL 10 must be configured so that world-writable directories are owned by root, sys, bin, or an application user.

Description: None

Levels:

medium

Automated: yes

Selections:

dir_perms_world_writable_root_owned: Ensure All World-Writable Directories Are Owned by root User
- CCE-89514-4

RHEL-10-400145: RHEL 10 must be configured so that all system device files are correctly labeled to prevent unauthorized modification.

Description: None

Levels:

medium

Automated: yes

Selections:

selinux_all_devicefiles_labeled: Ensure No Device Files are Unlabeled by SELinux
- CCE-90192-6

RHEL-10-400150: RHEL 10 must be configured so that the Secure Shell (SSH) server configuration file is group-owned by "root".

Description: None

Levels:

medium

Automated: yes

Selections:

directory_groupowner_sshd_config_d: Verify Group Who Owns SSH Server Configuration Files
- CCE-89991-4
file_groupowner_sshd_config: Verify Group Who Owns SSH Server config file
- CCE-86992-5
file_groupowner_sshd_drop_in_config: Verify Group Who Owns SSH Server Configuration Files
- CCE-86254-0

RHEL-10-400155: RHEL 10 must be configured so that the Secure Shell (SSH) server configuration file is owned by "root".

Description: None

Levels:

medium

Automated: yes

Selections:

directory_owner_sshd_config_d: Verify Owner on SSH Server Configuration Files
- CCE-89747-0
file_owner_sshd_config: Verify Owner on SSH Server config file
- CCE-89829-6
file_owner_sshd_drop_in_config: Verify Owner on SSH Server Configuration Files
- CCE-86268-0
file_sshd_50_redhat_exists: The File /etc/ssh/sshd_config.d/50-redhat.conf Must Exist
- CCE-86691-3

RHEL-10-400160: RHEL 10 must ensure that all local interactive user home directories are group-owned by the home directory owner's primary group.

Description: None

Levels:

medium

Automated: yes

Selections:

file_groupownership_home_directories: All Interactive User Home Directories Must Be Group-Owned By The Primary Group
- CCE-87946-0

RHEL-10-400165: RHEL 10 must enforce group ownership of audit logs by "root" or by a restricted logging group to prevent unauthorized read access.

Description: None

Levels:

medium

Automated: yes

Selections:

file_group_ownership_var_log_audit: System Audit Logs Must Be Group Owned By Root
- CCE-89126-7

RHEL-10-400170: RHEL 10 must enforce "root" ownership of the audit log directory to prevent unauthorized read access.

Description: None

Levels:

medium

Automated: yes

Selections:

directory_ownership_var_log_audit: System Audit Directories Must Be Owned By Root
- CCE-86731-7

RHEL-10-400175: RHEL 10 must enforce "root" ownership of audit logs to prevent unauthorized access.

Description: None

Levels:

medium

Automated: yes

Selections:

file_ownership_var_log_audit_stig: System Audit Logs Must Be Owned By Root
- CCE-89939-3

RHEL-10-400180: RHEL 10 must enforce group ownership by "root" or a restricted logging group for audit log files to prevent unauthorized access.

Description: None

Levels:

medium

Automated: yes

Selections:

file_group_ownership_var_log_audit: System Audit Logs Must Be Group Owned By Root
- CCE-89126-7

RHEL-10-400185: RHEL 10 must set mode "0600" or less permissive for the audit logs file to prevent unauthorized access to the audit log.

Description: None

Levels:

medium

Automated: yes

Selections:

file_permissions_var_log_audit: System Audit Logs Must Have Mode 0640 or Less Permissive
- CCE-90129-8

RHEL-10-400190: RHEL 10 must enforce the audit log directory to have a mode of "0750" or less permissive to prevent unauthorized read access.

Description: None

Levels:

medium

Automated: yes

Selections:

directory_permissions_var_log_audit: System Audit Logs Must Have Mode 0750 or Less Permissive
- CCE-86750-7

RHEL-10-400195: RHEL 10 must enforce root ownership of the "/etc/audit/" directory.

Description: None

Levels:

medium

Automated: yes

Selections:

file_ownership_audit_configuration: Audit Configuration Files Must Be Owned By Root
- CCE-88877-6

RHEL-10-400200: RHEL 10 must enforce root group ownership of the "/etc/audit/" directory.

Description: None

Levels:

medium

Automated: yes

Selections:

file_groupownership_audit_configuration: Audit Configuration Files Must Be Owned By Group root
- CCE-88238-1

RHEL-10-400205: RHEL 10 must enforce mode "755" or less permissive for system commands.

Description: None

Levels:

medium

Automated: yes

Selections:

file_permissions_binary_dirs: Verify that System Executables Have Restrictive Permissions
- CCE-86978-4

RHEL-10-400210: RHEL 10 must enforce mode "755" or less permissive on library directories.

Description: None

Levels:

medium

Automated: yes

Selections:

dir_permissions_library_dirs: Verify that Shared Library Directories Have Restrictive Permissions
- CCE-87731-6

RHEL-10-400215: RHEL 10 must enforce mode "755" or less permissive for library files.

Description: None

Levels:

medium

Automated: yes

Selections:

file_permissions_library_dirs: Verify that Shared Library Files Have Restrictive Permissions
- CCE-88771-1

RHEL-10-400220: RHEL 10 must enforce mode "0755" or less permissive for the "/var/log" directory.

Description: None

Levels:

medium

Automated: yes

Selections:

file_permissions_var_log: Verify Permissions on /var/log Directory
- CCE-89801-5

RHEL-10-400225: RHEL 10 must enforce mode "0640" or less permissive for the "/var/log/messages" file.

Description: None

Levels:

medium

Automated: yes

Selections:

file_permissions_var_log_messages: Verify Permissions on /var/log/messages File
- CCE-89397-4

RHEL-10-400230: RHEL 10 must be configured to prohibit modification of permissions for cron configuration files and directories from the operating system defaults.

Description: None

Levels:

medium

Automated: yes

Selections:

file_permissions_cron_d: Verify Permissions on cron.d
- CCE-86651-7
file_permissions_cron_daily: Verify Permissions on cron.daily
- CCE-88919-6
file_permissions_cron_hourly: Verify Permissions on cron.hourly
- CCE-88664-8
file_permissions_cron_monthly: Verify Permissions on cron.monthly
- CCE-86632-7
file_permissions_cron_weekly: Verify Permissions on cron.weekly
- CCE-89733-0
file_permissions_crontab: Verify Permissions on crontab
- CCE-90078-7

RHEL-10-400235: RHEL 10 must enforce mode "0740" or less permissive for local initialization files.

Description: None

Levels:

medium

Automated: yes

Selections:

file_permission_user_init_files: Ensure All User Initialization Files Have Mode 0740 Or Less Permissive
- CCE-87771-2
var_user_initialization_files_regex = all_dotfiles

RHEL-10-400240: RHEL 10 must enforce mode "0750" or less permissive for local interactive user home directories.

Description: None

Levels:

medium

Automated: yes

Selections:

file_permissions_home_directories: All Interactive User Home Directories Must Have mode 0750 Or Less Permissive
- CCE-86605-3

RHEL-10-400245: RHEL 10 must enforce mode "0644" or less permissive for the "/etc/group" file to prevent unauthorized access.

Description: None

Levels:

medium

Automated: yes

Selections:

file_permissions_etc_group: Verify Permissions on group File
- CCE-88868-5

RHEL-10-400250: RHEL 10 must enforce mode "0644" or less permissive for the "/etc/group-" file to prevent unauthorized access.

Description: None

Levels:

medium

Automated: yes

Selections:

file_permissions_backup_etc_group: Verify Permissions on Backup group File
- CCE-86579-0

RHEL-10-400255: RHEL 10 must enforce mode "0000" or less permissive for the "/etc/gshadow" file to prevent unauthorized access.

Description: None

Levels:

medium

Automated: yes

Selections:

file_permissions_etc_gshadow: Verify Permissions on gshadow File
- CCE-86975-0

RHEL-10-400260: RHEL 10 must enforce mode "0000" or less permissive for the "/etc/gshadow-" file to prevent unauthorized access.

Description: None

Levels:

medium

Automated: yes

Selections:

file_permissions_backup_etc_gshadow: Verify Permissions on Backup gshadow File
- CCE-89056-6

RHEL-10-400265: RHEL 10 must enforce mode "0644" or less permissive for the "/etc/passwd" file to prevent unauthorized access.

Description: None

Levels:

medium

Automated: yes

Selections:

file_permissions_etc_passwd: Verify Permissions on passwd File
- CCE-90644-6

RHEL-10-400270: RHEL 10 must enforce mode "0644" or less permissive for "/etc/passwd-" file to prevent unauthorized access.

Description: None

Levels:

medium

Automated: yes

Selections:

file_permissions_backup_etc_passwd: Verify Permissions on Backup passwd File
- CCE-86854-7

RHEL-10-400275: RHEL 10 must enforce mode "0000" or less permissive for "/etc/shadow-" file to prevent unauthorized access.

Description: None

Levels:

medium

Automated: yes

Selections:

file_permissions_backup_etc_shadow: Verify Permissions on Backup shadow File
- CCE-87423-0

RHEL-10-400280: RHEL 10 must be configured so that a sticky bit is set on all public directories.

Description: None

Levels:

medium

Automated: yes

Selections:

dir_perms_world_writable_sticky_bits: Verify that All World-Writable Directories Have Sticky Bits Set
- CCE-88397-5

RHEL-10-400285: RHEL 10 must be configured so that all local files and directories have a valid group owner.

Description: None

Levels:

medium

Automated: yes

Selections:

file_permissions_ungroupowned: Ensure All Files Are Owned by a Group
- CCE-88305-8

RHEL-10-400290: RHEL 10 must be configured so that all local files and directories must have a valid owner.

Description: None

Levels:

medium

Automated: yes

Selections:

no_files_unowned_by_user: Ensure All Files Are Owned by a User
- CCE-89680-3

RHEL-10-400295: RHEL 10 must enforce mode "0000" for "/etc/shadow" to prevent unauthorized access.

Description: None

Levels:

medium

Automated: yes

Selections:

file_permissions_etc_shadow: Verify Permissions on shadow File
- CCE-88433-8

RHEL-10-400300: RHEL 10 must be configured so that audit tools are owned by "root".

Description: None

Levels:

medium

Automated: yes

Selections:

file_audit_tools_ownership: Audit Tools Must Be Owned by Root
- CCE-87874-4

RHEL-10-400305: RHEL 10 must be configured so that audit tools are group-owned by "root".

Description: None

Levels:

medium

Automated: yes

Selections:

file_audit_tools_group_ownership: Audit Tools Must Be Group-owned by Root
- CCE-86839-8

RHEL-10-400310: RHEL 10 must set the umask value to "077" for all local interactive user accounts.

Description: None

Levels:

medium

Automated: yes

Selections:

accounts_umask_interactive_users: Ensure the Default Umask is Set Correctly For Interactive Users
- CCE-87122-8
var_accounts_user_umask = 077

RHEL-10-400315: RHEL 10 must define default permissions for the bash shell.

Description: None

Levels:

medium

Automated: yes

Selections:

accounts_umask_etc_bashrc: Ensure the Default Bash Umask is Set Correctly
- CCE-88580-6
var_accounts_user_umask = 077

RHEL-10-400320: RHEL 10 must define default permissions for the c shell.

Description: None

Levels:

medium

Automated: yes

Selections:

accounts_umask_etc_csh_cshrc: Ensure the Default C Shell Umask is Set Correctly
- CCE-90597-6
var_accounts_user_umask = 077

RHEL-10-400325: RHEL 10 must define default permissions for all authenticated users in such a way that the user can read and modify only their own files.

Description: None

Levels:

medium

Automated: yes

Selections:

accounts_umask_etc_login_defs: Ensure the Default Umask is Set Correctly in login.defs
- CCE-89314-9
var_accounts_user_umask = 077

RHEL-10-400330: RHEL 10 must define default permissions for the system default profile.

Description: None

Levels:

medium

Automated: yes

Selections:

accounts_umask_etc_profile: Ensure the Default Umask is Set Correctly in /etc/profile
- CCE-87651-6
var_accounts_user_umask = 077

RHEL-10-400335: RHEL 10 must enforce that all local initialization files configured by systemd-tmpfiles have mode "0600" or less permissive.

Description: None

Levels:

medium

Automated: yes

Selections:

rootfiles_configured: Ensure rootfiles tmpfile.d is Configured Correctly
- CCE-86476-9

RHEL-10-400340: RHEL 10 must enforce mode "0600" or less permissive for Secure Shell (SSH) private host key files.

Description: None

Levels:

medium

Automated: yes

Selections:

file_permissions_sshd_private_key: Verify Permissions on SSH Server Private *_key Key Files
- CCE-88018-7

RHEL-10-400345: RHEL 10 must enforce "root" group ownership of the "/boot/grub2/grub.cfg" file.

Description: None

Levels:

medium

Automated: yes

Selections:

file_groupowner_grub2_cfg: Verify /boot/grub2/grub.cfg Group Ownership
- CCE-88691-1

RHEL-10-400350: RHEL 10 must enforce "root" ownership of the "/boot/grub2/grub.cfg" file.

Description: None

Levels:

medium

Automated: yes

Selections:

file_owner_grub2_cfg: Verify /boot/grub2/grub.cfg User Ownership
- CCE-89438-6

RHEL-10-400355: RHEL 10 must prevent device files from being interpreted on file systems that contain user home directories.

Description: None

Levels:

medium

Automated: yes

Selections:

mount_option_home_nodev: Add nodev Option to /home
- CCE-87344-8

RHEL-10-400360: RHEL 10 must prevent files with the "setuid" and "setgid" bit set from being executed on file systems that contain user home directories.

Description: None

Levels:

medium

Automated: yes

Selections:

mount_option_home_nosuid: Add nosuid Option to /home
- CCE-88987-3

RHEL-10-400365: RHEL 10 must prevent code from being executed on file systems that contain user home directories.

Description: None

Levels:

medium

Automated: yes

Selections:

mount_option_home_noexec: Add noexec Option to /home
- CCE-87810-8

RHEL-10-400400: RHEL 10 must mount "/var/log/audit" with the "nodev" option.

Description: None

Levels:

medium

Automated: yes

Selections:

mount_option_var_log_audit_nodev: Add nodev Option to /var/log/audit
- CCE-87220-0

RHEL-10-400405: RHEL 10 must mount "/var/log/audit" with the "noexec" option.

Description: None

Levels:

medium

Automated: yes

Selections:

mount_option_var_log_audit_noexec: Add noexec Option to /var/log/audit
- CCE-88957-6

RHEL-10-400410: RHEL 10 must mount "/var/log/audit" with the "nosuid" option.

Description: None

Levels:

medium

Automated: yes

Selections:

mount_option_var_log_audit_nosuid: Add nosuid Option to /var/log/audit
- CCE-90694-1

RHEL-10-400450: RHEL 10 must enforce a mode of "0755" or less permissive for audit tools.

Description: None

Levels:

medium

Automated: yes

Selections:

file_audit_tools_permissions: Audit Tools Must Have a Mode of 0755 or Less Permissive
- CCE-86578-2

RHEL-10-400500: RHEL 10 must prohibit local initialization files from executing world-writable programs.

Description: None

Levels:

medium

Automated: yes

Selections:

accounts_user_dot_no_world_writable_programs: User Initialization Files Must Not Run World-Writable Programs
- CCE-90449-0

RHEL-10-500000: RHEL 10 must enable the systemd-journald service.

Description: None

Levels:

medium

Automated: yes

Selections:

service_systemd-journald_enabled: Enable systemd-journald Service
- CCE-89396-6

RHEL-10-500005: RHEL 10 must enable auditing of processes that start prior to the audit daemon.

Description: None

Levels:

medium

Automated: yes

Selections:

grub2_audit_argument: Enable Auditing for Processes Which Start Prior to the Audit Daemon
- CCE-88376-9

RHEL-10-500010: RHEL 10 must audit local events.

Description: None

Levels:

medium

Automated: yes

Selections:

auditd_local_events: Include Local Events in Audit Logs
- CCE-88064-1

RHEL-10-500015: RHEL 10 must write audit records to disk.

Description: None

Levels:

medium

Automated: yes

Selections:

auditd_write_logs: Write Audit Logs to the Disk
- CCE-88724-0

RHEL-10-500020: RHEL 10 must log username information when unsuccessful login attempts occur.

Description: None

Levels:

medium

Automated: yes

Selections:

accounts_passwords_pam_faillock_audit: Account Lockouts Must Be Logged
- CCE-90730-3

RHEL-10-500025: RHEL 10 must allow only the information system security manager (ISSM) (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited.

Description: None

Levels:

medium

Automated: yes

Selections:

file_permissions_etc_audit_auditd: Verify Permissions on /etc/audit/auditd.conf
- CCE-89306-5
file_permissions_etc_audit_rulesd: Verify Permissions on /etc/audit/rules.d/*.rules
- CCE-89313-1

RHEL-10-500030: RHEL 10 must allocate an "audit_backlog_limit" of sufficient size to capture processes that start prior to the audit daemon.

Description: None

Levels:

medium

Automated: yes

Selections:

grub2_audit_backlog_limit_argument: Extend Audit Backlog Limit for the Audit Daemon
- CCE-88192-0
var_audit_backlog_limit = 8192

RHEL-10-500035: RHEL 10 must take appropriate action when a critical audit processing failure occurs.

Description: None

Levels:

medium

Automated: yes

Selections:

audit_rules_system_shutdown: Shutdown System When Auditing Failures Occur
- CCE-87352-1
var_audit_failure_mode = panic

RHEL-10-500040: RHEL 10 must take action when allocated audit record storage volume reaches 75 percent of the audit record storage capacity.

Description: None

Levels:

medium

Automated: yes

Selections:

auditd_data_retention_space_left_percentage: Configure auditd space_left on Low Disk Space
- CCE-88619-2
var_auditd_space_left_percentage = 25pc

RHEL-10-500045: RHEL 10 must label all off-loaded audit logs before sending them to the central log server.

Description: None

Levels:

medium

Automated: yes

Selections:

auditd_name_format: Set type of computer node name logging in audit logs
- CCE-87429-7
var_auditd_name_format = stig

RHEL-10-500100: RHEL 10 must allocate audit record storage capacity to store at least one week's worth of audit records.

Description: None

Levels:

low

Automated: yes

Selections:

auditd_audispd_configure_sufficiently_large_partition: Configure a Sufficiently Large Partition for Audit Logs
- CCE-87194-7

RHEL-10-500105: RHEL 10 must take action when allocated audit record storage volume reaches 95 percent of the audit record storage capacity.

Description: None

Levels:

medium

Automated: yes

Selections:

auditd_data_retention_admin_space_left_percentage: Configure auditd admin_space_left on Low Disk Space
- CCE-88585-5
var_auditd_admin_space_left_percentage = 5pc

RHEL-10-500110: RHEL 10 must take action when allocated audit record storage volume reaches 95 percent of the repository maximum audit record storage capacity.

Description: None

Levels:

medium

Automated: yes

Selections:

auditd_data_retention_admin_space_left_action: Configure auditd admin_space_left Action on Low Disk Space
- CCE-89040-0
var_auditd_admin_space_left_action = single

RHEL-10-500115: RHEL 10 must take appropriate action when the internal event queue is full.

Description: None

Levels:

medium

Automated: yes

Selections:

auditd_overflow_action: Appropriate Action Must be Setup When the Internal Audit Event Queue is Full
- CCE-87003-0

RHEL-10-500120: RHEL 10 must produce audit records containing information to establish the identity of any individual or process associated with the event.

Description: None

Levels:

medium

Automated: yes

Selections:

auditd_log_format: Resolve information before writing to audit logs
- CCE-88921-2

RHEL-10-500125: RHEL 10 must periodically flush audit records to disk to ensure that audit records are not lost.

Description: None

Levels:

medium

Automated: yes

Selections:

auditd_freq: Set number of records to cause an explicit flush to audit logs
- CCE-87482-6
var_auditd_freq = 100

RHEL-10-500205: RHEL 10 must notify the system administrator (SA) and information system security officer (ISSO) (at a minimum) when allocated audit record storage volume 75 percent utilization.

Description: None

Levels:

medium

Automated: yes

Selections:

auditd_data_retention_space_left_action: Configure auditd space_left Action on Low Disk Space
- CCE-88897-4
var_auditd_space_left_action = email

RHEL-10-500210: RHEL 10 must notify the system administrator (SA) and/or information system security officer (ISSO) (at a minimum) of an audit processing failure.

Description: None

Levels:

medium

Automated: yes

Selections:

auditd_data_retention_action_mail_acct: Configure auditd mail_acct Action on Low Disk Space
- CCE-89081-4
var_auditd_action_mail_acct = root

RHEL-10-500215: RHEL 10 must log Secure Shell (SSH) connection attempts and failures to the server.

Description: None

Levels:

medium

Automated: yes

Selections:

sshd_set_loglevel_verbose: Set SSH Daemon LogLevel to VERBOSE
- CCE-86241-7

RHEL-10-500300: RHEL 10 must generate audit records for successful and unsuccessful uses of the "execve" system call.

Description: None

Levels:

medium

Automated: yes

Selections:

audit_rules_suid_privilege_function: Record Events When Privileged Executables Are Run
- CCE-88933-7

RHEL-10-500310: RHEL 10 must generate audit records for successful and unsuccessful uses of the "setxattr", "fsetxattr", "lsetxattr", "removexattr", "fremovexattr", and "lremovexattr" system calls.

Description: None

Levels:

medium

Automated: yes

Selections:

audit_rules_dac_modification_fremovexattr: Record Events that Modify the System's Discretionary Access Controls - fremovexattr
- CCE-88352-0
audit_rules_dac_modification_fsetxattr: Record Events that Modify the System's Discretionary Access Controls - fsetxattr
- CCE-89370-1
audit_rules_dac_modification_lremovexattr: Record Events that Modify the System's Discretionary Access Controls - lremovexattr
- CCE-90100-9
audit_rules_dac_modification_lsetxattr: Record Events that Modify the System's Discretionary Access Controls - lsetxattr
- CCE-88052-6
audit_rules_dac_modification_removexattr: Record Events that Modify the System's Discretionary Access Controls - removexattr
- CCE-89677-9
audit_rules_dac_modification_setxattr: Record Events that Modify the System's Discretionary Access Controls - setxattr
- CCE-89571-4

RHEL-10-500320: RHEL 10 must generate audit records for successful and unsuccessful uses of "umount" system calls.

Description: None

Levels:

medium

Automated: yes

Selections:

audit_rules_privileged_commands_umount: Ensure auditd Collects Information on the Use of Privileged Commands - umount
- CCE-86962-8

RHEL-10-500330: RHEL 10 must generate audit records for successful and unsuccessful uses of the "chacl" command.

Description: None

Levels:

medium

Automated: yes

Selections:

audit_rules_execution_chacl: Record Any Attempts to Run chacl
- CCE-88467-6

RHEL-10-500340: RHEL 10 must generate audit records for successful and unsuccessful uses of the "setfacl" command.

Description: None

Levels:

medium

Automated: yes

Selections:

audit_rules_execution_setfacl: Record Any Attempts to Run setfacl
- CCE-87662-3

RHEL-10-500350: RHEL 10 must generate audit records for successful and unsuccessful uses of the "chcon" command.

Description: None

Levels:

medium

Automated: yes

Selections:

audit_rules_execution_chcon: Record Any Attempts to Run chcon
- CCE-87762-1

RHEL-10-500360: RHEL 10 must generate audit records for successful and unsuccessful uses of the "semanage" command.

Description: None

Levels:

medium

Automated: yes

Selections:

audit_rules_execution_semanage: Record Any Attempts to Run semanage
- CCE-89541-7

RHEL-10-500370: RHEL 10 must generate audit records for successful and unsuccessful uses of the "setfiles" command.

Description: None

Levels:

medium

Automated: yes

Selections:

audit_rules_execution_setfiles: Record Any Attempts to Run setfiles
- CCE-88818-0

RHEL-10-500380: RHEL 10 must generate audit records for successful and unsuccessful uses of the "setsebool" command.

Description: None

Levels:

medium

Automated: yes

Selections:

audit_rules_execution_setsebool: Record Any Attempts to Run setsebool
- CCE-87741-5

RHEL-10-500390: RHEL 10 must generate audit records for successful and unsuccessful uses of the "truncate", "ftruncate", "creat", "open", "openat", and "open_by_handle_at" system calls.

Description: None

Levels:

medium

Automated: yes

Selections:

audit_rules_unsuccessful_file_modification_creat: Record Unsuccessful Access Attempts to Files - creat
- CCE-87052-7
audit_rules_unsuccessful_file_modification_ftruncate: Record Unsuccessful Access Attempts to Files - ftruncate
- CCE-86729-1
audit_rules_unsuccessful_file_modification_open: Record Unsuccessful Access Attempts to Files - open
- CCE-87349-7
audit_rules_unsuccessful_file_modification_open_by_handle_at: Record Unsuccessful Access Attempts to Files - open_by_handle_at
- CCE-90251-0
audit_rules_unsuccessful_file_modification_openat: Record Unsuccessful Access Attempts to Files - openat
- CCE-89291-9
audit_rules_unsuccessful_file_modification_truncate: Record Unsuccessful Access Attempts to Files - truncate
- CCE-89869-2

RHEL-10-500400: RHEL 10 must generate audit records for successful and unsuccessful uses of the "delete_module" system call.

Description: None

Levels:

medium

Automated: yes

Selections:

audit_rules_kernel_module_loading_delete: Ensure auditd Collects Information on Kernel Module Unloading - delete_module
- CCE-89982-3

RHEL-10-500410: RHEL 10 must generate audit records for successful and unsuccessful uses of the "init_module" and "finit_module" system calls.

Description: None

Levels:

medium

Automated: yes

Selections:

audit_rules_kernel_module_loading_finit: Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- CCE-88638-2
audit_rules_kernel_module_loading_init: Ensure auditd Collects Information on Kernel Module Loading - init_module
- CCE-90172-8

RHEL-10-500420: RHEL 10 must generate audit records for successful and unsuccessful uses of the "chage" command.

Description: None

Levels:

medium

Automated: yes

Selections:

audit_rules_privileged_commands_chage: Ensure auditd Collects Information on the Use of Privileged Commands - chage
- CCE-90143-9

RHEL-10-500430: RHEL 10 must generate audit records for successful and unsuccessful uses of the "chsh" command.

Description: None

Levels:

medium

Automated: yes

Selections:

audit_rules_privileged_commands_chsh: Ensure auditd Collects Information on the Use of Privileged Commands - chsh
- CCE-89551-6

RHEL-10-500440: RHEL 10 must generate audit records for successful and unsuccessful uses of the "crontab" command.

Description: None

Levels:

medium

Automated: yes

Selections:

audit_rules_privileged_commands_crontab: Ensure auditd Collects Information on the Use of Privileged Commands - crontab
- CCE-89029-3

RHEL-10-500450: RHEL 10 must generate audit records for successful and unsuccessful uses of the "gpasswd" command.

Description: None

Levels:

medium

Automated: yes

Selections:

audit_rules_privileged_commands_gpasswd: Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd
- CCE-89403-0

RHEL-10-500460: RHEL 10 must generate audit records for successful and unsuccessful uses of the "kmod" command.

Description: None

Levels:

medium

Automated: yes

Selections:

audit_rules_privileged_commands_kmod: Ensure auditd Collects Information on the Use of Privileged Commands - kmod
- CCE-86727-5

RHEL-10-500470: RHEL 10 must generate audit records for successful and unsuccessful uses of the "newgrp" command.

Description: None

Levels:

medium

Automated: yes

Selections:

audit_rules_privileged_commands_newgrp: Ensure auditd Collects Information on the Use of Privileged Commands - newgrp
- CCE-88752-1

RHEL-10-500480: RHEL 10 must generate audit records for successful and unsuccessful uses of the "pam_timestamp_check" command.

Description: None

Levels:

medium

Automated: yes

Selections:

audit_rules_privileged_commands_pam_timestamp_check: Ensure auditd Collects Information on the Use of Privileged Commands - pam_timestamp_check
- CCE-89521-9

RHEL-10-500490: RHEL 10 must generate audit records for successful and unsuccessful uses of the "passwd" command.

Description: None

Levels:

medium

Automated: yes

Selections:

audit_rules_privileged_commands_passwd: Ensure auditd Collects Information on the Use of Privileged Commands - passwd
- CCE-89215-8

RHEL-10-500500: RHEL 10 must generate audit records for successful and unsuccessful uses of the "postdrop" command.

Description: None

Levels:

medium

Automated: yes

Selections:

audit_rules_privileged_commands_postdrop: Ensure auditd Collects Information on the Use of Privileged Commands - postdrop
- CCE-89394-1

RHEL-10-500510: RHEL 10 must generate audit records for successful and unsuccessful uses of the "postqueue" command.

Description: None

Levels:

medium

Automated: yes

Selections:

audit_rules_privileged_commands_postqueue: Ensure auditd Collects Information on the Use of Privileged Commands - postqueue
- CCE-87927-0

RHEL-10-500520: RHEL 10 must generate audit records for successful and unsuccessful uses of the ssh-agent command.

Description: None

Levels:

medium

Automated: yes

Selections:

audit_rules_privileged_commands_ssh_agent: Record Any Attempts to Run ssh-agent
- CCE-90081-1

RHEL-10-500530: RHEL 10 must generate audit records for successful and unsuccessful uses of the "ssh-keysign" command.

Description: None

Levels:

medium

Automated: yes

Selections:

audit_rules_privileged_commands_ssh_keysign: Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign
- CCE-88874-3

RHEL-10-500540: RHEL 10 must generate audit records for successful and unsuccessful uses of the "su" command.

Description: None

Levels:

medium

Automated: yes

Selections:

audit_rules_privileged_commands_su: Ensure auditd Collects Information on the Use of Privileged Commands - su
- CCE-89587-0

RHEL-10-500550: RHEL 10 must generate audit records for successful and unsuccessful uses of the "sudo" command.

Description: None

Levels:

medium

Automated: yes

Selections:

audit_rules_privileged_commands_sudo: Ensure auditd Collects Information on the Use of Privileged Commands - sudo
- CCE-89698-5

RHEL-10-500560: RHEL 10 must generate audit records for successful and unsuccessful uses of the "sudoedit" command.

Description: None

Levels:

medium

Automated: yes

Selections:

audit_rules_privileged_commands_sudoedit: Ensure auditd Collects Information on the Use of Privileged Commands - sudoedit
- CCE-89601-9

RHEL-10-500570: RHEL 10 must generate audit records for successful and unsuccessful uses of the "unix_chkpwd" command.

Description: None

Levels:

medium

Automated: yes

Selections:

audit_rules_privileged_commands_unix_chkpwd: Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
- CCE-89529-2

RHEL-10-500580: RHEL 10 must generate audit records for successful and unsuccessful uses of the "unix_update" command.

Description: None

Levels:

medium

Automated: yes

Selections:

audit_rules_privileged_commands_unix_update: Ensure auditd Collects Information on the Use of Privileged Commands - unix_update
- CCE-86620-2

RHEL-10-500590: RHEL 10 must generate audit records for successful and unsuccessful uses of the "userhelper" command.

Description: None

Levels:

medium

Automated: yes

Selections:

audit_rules_privileged_commands_userhelper: Ensure auditd Collects Information on the Use of Privileged Commands - userhelper
- CCE-90652-9

RHEL-10-500600: RHEL 10 must generate audit records for successful and unsuccessful uses of the "usermod" command.

Description: None

Levels:

medium

Automated: yes

Selections:

audit_rules_privileged_commands_usermod: Ensure auditd Collects Information on the Use of Privileged Commands - usermod
- CCE-87659-9

RHEL-10-500610: RHEL 10 must generate audit records for successful and unsuccessful uses of the "mount" command.

Description: None

Levels:

medium

Automated: yes

Selections:

audit_rules_media_export: Ensure auditd Collects Information on Exporting to Media (successful)
- CCE-86590-7

RHEL-10-500620: RHEL 10 must generate audit records for successful and unsuccessful uses of the "init" command.

Description: None

Levels:

medium

Automated: yes

Selections:

audit_privileged_commands_init: Ensure auditd Collects Information on the Use of Privileged Commands - init
- CCE-88214-2

RHEL-10-500630: RHEL 10 must generate audit records for successful and unsuccessful uses of the "poweroff" command.

Description: None

Levels:

medium

Automated: yes

Selections:

audit_privileged_commands_poweroff: Ensure auditd Collects Information on the Use of Privileged Commands - poweroff
- CCE-86744-0

RHEL-10-500640: RHEL 10 must generate audit records for successful and unsuccessful uses of the "reboot" command.

Description: None

Levels:

medium

Automated: yes

Selections:

audit_privileged_commands_reboot: Ensure auditd Collects Information on the Use of Privileged Commands - reboot
- CCE-88843-8

RHEL-10-500650: RHEL 10 must generate audit records for successful and unsuccessful uses of the shutdown command.

Description: None

Levels:

medium

Automated: yes

Selections:

audit_privileged_commands_shutdown: Ensure auditd Collects Information on the Use of Privileged Commands - shutdown
- CCE-88922-0

RHEL-10-500660: RHEL 10 must generate audit records for successful and unsuccessful uses of the "umount" system call.

Description: None

Levels:

medium

Automated: yes

Selections:

audit_rules_dac_modification_umount: Record Events that Modify the System's Discretionary Access Controls - umount
- CCE-87601-1

RHEL-10-500670: RHEL 10 must generate audit records for successful and unsuccessful uses of the "umount2" system call.

Description: None

Levels:

medium

Automated: yes

Selections:

audit_rules_dac_modification_umount2: Record Events that Modify the System's Discretionary Access Controls - umount2
- CCE-89822-1

RHEL-10-500680: RHEL 10 must generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/sudoers".

Description: None

Levels:

medium

Automated: yes

Selections:

audit_rules_sudoers: Ensure auditd Collects System Administrator Actions - /etc/sudoers
- CCE-88688-7

RHEL-10-500690: RHEL 10 must generate audit records for all account creations, modifications, disabling, and termination events that affect the "/etc/sudoers.d/" directory.

Description: None

Levels:

medium

Automated: yes

Selections:

audit_rules_sudoers_d: Ensure auditd Collects System Administrator Actions - /etc/sudoers.d/
- CCE-89020-2

RHEL-10-500700: RHEL 10 must generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/group".

Description: None

Levels:

medium

Automated: yes

Selections:

audit_rules_usergroup_modification_group: Record Events that Modify User/Group Information - /etc/group
- CCE-87111-1

RHEL-10-500710: RHEL 10 must generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/gshadow".

Description: None

Levels:

medium

Automated: yes

Selections:

audit_rules_usergroup_modification_gshadow: Record Events that Modify User/Group Information - /etc/gshadow
- CCE-87736-5

RHEL-10-500720: RHEL 10 must generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/opasswd".

Description: None

Levels:

medium

Automated: yes

Selections:

audit_rules_usergroup_modification_opasswd: Record Events that Modify User/Group Information - /etc/security/opasswd
- CCE-90664-4

RHEL-10-500730: RHEL 10 must generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/passwd".

Description: None

Levels:

medium

Automated: yes

Selections:

audit_rules_usergroup_modification_passwd: Record Events that Modify User/Group Information - /etc/passwd
- CCE-88286-0

RHEL-10-500740: RHEL 10 must generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/shadow".

Description: None

Levels:

medium

Automated: yes

Selections:

audit_rules_usergroup_modification_shadow: Record Events that Modify User/Group Information - /etc/shadow
- CCE-88637-4

RHEL-10-500750: RHEL 10 must generate audit records for all account creations, modifications, disabling, and termination events that affect "/var/log/faillock".

Description: None

Levels:

medium

Automated: yes

Selections:

audit_rules_login_events_faillock: Record Attempts to Alter Logon and Logout Events - faillock
- CCE-89479-0

RHEL-10-500760: RHEL 10 must generate audit records for all account creations, modifications, disabling, and termination events that affect "/var/log/lastlog".

Description: None

Levels:

medium

Automated: yes

Selections:

audit_rules_login_events_lastlog: Record Attempts to Alter Logon and Logout Events - lastlog
- CCE-88938-6

RHEL-10-500780: RHEL 10 must generate audit records for all uses of the "chmod", "fchmod", "fchmodat", and "fchmodat2" syscalls.

Description: None

Levels:

medium

Automated: yes

Selections:

audit_rules_dac_modification_chmod: Record Events that Modify the System's Discretionary Access Controls - chmod
- CCE-90466-4
audit_rules_dac_modification_fchmod: Record Events that Modify the System's Discretionary Access Controls - fchmod
- CCE-88200-1
audit_rules_dac_modification_fchmodat: Record Events that Modify the System's Discretionary Access Controls - fchmodat
- CCE-89356-0
audit_rules_dac_modification_fchmodat2: Record Events that Modify the System's Discretionary Access Controls - fchmodat2
- CCE-86535-2

RHEL-10-500790: RHEL 10 must generate audit records for all uses of the "chown", "fchown", "fchownat", and "lchown" syscalls.

Description: None

Levels:

medium

Automated: yes

Selections:

audit_rules_dac_modification_chown: Record Events that Modify the System's Discretionary Access Controls - chown
- CCE-89540-9
audit_rules_dac_modification_fchown: Record Events that Modify the System's Discretionary Access Controls - fchown
- CCE-90685-9
audit_rules_dac_modification_fchownat: Record Events that Modify the System's Discretionary Access Controls - fchownat
- CCE-90651-1
audit_rules_dac_modification_lchown: Record Events that Modify the System's Discretionary Access Controls - lchown
- CCE-88243-1

RHEL-10-500810: RHEL 10 must generate audit records for all uses of the "rename", "unlink", "rmdir", "renameat", "renameat2", and "unlinkat" system calls.

Description: None

Levels:

medium

Automated: yes

Selections:

audit_rules_file_deletion_events_rename: Ensure auditd Collects File Deletion Events by User - rename
- CCE-90733-7
audit_rules_file_deletion_events_renameat: Ensure auditd Collects File Deletion Events by User - renameat
- CCE-90237-9
audit_rules_file_deletion_events_renameat2: Ensure auditd Collects File Deletion Events by User - renameat2
- CCE-86188-0
audit_rules_file_deletion_events_rmdir: Ensure auditd Collects File Deletion Events by User - rmdir
- CCE-88762-0
audit_rules_file_deletion_events_unlink: Ensure auditd Collects File Deletion Events by User - unlink
- CCE-86737-4
audit_rules_file_deletion_events_unlinkat: Ensure auditd Collects File Deletion Events by User - unlinkat
- CCE-87813-2

RHEL-10-600000: RHEL 10 must require a boot loader superuser password.

Description: None

Levels:

medium

Automated: yes

Selections:

grub2_password: Set Boot Loader Password in grub2
- CCE-87614-4

RHEL-10-600010: RHEL 10 must require a unique superusers name upon booting into single-user and maintenance modes.

Description: None

Levels:

medium

Automated: yes

Selections:

grub2_admin_username: Set the Boot Loader Admin Username to a Non-Default Value
- CCE-89960-9

RHEL-10-600020: RHEL 10 must not assign an interactive login shell for system accounts.

Description: None

Levels:

medium

Automated: yes

Selections:

no_shelllogin_for_systemaccounts: Ensure that System Accounts Do Not Run a Shell Upon Login
- CCE-87448-7

RHEL-10-600100: RHEL 10 must, for new users or password changes, have a 60-day maximum password lifetime restriction for user account passwords in "/etc/login.defs".

Description: None

Levels:

medium

Automated: yes

Selections:

accounts_maximum_age_login_defs: Set Password Maximum Age
- CCE-87961-9
var_accounts_maximum_age_login_defs = 60

RHEL-10-600110: RHEL 10 must, for user account passwords, have a 60-day maximum password lifetime restriction.

Description: None

Levels:

medium

Automated: yes

Selections:

accounts_password_set_max_life_existing: Set Existing Passwords Maximum Age
- CCE-87137-6
var_accounts_maximum_age_login_defs = 60

RHEL-10-600120: RHEL 10 must assign a home directory for local interactive user accounts upon creation.

Description: None

Levels:

medium

Automated: yes

Selections:

accounts_have_homedir_login_defs: Ensure Home Directories are Created for New Users
- CCE-88604-4

RHEL-10-600130: RHEL 10 must not allow duplicate user IDs (UIDs) to exist for interactive users.

Description: None

Levels:

medium

Automated: yes

Selections:

account_unique_id: Ensure All Accounts on the System Have Unique User IDs
- CCE-89811-4

RHEL-10-600140: RHEL 10 must automatically expire temporary accounts within 72 hours.

Description: None

Levels:

medium

Automated: yes

Selections:

account_temp_expire_date: Assign Expiration Date to Temporary Accounts
- CCE-89470-9

RHEL-10-600150: RHEL 10 must assign a primary group to all interactive users.

Description: None

Levels:

medium

Automated: yes

Selections:

gid_passwd_group_same: All GIDs referenced in /etc/passwd must be defined in /etc/group
- CCE-87466-9

RHEL-10-600160: RHEL 10 must disable account identifiers (individuals, groups, roles, and devices) after 35 days of inactivity.

Description: None

Levels:

medium

Automated: yes

Selections:

account_disable_post_pw_expiration: Set Account Expiration Following Inactivity
- CCE-88966-7
var_account_disable_post_pw_expiration = 35

RHEL-10-600170: RHEL 10 must be configured so that all local interactive user initialization file executable search path statements do not contain statements that will reference a working directory other than user home directories.

Description: None

Levels:

medium

Automated: yes

Selections:

accounts_user_home_paths_only: Ensure that Users Path Contains Only Local Directories
- CCE-88926-1

RHEL-10-600180: RHEL 10 must assign a home directory to all local interactive users in the "/etc/passwd" file.

Description: None

Levels:

medium

Automated: yes

Selections:

accounts_user_interactive_home_directory_defined: All Interactive Users Must Have A Home Directory Defined
- CCE-89933-6

RHEL-10-600190: RHEL 10 must ensure that all local interactive user home directories defined in the "/etc/passwd" file must exist.

Description: None

Levels:

medium

Automated: yes

Selections:

accounts_user_interactive_home_directory_exists: All Interactive Users Home Directories Must Exist
- CCE-86659-0

RHEL-10-600200: RHEL 10 must enforce a delay of at least four seconds between login prompts following a failed login attempt.

Description: None

Levels:

medium

Automated: yes

Selections:

accounts_logon_fail_delay: Ensure the Logon Failure Delay is Set Correctly in login.defs
- CCE-86822-4
var_accounts_fail_delay = 4

RHEL-10-600210: RHEL 10 must enforce a 24-hours minimum password lifetime restriction for passwords for new users or password changes in "/etc/login.defs".

Description: None

Levels:

medium

Automated: yes

Selections:

accounts_minimum_age_login_defs: Set Password Minimum Age
- CCE-89307-3
var_accounts_minimum_age_login_defs = 1

RHEL-10-600220: RHEL 10 must enforce that passwords be created with a minimum of 15 characters.

Description: None

Levels:

medium

Automated: yes

Selections:

accounts_password_pam_minlen: Ensure PAM Enforces Password Requirements - Minimum Length
- CCE-87852-0
var_password_pam_minlen = 15

RHEL-10-600230: RHEL 10 must enforce password complexity by requiring at least one special character to be used.

Description: None

Levels:

medium

Automated: yes

Selections:

accounts_password_pam_ocredit: Ensure PAM Enforces Password Requirements - Minimum Special Characters
- CCE-89297-6
var_password_pam_ocredit = 1

RHEL-10-600240: RHEL 10 must enforce password complexity by requiring that at least one lowercase character be used.

Description: None

Levels:

medium

Automated: yes

Selections:

accounts_password_pam_lcredit: Ensure PAM Enforces Password Requirements - Minimum Lowercase Characters
- CCE-90276-7
var_password_pam_lcredit = 1

RHEL-10-600250: RHEL 10 must enforce password complexity by requiring that at least one uppercase character be used.

Description: None

Levels:

medium

Automated: yes

Selections:

accounts_password_pam_ucredit: Ensure PAM Enforces Password Requirements - Minimum Uppercase Characters
- CCE-89959-1
var_password_pam_ucredit = 1

RHEL-10-600260: RHEL 10 must require the change of at least eight characters when passwords are changed.

Description: None

Levels:

medium

Automated: yes

Selections:

accounts_password_pam_difok: Ensure PAM Enforces Password Requirements - Minimum Different Characters
- CCE-90363-3
var_password_pam_difok = 8

RHEL-10-600270: RHEL 10 must enforce that passwords have a 24 hours/1 day minimum lifetime restriction in "/etc/shadow".

Description: None

Levels:

medium

Automated: yes

Selections:

accounts_password_set_min_life_existing: Set Existing Passwords Minimum Age
- CCE-87953-6
var_accounts_minimum_age_login_defs = 1

RHEL-10-600280: RHEL 10 must require the maximum number of repeating characters of the same character class to be limited to four when passwords are changed.

Description: None

Levels:

medium

Automated: yes

Selections:

accounts_password_pam_maxclassrepeat: Ensure PAM Enforces Password Requirements - Maximum Consecutive Repeating Characters from Same Character Class
- CCE-88844-6
var_password_pam_maxclassrepeat = 4

RHEL-10-600290: RHEL 10 must require that the maximum number of repeating characters be limited to three when passwords are changed.

Description: None

Levels:

medium

Automated: yes

Selections:

accounts_password_pam_maxrepeat: Set Password Maximum Consecutive Repeating Characters
- CCE-88015-3
var_password_pam_maxrepeat = 3

RHEL-10-600300: RHEL 10 must require the change of at least four character classes when passwords are changed.

Description: None

Levels:

medium

Automated: yes

Selections:

accounts_password_pam_minclass: Ensure PAM Enforces Password Requirements - Minimum Different Categories
- CCE-87289-5
var_password_pam_minclass = 4

RHEL-10-600310: RHEL 10 must enforce password complexity by requiring that at least one numeric character be used.

Description: None

Levels:

medium

Automated: yes

Selections:

accounts_password_pam_dcredit: Ensure PAM Enforces Password Requirements - Minimum Digit Characters
- CCE-89089-7
var_password_pam_dcredit = 1

RHEL-10-600320: RHEL 10 must prevent the use of dictionary words for passwords.

Description: None

Levels:

medium

Automated: yes

Selections:

accounts_password_pam_dictcheck: Ensure PAM Enforces Password Requirements - Prevent the Use of Dictionary Words
- CCE-88171-4

RHEL-10-600400: RHEL 10 must allow only the root account to have unrestricted access to the system.

Description: None

Levels:

medium

Automated: yes

Selections:

accounts_no_uid_except_zero: Verify Only Root Has UID 0
- CCE-87552-6

RHEL-10-600405: RHEL 10 must enforce password complexity rules for the "root" account.

Description: None

Levels:

medium

Automated: yes

Selections:

accounts_password_pam_enforce_root: Ensure PAM Enforces Password Requirements - Enforce for root User
- CCE-90134-8

RHEL-10-600410: RHEL 10 must automatically lock an account when three unsuccessful login attempts occur.

Description: None

Levels:

medium

Automated: yes

Selections:

accounts_passwords_pam_faillock_deny: Lock Accounts After Failed Password Attempts
- CCE-87388-5
var_accounts_passwords_pam_faillock_deny = 3

RHEL-10-600415: RHEL 10 must automatically lock the root account until the root account is released by an administrator when three unsuccessful login attempts occur during a 15-minute time period.

Description: None

Levels:

medium

Automated: yes

Selections:

accounts_passwords_pam_faillock_deny_root: Configure the root Account for Failed Password Attempts
- CCE-87975-9

RHEL-10-600420: RHEL 10 must automatically lock an account when three unsuccessful login attempts occur during a 15-minute time period.

Description: None

Levels:

medium

Automated: yes

Selections:

accounts_passwords_pam_faillock_interval: Set Interval For Counting Failed Password Attempts
- CCE-86672-3
var_accounts_passwords_pam_faillock_fail_interval = 900

RHEL-10-600425: RHEL 10 must maintain an account lock until the locked account is released by an administrator.

Description: None

Levels:

medium

Automated: yes

Selections:

accounts_passwords_pam_faillock_unlock_time: Set Lockout Time for Failed Password Attempts
- CCE-89250-5
var_accounts_passwords_pam_faillock_unlock_time = never

RHEL-10-600430: RHEL 10 must ensure account lockouts persist.

Description: None

Levels:

medium

Automated: yes

Selections:

accounts_passwords_pam_faillock_dir: Lock Accounts Must Persist
- CCE-90182-7

RHEL-10-600450: RHEL 10 must not have unauthorized accounts.

Description: None

Levels:

medium

Automated: yes

Selections:

accounts_authorized_local_users: Only Authorized Local User Accounts Exist on Operating System
- CCE-88135-9
var_accounts_authorized_local_users_regex = rhel9

RHEL-10-600455: RHEL 10 must not allow blank or null passwords.

Description: None

Levels:

medium

Automated: yes

Selections:

no_empty_passwords: Prevent Login to Accounts With Empty Password
- CCE-86640-0

RHEL-10-600460: RHEL 10 must not have accounts configured with blank or null passwords.

Description: None

Levels:

medium

Automated: yes

Selections:

no_empty_passwords_etc_shadow: Ensure There Are No Accounts With Blank or Null Passwords
- CCE-90491-2

RHEL-10-600470: RHEL 10 must have a unique group ID (GID) for each group in "/etc/group".

Description: None

Levels:

medium

Automated: yes

Selections:

group_unique_id: Ensure All Groups on the System Have Unique Group ID
- CCE-86908-1

RHEL-10-600475: RHEL 10 must limit the number of concurrent sessions to 10 for all accounts and/or account types.

Description: None

Levels:

low

Automated: yes

Selections:

accounts_max_concurrent_login_sessions: Limit the Number of Concurrent Login Sessions Allowed Per User
- CCE-90751-9
var_accounts_max_concurrent_login_sessions = 10

RHEL-10-600485: RHEL 10 must ensure the password complexity module in the system-auth file is configured for three or fewer retries.

Description: None

Levels:

medium

Automated: yes

Selections:

accounts_password_pam_pwquality_retry: Ensure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session in /etc/security/pwquality.conf
- CCE-90663-6
var_password_pam_retry = 3

RHEL-10-600500: RHEL 10 must restrict the use of the "su" command.

Description: None

Levels:

medium

Automated: yes

Selections:

use_pam_wheel_for_su: Enforce usage of pam_wheel for su authentication
- CCE-90595-0

RHEL-10-600510: RHEL 10 must be configured to not bypass password requirements for privilege escalation.

Description: None

Levels:

medium

Automated: yes

Selections:

disallow_bypass_password_sudo: Disallow Configuration to Bypass Password Requirements for Privilege Escalation
- CCE-89298-4

RHEL-10-600520: RHEL 10 must restrict privilege elevation to authorized personnel.

Description: None

Levels:

medium

Automated: yes

Selections:

sudo_restrict_privilege_elevation_to_authorized: The operating system must restrict privilege elevation to authorized personnel
- CCE-87421-4

RHEL-10-600530: RHEL 10 must require users to reauthenticate for privilege escalation.

Description: None

Levels:

medium

Automated: yes

Selections:

sudo_remove_no_authenticate: Ensure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- CCE-88892-5

RHEL-10-600540: RHEL 10 must require reauthentication when using the "sudo" command.

Description: None

Levels:

medium

Automated: yes

Selections:

sudo_require_reauthentication: Require Re-Authentication When Using the sudo Command
- CCE-88136-7
var_sudo_timestamp_timeout = always_prompt

RHEL-10-600550: RHEL 10 must use the invoking user's password for privilege escalation when using "sudo".

Description: None

Levels:

medium

Automated: yes

Selections:

sudoers_validate_passwd: Ensure invoking users password for privilege escalation when using sudo
- CCE-88855-2

RHEL-10-600560: RHEL 10 must require users to provide a password for privilege escalation.

Description: None

Levels:

high

Automated: yes

Selections:

sudo_remove_nopasswd: Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
- CCE-87015-4

RHEL-10-600600: RHEL 10 must configure the use of the pam_faillock.so module in the "/etc/pam.d/system-auth" file.

Description: None

Levels:

medium

Automated: yes

Selections:

account_password_pam_faillock_system_auth: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/system-auth File.
- CCE-88810-7

RHEL-10-600610: RHEL 10 must configure the use of the pam_faillock.so module in the "/etc/pam.d/password-auth" file.

Description: None

Levels:

medium

Automated: yes

Selections:

account_password_pam_faillock_password_auth: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/password-auth File.
- CCE-87657-3

RHEL-10-600620: RHEL 10 must ensure the password complexity module is enabled in the "password-auth" file.

Description: None

Levels:

medium

Automated: yes

Selections:

accounts_password_pam_pwquality_password_auth: Ensure PAM password complexity module is enabled in password-auth
- CCE-89505-2

RHEL-10-600630: RHEL 10 must ensure the password complexity module is enabled in the "system-auth" file.

Description: None

Levels:

medium

Automated: yes

Selections:

accounts_password_pam_pwquality_system_auth: Ensure PAM password complexity module is enabled in system-auth
- CCE-89362-8

RHEL-10-600640: RHEL 10 must enable the Pluggable Authentication Module (PAM) interface for SSHD.

Description: None

Levels:

high

Automated: yes

Selections:

sshd_enable_pam: Enable PAM
- CCE-87045-1

RHEL-10-600650: RHEL 10 must ensure that the pam_unix.so module is configured in the password-auth file to use a FIPS 140-3-approved cryptographic hashing algorithm for system authentication.

Description: None

Levels:

medium

Automated: yes

Selections:

set_password_hashing_algorithm_passwordauth: Set PAM Password Hashing Algorithm - password-auth
- CCE-88661-4
var_password_hashing_algorithm_pam = sha512

RHEL-10-600700: RHEL 10 must be configured to use a sufficient number of hashing rounds for the shadow password suite.

Description: None

Levels:

medium

Automated: yes

Selections:

accounts_password_pam_unix_rounds_system_auth: Set number of Password Hashing Rounds - system-auth
- CCE-90063-9
var_password_pam_unix_rounds = 100000

RHEL-10-600710: RHEL 10 must be configured to use a FIPS 140-3-approved cryptographic hashing algorithm for system authentication by ensuring that the pam_unix.so module is configured in the "system-auth" file.

Description: None

Levels:

medium

Automated: yes

Selections:

set_password_hashing_algorithm_systemauth: Set PAM Password Hashing Algorithm - system-auth
- CCE-88697-8
var_password_hashing_algorithm_pam = sha512

RHEL-10-600720: RHEL 10 must be configured so that password-auth uses a sufficient number of hashing rounds.

Description: None

Levels:

medium

Automated: yes

Selections:

accounts_password_pam_unix_rounds_password_auth: Set number of Password Hashing Rounds - password-auth
- CCE-88891-7
var_password_pam_unix_rounds = 100000

RHEL-10-600730: RHEL 10 must employ FIPS 140-3-approved cryptographic hashing algorithms for all stored passwords.

Description: None

Levels:

high

Automated: yes

Selections:

accounts_password_all_shadowed_sha512: Verify All Account Password Hashes are Shadowed with SHA512
- CCE-90070-4

RHEL-10-600740: RHEL 10 must be configured to use the shadow file to store only encrypted representations of passwords.

Description: None

Levels:

high

Automated: yes

Selections:

set_password_hashing_algorithm_logindefs: Set Password Hashing Algorithm in /etc/login.defs
- CCE-89508-6
var_password_hashing_algorithm = SHA512

RHEL-10-600750: RHEL 10 must be configured so that user and group account administration utilities are configured to store only encrypted representations of passwords.

Description: None

Levels:

high

Automated: yes

Selections:

set_password_hashing_algorithm_libuserconf: Set Password Hashing Algorithm in /etc/libuser.conf
- CCE-90325-2
var_password_hashing_algorithm_pam = sha512

RHEL-10-700010: RHEL 10 must display the Standard Mandatory DOD Notice and Consent Banner before granting local or remote access to the system via a Secure Shell (SSH) login.

Description: None

Levels:

medium

Automated: yes

Selections:

sshd_enable_warning_banner: Enable SSH Warning Banner
- CCE-86539-4

RHEL-10-700020: RHEL 10 must display the Standard Mandatory DOD Notice and Consent Banner before granting local or remote access to the system via a graphical user login.

Description: None

Levels:

medium

Automated: yes

Selections:

dconf_gnome_login_banner_text: Set the GNOME3 Login Warning Banner Text
- CCE-88901-4
dconf_login_banner_contents = dod_default
dconf_login_banner_text = dod_banners

RHEL-10-700030: RHEL 10 must prevent a user from overriding the banner-message-enable setting for the graphical user interface.

Description: None

Levels:

medium

Automated: yes

Selections:

dconf_gnome_banner_enabled: Enable GNOME3 Login Warning Banner
- CCE-87417-2

RHEL-10-700040: RHEL 10 must display the Standard Mandatory DOD Notice and Consent Banner before granting local or remote access to the system via a command line user login.

Description: None

Levels:

medium

Automated: yes

Selections:

banner_etc_issue: Modify the System Login Banner
- CCE-88261-3
login_banner_contents = dod_default
login_banner_text = dod_banners

RHEL-10-700100: RHEL 10 must prevent special devices on file systems that are imported via Network File System (NFS).

Description: None

Levels:

medium

Automated: yes

Selections:

mount_option_nodev_remote_filesystems: Mount Remote Filesystems with nodev
- CCE-88013-8

RHEL-10-700105: RHEL 10 must prevent code from being executed on file systems that are imported via Network File System (NFS).

Description: None

Levels:

medium

Automated: yes

Selections:

mount_option_noexec_remote_filesystems: Mount Remote Filesystems with noexec
- CCE-86463-7

RHEL-10-700110: RHEL 10 must prevent files with the "setuid" and "setgid" bit set from being executed on file systems that are imported via Network File System (NFS).

Description: None

Levels:

medium

Automated: yes

Selections:

mount_option_nosuid_remote_filesystems: Mount Remote Filesystems with nosuid
- CCE-90504-2

RHEL-10-700115: RHEL 10 must be configured so that the Network File System (NFS) is configured to use RPCSEC_GSS.

Description: None

Levels:

medium

Automated: yes

Selections:

mount_option_krb_sec_remote_filesystems: Mount Remote Filesystems with Kerberos Security
- CCE-87249-9

RHEL-10-700120: RHEL 10 must mount "/boot" with the "nodev" option.

Description: None

Levels:

medium

Automated: yes

Selections:

mount_option_boot_nodev: Add nodev Option to /boot
- CCE-90132-2

RHEL-10-700125: RHEL 10 must prevent files with the "setuid" and "setgid" bit set from being executed on the "/boot" directory.

Description: None

Levels:

medium

Automated: yes

Selections:

mount_option_boot_nosuid: Add nosuid Option to /boot
- CCE-88881-8

RHEL-10-700130: RHEL 10 must prevent files with the "setuid" and "setgid" bit set from being executed on the "/boot/efi" directory.

Description: None

Levels:

medium

Automated: yes

Selections:

mount_option_boot_efi_nosuid: Add nosuid Option to /boot/efi
- CCE-86492-6

RHEL-10-700135: RHEL 10 must mount "/dev/shm" with the "nodev" option.

Description: None

Levels:

medium

Automated: yes

Selections:

mount_option_dev_shm_nodev: Add nodev Option to /dev/shm
- CCE-86783-8

RHEL-10-700140: RHEL 10 must mount "/dev/shm" with the "noexec" option.

Description: None

Levels:

medium

Automated: yes

Selections:

mount_option_dev_shm_noexec: Add noexec Option to /dev/shm
- CCE-86775-4

RHEL-10-700145: RHEL 10 must mount "/dev/shm" with the "nosuid" option.

Description: None

Levels:

medium

Automated: yes

Selections:

mount_option_dev_shm_nosuid: Add nosuid Option to /dev/shm
- CCE-88358-7

RHEL-10-700150: RHEL 10 must mount "/tmp" with the "nodev" option.

Description: None

Levels:

medium

Automated: yes

Selections:

mount_option_tmp_nodev: Add nodev Option to /tmp
- CCE-90522-4

RHEL-10-700155: RHEL 10 must mount "/tmp" with the "noexec" option.

Description: None

Levels:

medium

Automated: yes

Selections:

mount_option_tmp_noexec: Add noexec Option to /tmp
- CCE-87095-6

RHEL-10-700160: RHEL 10 must mount "/tmp" with the "nosuid" option.

Description: None

Levels:

medium

Automated: yes

Selections:

mount_option_tmp_nosuid: Add nosuid Option to /tmp
- CCE-87318-2

RHEL-10-700165: RHEL 10 must mount "/var" with the "nodev" option.

Description: None

Levels:

medium

Automated: yes

Selections:

mount_option_var_nodev: Add nodev Option to /var
- CCE-87070-9

RHEL-10-700170: RHEL 10 must mount "/var/log" with the "nodev" option.

Description: None

Levels:

medium

Automated: yes

Selections:

mount_option_var_log_nodev: Add nodev Option to /var/log
- CCE-89389-1

RHEL-10-700175: RHEL 10 must mount "/var/log" with the "noexec" option.

Description: None

Levels:

medium

Automated: yes

Selections:

mount_option_var_log_noexec: Add noexec Option to /var/log
- CCE-89129-1

RHEL-10-700180: RHEL 10 must mount "/var/log" with the "nosuid" option.

Description: None

Levels:

medium

Automated: yes

Selections:

mount_option_var_log_nosuid: Add nosuid Option to /var/log
- CCE-90639-6

RHEL-10-700185: RHEL 10 must mount "/var/tmp" with the "nodev" option.

Description: None

Levels:

medium

Automated: yes

Selections:

mount_option_var_tmp_nodev: Add nodev Option to /var/tmp
- CCE-89441-0

RHEL-10-700190: RHEL 10 must mount "/var/tmp" with the "noexec" option.

Description: None

Levels:

medium

Automated: yes

Selections:

mount_option_var_tmp_noexec: Add noexec Option to /var/tmp
- CCE-87347-1

RHEL-10-700195: RHEL 10 must mount "/var/tmp" with the "nosuid" option.

Description: None

Levels:

medium

Automated: yes

Selections:

mount_option_var_tmp_nosuid: Add nosuid Option to /var/tmp
- CCE-87892-6

RHEL-10-700200: RHEL 10 must prevent special devices on nonroot local partitions.

Description: None

Levels:

medium

Automated: yes

Selections:

mount_option_nodev_nonroot_local_partitions: Add nodev Option to Non-Root Local Partitions
- CCE-88981-6

RHEL-10-700400: RHEL 10 must enable the SELinux targeted policy.

Description: None

Levels:

medium

Automated: yes

Selections:

selinux_policytype: Configure SELinux Policy
- CCE-88366-0
var_selinux_policy_name = targeted

RHEL-10-700410: RHEL 10 must elevate the SELinux context when an administrator calls the sudo command.

Description: None

Levels:

medium

Automated: yes

Selections:

selinux_context_elevation_for_sudo: Elevate The SELinux Context When An Administrator Calls The Sudo Command
- CCE-88418-9

RHEL-10-700420: RHEL 10 must use a Linux Security Module configured to enforce limits on system services.

Description: None

Levels:

medium

Automated: yes

Selections:

selinux_state: Ensure SELinux State is Enforcing
- CCE-89386-7
var_selinux_state = enforcing

RHEL-10-700430: RHEL 10 must configure SELinux context type to allow the use of a nondefault faillock tally directory.

Description: None

Levels:

medium

Automated: yes

Selections:

account_password_selinux_faillock_dir: An SELinux Context must be configured for the pam_faillock.so records directory
- CCE-90568-7

RHEL-10-700500: RHEL 10 must be configured so that Secure Shell (SSH) public host key files have mode "0644" or less permissive.

Description: None

Levels:

medium

Automated: yes

Selections:

file_permissions_sshd_pub_key: Verify Permissions on SSH Server Public *.pub Key Files
- CCE-87454-5

RHEL-10-700510: RHEL 10 must be configured so that the Secure Shell (SSH) daemon does not allow Generic Security Service Application Program Interface (GSSAPI) authentication.

Description: None

Levels:

medium

Automated: yes

Selections:

sshd_disable_gssapi_auth: Disable GSSAPI Authentication
- CCE-89145-7

RHEL-10-700520: RHEL 10 must be configured so that the Secure Shell (SSH) daemon does not allow Kerberos authentication.

Description: None

Levels:

medium

Automated: yes

Selections:

sshd_disable_kerb_auth: Disable Kerberos Authentication
- CCE-90591-9

RHEL-10-700530: RHEL 10 must be configured so that the Secure Shell (SSH) daemon does not allow rhosts authentication.

Description: None

Levels:

medium

Automated: yes

Selections:

sshd_disable_rhosts: Disable SSH Support for .rhosts Files
- CCE-87777-9

RHEL-10-700540: RHEL 10 must be configured so that the Secure Shell (SSH) daemon does not allow known hosts authentication.

Description: None

Levels:

medium

Automated: yes

Selections:

sshd_disable_user_known_hosts: Disable SSH Support for User Known Hosts
- CCE-87313-3

RHEL-10-700550: RHEL 10 must be configured so that the Secure Shell (SSH) daemon disables remote X connections for interactive users.

Description: None

Levels:

medium

Automated: yes

Selections:

sshd_disable_x11_forwarding: Disable X11 Forwarding
- CCE-89476-6

RHEL-10-700560: RHEL 10 must be configured so that the Secure Shell (SSH) daemon performs strict mode checking of home directory configuration files.

Description: None

Levels:

medium

Automated: yes

Selections:

sshd_enable_strictmodes: Enable Use of Strict Mode Checking
- CCE-88037-7

RHEL-10-700570: RHEL 10 must be configured so that the Secure Shell (SSH) daemon displays the date and time of the last successful account login upon an SSH login.

Description: None

Levels:

medium

Automated: yes

Selections:

sshd_print_last_log: Enable SSH Print Last Log
- CCE-88362-9

RHEL-10-700580: RHEL 10 must be configured so that the Secure Shell (SSH) daemon prevents remote hosts from connecting to the proxy display.

Description: None

Levels:

medium

Automated: yes

Selections:

sshd_x11_use_localhost: Prevent remote hosts from connecting to the proxy display
- CCE-86528-7

RHEL-10-700590: RHEL 10 must be configured so that Secure Shell (SSH) server configuration files' permissions are not modified.

Description: None

Levels:

medium

Automated: yes

Selections:

directory_permissions_sshd_config_d: Verify Permissions on SSH Server Config File
- CCE-89963-3
file_permissions_sshd_config: Verify Permissions on SSH Server config file
- CCE-86264-9
file_permissions_sshd_drop_in_config: Verify Permissions on SSH Server Config File
- CCE-86442-1

RHEL-10-700600: RHEL 10 must be configured so that SSHD accepts public key authentication.

Description: None

Levels:

medium

Automated: yes

Selections:

sshd_enable_pubkey_auth: Enable Public Key Authentication
- CCE-90625-5

RHEL-10-700610: RHEL 10 must be configured so that SSHD does not allow blank passwords.

Description: None

Levels:

medium

Automated: yes

Selections:

sshd_disable_empty_passwords: Disable SSH Access via Empty Passwords
- CCE-86753-1

RHEL-10-700620: RHEL 10 must not permit direct logins to the root account using remote access via Secure Shell (SSH).

Description: None

Levels:

medium

Automated: yes

Selections:

sshd_disable_root_login: Disable SSH Root Login
- CCE-89730-6

RHEL-10-700630: RHEL 10 must not allow a noncertificate trusted host Secure Shell (SSH) login to the system.

Description: None

Levels:

medium

Automated: yes

Selections:

disable_host_auth: Disable Host-Based Authentication
- CCE-88057-5

RHEL-10-700640: RHEL 10 must not allow users to override Secure Shell (SSH) environment variables.

Description: None

Levels:

high

Automated: yes

Selections:

sshd_do_not_permit_user_env: Do Not Allow SSH Environment Options
- CCE-87395-0

RHEL-10-700650: RHEL 10 must force a frequent session key renegotiation for Secure Shell (SSH) connections to the server.

Description: None

Levels:

high

Automated: yes

Selections:

sshd_rekey_limit: Force frequent session key renegotiation
- CCE-88356-1
var_rekey_limit_size = 1G
var_rekey_limit_time = 1hour

RHEL-10-700660: RHEL 10 must be configured so that all network connections associated with Secure Shell (SSH) traffic terminate after becoming unresponsive.

Description: None

Levels:

medium

Automated: yes

Selections:

sshd_set_keepalive: Set SSH Client Alive Count Max
- CCE-86794-5
var_sshd_set_keepalive = 1

RHEL-10-700670: RHEL 10 must forward mail from postmaster to the root account using a postfix alias.

Description: None

Levels:

medium

Automated: yes

Selections:

postfix_client_configure_mail_alias_postmaster: Configure System to Forward All Mail From Postmaster to The Root Account
- CCE-89448-5

RHEL-10-700680: RHEL 10 must not have a "shosts.equiv" file on the system.

Description: None

Levels:

medium

Automated: yes

Selections:

no_host_based_files: Remove Host-Based Authentication Files
- CCE-89350-3

RHEL-10-700690: RHEL 10 must not have any ".shosts" files on the system.

Description: None

Levels:

medium

Automated: yes

Selections:

no_user_host_based_files: Remove User Host-Based Authentication Files
- CCE-89341-2

RHEL-10-700700: RHEL 10 must prevent a user from overriding the disabling of the graphical user interface automount function.

Description: None

Levels:

medium

Automated: yes

Selections:

dconf_gnome_disable_automount_open: Disable GNOME3 Automount Opening
- CCE-86628-5

RHEL-10-700710: RHEL 10 must prevent a user from overriding the disabling of the graphical user interface autorun function.

Description: None

Levels:

medium

Automated: yes

Selections:

dconf_gnome_disable_autorun: Disable GNOME3 Automount running
- CCE-87588-0

RHEL-10-700720: RHEL 10 must not allow unattended or automatic login via the graphical user interface.

Description: None

Levels:

high

Automated: yes

Selections:

gnome_gdm_disable_automatic_login: Disable GDM Automatic Login
- CCE-87057-6

RHEL-10-700730: RHEL 10 must prevent a user from overriding the disabling of the graphical user smart card removal action.

Description: None

Levels:

medium

Automated: yes

Selections:

dconf_gnome_lock_screen_on_smartcard_removal: Enable the GNOME3 Screen Locking On Smartcard Removal
- CCE-87751-4

RHEL-10-700740: RHEL 10 must prevent a user from overriding the screensaver lock-enabled setting for the graphical user interface.

Description: None

Levels:

medium

Automated: yes

Selections:

dconf_gnome_screensaver_lock_enabled: Enable GNOME3 Screensaver Lock After Idle Period
- CCE-89684-5
dconf_gnome_screensaver_lock_locked: Ensure Users Cannot Change GNOME3 Screensaver Lock After Idle Period
- CCE-87356-2

RHEL-10-700750: RHEL 10 must automatically lock graphical user sessions after 15 minutes of inactivity.

Description: None

Levels:

medium

Automated: yes

Selections:

dconf_gnome_screensaver_idle_delay: Set GNOME3 Screensaver Inactivity Timeout
- CCE-87170-7
inactivity_timeout_value = 15_minutes

RHEL-10-700760: RHEL 10 must prevent a user from overriding the session idle-delay setting for the graphical user interface.

Description: None

Levels:

medium

Automated: yes

Selections:

dconf_gnome_session_idle_user_locks: Ensure Users Cannot Change GNOME3 Session Idle Settings
- CCE-88587-1

RHEL-10-700770: RHEL 10 must initiate a session lock for graphical user interfaces when the screensaver is activated.

Description: None

Levels:

medium

Automated: yes

Selections:

dconf_gnome_screensaver_lock_delay: Set GNOME3 Screensaver Lock Delay After Activation Period
- CCE-88417-1
var_screensaver_lock_delay = 5_seconds

RHEL-10-700780: RHEL 10 must prevent a user from overriding the session lock-delay setting for the graphical user interface.

Description: None

Levels:

medium

Automated: yes

Selections:

dconf_gnome_screensaver_user_locks: Ensure Users Cannot Change GNOME3 Screensaver Settings
- CCE-88349-6

RHEL-10-700790: RHEL 10 must conceal, via the session lock, information previously visible on the display with a publicly viewable image.

Description: None

Levels:

medium

Automated: yes

Selections:

dconf_gnome_screensaver_mode_blank: Implement Blank Screensaver
- CCE-88476-7

RHEL-10-700800: RHEL 10 must ensure effective dconf policy matches the policy keyfiles.

Description: None

Levels:

medium

Automated: yes

Selections:

dconf_db_up_to_date: Make sure that the dconf databases are up-to-date with regards to respective keyfiles
- CCE-86609-5

RHEL-10-700810: RHEL 10 must prevent a user from overriding the disable-restart-buttons setting for the graphical user interface.

Description: None

Levels:

medium

Automated: yes

Selections:

dconf_gnome_disable_restart_shutdown: Disable the GNOME3 Login Restart and Shutdown Buttons
- CCE-87837-1

RHEL-10-700820: RHEL 10 must prevent a user from overriding the Ctrl-Alt-Del sequence settings for the graphical user interface.

Description: None

Levels:

medium

Automated: yes

Selections:

dconf_gnome_disable_ctrlaltdel_reboot: Disable Ctrl-Alt-Del Reboot Key Sequence in GNOME3
- CCE-90658-6

RHEL-10-700830: RHEL 10 must disable the ability of a user to accidentally press Ctrl-Alt-Del and cause a system to shut down or reboot.

Description: None

Levels:

medium

Automated: yes

Selections:

dconf_gnome_disable_ctrlaltdel_reboot: Disable Ctrl-Alt-Del Reboot Key Sequence in GNOME3
- CCE-90658-6

RHEL-10-700840: RHEL 10 must disable the user list at login for graphical user interfaces.

Description: None

Levels:

medium

Automated: yes

Selections:

dconf_gnome_disable_user_list: Disable the GNOME3 Login User List
- CCE-87918-9

RHEL-10-700850: RHEL 10 must be configured to disable USB mass storage.

Description: None

Levels:

medium

Automated: yes

Selections:

kernel_module_usb-storage_disabled: Disable Modprobe Loading of USB Storage Driver
- CCE-89301-6

RHEL-10-700860: RHEL 10 must disable Bluetooth.

Description: None

Levels:

medium

Automated: yes

Selections:

kernel_module_bluetooth_disabled: Disable Bluetooth Kernel Module
- CCE-87455-2

RHEL-10-700870: RHEL 10 must disable wireless network adapters.

Description: None

Levels:

medium

Automated: yes

Selections:

wireless_disable_interfaces: Deactivate Wireless Network Interfaces
- CCE-88576-4

RHEL-10-700880: RHEL 10 must disable the graphical user interface automounter unless required.

Description: None

Levels:

medium

Automated: yes

Selections:

dconf_gnome_disable_automount_open: Disable GNOME3 Automount Opening
- CCE-86628-5

RHEL-10-700890: RHEL 10 must disable the graphical user interface autorunner unless required.

Description: None

Levels:

low

Automated: yes

Selections:

dconf_gnome_disable_autorun: Disable GNOME3 Automount running
- CCE-87588-0

RHEL-10-700900: RHEL 10 must implement nonexecutable data to protect its memory from unauthorized code execution.

Description: None

Levels:

medium

Automated: yes

Selections:

bios_enable_execution_restrictions: Enable NX or XD Support in the BIOS
- CCE-89763-7

RHEL-10-700920: RHEL 10 must automatically exit interactive command shell user sessions after 15 minutes of inactivity.

Description: None

Levels:

medium

Automated: yes

Selections:

accounts_tmout: Set Interactive Session Timeout
- CCE-88163-1
var_accounts_tmout = 15_min

RHEL-10-700930: RHEL 10 must be configured with a timeout interval for the Secure Shell (SSH) daemon.

Description: None

Levels:

medium

Automated: yes

Selections:

sshd_idle_timeout_value = 10_minutes
sshd_set_idle_timeout: Set SSH Client Alive Interval
- CCE-90362-5

RHEL-10-700940: RHEL 10 must not default to the graphical display manager unless approved.

Description: None

Levels:

medium

Automated: yes

Selections:

xwindows_runlevel_target: Disable Graphical Environment Startup By Setting Default Target
- CCE-89266-1

RHEL-10-700950: RHEL 10 must disable the systemd Ctrl-Alt-Delete burst key sequence.

Description: None

Levels:

high

Automated: yes

Selections:

disable_ctrlaltdel_burstaction: Disable Ctrl-Alt-Del Burst Action
- CCE-87627-6

RHEL-10-700960: RHEL 10 must disable the x86 Ctrl-Alt-Delete key sequence.

Description: None

Levels:

high

Automated: yes

Selections:

disable_ctrlaltdel_reboot: Disable Ctrl-Alt-Del Reboot Activation
- CCE-90035-7

RHEL-10-700980: RHEL 10 must disable the ability of systemd to spawn an interactive boot process.

Description: None

Levels:

medium

Automated: yes

Selections:

grub2_disable_interactive_boot: Verify that Interactive Boot is Disabled
- CCE-89661-3

RHEL-10-700990: RHEL 10 must disable virtual system calls.

Description: None

Levels:

medium

Automated: yes

Selections:

grub2_vsyscall_argument: Disable vsyscalls
- CCE-87153-3

RHEL-10-701000: RHEL 10 must clear the page allocator to prevent use-after-free attacks.

Description: None

Levels:

medium

Automated: yes

Selections:

grub2_page_poison_argument: Enable page allocator poisoning
- CCE-89086-3

RHEL-10-701010: RHEL 10 must clear memory when it is freed to prevent use-after-free attacks.

Description: None

Levels:

medium

Automated: yes

Selections:

grub2_init_on_free: The system must booted with init_on_free=1
- CCE-90140-5

RHEL-10-701020: RHEL 10 must enable mitigations against processor-based vulnerabilities.

Description: None

Levels:

medium

Automated: yes

Selections:

grub2_pti_argument: Enable Kernel Page-Table Isolation (KPTI)
- CCE-88971-7

RHEL-10-701030: RHEL 10 must restrict access to the kernel message buffer.

Description: None

Levels:

medium

Automated: yes

Selections:

sysctl_kernel_dmesg_restrict: Restrict Access to Kernel Message Buffer
- CCE-89000-4

RHEL-10-701040: RHEL 10 must prevent kernel profiling by nonprivileged users.

Description: None

Levels:

medium

Automated: yes

Selections:

sysctl_kernel_perf_event_paranoid: Disallow kernel profiling by unprivileged users
- CCE-90142-1

RHEL-10-701050: RHEL 10 must prevent the loading of a new kernel for later execution.

Description: None

Levels:

high

Automated: yes

Selections:

sysctl_kernel_kexec_load_disabled: Disable Kernel Image Loading
- CCE-89232-3

RHEL-10-701060: RHEL 10 must restrict exposed kernel pointer address access.

Description: None

Levels:

medium

Automated: yes

Selections:

sysctl_kernel_kptr_restrict: Restrict Exposed Kernel Pointer Addresses Access
- CCE-88686-1

RHEL-10-701070: RHEL 10 must enable kernel parameters to enforce discretionary access control (DAC) on hardlinks.

Description: None

Levels:

medium

Automated: yes

Selections:

sysctl_fs_protected_hardlinks: Enable Kernel Parameter to Enforce DAC on Hardlinks
- CCE-86689-7

RHEL-10-701080: RHEL 10 must enable kernel parameters to enforce discretionary access control (DAC) on symlinks.

Description: None

Levels:

medium

Automated: yes

Selections:

sysctl_fs_protected_symlinks: Enable Kernel Parameter to Enforce DAC on Symlinks
- CCE-88796-8

RHEL-10-701090: RHEL 10 must disable the "kernel.core_pattern".

Description: None

Levels:

medium

Automated: yes

Selections:

sysctl_kernel_core_pattern: Disable storing core dumps
- CCE-86714-3

RHEL-10-701100: RHEL 10 must be configured to disable the Controller Area Network (CAN) kernel module.

Description: None

Levels:

medium

Automated: yes

Selections:

kernel_module_can_disabled: Disable CAN Support
- CCE-89282-8

RHEL-10-701110: RHEL 10 must disable the Stream Control Transmission Protocol (SCTP) kernel module.

Description: None

Levels:

medium

Automated: yes

Selections:

kernel_module_sctp_disabled: Disable SCTP Support
- CCE-90489-6

RHEL-10-701120: RHEL 10 must disable the Transparent Inter Process Communication (TIPC) kernel module.

Description: None

Levels:

medium

Automated: yes

Selections:

kernel_module_tipc_disabled: Disable TIPC Support
- CCE-86569-1

RHEL-10-701130: RHEL 10 must implement address space layout randomization (ASLR) to protect its memory from unauthorized code execution.

Description: None

Levels:

medium

Automated: yes

Selections:

sysctl_kernel_randomize_va_space: Enable Randomized Layout of Virtual Address Space
- CCE-87876-9

RHEL-10-701140: RHEL 10 must restrict usage of ptrace to descendant processes.

Description: None

Levels:

medium

Automated: yes

Selections:

sysctl_kernel_yama_ptrace_scope: Restrict usage of ptrace to descendant processes
- CCE-88785-1

RHEL-10-701150: RHEL 10 must disable core dump backtraces.

Description: None

Levels:

medium

Automated: yes

Selections:

coredump_disable_backtraces: Disable core dump backtraces
- CCE-88825-5

RHEL-10-701160: RHEL 10 must disable storing core dumps.

Description: None

Levels:

medium

Automated: yes

Selections:

coredump_disable_storage: Disable storing core dump
- CCE-88732-3

RHEL-10-701170: RHEL 10 must disable core dumps for all users.

Description: None

Levels:

medium

Automated: yes

Selections:

disable_users_coredumps: Disable Core Dumps for All Users
- CCE-88330-6

RHEL-10-701180: RHEL 10 must disable acquiring, saving, and processing core dumps.

Description: None

Levels:

medium

Automated: yes

Selections:

service_systemd-coredump_disabled: Disable acquiring, saving, and processing core dumps
- CCE-90438-3

RHEL-10-701190: RHEL 10 must implement nonexecutable data to protect its memory from unauthorized code execution.

Description: None

Levels:

medium

Automated: yes

Selections:

sysctl_kernel_exec_shield: Enable ExecShield via sysctl
- CCE-89079-8

RHEL-10-701200: RHEL 10 must disable the kdump service.

Description: None

Levels:

medium

Automated: yes

Selections:

service_kdump_disabled: Disable KDump Kernel Crash Analyzer (kdump)
- CCE-88407-2

RHEL-10-701210: RHEL 10 must disable file system automount function unless required.

Description: None

Levels:

medium

Automated: yes

Selections:

service_autofs_disabled: Disable the Automounter
- CCE-88947-7

RHEL-10-701220: RHEL 10 must enable certificate-based smart card authentication.

Description: None

Levels:

medium

Automated: yes

Selections:

sssd_enable_smartcards: Enable Smartcards in SSSD
- CCE-90275-9

RHEL-10-701230: RHEL 10 must implement certificate status checking for multifactor authentication.

Description: None

Levels:

medium

Automated: yes

Selections:

sssd_certificate_verification: Certificate status checking in SSSD
- CCE-86192-2
var_sssd_certificate_verification_digest_function = sha512

RHEL-10-701240: RHEL 10 must, for PKI-based authentication, enforce authorized access to the corresponding private key.

Description: None

Levels:

medium

Automated: yes

Selections:

ssh_keys_passphrase_protected: Verify the SSH Private Key Files Have a Passcode
- CCE-89160-6

RHEL-10-701250: RHEL 10 must require authentication to access emergency mode.

Description: None

Levels:

medium

Automated: yes

Selections:

require_emergency_target_auth: Require Authentication for Emergency Systemd Target
- CCE-89188-7

RHEL-10-701260: RHEL 10 must require authentication to access single-user mode.

Description: None

Levels:

medium

Automated: yes

Selections:

require_singleuser_auth: Require Authentication for Single User Mode
- CCE-90014-2

RHEL-10-701270: RHEL 10 must, for PKI-based authentication, validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor.

Description: None

Levels:

medium

Automated: yes

Selections:

sssd_has_trust_anchor: SSSD Has a Correct Trust Anchor
- CCE-87826-4

RHEL-10-701280: RHEL 10 must map the authenticated identity to the user or group account for public key infrastructure (PKI)-based authentication.

Description: None

Levels:

medium

Automated: yes

Selections:

sssd_enable_certmap: Enable Certmap in SSSD
- CCE-90713-9

RHEL-10-701290: RHEL 10 must prohibit the use of cached authenticators after one day.

Description: None

Levels:

medium

Automated: yes

Selections:

sssd_offline_cred_expiration: Configure SSSD to Expire Offline Credentials
- CCE-90741-0

RHEL-10-800000: RHEL 10 must control remote access methods.

Description: None

Levels:

medium

Automated: yes

Selections:

configure_firewalld_ports: Configure the Firewalld Ports
- CCE-87091-5

RHEL-10-800010: RHEL 10 must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services, as defined in the Ports, Protocols, and Services Management (PPSM) Category Assignments List (CAL) and vulnerability assessments.

Description: None

Levels:

medium

Automated: yes

Selections:

firewalld_sshd_port_enabled: Enable SSH Server firewalld Firewall Exception
- CCE-89799-1

RHEL-10-800020: RHEL 10 must enforce that network interfaces not be in promiscuous mode.

Description: None

Levels:

medium

Automated: yes

Selections:

network_sniffer_disabled: Ensure System is Not Acting as a Network Sniffer
- CCE-88985-7

RHEL-10-800030: RHEL 10 must disable access to the network bpf system call from nonprivileged processes.

Description: None

Levels:

medium

Automated: yes

Selections:

sysctl_kernel_unprivileged_bpf_disabled: Disable Access to Network bpf() Syscall From Unprivileged Processes
- CCE-89405-5

RHEL-10-800040: RHEL 10 must securely compare internal information system clocks at least every 24 hours.

Description: None

Levels:

medium

Automated: yes

Selections:

chronyd_or_ntpd_set_maxpoll: Configure Time Service Maxpoll Interval
- CCE-88549-1
chronyd_server_directive: Ensure Chrony is only configured with the server directive
- CCE-88824-8
chronyd_specify_remote_server: A remote time server for Chrony is configured
- CCE-86811-7
var_multiple_time_servers = stig
var_time_service_set_maxpoll = 18_hours

RHEL-10-800050: RHEL 10 must enable hardening for the Berkeley Packet Filter (BPF) just-in-time compiler.

Description: None

Levels:

medium

Automated: yes

Selections:

sysctl_net_core_bpf_jit_harden: Harden the operation of the BPF just-in-time compiler
- CCE-89631-6

RHEL-10-800060: RHEL 10 must have at least two name servers configured for systems using Domain Name Server (DNS) resolution.

Description: None

Levels:

medium

Automated: yes

Selections:

network_configure_name_resolution: Configure Multiple DNS Servers in /etc/resolv.conf
- CCE-88312-4

RHEL-10-800070: RHEL 10 must not have unauthorized IP tunnels configured.

Description: None

Levels:

medium

Automated: yes

Selections:

libreswan_approved_tunnels: Verify Any Configured IPSec Tunnel Connections
- CCE-87382-8

RHEL-10-800080: RHEL 10 must be configured to use Transmission Control Protocol (TCP) syncookies.

Description: None

Levels:

medium

Automated: yes

Selections:

sysctl_net_ipv4_tcp_syncookies: Enable Kernel Parameter to Use TCP Syncookies on Network Interfaces
- CCE-88084-9

RHEL-10-800090: RHEL 10 must ignore Internet Protocol version 4 (IPv4) Internet Control Message Protocol (ICMP) redirect messages.

Description: None

Levels:

medium

Automated: yes

Selections:

sysctl_net_ipv4_conf_all_accept_redirects: Disable Accepting ICMP Redirects for All IPv4 Interfaces
- CCE-90409-4

RHEL-10-800100: RHEL 10 must not forward Internet Protocol version 4 (IPv4) source-routed packets.

Description: None

Levels:

medium

Automated: yes

Selections:

sysctl_net_ipv4_conf_all_accept_source_route: Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- CCE-90165-2

RHEL-10-800110: RHEL 10 must log Internet Protocol version 4 (IPv4) packets with impossible addresses.

Description: None

Levels:

medium

Automated: yes

Selections:

sysctl_net_ipv4_conf_all_log_martians: Enable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- CCE-89499-8

RHEL-10-800120: RHEL 10 must log Internet Protocol version 4 (IPv4) packets with impossible addresses by default.

Description: None

Levels:

medium

Automated: yes

Selections:

sysctl_net_ipv4_conf_default_log_martians: Enable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces by Default
- CCE-87672-2

RHEL-10-800130: RHEL 10 must use reverse path filtering on all Internet Protocol version 4 (IPv4) interfaces.

Description: None

Levels:

medium

Automated: yes

Selections:

sysctl_net_ipv4_conf_all_rp_filter: Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
- CCE-88689-5

RHEL-10-800140: RHEL 10 must prevent Internet Protocol version 4 (IPv4) Internet Control Message Protocol (ICMP) redirect messages from being accepted.

Description: None

Levels:

medium

Automated: yes

Selections:

sysctl_net_ipv4_conf_default_accept_redirects: Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- CCE-86820-8

RHEL-10-800150: RHEL 10 must not forward Internet Protocol version 4 (IPv4) source-routed packets by default.

Description: None

Levels:

medium

Automated: yes

Selections:

sysctl_net_ipv4_conf_default_accept_source_route: Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- CCE-88071-6

RHEL-10-800160: RHEL 10 must use a reverse-path filter for Internet Protocol version 4 (IPv4) network traffic when possible by default.

Description: None

Levels:

medium

Automated: yes

Selections:

sysctl_net_ipv4_conf_default_rp_filter: Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
- CCE-87424-8

RHEL-10-800170: RHEL 10 must not respond to Internet Control Message Protocol (ICMP) echoes sent to a broadcast address.

Description: None

Levels:

medium

Automated: yes

Selections:

sysctl_net_ipv4_icmp_echo_ignore_broadcasts: Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- CCE-86918-0

RHEL-10-800180: RHEL 10 must limit the number of bogus Internet Control Message Protocol (ICMP) response errors logs.

Description: None

Levels:

medium

Automated: yes

Selections:

sysctl_net_ipv4_icmp_ignore_bogus_error_responses: Enable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
- CCE-87841-3

RHEL-10-800190: RHEL 10 must not send Internet Control Message Protocol (ICMP) redirects.

Description: None

Levels:

medium

Automated: yes

Selections:

sysctl_net_ipv4_conf_all_send_redirects: Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- CCE-88360-3

RHEL-10-800200: RHEL 10 must not allow interfaces to perform Internet Control Message Protocol (ICMP) redirects by default.

Description: None

Levels:

medium

Automated: yes

Selections:

sysctl_net_ipv4_conf_default_send_redirects: Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- CCE-89177-0

RHEL-10-800210: RHEL 10 must not enable Internet Protocol version 4 (IPv4) packet forwarding unless the system is a router.

Description: None

Levels:

medium

Automated: yes

Selections:

sysctl_net_ipv4_conf_all_forwarding: Disable Kernel Parameter for IPv4 Forwarding on all IPv4 Interfaces
- CCE-87420-6

RHEL-10-800220: RHEL 10 must not accept router advertisements on all Internet Protocol version 6 (IPv6) interfaces.

Description: None

Levels:

medium

Automated: yes

Selections:

sysctl_net_ipv6_conf_all_accept_ra: Configure Accepting Router Advertisements on All IPv6 Interfaces
- CCE-88665-5

RHEL-10-800230: RHEL 10 must ignore IPv6 Internet Control Message Protocol (ICMP) redirect messages.

Description: None

Levels:

medium

Automated: yes

Selections:

sysctl_net_ipv6_conf_all_accept_redirects: Disable Accepting ICMP Redirects for All IPv6 Interfaces
- CCE-90083-7

RHEL-10-800240: RHEL 10 must not forward Internet Protocol version 6 (IPv6) source-routed packets.

Description: None

Levels:

medium

Automated: yes

Selections:

sysctl_net_ipv6_conf_all_accept_source_route: Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces
- CCE-90450-8

RHEL-10-800250: RHEL 10 must not enable Internet Protocol version 6 (IPv6) packet forwarding unless the system is a router.

Description: None

Levels:

medium

Automated: yes

Selections:

sysctl_net_ipv6_conf_all_forwarding: Disable Kernel Parameter for IPv6 Forwarding
- CCE-86882-8

RHEL-10-800260: RHEL 10 must not accept router advertisements on all Internet Protocol version 6 (IPv6) interfaces by default.

Description: None

Levels:

medium

Automated: yes

Selections:

sysctl_net_ipv6_conf_default_accept_ra: Disable Accepting Router Advertisements on all IPv6 Interfaces by Default
- CCE-90557-0

RHEL-10-800270: RHEL 10 must prevent Internet Protocol version 6 (IPv6) Internet Control Message Protocol (ICMP) redirect messages from being accepted.

Description: None

Levels:

medium

Automated: yes

Selections:

sysctl_net_ipv6_conf_default_accept_redirects: Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
- CCE-89486-5

RHEL-10-800280: RHEL 10 must not forward Internet Protocol version 6 (IPv6) source-routed packets by default.

Description: None

Levels:

medium

Automated: yes

Selections:

sysctl_net_ipv6_conf_default_accept_source_route: Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default
- CCE-89135-8

RHEL-10-800290: RHEL 10 must protect against or limit the effects of denial-of-service (DoS) attacks by ensuring that rate-limiting measures on impacted network interfaces are implemented.

Description: None

Levels:

medium

Automated: yes

Selections:

firewalld-backend: Configure Firewalld to Use the Nftables Backend
- CCE-87099-8

RHEL-10-800300: RHEL 10 must configure a DNS processing mode in Network Manager to avoid conflicts with other Domain Name Server (DNS) managers and to not leak DNS queries to untrusted networks.

Description: None

Levels:

medium

Automated: yes

Selections:

networkmanager_dns_mode: NetworkManager DNS Mode Must Be Must Configured
- CCE-90712-1
var_networkmanager_dns_mode = explicit_default

RHEL-10-800310: RHEL 10 must be configured to operate in secure mode if the Trivial File Transfer Protocol (TFTP) server service is required.

Description: None

Levels:

medium

Automated: yes

Selections:

tftp_uses_secure_mode_systemd: Ensure tftp systemd Service Uses Secure Mode
- CCE-86495-9

RHEL-10-900000: RHEL 10 must enforce mode "0640" or less for the "/etc/audit/auditd.conf" file to prevent unauthorized access.

Description: None

Levels:

medium

Automated: yes

Selections:

file_permissions_etc_audit_auditd: Verify Permissions on /etc/audit/auditd.conf
- CCE-89306-5

RHEL-10-900100: RHEL 10 must prevent unauthorized changes to the audit system.

Description: None

Levels:

medium

Automated: yes

Selections:

audit_rules_immutable: Make the auditd Configuration Immutable
- CCE-89816-3

RHEL-10-001000: RHEL 10 must be a vendor-supported release.

Description: None

Levels:

high

Automated: yes

Selections:

installed_OS_is_vendor_supported: The Installed Operating System Is Vendor Supported
- CCE-89725-6