Definition of Security for industrial automation and control systems - Part 4-2: Technical security requirements for IACS components for rhel9

CR 7.1: Denial of service protection

Description: None

• sl1

Automated: yes

• sysctl_net_ipv4_tcp_syncookies: Enable Kernel Parameter to Use TCP Syncookies on Network Interfaces
  • CCE-84006-6

CR 7.1 RE(1): Manage communication load from component

Description: None

• sl2

Automated: yes

• sysctl_net_ipv4_tcp_syncookies: Enable Kernel Parameter to Use TCP Syncookies on Network Interfaces
  • CCE-84006-6

CR 7.2: Resource management

Description: None

• sl1

Automated: no

No rules selected

CR 7.3: Control system backup

Description: None

• sl1

Automated: no

No rules selected

CR 7.3 RE(1): Backup integrity verification

Description: None

• sl2

Automated: no

No rules selected

CR 7.4: Control system recovery and reconstitution

Description: None

• sl1

Automated: no

No rules selected

CR 7.6: Network and security configuration settings

Description: None

• sl1

Automated: yes

• accounts_password_pam_modules_in_authselect_profile: Ensure Active Authselect Profile Includes PAM Modules
  • CCE-90719-6
• accounts_umask_etc_bashrc: Ensure the Default Bash Umask is Set Correctly
  • CCE-83644-5
• accounts_umask_etc_login_defs: Ensure the Default Umask is Set Correctly in login.defs
  • CCE-83647-8
• accounts_umask_etc_profile: Ensure the Default Umask is Set Correctly in /etc/profile
  • CCE-90828-5
• accounts_user_interactive_home_directory_exists: All Interactive Users Home Directories Must Exist
  • CCE-83639-5
• audit_rules_media_export: Ensure auditd Collects Information on Exporting to Media (successful)
  • CCE-83735-1
• banner_etc_issue_cis: Ensure Local Login Warning Banner Is Configured Properly
  • CCE-86142-7
• banner_etc_issue_net_cis: Ensure Remote Login Warning Banner Is Configured Properly
  • CCE-86143-5
• banner_etc_motd_cis: Ensure Message Of The Day Is Configured Properly
  • CCE-86141-9
• chronyd_run_as_chrony_user: Ensure that chronyd is running under chrony user account
  • CCE-84108-0
• cis_banner_text = cis
• coredump_disable_backtraces: Disable core dump backtraces
  • CCE-83984-5
• coredump_disable_storage: Disable storing core dump
  • CCE-83979-5
• dconf_db_up_to_date: Make sure that the dconf databases are up-to-date with regards to respective keyfiles
  • CCE-87295-2
• dconf_gnome_disable_user_list: Disable the GNOME3 Login User List
  • CCE-88285-2
• dconf_login_banner_contents = cis_default
• dconf_login_banner_text = cis_banners
• disable_host_auth: Disable Host-Based Authentication
  • CCE-90816-0
• enable_authselect: Enable authselect
  • CCE-89732-2
• file_groupowner_grub2_cfg: Verify /boot/grub2/grub.cfg Group Ownership
  • CCE-83848-2
• file_groupowner_user_cfg: Verify /boot/grub2/user.cfg Group Ownership
  • CCE-86010-6
• file_groupownership_sshd_private_key: Verify Group Ownership on SSH Server Private *_key Key Files
  • CCE-86127-8
• file_groupownership_sshd_pub_key: Verify Group Ownership on SSH Server Public *.pub Key Files
  • CCE-86136-9
• file_owner_grub2_cfg: Verify /boot/grub2/grub.cfg User Ownership
  • CCE-83845-8
• file_owner_user_cfg: Verify /boot/grub2/user.cfg User Ownership
  • CCE-86016-3
• file_ownership_sshd_private_key: Verify Ownership on SSH Server Private *_key Key Files
  • CCE-86119-5
• file_ownership_sshd_pub_key: Verify Ownership on SSH Server Public *.pub Key Files
  • CCE-86130-2
• file_permissions_grub2_cfg: Verify /boot/grub2/grub.cfg Permissions
  • CCE-83846-6
• file_permissions_home_directories: All Interactive User Home Directories Must Have mode 0750 Or Less Permissive
  • CCE-83634-6
• file_permissions_sshd_private_key: Verify Permissions on SSH Server Private *_key Key Files
  • CCE-90820-2
• file_permissions_sshd_pub_key: Verify Permissions on SSH Server Public *.pub Key Files
  • CCE-90819-4
• file_permissions_user_cfg: Verify /boot/grub2/user.cfg Permissions
  • CCE-86025-4
• no_empty_passwords: Prevent Login to Accounts With Empty Password
  • CCE-83611-4
• no_empty_passwords_etc_shadow: Ensure There Are No Accounts With Blank or Null Passwords
  • CCE-85972-8
• package_pam_pwquality_installed: Install pam_pwquality Package
  • CCE-86226-8
• package_rsync_removed: Uninstall rsync Package
  • CCE-86336-5
• package_samba_removed: Uninstall Samba Package
  • CCE-85979-3
• package_squid_removed: Uninstall squid Package
  • CCE-84238-5
• partition_for_tmp: Ensure /tmp Located On Separate Partition
  • CCE-90845-9
• partition_for_var_log: Ensure /var/log Located On Separate Partition
  • CCE-90848-3
• service_nfs_disabled: Disable Network File System (nfs)
  • CCE-90850-9
• service_rpcbind_disabled: Disable rpcbind Service
  • CCE-84245-0
• sshd_disable_gssapi_auth: Disable GSSAPI Authentication
  • CCE-90808-7
• sshd_set_login_grace_time: Ensure SSH LoginGraceTime is configured
  • CCE-86552-7
• sysctl_kernel_randomize_va_space: Enable Randomized Layout of Virtual Address Space
  • CCE-83971-2
• sysctl_kernel_yama_ptrace_scope: Restrict usage of ptrace to descendant processes
  • CCE-83965-4
• sysctl_net_ipv4_conf_all_accept_redirects: Disable Accepting ICMP Redirects for All IPv4 Interfaces
  • CCE-84011-6
• sysctl_net_ipv4_conf_all_accept_redirects_value = disabled
• sysctl_net_ipv4_conf_all_accept_source_route: Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
  • CCE-84001-7
• sysctl_net_ipv4_conf_all_accept_source_route_value = disabled
• sysctl_net_ipv4_conf_all_log_martians: Enable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
  • CCE-84000-9
• sysctl_net_ipv4_conf_all_log_martians_value = enabled
• sysctl_net_ipv4_conf_all_rp_filter: Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
  • CCE-84008-2
• sysctl_net_ipv4_conf_all_rp_filter_value = enabled
• sysctl_net_ipv4_conf_all_secure_redirects: Disable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
  • CCE-84016-5
• sysctl_net_ipv4_conf_all_secure_redirects_value = disabled
• sysctl_net_ipv4_conf_all_send_redirects: Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
  • CCE-83997-7
• sysctl_net_ipv4_conf_default_accept_redirects: Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
  • CCE-84003-3
• sysctl_net_ipv4_conf_default_accept_redirects_value = disabled
• sysctl_net_ipv4_conf_default_accept_source_route: Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
  • CCE-84007-4
• sysctl_net_ipv4_conf_default_accept_source_route_value = disabled
• sysctl_net_ipv4_conf_default_log_martians: Enable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces by Default
  • CCE-84014-0
• sysctl_net_ipv4_conf_default_log_martians_value = enabled
• sysctl_net_ipv4_conf_default_rp_filter: Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
  • CCE-84009-0
• sysctl_net_ipv4_conf_default_rp_filter_value = enabled
• sysctl_net_ipv4_conf_default_secure_redirects: Configure Kernel Parameter for Accepting Secure Redirects By Default
  • CCE-84019-9
• sysctl_net_ipv4_conf_default_secure_redirects_value = disabled
• sysctl_net_ipv4_conf_default_send_redirects: Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
  • CCE-83999-3
• sysctl_net_ipv4_icmp_echo_ignore_broadcasts: Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
  • CCE-84004-1
• sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value = enabled
• sysctl_net_ipv4_icmp_ignore_bogus_error_responses: Enable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
  • CCE-84015-7
• sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value = enabled
• sysctl_net_ipv4_ip_forward: Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces
  • CCE-83998-5
• sysctl_net_ipv6_conf_all_accept_ra: Configure Accepting Router Advertisements on All IPv6 Interfaces
  • CCE-84120-5
• sysctl_net_ipv6_conf_all_accept_ra_value = disabled
• sysctl_net_ipv6_conf_all_accept_redirects: Disable Accepting ICMP Redirects for All IPv6 Interfaces
  • CCE-84125-4
• sysctl_net_ipv6_conf_all_accept_redirects_value = disabled
• sysctl_net_ipv6_conf_all_accept_source_route: Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces
  • CCE-84131-2
• sysctl_net_ipv6_conf_all_accept_source_route_value = disabled
• sysctl_net_ipv6_conf_all_forwarding: Disable Kernel Parameter for IPv6 Forwarding
  • CCE-84114-8
• sysctl_net_ipv6_conf_all_forwarding_value = disabled
• sysctl_net_ipv6_conf_default_accept_ra: Disable Accepting Router Advertisements on all IPv6 Interfaces by Default
  • CCE-84124-7
• sysctl_net_ipv6_conf_default_accept_ra_value = disabled
• sysctl_net_ipv6_conf_default_accept_redirects: Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
  • CCE-84113-0
• sysctl_net_ipv6_conf_default_accept_redirects_value = disabled
• sysctl_net_ipv6_conf_default_accept_source_route: Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default
  • CCE-84130-4
• sysctl_net_ipv6_conf_default_accept_source_route_value = disabled
• var_accounts_user_umask = 027
• var_authselect_profile = sssd
• var_sshd_set_login_grace_time = 60

CR 7.7: Least functionality

Description: None

• sl1

Automated: yes

• dconf_gnome_disable_autorun: Disable GNOME3 Automount running
  • CCE-90257-7
• file_ownership_var_log_audit_stig: System Audit Logs Must Be Owned By Root
  • CCE-89952-6
• gnome_gdm_disable_xdmcp: Disable XDMCP in GDM
  • CCE-86033-8
• has_nonlocal_mta: Ensure Mail Transfer Agent is not Listening on any non-loopback Address
  • CCE-88499-9
• kernel_module_cramfs_disabled: Disable Mounting of cramfs
  • CCE-83853-2
• kernel_module_dccp_disabled: Disable DCCP Support
  • CCE-84136-1
• kernel_module_freevxfs_disabled: Disable Mounting of freevxfs
  • CCE-86763-0
• kernel_module_hfs_disabled: Disable Mounting of hfs
  • CCE-86764-8
• kernel_module_hfsplus_disabled: Disable Mounting of hfsplus
  • CCE-86765-5
• kernel_module_jffs2_disabled: Disable Mounting of jffs2
  • CCE-86766-3
• kernel_module_rds_disabled: Disable RDS Support
  • CCE-84064-5
• kernel_module_sctp_disabled: Disable SCTP Support
  • CCE-84139-5
• kernel_module_squashfs_disabled: Disable Mounting of squashfs
  • CCE-83855-7
• kernel_module_tipc_disabled: Disable TIPC Support
  • CCE-84065-2
• kernel_module_udf_disabled: Disable Mounting of udf
  • CCE-83852-4
• mount_option_dev_shm_nodev: Add nodev Option to /dev/shm
  • CCE-83881-3
• mount_option_dev_shm_noexec: Add noexec Option to /dev/shm
  • CCE-83857-3
• mount_option_dev_shm_nosuid: Add nosuid Option to /dev/shm
  • CCE-83891-2
• mount_option_tmp_nodev: Add nodev Option to /tmp
  • CCE-83869-8
• mount_option_tmp_noexec: Add noexec Option to /tmp
  • CCE-83885-4
• mount_option_tmp_nosuid: Add nosuid Option to /tmp
  • CCE-83872-2
• package_bind_removed: Uninstall bind Package
  • CCE-86505-5
• package_cyrus-imapd_removed: Uninstall cyrus-imapd Package
  • CCE-88120-1
• package_dhcp_removed: Uninstall DHCP Server Package
  • CCE-84240-1
• package_dovecot_removed: Uninstall dovecot Package
  • CCE-85977-7
• package_ftp_removed: Remove ftp Package
  • CCE-86075-9
• package_gdm_removed: Remove the GDM Package Group
  • CCE-83549-6
• package_httpd_removed: Uninstall httpd Package
  • CCE-85974-4
• package_net-snmp_removed: Uninstall net-snmp Package
  • CCE-85981-9
• package_nginx_removed: Uninstall nginx Package
  • CCE-88035-1
• package_openldap-clients_removed: Ensure LDAP client is not installed
  • CCE-90831-9
• package_telnet-server_removed: Uninstall telnet-server Package
  • CCE-84149-4
• package_telnet_removed: Remove telnet Clients
  • CCE-84146-0
• package_tftp-server_removed: Uninstall tftp-server Package
  • CCE-84154-4
• package_tftp_removed: Remove tftp Daemon
  • CCE-84153-6
• package_vsftpd_removed: Uninstall vsftpd Package
  • CCE-84159-3
• package_xorg-x11-server-common_removed: Remove the X Windows Package Group
  • CCE-84104-9
• partition_for_dev_shm: Ensure /dev/shm is configured
  • CCE-86283-9
• partition_for_home: Ensure /home Located On Separate Partition
  • CCE-83468-9
• partition_for_tmp: Ensure /tmp Located On Separate Partition
  • CCE-90845-9
• partition_for_var: Ensure /var Located On Separate Partition
  • CCE-83466-3
• partition_for_var_log: Ensure /var/log Located On Separate Partition
  • CCE-90848-3
• partition_for_var_log_audit: Ensure /var/log/audit Located On Separate Partition
  • CCE-90847-5
• partition_for_var_tmp: Ensure /var/tmp Located On Separate Partition
  • CCE-83487-9
• postfix_network_listening_disabled: Disable Postfix Network Listening
  • CCE-90825-1
• service_bluetooth_disabled: Disable Bluetooth Service
  • CCE-86761-4
• service_cups_disabled: Disable the CUPS Service
  • CCE-90795-6
• service_dnsmasq_disabled: Disable dnsmasq Service
  • CCE-90721-2
• service_nftables_disabled: Verify nftables Service is Disabled
  • CCE-88429-6
• sshd_disable_forwarding: Disable SSH Forwarding
  • CCE-90197-5
• var_postfix_inet_interfaces = loopback-only
• wireless_disable_interfaces: Deactivate Wireless Network Interfaces
  • CCE-84066-0
• xwindows_runlevel_target: Disable Graphical Environment Startup By Setting Default Target
  • CCE-84105-6

CR 7.8: Control system component inventory

Description: None

• sl2

Automated: no

No rules selected

CR 5.1: Network segmentation

Description: None

• sl1

Automated: yes

• package_firewalld_installed: Install firewalld Package
  • CCE-84021-5
• service_firewalld_enabled: Verify firewalld Enabled
  • CCE-90833-5

CR 6.1: Audit log accessibility

Description: None

• sl1

Automated: yes

• audit_rules_immutable: Make the auditd Configuration Immutable
  • CCE-83716-1
• file_groupownership_audit_configuration: Audit Configuration Files Must Be Owned By Group root
  • CCE-86446-2
• file_ownership_audit_binaries: Verify that audit tools are owned by root
  • CCE-86454-6
• file_ownership_audit_configuration: Audit Configuration Files Must Be Owned By Root
  • CCE-86445-4

CR 6.2: Continuous monitoring

Description: None

• sl2

Automated: yes

• kernel_module_dccp_disabled: Disable DCCP Support
  • CCE-84136-1
• kernel_module_rds_disabled: Disable RDS Support
  • CCE-84064-5
• kernel_module_sctp_disabled: Disable SCTP Support
  • CCE-84139-5
• kernel_module_tipc_disabled: Disable TIPC Support
  • CCE-84065-2
• service_avahi-daemon_disabled: Disable Avahi Server Software
  • CCE-90824-4

CR 2.1: Authorization enforcement

Description: None

• sl1

Automated: yes

• accounts_umask_etc_bashrc: Ensure the Default Bash Umask is Set Correctly
  • CCE-83644-5
• accounts_umask_etc_login_defs: Ensure the Default Umask is Set Correctly in login.defs
  • CCE-83647-8
• accounts_umask_etc_profile: Ensure the Default Umask is Set Correctly in /etc/profile
  • CCE-90828-5
• audit_rules_immutable: Make the auditd Configuration Immutable
  • CCE-83716-1
• dir_perms_world_writable_sticky_bits: Verify that All World-Writable Directories Have Sticky Bits Set
  • CCE-83895-3
• ensure_pam_wheel_group_empty: Ensure the Group Used by pam_wheel.so Module Exists on System and is Empty
  • CCE-86072-6
• file_at_allow_exists: Ensure that /etc/at.allow exists
  • CCE-86856-2
• file_at_deny_not_exist: Ensure that /etc/at.deny does not exist
  • CCE-86946-1
• file_cron_allow_exists: Ensure that /etc/cron.allow exists
  • CCE-86185-6
• file_cron_deny_not_exist: Ensure that /etc/cron.deny does not exist
  • CCE-86850-5
• file_etc_security_opasswd: Verify Permissions and Ownership of Old Passwords File
  • CCE-86762-2
• file_groupowner_at_allow: Verify Group Who Owns /etc/at.allow file
  • CCE-87103-8
• file_groupowner_backup_etc_group: Verify Group Who Owns Backup group File
  • CCE-83928-2
• file_groupowner_backup_etc_gshadow: Verify Group Who Owns Backup gshadow File
  • CCE-83951-4
• file_groupowner_backup_etc_passwd: Verify Group Who Owns Backup passwd File
  • CCE-83933-2
• file_groupowner_backup_etc_shadow: Verify User Who Owns Backup shadow File
  • CCE-83938-1
• file_groupowner_cron_allow: Verify Group Who Owns /etc/cron.allow file
  • CCE-86830-7
• file_groupowner_cron_d: Verify Group Who Owns cron.d
  • CCE-84177-5
• file_groupowner_cron_daily: Verify Group Who Owns cron.daily
  • CCE-84170-0
• file_groupowner_cron_hourly: Verify Group Who Owns cron.hourly
  • CCE-84186-6
• file_groupowner_cron_monthly: Verify Group Who Owns cron.monthly
  • CCE-84189-0
• file_groupowner_cron_weekly: Verify Group Who Owns cron.weekly
  • CCE-84174-2
• file_groupowner_crontab: Verify Group Who Owns Crontab
  • CCE-84171-8
• file_groupowner_etc_group: Verify Group Who Owns group File
  • CCE-83945-6
• file_groupowner_etc_gshadow: Verify Group Who Owns gshadow File
  • CCE-83948-0
• file_groupowner_etc_issue: Verify Group Ownership of System Login Banner
  • CCE-86699-6
• file_groupowner_etc_issue_net: Verify Group Ownership of System Login Banner for Remote Connections
  • CCE-86052-8
• file_groupowner_etc_motd: Verify Group Ownership of Message of the Day Banner
  • CCE-86697-0
• file_groupowner_etc_passwd: Verify Group Who Owns passwd File
  • CCE-83950-6
• file_groupowner_etc_shadow: Verify Group Who Owns shadow File
  • CCE-83930-8
• file_groupowner_etc_shells: Verify Group Who Owns /etc/shells File
  • CCE-90434-2
• file_groupowner_grub2_cfg: Verify /boot/grub2/grub.cfg Group Ownership
  • CCE-83848-2
• file_groupowner_sshd_config: Verify Group Who Owns SSH Server config file
  • CCE-90817-8
• file_groupowner_user_cfg: Verify /boot/grub2/user.cfg Group Ownership
  • CCE-86010-6
• file_groupownership_sshd_private_key: Verify Group Ownership on SSH Server Private *_key Key Files
  • CCE-86127-8
• file_groupownership_sshd_pub_key: Verify Group Ownership on SSH Server Public *.pub Key Files
  • CCE-86136-9
• file_owner_backup_etc_group: Verify User Who Owns Backup group File
  • CCE-83944-9
• file_owner_backup_etc_gshadow: Verify User Who Owns Backup gshadow File
  • CCE-83929-0
• file_owner_backup_etc_passwd: Verify User Who Owns Backup passwd File
  • CCE-83947-2
• file_owner_backup_etc_shadow: Verify Group Who Owns Backup shadow File
  • CCE-83949-8
• file_owner_cron_allow: Verify User Who Owns /etc/cron.allow file
  • CCE-86844-8
• file_owner_cron_d: Verify Owner on cron.d
  • CCE-84169-2
• file_owner_cron_daily: Verify Owner on cron.daily
  • CCE-84188-2
• file_owner_cron_hourly: Verify Owner on cron.hourly
  • CCE-84168-4
• file_owner_cron_monthly: Verify Owner on cron.monthly
  • CCE-84179-1
• file_owner_cron_weekly: Verify Owner on cron.weekly
  • CCE-84190-8
• file_owner_crontab: Verify Owner on crontab
  • CCE-84167-6
• file_owner_etc_group: Verify User Who Owns group File
  • CCE-83925-8
• file_owner_etc_gshadow: Verify User Who Owns gshadow File
  • CCE-83924-1
• file_owner_etc_issue: Verify ownership of System Login Banner
  • CCE-86700-2
• file_owner_etc_issue_net: Verify ownership of System Login Banner for Remote Connections
  • CCE-86057-7
• file_owner_etc_motd: Verify ownership of Message of the Day Banner
  • CCE-86698-8
• file_owner_etc_passwd: Verify User Who Owns passwd File
  • CCE-83943-1
• file_owner_etc_shadow: Verify User Who Owns shadow File
  • CCE-83926-6
• file_owner_etc_shells: Verify Who Owns /etc/shells File
  • CCE-90435-9
• file_owner_grub2_cfg: Verify /boot/grub2/grub.cfg User Ownership
  • CCE-83845-8
• file_owner_sshd_config: Verify Owner on SSH Server config file
  • CCE-90821-0
• file_owner_user_cfg: Verify /boot/grub2/user.cfg User Ownership
  • CCE-86016-3
• file_ownership_sshd_private_key: Verify Ownership on SSH Server Private *_key Key Files
  • CCE-86119-5
• file_ownership_sshd_pub_key: Verify Ownership on SSH Server Public *.pub Key Files
  • CCE-86130-2
• file_permissions_at_allow: Verify Permissions on /etc/at.allow file
  • CCE-86904-0
• file_permissions_backup_etc_group: Verify Permissions on Backup group File
  • CCE-83939-9
• file_permissions_backup_etc_gshadow: Verify Permissions on Backup gshadow File
  • CCE-83942-3
• file_permissions_backup_etc_passwd: Verify Permissions on Backup passwd File
  • CCE-83940-7
• file_permissions_backup_etc_shadow: Verify Permissions on Backup shadow File
  • CCE-83935-7
• file_permissions_cron_allow: Verify Permissions on /etc/cron.allow file
  • CCE-86877-8
• file_permissions_cron_d: Verify Permissions on cron.d
  • CCE-84183-3
• file_permissions_cron_daily: Verify Permissions on cron.daily
  • CCE-84175-9
• file_permissions_cron_hourly: Verify Permissions on cron.hourly
  • CCE-84173-4
• file_permissions_cron_monthly: Verify Permissions on cron.monthly
  • CCE-84181-7
• file_permissions_cron_weekly: Verify Permissions on cron.weekly
  • CCE-84187-4
• file_permissions_crontab: Verify Permissions on crontab
  • CCE-84176-7
• file_permissions_etc_group: Verify Permissions on group File
  • CCE-83934-0
• file_permissions_etc_gshadow: Verify Permissions on gshadow File
  • CCE-83921-7
• file_permissions_etc_issue: Verify permissions on System Login Banner
  • CCE-83551-2
• file_permissions_etc_issue_net: Verify permissions on System Login Banner for Remote Connections
  • CCE-86048-6
• file_permissions_etc_motd: Verify permissions on Message of the Day Banner
  • CCE-83554-6
• file_permissions_etc_passwd: Verify Permissions on passwd File
  • CCE-83931-6
• file_permissions_etc_shadow: Verify Permissions on shadow File
  • CCE-83941-5
• file_permissions_etc_shells: Verify Permissions on /etc/shells File
  • CCE-90432-6
• file_permissions_grub2_cfg: Verify /boot/grub2/grub.cfg Permissions
  • CCE-83846-6
• file_permissions_sshd_config: Verify Permissions on SSH Server config file
  • CCE-90818-6
• file_permissions_sshd_private_key: Verify Permissions on SSH Server Private *_key Key Files
  • CCE-90820-2
• file_permissions_sshd_pub_key: Verify Permissions on SSH Server Public *.pub Key Files
  • CCE-90819-4
• file_permissions_unauthorized_world_writable: Ensure No World-Writable Files Exist
  • CCE-83902-7
• file_permissions_ungroupowned: Ensure All Files Are Owned by a Group
  • CCE-83906-8
• file_permissions_user_cfg: Verify /boot/grub2/user.cfg Permissions
  • CCE-86025-4
• grub2_enable_selinux: Ensure SELinux Not Disabled in /etc/default/grub
  • CCE-84078-5
• grub2_password: Set Boot Loader Password in grub2
  • CCE-83849-0
• mount_option_dev_shm_nodev: Add nodev Option to /dev/shm
  • CCE-83881-3
• mount_option_dev_shm_noexec: Add noexec Option to /dev/shm
  • CCE-83857-3
• mount_option_dev_shm_nosuid: Add nosuid Option to /dev/shm
  • CCE-83891-2
• mount_option_home_nodev: Add nodev Option to /home
  • CCE-83871-4
• mount_option_home_nosuid: Add nosuid Option to /home
  • CCE-83894-6
• mount_option_tmp_noexec: Add noexec Option to /tmp
  • CCE-83885-4
• mount_option_tmp_nosuid: Add nosuid Option to /tmp
  • CCE-83872-2
• mount_option_var_log_audit_nodev: Add nodev Option to /var/log/audit
  • CCE-83882-1
• mount_option_var_log_audit_noexec: Add noexec Option to /var/log/audit
  • CCE-83878-9
• mount_option_var_log_audit_nosuid: Add nosuid Option to /var/log/audit
  • CCE-83893-8
• mount_option_var_log_nodev: Add nodev Option to /var/log
  • CCE-83886-2
• mount_option_var_log_noexec: Add noexec Option to /var/log
  • CCE-83887-0
• mount_option_var_log_nosuid: Add nosuid Option to /var/log
  • CCE-83870-6
• mount_option_var_nodev: Add nodev Option to /var
  • CCE-83868-0
• mount_option_var_nosuid: Add nosuid Option to /var
  • CCE-83867-2
• mount_option_var_tmp_nodev: Add nodev Option to /var/tmp
  • CCE-83864-9
• mount_option_var_tmp_noexec: Add noexec Option to /var/tmp
  • CCE-83866-4
• mount_option_var_tmp_nosuid: Add nosuid Option to /var/tmp
  • CCE-83863-1
• no_files_unowned_by_user: Ensure All Files Are Owned by a User
  • CCE-83896-1
• package_libselinux_installed: Install libselinux Package
  • CCE-84069-4
• package_mcstrans_removed: Uninstall mcstrans Package
  • CCE-84072-8
• package_setroubleshoot_removed: Uninstall setroubleshoot Package
  • CCE-84073-6
• rsyslog_filecreatemode: Ensure rsyslog Default File Permissions Configured
  • CCE-88322-3
• rsyslog_files_groupownership: Ensure Log Files Are Owned By Appropriate Group
  • CCE-83834-2
• rsyslog_files_ownership: Ensure Log Files Are Owned By Appropriate User
  • CCE-83946-4
• rsyslog_files_permissions: Ensure System Log Files Have Correct Permissions
  • CCE-83689-0
• selinux_not_disabled: Ensure SELinux is Not Disabled
  • CCE-86152-6
• selinux_policytype: Configure SELinux Policy
  • CCE-84074-4
• selinux_state: Ensure SELinux State is Enforcing
  • CCE-84079-3
• sshd_limit_user_access: Limit Users' SSH Access
  • CCE-86817-4
• use_pam_wheel_group_for_su: Enforce Usage of pam_wheel with Group Parameter for su Authentication
  • CCE-86065-0
• var_accounts_user_umask = 027
• var_pam_wheel_group_for_su = cis
• var_selinux_policy_name = targeted
• var_selinux_state = enforcing

CR 2.1 RE(1+2): Authorization enforcement for all users and permission mapping to roles

Description: None

• sl2

Automated: yes

• accounts_umask_etc_bashrc: Ensure the Default Bash Umask is Set Correctly
  • CCE-83644-5
• accounts_umask_etc_login_defs: Ensure the Default Umask is Set Correctly in login.defs
  • CCE-83647-8
• accounts_umask_etc_profile: Ensure the Default Umask is Set Correctly in /etc/profile
  • CCE-90828-5
• audit_rules_immutable: Make the auditd Configuration Immutable
  • CCE-83716-1
• dir_perms_world_writable_sticky_bits: Verify that All World-Writable Directories Have Sticky Bits Set
  • CCE-83895-3
• ensure_pam_wheel_group_empty: Ensure the Group Used by pam_wheel.so Module Exists on System and is Empty
  • CCE-86072-6
• file_at_allow_exists: Ensure that /etc/at.allow exists
  • CCE-86856-2
• file_at_deny_not_exist: Ensure that /etc/at.deny does not exist
  • CCE-86946-1
• file_cron_allow_exists: Ensure that /etc/cron.allow exists
  • CCE-86185-6
• file_cron_deny_not_exist: Ensure that /etc/cron.deny does not exist
  • CCE-86850-5
• file_etc_security_opasswd: Verify Permissions and Ownership of Old Passwords File
  • CCE-86762-2
• file_groupowner_at_allow: Verify Group Who Owns /etc/at.allow file
  • CCE-87103-8
• file_groupowner_backup_etc_group: Verify Group Who Owns Backup group File
  • CCE-83928-2
• file_groupowner_backup_etc_gshadow: Verify Group Who Owns Backup gshadow File
  • CCE-83951-4
• file_groupowner_backup_etc_passwd: Verify Group Who Owns Backup passwd File
  • CCE-83933-2
• file_groupowner_backup_etc_shadow: Verify User Who Owns Backup shadow File
  • CCE-83938-1
• file_groupowner_cron_allow: Verify Group Who Owns /etc/cron.allow file
  • CCE-86830-7
• file_groupowner_cron_d: Verify Group Who Owns cron.d
  • CCE-84177-5
• file_groupowner_cron_daily: Verify Group Who Owns cron.daily
  • CCE-84170-0
• file_groupowner_cron_hourly: Verify Group Who Owns cron.hourly
  • CCE-84186-6
• file_groupowner_cron_monthly: Verify Group Who Owns cron.monthly
  • CCE-84189-0
• file_groupowner_cron_weekly: Verify Group Who Owns cron.weekly
  • CCE-84174-2
• file_groupowner_crontab: Verify Group Who Owns Crontab
  • CCE-84171-8
• file_groupowner_etc_group: Verify Group Who Owns group File
  • CCE-83945-6
• file_groupowner_etc_gshadow: Verify Group Who Owns gshadow File
  • CCE-83948-0
• file_groupowner_etc_issue: Verify Group Ownership of System Login Banner
  • CCE-86699-6
• file_groupowner_etc_issue_net: Verify Group Ownership of System Login Banner for Remote Connections
  • CCE-86052-8
• file_groupowner_etc_motd: Verify Group Ownership of Message of the Day Banner
  • CCE-86697-0
• file_groupowner_etc_passwd: Verify Group Who Owns passwd File
  • CCE-83950-6
• file_groupowner_etc_shadow: Verify Group Who Owns shadow File
  • CCE-83930-8
• file_groupowner_etc_shells: Verify Group Who Owns /etc/shells File
  • CCE-90434-2
• file_groupowner_grub2_cfg: Verify /boot/grub2/grub.cfg Group Ownership
  • CCE-83848-2
• file_groupowner_sshd_config: Verify Group Who Owns SSH Server config file
  • CCE-90817-8
• file_groupowner_user_cfg: Verify /boot/grub2/user.cfg Group Ownership
  • CCE-86010-6
• file_groupownership_sshd_private_key: Verify Group Ownership on SSH Server Private *_key Key Files
  • CCE-86127-8
• file_groupownership_sshd_pub_key: Verify Group Ownership on SSH Server Public *.pub Key Files
  • CCE-86136-9
• file_owner_backup_etc_group: Verify User Who Owns Backup group File
  • CCE-83944-9
• file_owner_backup_etc_gshadow: Verify User Who Owns Backup gshadow File
  • CCE-83929-0
• file_owner_backup_etc_passwd: Verify User Who Owns Backup passwd File
  • CCE-83947-2
• file_owner_backup_etc_shadow: Verify Group Who Owns Backup shadow File
  • CCE-83949-8
• file_owner_cron_allow: Verify User Who Owns /etc/cron.allow file
  • CCE-86844-8
• file_owner_cron_d: Verify Owner on cron.d
  • CCE-84169-2
• file_owner_cron_daily: Verify Owner on cron.daily
  • CCE-84188-2
• file_owner_cron_hourly: Verify Owner on cron.hourly
  • CCE-84168-4
• file_owner_cron_monthly: Verify Owner on cron.monthly
  • CCE-84179-1
• file_owner_cron_weekly: Verify Owner on cron.weekly
  • CCE-84190-8
• file_owner_crontab: Verify Owner on crontab
  • CCE-84167-6
• file_owner_etc_group: Verify User Who Owns group File
  • CCE-83925-8
• file_owner_etc_gshadow: Verify User Who Owns gshadow File
  • CCE-83924-1
• file_owner_etc_issue: Verify ownership of System Login Banner
  • CCE-86700-2
• file_owner_etc_issue_net: Verify ownership of System Login Banner for Remote Connections
  • CCE-86057-7
• file_owner_etc_motd: Verify ownership of Message of the Day Banner
  • CCE-86698-8
• file_owner_etc_passwd: Verify User Who Owns passwd File
  • CCE-83943-1
• file_owner_etc_shadow: Verify User Who Owns shadow File
  • CCE-83926-6
• file_owner_etc_shells: Verify Who Owns /etc/shells File
  • CCE-90435-9
• file_owner_grub2_cfg: Verify /boot/grub2/grub.cfg User Ownership
  • CCE-83845-8
• file_owner_sshd_config: Verify Owner on SSH Server config file
  • CCE-90821-0
• file_owner_user_cfg: Verify /boot/grub2/user.cfg User Ownership
  • CCE-86016-3
• file_ownership_sshd_private_key: Verify Ownership on SSH Server Private *_key Key Files
  • CCE-86119-5
• file_ownership_sshd_pub_key: Verify Ownership on SSH Server Public *.pub Key Files
  • CCE-86130-2
• file_permissions_at_allow: Verify Permissions on /etc/at.allow file
  • CCE-86904-0
• file_permissions_backup_etc_group: Verify Permissions on Backup group File
  • CCE-83939-9
• file_permissions_backup_etc_gshadow: Verify Permissions on Backup gshadow File
  • CCE-83942-3
• file_permissions_backup_etc_passwd: Verify Permissions on Backup passwd File
  • CCE-83940-7
• file_permissions_backup_etc_shadow: Verify Permissions on Backup shadow File
  • CCE-83935-7
• file_permissions_cron_allow: Verify Permissions on /etc/cron.allow file
  • CCE-86877-8
• file_permissions_cron_d: Verify Permissions on cron.d
  • CCE-84183-3
• file_permissions_cron_daily: Verify Permissions on cron.daily
  • CCE-84175-9
• file_permissions_cron_hourly: Verify Permissions on cron.hourly
  • CCE-84173-4
• file_permissions_cron_monthly: Verify Permissions on cron.monthly
  • CCE-84181-7
• file_permissions_cron_weekly: Verify Permissions on cron.weekly
  • CCE-84187-4
• file_permissions_crontab: Verify Permissions on crontab
  • CCE-84176-7
• file_permissions_etc_group: Verify Permissions on group File
  • CCE-83934-0
• file_permissions_etc_gshadow: Verify Permissions on gshadow File
  • CCE-83921-7
• file_permissions_etc_issue: Verify permissions on System Login Banner
  • CCE-83551-2
• file_permissions_etc_issue_net: Verify permissions on System Login Banner for Remote Connections
  • CCE-86048-6
• file_permissions_etc_motd: Verify permissions on Message of the Day Banner
  • CCE-83554-6
• file_permissions_etc_passwd: Verify Permissions on passwd File
  • CCE-83931-6
• file_permissions_etc_shadow: Verify Permissions on shadow File
  • CCE-83941-5
• file_permissions_etc_shells: Verify Permissions on /etc/shells File
  • CCE-90432-6
• file_permissions_grub2_cfg: Verify /boot/grub2/grub.cfg Permissions
  • CCE-83846-6
• file_permissions_sshd_config: Verify Permissions on SSH Server config file
  • CCE-90818-6
• file_permissions_sshd_private_key: Verify Permissions on SSH Server Private *_key Key Files
  • CCE-90820-2
• file_permissions_sshd_pub_key: Verify Permissions on SSH Server Public *.pub Key Files
  • CCE-90819-4
• file_permissions_unauthorized_world_writable: Ensure No World-Writable Files Exist
  • CCE-83902-7
• file_permissions_ungroupowned: Ensure All Files Are Owned by a Group
  • CCE-83906-8
• file_permissions_user_cfg: Verify /boot/grub2/user.cfg Permissions
  • CCE-86025-4
• grub2_enable_selinux: Ensure SELinux Not Disabled in /etc/default/grub
  • CCE-84078-5
• grub2_password: Set Boot Loader Password in grub2
  • CCE-83849-0
• mount_option_dev_shm_nodev: Add nodev Option to /dev/shm
  • CCE-83881-3
• mount_option_dev_shm_noexec: Add noexec Option to /dev/shm
  • CCE-83857-3
• mount_option_dev_shm_nosuid: Add nosuid Option to /dev/shm
  • CCE-83891-2
• mount_option_home_nodev: Add nodev Option to /home
  • CCE-83871-4
• mount_option_home_nosuid: Add nosuid Option to /home
  • CCE-83894-6
• mount_option_tmp_noexec: Add noexec Option to /tmp
  • CCE-83885-4
• mount_option_tmp_nosuid: Add nosuid Option to /tmp
  • CCE-83872-2
• mount_option_var_log_audit_nodev: Add nodev Option to /var/log/audit
  • CCE-83882-1
• mount_option_var_log_audit_noexec: Add noexec Option to /var/log/audit
  • CCE-83878-9
• mount_option_var_log_audit_nosuid: Add nosuid Option to /var/log/audit
  • CCE-83893-8
• mount_option_var_log_nodev: Add nodev Option to /var/log
  • CCE-83886-2
• mount_option_var_log_noexec: Add noexec Option to /var/log
  • CCE-83887-0
• mount_option_var_log_nosuid: Add nosuid Option to /var/log
  • CCE-83870-6
• mount_option_var_nodev: Add nodev Option to /var
  • CCE-83868-0
• mount_option_var_nosuid: Add nosuid Option to /var
  • CCE-83867-2
• mount_option_var_tmp_nodev: Add nodev Option to /var/tmp
  • CCE-83864-9
• mount_option_var_tmp_noexec: Add noexec Option to /var/tmp
  • CCE-83866-4
• mount_option_var_tmp_nosuid: Add nosuid Option to /var/tmp
  • CCE-83863-1
• no_files_unowned_by_user: Ensure All Files Are Owned by a User
  • CCE-83896-1
• package_libselinux_installed: Install libselinux Package
  • CCE-84069-4
• package_mcstrans_removed: Uninstall mcstrans Package
  • CCE-84072-8
• package_setroubleshoot_removed: Uninstall setroubleshoot Package
  • CCE-84073-6
• rsyslog_filecreatemode: Ensure rsyslog Default File Permissions Configured
  • CCE-88322-3
• rsyslog_files_groupownership: Ensure Log Files Are Owned By Appropriate Group
  • CCE-83834-2
• rsyslog_files_ownership: Ensure Log Files Are Owned By Appropriate User
  • CCE-83946-4
• rsyslog_files_permissions: Ensure System Log Files Have Correct Permissions
  • CCE-83689-0
• selinux_not_disabled: Ensure SELinux is Not Disabled
  • CCE-86152-6
• selinux_policytype: Configure SELinux Policy
  • CCE-84074-4
• selinux_state: Ensure SELinux State is Enforcing
  • CCE-84079-3
• sshd_disable_root_login: Disable SSH Root Login
  • CCE-90800-4
• sshd_limit_user_access: Limit Users' SSH Access
  • CCE-86817-4
• sudo_add_use_pty: Ensure Only Users Logged In To Real tty Can Execute Sudo - sudo use_pty
  • CCE-83538-9
• sudo_remove_no_authenticate: Ensure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
  • CCE-83544-7
• sudo_remove_nopasswd: Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
  • CCE-83536-3
• use_pam_wheel_group_for_su: Enforce Usage of pam_wheel with Group Parameter for su Authentication
  • CCE-86065-0
• var_accounts_user_umask = 027
• var_pam_wheel_group_for_su = cis
• var_selinux_policy_name = targeted
• var_selinux_state = enforcing

CR 2.2: Wireless use control

Description: None

• sl1

Automated: yes

• wireless_disable_interfaces: Deactivate Wireless Network Interfaces
  • CCE-84066-0

HDR 2.4: Mobile code

Description: None

• sl1

Automated: yes

• dconf_gnome_disable_autorun: Disable GNOME3 Automount running
  • CCE-90257-7
• file_ownership_var_log_audit_stig: System Audit Logs Must Be Owned By Root
  • CCE-89952-6
• gnome_gdm_disable_xdmcp: Disable XDMCP in GDM
  • CCE-86033-8
• has_nonlocal_mta: Ensure Mail Transfer Agent is not Listening on any non-loopback Address
  • CCE-88499-9
• kernel_module_cramfs_disabled: Disable Mounting of cramfs
  • CCE-83853-2
• kernel_module_dccp_disabled: Disable DCCP Support
  • CCE-84136-1
• kernel_module_freevxfs_disabled: Disable Mounting of freevxfs
  • CCE-86763-0
• kernel_module_hfs_disabled: Disable Mounting of hfs
  • CCE-86764-8
• kernel_module_hfsplus_disabled: Disable Mounting of hfsplus
  • CCE-86765-5
• kernel_module_jffs2_disabled: Disable Mounting of jffs2
  • CCE-86766-3
• kernel_module_rds_disabled: Disable RDS Support
  • CCE-84064-5
• kernel_module_sctp_disabled: Disable SCTP Support
  • CCE-84139-5
• kernel_module_squashfs_disabled: Disable Mounting of squashfs
  • CCE-83855-7
• kernel_module_tipc_disabled: Disable TIPC Support
  • CCE-84065-2
• kernel_module_udf_disabled: Disable Mounting of udf
  • CCE-83852-4
• kernel_module_usb-storage_disabled: Disable Modprobe Loading of USB Storage Driver
  • CCE-83851-6
• mount_option_dev_shm_nodev: Add nodev Option to /dev/shm
  • CCE-83881-3
• mount_option_dev_shm_noexec: Add noexec Option to /dev/shm
  • CCE-83857-3
• mount_option_dev_shm_nosuid: Add nosuid Option to /dev/shm
  • CCE-83891-2
• mount_option_tmp_nodev: Add nodev Option to /tmp
  • CCE-83869-8
• mount_option_tmp_noexec: Add noexec Option to /tmp
  • CCE-83885-4
• mount_option_tmp_nosuid: Add nosuid Option to /tmp
  • CCE-83872-2
• package_bind_removed: Uninstall bind Package
  • CCE-86505-5
• package_cyrus-imapd_removed: Uninstall cyrus-imapd Package
  • CCE-88120-1
• package_dhcp_removed: Uninstall DHCP Server Package
  • CCE-84240-1
• package_dovecot_removed: Uninstall dovecot Package
  • CCE-85977-7
• package_ftp_removed: Remove ftp Package
  • CCE-86075-9
• package_gdm_removed: Remove the GDM Package Group
  • CCE-83549-6
• package_httpd_removed: Uninstall httpd Package
  • CCE-85974-4
• package_net-snmp_removed: Uninstall net-snmp Package
  • CCE-85981-9
• package_nginx_removed: Uninstall nginx Package
  • CCE-88035-1
• package_openldap-clients_removed: Ensure LDAP client is not installed
  • CCE-90831-9
• package_telnet-server_removed: Uninstall telnet-server Package
  • CCE-84149-4
• package_telnet_removed: Remove telnet Clients
  • CCE-84146-0
• package_tftp-server_removed: Uninstall tftp-server Package
  • CCE-84154-4
• package_tftp_removed: Remove tftp Daemon
  • CCE-84153-6
• package_vsftpd_removed: Uninstall vsftpd Package
  • CCE-84159-3
• package_xorg-x11-server-common_removed: Remove the X Windows Package Group
  • CCE-84104-9
• partition_for_dev_shm: Ensure /dev/shm is configured
  • CCE-86283-9
• partition_for_home: Ensure /home Located On Separate Partition
  • CCE-83468-9
• partition_for_tmp: Ensure /tmp Located On Separate Partition
  • CCE-90845-9
• partition_for_var: Ensure /var Located On Separate Partition
  • CCE-83466-3
• partition_for_var_log: Ensure /var/log Located On Separate Partition
  • CCE-90848-3
• partition_for_var_log_audit: Ensure /var/log/audit Located On Separate Partition
  • CCE-90847-5
• partition_for_var_tmp: Ensure /var/tmp Located On Separate Partition
  • CCE-83487-9
• postfix_network_listening_disabled: Disable Postfix Network Listening
  • CCE-90825-1
• service_autofs_disabled: Disable the Automounter
  • CCE-83850-8
• service_bluetooth_disabled: Disable Bluetooth Service
  • CCE-86761-4
• service_cups_disabled: Disable the CUPS Service
  • CCE-90795-6
• service_dnsmasq_disabled: Disable dnsmasq Service
  • CCE-90721-2
• service_nftables_disabled: Verify nftables Service is Disabled
  • CCE-88429-6
• sshd_disable_forwarding: Disable SSH Forwarding
  • CCE-90197-5
• var_postfix_inet_interfaces = loopback-only
• wireless_disable_interfaces: Deactivate Wireless Network Interfaces
  • CCE-84066-0
• xwindows_runlevel_target: Disable Graphical Environment Startup By Setting Default Target
  • CCE-84105-6

HDR 2.4 RE(1): Mobile code authenticity check

Description: None

• sl2

Automated: yes

• dconf_gnome_disable_autorun: Disable GNOME3 Automount running
  • CCE-90257-7
• file_ownership_var_log_audit_stig: System Audit Logs Must Be Owned By Root
  • CCE-89952-6
• gnome_gdm_disable_xdmcp: Disable XDMCP in GDM
  • CCE-86033-8
• has_nonlocal_mta: Ensure Mail Transfer Agent is not Listening on any non-loopback Address
  • CCE-88499-9
• kernel_module_cramfs_disabled: Disable Mounting of cramfs
  • CCE-83853-2
• kernel_module_dccp_disabled: Disable DCCP Support
  • CCE-84136-1
• kernel_module_freevxfs_disabled: Disable Mounting of freevxfs
  • CCE-86763-0
• kernel_module_hfs_disabled: Disable Mounting of hfs
  • CCE-86764-8
• kernel_module_hfsplus_disabled: Disable Mounting of hfsplus
  • CCE-86765-5
• kernel_module_jffs2_disabled: Disable Mounting of jffs2
  • CCE-86766-3
• kernel_module_rds_disabled: Disable RDS Support
  • CCE-84064-5
• kernel_module_sctp_disabled: Disable SCTP Support
  • CCE-84139-5
• kernel_module_squashfs_disabled: Disable Mounting of squashfs
  • CCE-83855-7
• kernel_module_tipc_disabled: Disable TIPC Support
  • CCE-84065-2
• kernel_module_udf_disabled: Disable Mounting of udf
  • CCE-83852-4
• kernel_module_usb-storage_disabled: Disable Modprobe Loading of USB Storage Driver
  • CCE-83851-6
• mount_option_dev_shm_nodev: Add nodev Option to /dev/shm
  • CCE-83881-3
• mount_option_dev_shm_noexec: Add noexec Option to /dev/shm
  • CCE-83857-3
• mount_option_dev_shm_nosuid: Add nosuid Option to /dev/shm
  • CCE-83891-2
• mount_option_tmp_nodev: Add nodev Option to /tmp
  • CCE-83869-8
• mount_option_tmp_noexec: Add noexec Option to /tmp
  • CCE-83885-4
• mount_option_tmp_nosuid: Add nosuid Option to /tmp
  • CCE-83872-2
• package_bind_removed: Uninstall bind Package
  • CCE-86505-5
• package_cyrus-imapd_removed: Uninstall cyrus-imapd Package
  • CCE-88120-1
• package_dhcp_removed: Uninstall DHCP Server Package
  • CCE-84240-1
• package_dovecot_removed: Uninstall dovecot Package
  • CCE-85977-7
• package_ftp_removed: Remove ftp Package
  • CCE-86075-9
• package_gdm_removed: Remove the GDM Package Group
  • CCE-83549-6
• package_httpd_removed: Uninstall httpd Package
  • CCE-85974-4
• package_net-snmp_removed: Uninstall net-snmp Package
  • CCE-85981-9
• package_nginx_removed: Uninstall nginx Package
  • CCE-88035-1
• package_openldap-clients_removed: Ensure LDAP client is not installed
  • CCE-90831-9
• package_telnet-server_removed: Uninstall telnet-server Package
  • CCE-84149-4
• package_telnet_removed: Remove telnet Clients
  • CCE-84146-0
• package_tftp-server_removed: Uninstall tftp-server Package
  • CCE-84154-4
• package_tftp_removed: Remove tftp Daemon
  • CCE-84153-6
• package_vsftpd_removed: Uninstall vsftpd Package
  • CCE-84159-3
• package_xorg-x11-server-common_removed: Remove the X Windows Package Group
  • CCE-84104-9
• partition_for_dev_shm: Ensure /dev/shm is configured
  • CCE-86283-9
• partition_for_home: Ensure /home Located On Separate Partition
  • CCE-83468-9
• partition_for_tmp: Ensure /tmp Located On Separate Partition
  • CCE-90845-9
• partition_for_var: Ensure /var Located On Separate Partition
  • CCE-83466-3
• partition_for_var_log: Ensure /var/log Located On Separate Partition
  • CCE-90848-3
• partition_for_var_log_audit: Ensure /var/log/audit Located On Separate Partition
  • CCE-90847-5
• partition_for_var_tmp: Ensure /var/tmp Located On Separate Partition
  • CCE-83487-9
• postfix_network_listening_disabled: Disable Postfix Network Listening
  • CCE-90825-1
• service_autofs_disabled: Disable the Automounter
  • CCE-83850-8
• service_bluetooth_disabled: Disable Bluetooth Service
  • CCE-86761-4
• service_cups_disabled: Disable the CUPS Service
  • CCE-90795-6
• service_dnsmasq_disabled: Disable dnsmasq Service
  • CCE-90721-2
• service_nftables_disabled: Verify nftables Service is Disabled
  • CCE-88429-6
• sshd_disable_forwarding: Disable SSH Forwarding
  • CCE-90197-5
• var_postfix_inet_interfaces = loopback-only
• wireless_disable_interfaces: Deactivate Wireless Network Interfaces
  • CCE-84066-0
• xwindows_runlevel_target: Disable Graphical Environment Startup By Setting Default Target
  • CCE-84105-6

CR 2.5: Session lock

Description: None

• sl1

Automated: yes

• dconf_gnome_screensaver_idle_delay: Set GNOME3 Screensaver Inactivity Timeout
  • CCE-86510-5
• dconf_gnome_screensaver_lock_delay: Set GNOME3 Screensaver Lock Delay After Activation Period
  • CCE-86954-5
• dconf_gnome_screensaver_user_locks: Ensure Users Cannot Change GNOME3 Screensaver Settings
  • CCE-87491-7
• dconf_gnome_session_idle_user_locks: Ensure Users Cannot Change GNOME3 Session Idle Settings
  • CCE-85971-0
• var_screensaver_lock_delay = 5_seconds

CR 2.6: Remote session termination

Description: None

• sl2

Automated: yes

• configure_custom_crypto_policy_cis: Implement Custom Crypto Policy Modules for CIS Benchmark
  • CCE-88900-6

CR 2.8: Auditable events

Description: None

• sl1

Automated: yes

• aide_build_database: Build and Test AIDE Database
  • CCE-83438-2
• aide_periodic_cron_checking: Configure Periodic Execution of AIDE
  • CCE-83437-4
• audit_rules_dac_modification_chmod: Record Events that Modify the System's Discretionary Access Controls - chmod
  • CCE-83830-0
• audit_rules_dac_modification_chown: Record Events that Modify the System's Discretionary Access Controls - chown
  • CCE-83812-8
• audit_rules_dac_modification_fchmod: Record Events that Modify the System's Discretionary Access Controls - fchmod
  • CCE-83832-6
• audit_rules_dac_modification_fchmodat: Record Events that Modify the System's Discretionary Access Controls - fchmodat
  • CCE-83822-7
• audit_rules_dac_modification_fchown: Record Events that Modify the System's Discretionary Access Controls - fchown
  • CCE-83829-2
• audit_rules_dac_modification_fchownat: Record Events that Modify the System's Discretionary Access Controls - fchownat
  • CCE-83831-8
• audit_rules_dac_modification_fremovexattr: Record Events that Modify the System's Discretionary Access Controls - fremovexattr
  • CCE-83821-9
• audit_rules_dac_modification_fsetxattr: Record Events that Modify the System's Discretionary Access Controls - fsetxattr
  • CCE-83817-7
• audit_rules_dac_modification_lchown: Record Events that Modify the System's Discretionary Access Controls - lchown
  • CCE-83833-4
• audit_rules_dac_modification_lremovexattr: Record Events that Modify the System's Discretionary Access Controls - lremovexattr
  • CCE-83814-4
• audit_rules_dac_modification_lsetxattr: Record Events that Modify the System's Discretionary Access Controls - lsetxattr
  • CCE-83808-6
• audit_rules_dac_modification_removexattr: Record Events that Modify the System's Discretionary Access Controls - removexattr
  • CCE-83807-8
• audit_rules_dac_modification_setxattr: Record Events that Modify the System's Discretionary Access Controls - setxattr
  • CCE-83811-0
• audit_rules_execution_chacl: Record Any Attempts to Run chacl
  • CCE-87685-4
• audit_rules_execution_chcon: Record Any Attempts to Run chcon
  • CCE-83748-4
• audit_rules_execution_setfacl: Record Any Attempts to Run setfacl
  • CCE-90482-1
• audit_rules_file_deletion_events_rename: Ensure auditd Collects File Deletion Events by User - rename
  • CCE-83754-2
• audit_rules_file_deletion_events_renameat: Ensure auditd Collects File Deletion Events by User - renameat
  • CCE-83756-7
• audit_rules_file_deletion_events_unlink: Ensure auditd Collects File Deletion Events by User - unlink
  • CCE-83757-5
• audit_rules_file_deletion_events_unlinkat: Ensure auditd Collects File Deletion Events by User - unlinkat
  • CCE-83755-9
• audit_rules_kernel_module_loading_create: Ensure auditd Collects Information on Kernel Module Unloading - create_module
  • CCE-88436-1
• audit_rules_kernel_module_loading_delete: Ensure auditd Collects Information on Kernel Module Unloading - delete_module
  • CCE-83802-9
• audit_rules_kernel_module_loading_finit: Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
  • CCE-83803-7
• audit_rules_kernel_module_loading_init: Ensure auditd Collects Information on Kernel Module Loading - init_module
  • CCE-90835-0
• audit_rules_kernel_module_loading_query: Ensure auditd Collects Information on Kernel Module Loading and Unloading - query_module
  • CCE-88749-7
• audit_rules_login_events_faillock: Record Attempts to Alter Logon and Logout Events - faillock
  • CCE-83783-1
• audit_rules_login_events_lastlog: Record Attempts to Alter Logon and Logout Events - lastlog
  • CCE-83785-6
• audit_rules_mac_modification: Record Events that Modify the System's Mandatory Access Controls
  • CCE-83721-1
• audit_rules_mac_modification_usr_share: Record Events that Modify the System's Mandatory Access Controls in usr/share
  • CCE-86343-1
• audit_rules_media_export: Ensure auditd Collects Information on Exporting to Media (successful)
  • CCE-83735-1
• audit_rules_networkconfig_modification: Record Events that Modify the System's Network Environment
  • CCE-83706-2
• audit_rules_networkconfig_modification_hostname_file: Record Events that Modify the System's Network Environment - /etc/hostname
  • CCE-86603-8
• audit_rules_networkconfig_modification_network_scripts: Record Events that Modify the System's Network Environment - /etc/sysconfig/network-scripts
  • CCE-86940-4
• audit_rules_networkconfig_modification_networkmanager: Record Events that Modify the System's Network Environment - /etc/NetworkManager/
  • CCE-86481-9
• audit_rules_privileged_commands: Ensure auditd Collects Information on the Use of Privileged Commands
  • CCE-83759-1
• audit_rules_privileged_commands_kmod: Ensure auditd Collects Information on the Use of Privileged Commands - kmod
  • CCE-90262-7
• audit_rules_privileged_commands_usermod: Ensure auditd Collects Information on the Use of Privileged Commands - usermod
  • CCE-87212-7
• audit_rules_session_events_btmp: Record Attempts to Alter Process and Session Initiation Information btmp
  • CCE-86198-9
• audit_rules_session_events_utmp: Record Attempts to Alter Process and Session Initiation Information utmp
  • CCE-86202-9
• audit_rules_session_events_wtmp: Record Attempts to Alter Process and Session Initiation Information wtmp
  • CCE-86203-7
• audit_rules_suid_auid_privilege_function: Record Events When Executables Are Run As Another User
  • CCE-86368-8
• audit_rules_sysadmin_actions: Ensure auditd Collects System Administrator Actions
  • CCE-83729-4
• audit_rules_time_adjtimex: Record attempts to alter time through adjtimex
  • CCE-83840-9
• audit_rules_time_clock_settime: Record Attempts to Alter Time Through clock_settime
  • CCE-83837-5
• audit_rules_time_settimeofday: Record attempts to alter time through settimeofday
  • CCE-83836-7
• audit_rules_time_watch_localtime: Record Attempts to Alter the localtime File
  • CCE-83839-1
• audit_rules_unsuccessful_file_modification_creat: Record Unsuccessful Access Attempts to Files - creat
  • CCE-83786-4
• audit_rules_unsuccessful_file_modification_ftruncate: Record Unsuccessful Access Attempts to Files - ftruncate
  • CCE-83800-3
• audit_rules_unsuccessful_file_modification_open: Record Unsuccessful Access Attempts to Files - open
  • CCE-83801-1
• audit_rules_unsuccessful_file_modification_openat: Record Unsuccessful Access Attempts to Files - openat
  • CCE-83794-8
• audit_rules_unsuccessful_file_modification_truncate: Record Unsuccessful Access Attempts to Files - truncate
  • CCE-83792-2
• audit_rules_usergroup_modification_group: Record Events that Modify User/Group Information - /etc/group
  • CCE-83722-9
• audit_rules_usergroup_modification_gshadow: Record Events that Modify User/Group Information - /etc/gshadow
  • CCE-83723-7
• audit_rules_usergroup_modification_nsswitch_conf: Record Events that Modify User/Group Information - /etc/nsswitch.conf
  • CCE-86213-6
• audit_rules_usergroup_modification_opasswd: Record Events that Modify User/Group Information - /etc/security/opasswd
  • CCE-83712-0
• audit_rules_usergroup_modification_pam_conf: Record Events that Modify User/Group Information - /etc/pam.conf
  • CCE-86212-8
• audit_rules_usergroup_modification_pamd: Record Events that Modify User/Group Information - /etc/pam.d/
  • CCE-86211-0
• audit_rules_usergroup_modification_passwd: Record Events that Modify User/Group Information - /etc/passwd
  • CCE-83714-6
• audit_rules_usergroup_modification_shadow: Record Events that Modify User/Group Information - /etc/shadow
  • CCE-83725-2
• audit_sudo_log_events: Record Attempts to perform maintenance activities
  • CCE-86433-0
• auditd_data_disk_error_action: Configure auditd Disk Error Action on Disk Error
  • CCE-83690-8
• auditd_data_disk_full_action: Configure auditd Disk Full Action when Disk Space Is Full
  • CCE-83684-1
• auditd_data_retention_action_mail_acct: Configure auditd mail_acct Action on Low Disk Space
  • CCE-83698-1
• auditd_data_retention_admin_space_left_action: Configure auditd admin_space_left Action on Low Disk Space
  • CCE-83700-5
• auditd_data_retention_space_left_action: Configure auditd space_left Action on Low Disk Space
  • CCE-83703-9
• chronyd_specify_remote_server: A remote time server for Chrony is configured
  • CCE-84218-7
• directory_permissions_var_log_audit: System Audit Logs Must Have Mode 0750 or Less Permissive
  • CCE-83734-4
• ensure_journald_and_rsyslog_not_active_together: Ensure journald and rsyslog Are Not Active Together
  • CCE-90715-4
• file_groupownership_audit_binaries: Verify that audit tools are owned by group root
  • CCE-86457-9
• file_ownership_var_log_audit_stig: System Audit Logs Must Be Owned By Root
  • CCE-89952-6
• file_permissions_audit_binaries: Verify that audit tools Have Mode 0755 or less
  • CCE-86448-8
• file_permissions_audit_configuration: Audit Configuration Files Permissions are 640 or More Restrictive
  • CCE-88002-1
• grub2_audit_argument: Enable Auditing for Processes Which Start Prior to the Audit Daemon
  • CCE-83651-0
• grub2_audit_backlog_limit_argument: Extend Audit Backlog Limit for the Audit Daemon
  • CCE-83652-8
• journald_storage: Ensure journald is configured to write log files to persistent disk
  • CCE-86046-0
• package_aide_installed: Install AIDE
  • CCE-90843-4
• package_audit-libs_installed: Ensure the audit-libs package as a part of audit Subsystem is Installed
  • CCE-86772-1
• package_audit_installed: Ensure the audit Subsystem is Installed
  • CCE-83649-4
• package_chrony_installed: The Chrony package is installed
  • CCE-84215-3
• package_systemd-journal-remote_installed: Install systemd-journal-remote Package
  • CCE-86760-6
• service_auditd_enabled: Enable auditd Service
  • CCE-90829-3
• service_systemd-journald_enabled: Enable systemd-journald Service
  • CCE-85941-3
• socket_systemd-journal-remote_disabled: Disable systemd-journal-remote Socket
  • CCE-87606-0
• sshd_max_auth_tries_value = 4
• sshd_set_loglevel_verbose: Set SSH Daemon LogLevel to VERBOSE
  • CCE-86923-0
• sshd_set_max_auth_tries: Set SSH authentication attempt limit
  • CCE-90810-3
• sudo_custom_logfile: Ensure Sudo Logfile Exists - sudo logfile
  • CCE-83527-2
• sysctl_net_ipv4_conf_all_log_martians: Enable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
  • CCE-84000-9
• sysctl_net_ipv4_conf_default_log_martians: Enable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces by Default
  • CCE-84014-0
• var_audit_backlog_limit = 8192
• var_auditd_action_mail_acct = root
• var_auditd_admin_space_left_action = cis_rhel9
• var_auditd_space_left_action = cis_rhel9
• var_multiple_time_servers = rhel

CR 2.9: Audit storage capacity

Description: None

• sl1

Automated: yes

• journald_compress: Ensure journald is configured to compress large log files
  • CCE-85931-4

CR 2.10: Response to audit processing failures

Description: None

• sl1

Automated: yes

• auditd_data_disk_error_action: Configure auditd Disk Error Action on Disk Error
  • CCE-83690-8
• auditd_data_disk_full_action: Configure auditd Disk Full Action when Disk Space Is Full
  • CCE-83684-1
• package_postfix_installed: The Postfix package is installed
  • CCE-85984-3
• var_auditd_disk_error_action = cis_rhel9
• var_auditd_disk_full_action = cis_rhel9

CR 2.11: Timestamps

Description: None

• sl1

Automated: yes

• auditd_data_retention_max_log_file: Configure auditd Max Log File Size
  • CCE-83683-3
• auditd_data_retention_max_log_file_action: Configure auditd max_log_file_action Upon Reaching Maximum Log Size
  • CCE-83701-3
• var_auditd_max_log_file = 6
• var_auditd_max_log_file_action = keep_logs

CR 2.11 RE(1): Time synchronization

Description: None

• sl2

Automated: yes

• auditd_data_retention_max_log_file: Configure auditd Max Log File Size
  • CCE-83683-3
• auditd_data_retention_max_log_file_action: Configure auditd max_log_file_action Upon Reaching Maximum Log Size
  • CCE-83701-3
• var_auditd_max_log_file = 6
• var_auditd_max_log_file_action = keep_logs

CR 2.12: Non-repudiation

Description: None

• sl1

Automated: no

No rules selected

HDR 2.13: Use of physical diagnostic and test interfaces

Description: None

• sl2

Automated: yes

• accounts_umask_etc_bashrc: Ensure the Default Bash Umask is Set Correctly
  • CCE-83644-5
• accounts_umask_etc_login_defs: Ensure the Default Umask is Set Correctly in login.defs
  • CCE-83647-8
• accounts_umask_etc_profile: Ensure the Default Umask is Set Correctly in /etc/profile
  • CCE-90828-5
• audit_rules_immutable: Make the auditd Configuration Immutable
  • CCE-83716-1
• dconf_gnome_disable_autorun: Disable GNOME3 Automount running
  • CCE-90257-7
• dir_perms_world_writable_sticky_bits: Verify that All World-Writable Directories Have Sticky Bits Set
  • CCE-83895-3
• ensure_pam_wheel_group_empty: Ensure the Group Used by pam_wheel.so Module Exists on System and is Empty
  • CCE-86072-6
• file_at_allow_exists: Ensure that /etc/at.allow exists
  • CCE-86856-2
• file_at_deny_not_exist: Ensure that /etc/at.deny does not exist
  • CCE-86946-1
• file_cron_allow_exists: Ensure that /etc/cron.allow exists
  • CCE-86185-6
• file_cron_deny_not_exist: Ensure that /etc/cron.deny does not exist
  • CCE-86850-5
• file_etc_security_opasswd: Verify Permissions and Ownership of Old Passwords File
  • CCE-86762-2
• file_groupowner_at_allow: Verify Group Who Owns /etc/at.allow file
  • CCE-87103-8
• file_groupowner_backup_etc_group: Verify Group Who Owns Backup group File
  • CCE-83928-2
• file_groupowner_backup_etc_gshadow: Verify Group Who Owns Backup gshadow File
  • CCE-83951-4
• file_groupowner_backup_etc_passwd: Verify Group Who Owns Backup passwd File
  • CCE-83933-2
• file_groupowner_backup_etc_shadow: Verify User Who Owns Backup shadow File
  • CCE-83938-1
• file_groupowner_cron_allow: Verify Group Who Owns /etc/cron.allow file
  • CCE-86830-7
• file_groupowner_cron_d: Verify Group Who Owns cron.d
  • CCE-84177-5
• file_groupowner_cron_daily: Verify Group Who Owns cron.daily
  • CCE-84170-0
• file_groupowner_cron_hourly: Verify Group Who Owns cron.hourly
  • CCE-84186-6
• file_groupowner_cron_monthly: Verify Group Who Owns cron.monthly
  • CCE-84189-0
• file_groupowner_cron_weekly: Verify Group Who Owns cron.weekly
  • CCE-84174-2
• file_groupowner_crontab: Verify Group Who Owns Crontab
  • CCE-84171-8
• file_groupowner_etc_group: Verify Group Who Owns group File
  • CCE-83945-6
• file_groupowner_etc_gshadow: Verify Group Who Owns gshadow File
  • CCE-83948-0
• file_groupowner_etc_issue: Verify Group Ownership of System Login Banner
  • CCE-86699-6
• file_groupowner_etc_issue_net: Verify Group Ownership of System Login Banner for Remote Connections
  • CCE-86052-8
• file_groupowner_etc_motd: Verify Group Ownership of Message of the Day Banner
  • CCE-86697-0
• file_groupowner_etc_passwd: Verify Group Who Owns passwd File
  • CCE-83950-6
• file_groupowner_etc_shadow: Verify Group Who Owns shadow File
  • CCE-83930-8
• file_groupowner_etc_shells: Verify Group Who Owns /etc/shells File
  • CCE-90434-2
• file_groupowner_grub2_cfg: Verify /boot/grub2/grub.cfg Group Ownership
  • CCE-83848-2
• file_groupowner_sshd_config: Verify Group Who Owns SSH Server config file
  • CCE-90817-8
• file_groupowner_user_cfg: Verify /boot/grub2/user.cfg Group Ownership
  • CCE-86010-6
• file_groupownership_sshd_private_key: Verify Group Ownership on SSH Server Private *_key Key Files
  • CCE-86127-8
• file_groupownership_sshd_pub_key: Verify Group Ownership on SSH Server Public *.pub Key Files
  • CCE-86136-9
• file_owner_backup_etc_group: Verify User Who Owns Backup group File
  • CCE-83944-9
• file_owner_backup_etc_gshadow: Verify User Who Owns Backup gshadow File
  • CCE-83929-0
• file_owner_backup_etc_passwd: Verify User Who Owns Backup passwd File
  • CCE-83947-2
• file_owner_backup_etc_shadow: Verify Group Who Owns Backup shadow File
  • CCE-83949-8
• file_owner_cron_allow: Verify User Who Owns /etc/cron.allow file
  • CCE-86844-8
• file_owner_cron_d: Verify Owner on cron.d
  • CCE-84169-2
• file_owner_cron_daily: Verify Owner on cron.daily
  • CCE-84188-2
• file_owner_cron_hourly: Verify Owner on cron.hourly
  • CCE-84168-4
• file_owner_cron_monthly: Verify Owner on cron.monthly
  • CCE-84179-1
• file_owner_cron_weekly: Verify Owner on cron.weekly
  • CCE-84190-8
• file_owner_crontab: Verify Owner on crontab
  • CCE-84167-6
• file_owner_etc_group: Verify User Who Owns group File
  • CCE-83925-8
• file_owner_etc_gshadow: Verify User Who Owns gshadow File
  • CCE-83924-1
• file_owner_etc_issue: Verify ownership of System Login Banner
  • CCE-86700-2
• file_owner_etc_issue_net: Verify ownership of System Login Banner for Remote Connections
  • CCE-86057-7
• file_owner_etc_motd: Verify ownership of Message of the Day Banner
  • CCE-86698-8
• file_owner_etc_passwd: Verify User Who Owns passwd File
  • CCE-83943-1
• file_owner_etc_shadow: Verify User Who Owns shadow File
  • CCE-83926-6
• file_owner_etc_shells: Verify Who Owns /etc/shells File
  • CCE-90435-9
• file_owner_grub2_cfg: Verify /boot/grub2/grub.cfg User Ownership
  • CCE-83845-8
• file_owner_sshd_config: Verify Owner on SSH Server config file
  • CCE-90821-0
• file_owner_user_cfg: Verify /boot/grub2/user.cfg User Ownership
  • CCE-86016-3
• file_ownership_sshd_private_key: Verify Ownership on SSH Server Private *_key Key Files
  • CCE-86119-5
• file_ownership_sshd_pub_key: Verify Ownership on SSH Server Public *.pub Key Files
  • CCE-86130-2
• file_ownership_var_log_audit_stig: System Audit Logs Must Be Owned By Root
  • CCE-89952-6
• file_permissions_at_allow: Verify Permissions on /etc/at.allow file
  • CCE-86904-0
• file_permissions_backup_etc_group: Verify Permissions on Backup group File
  • CCE-83939-9
• file_permissions_backup_etc_gshadow: Verify Permissions on Backup gshadow File
  • CCE-83942-3
• file_permissions_backup_etc_passwd: Verify Permissions on Backup passwd File
  • CCE-83940-7
• file_permissions_backup_etc_shadow: Verify Permissions on Backup shadow File
  • CCE-83935-7
• file_permissions_cron_allow: Verify Permissions on /etc/cron.allow file
  • CCE-86877-8
• file_permissions_cron_d: Verify Permissions on cron.d
  • CCE-84183-3
• file_permissions_cron_daily: Verify Permissions on cron.daily
  • CCE-84175-9
• file_permissions_cron_hourly: Verify Permissions on cron.hourly
  • CCE-84173-4
• file_permissions_cron_monthly: Verify Permissions on cron.monthly
  • CCE-84181-7
• file_permissions_cron_weekly: Verify Permissions on cron.weekly
  • CCE-84187-4
• file_permissions_crontab: Verify Permissions on crontab
  • CCE-84176-7
• file_permissions_etc_group: Verify Permissions on group File
  • CCE-83934-0
• file_permissions_etc_gshadow: Verify Permissions on gshadow File
  • CCE-83921-7
• file_permissions_etc_issue: Verify permissions on System Login Banner
  • CCE-83551-2
• file_permissions_etc_issue_net: Verify permissions on System Login Banner for Remote Connections
  • CCE-86048-6
• file_permissions_etc_motd: Verify permissions on Message of the Day Banner
  • CCE-83554-6
• file_permissions_etc_passwd: Verify Permissions on passwd File
  • CCE-83931-6
• file_permissions_etc_shadow: Verify Permissions on shadow File
  • CCE-83941-5
• file_permissions_etc_shells: Verify Permissions on /etc/shells File
  • CCE-90432-6
• file_permissions_grub2_cfg: Verify /boot/grub2/grub.cfg Permissions
  • CCE-83846-6
• file_permissions_sshd_config: Verify Permissions on SSH Server config file
  • CCE-90818-6
• file_permissions_sshd_private_key: Verify Permissions on SSH Server Private *_key Key Files
  • CCE-90820-2
• file_permissions_sshd_pub_key: Verify Permissions on SSH Server Public *.pub Key Files
  • CCE-90819-4
• file_permissions_unauthorized_world_writable: Ensure No World-Writable Files Exist
  • CCE-83902-7
• file_permissions_ungroupowned: Ensure All Files Are Owned by a Group
  • CCE-83906-8
• file_permissions_user_cfg: Verify /boot/grub2/user.cfg Permissions
  • CCE-86025-4
• gnome_gdm_disable_xdmcp: Disable XDMCP in GDM
  • CCE-86033-8
• grub2_enable_selinux: Ensure SELinux Not Disabled in /etc/default/grub
  • CCE-84078-5
• grub2_password: Set Boot Loader Password in grub2
  • CCE-83849-0
• has_nonlocal_mta: Ensure Mail Transfer Agent is not Listening on any non-loopback Address
  • CCE-88499-9
• kernel_module_cramfs_disabled: Disable Mounting of cramfs
  • CCE-83853-2
• kernel_module_dccp_disabled: Disable DCCP Support
  • CCE-84136-1
• kernel_module_freevxfs_disabled: Disable Mounting of freevxfs
  • CCE-86763-0
• kernel_module_hfs_disabled: Disable Mounting of hfs
  • CCE-86764-8
• kernel_module_hfsplus_disabled: Disable Mounting of hfsplus
  • CCE-86765-5
• kernel_module_jffs2_disabled: Disable Mounting of jffs2
  • CCE-86766-3
• kernel_module_rds_disabled: Disable RDS Support
  • CCE-84064-5
• kernel_module_sctp_disabled: Disable SCTP Support
  • CCE-84139-5
• kernel_module_squashfs_disabled: Disable Mounting of squashfs
  • CCE-83855-7
• kernel_module_tipc_disabled: Disable TIPC Support
  • CCE-84065-2
• kernel_module_udf_disabled: Disable Mounting of udf
  • CCE-83852-4
• mount_option_dev_shm_nodev: Add nodev Option to /dev/shm
  • CCE-83881-3
• mount_option_dev_shm_noexec: Add noexec Option to /dev/shm
  • CCE-83857-3
• mount_option_dev_shm_nosuid: Add nosuid Option to /dev/shm
  • CCE-83891-2
• mount_option_home_nodev: Add nodev Option to /home
  • CCE-83871-4
• mount_option_home_nosuid: Add nosuid Option to /home
  • CCE-83894-6
• mount_option_tmp_nodev: Add nodev Option to /tmp
  • CCE-83869-8
• mount_option_tmp_noexec: Add noexec Option to /tmp
  • CCE-83885-4
• mount_option_tmp_nosuid: Add nosuid Option to /tmp
  • CCE-83872-2
• mount_option_var_log_audit_nodev: Add nodev Option to /var/log/audit
  • CCE-83882-1
• mount_option_var_log_audit_noexec: Add noexec Option to /var/log/audit
  • CCE-83878-9
• mount_option_var_log_audit_nosuid: Add nosuid Option to /var/log/audit
  • CCE-83893-8
• mount_option_var_log_nodev: Add nodev Option to /var/log
  • CCE-83886-2
• mount_option_var_log_noexec: Add noexec Option to /var/log
  • CCE-83887-0
• mount_option_var_log_nosuid: Add nosuid Option to /var/log
  • CCE-83870-6
• mount_option_var_nodev: Add nodev Option to /var
  • CCE-83868-0
• mount_option_var_nosuid: Add nosuid Option to /var
  • CCE-83867-2
• mount_option_var_tmp_nodev: Add nodev Option to /var/tmp
  • CCE-83864-9
• mount_option_var_tmp_noexec: Add noexec Option to /var/tmp
  • CCE-83866-4
• mount_option_var_tmp_nosuid: Add nosuid Option to /var/tmp
  • CCE-83863-1
• no_files_unowned_by_user: Ensure All Files Are Owned by a User
  • CCE-83896-1
• package_bind_removed: Uninstall bind Package
  • CCE-86505-5
• package_cyrus-imapd_removed: Uninstall cyrus-imapd Package
  • CCE-88120-1
• package_dhcp_removed: Uninstall DHCP Server Package
  • CCE-84240-1
• package_dovecot_removed: Uninstall dovecot Package
  • CCE-85977-7
• package_ftp_removed: Remove ftp Package
  • CCE-86075-9
• package_gdm_removed: Remove the GDM Package Group
  • CCE-83549-6
• package_httpd_removed: Uninstall httpd Package
  • CCE-85974-4
• package_libselinux_installed: Install libselinux Package
  • CCE-84069-4
• package_mcstrans_removed: Uninstall mcstrans Package
  • CCE-84072-8
• package_net-snmp_removed: Uninstall net-snmp Package
  • CCE-85981-9
• package_nginx_removed: Uninstall nginx Package
  • CCE-88035-1
• package_openldap-clients_removed: Ensure LDAP client is not installed
  • CCE-90831-9
• package_setroubleshoot_removed: Uninstall setroubleshoot Package
  • CCE-84073-6
• package_telnet-server_removed: Uninstall telnet-server Package
  • CCE-84149-4
• package_telnet_removed: Remove telnet Clients
  • CCE-84146-0
• package_tftp-server_removed: Uninstall tftp-server Package
  • CCE-84154-4
• package_tftp_removed: Remove tftp Daemon
  • CCE-84153-6
• package_vsftpd_removed: Uninstall vsftpd Package
  • CCE-84159-3
• package_xorg-x11-server-common_removed: Remove the X Windows Package Group
  • CCE-84104-9
• partition_for_dev_shm: Ensure /dev/shm is configured
  • CCE-86283-9
• partition_for_home: Ensure /home Located On Separate Partition
  • CCE-83468-9
• partition_for_tmp: Ensure /tmp Located On Separate Partition
  • CCE-90845-9
• partition_for_var: Ensure /var Located On Separate Partition
  • CCE-83466-3
• partition_for_var_log: Ensure /var/log Located On Separate Partition
  • CCE-90848-3
• partition_for_var_log_audit: Ensure /var/log/audit Located On Separate Partition
  • CCE-90847-5
• partition_for_var_tmp: Ensure /var/tmp Located On Separate Partition
  • CCE-83487-9
• postfix_network_listening_disabled: Disable Postfix Network Listening
  • CCE-90825-1
• rsyslog_filecreatemode: Ensure rsyslog Default File Permissions Configured
  • CCE-88322-3
• rsyslog_files_groupownership: Ensure Log Files Are Owned By Appropriate Group
  • CCE-83834-2
• rsyslog_files_ownership: Ensure Log Files Are Owned By Appropriate User
  • CCE-83946-4
• rsyslog_files_permissions: Ensure System Log Files Have Correct Permissions
  • CCE-83689-0
• selinux_not_disabled: Ensure SELinux is Not Disabled
  • CCE-86152-6
• selinux_policytype: Configure SELinux Policy
  • CCE-84074-4
• selinux_state: Ensure SELinux State is Enforcing
  • CCE-84079-3
• service_bluetooth_disabled: Disable Bluetooth Service
  • CCE-86761-4
• service_cups_disabled: Disable the CUPS Service
  • CCE-90795-6
• service_dnsmasq_disabled: Disable dnsmasq Service
  • CCE-90721-2
• service_nftables_disabled: Verify nftables Service is Disabled
  • CCE-88429-6
• sshd_disable_forwarding: Disable SSH Forwarding
  • CCE-90197-5
• sshd_limit_user_access: Limit Users' SSH Access
  • CCE-86817-4
• use_pam_wheel_group_for_su: Enforce Usage of pam_wheel with Group Parameter for su Authentication
  • CCE-86065-0
• var_accounts_user_umask = 027
• var_pam_wheel_group_for_su = cis
• var_postfix_inet_interfaces = loopback-only
• var_selinux_policy_name = targeted
• var_selinux_state = enforcing
• wireless_disable_interfaces: Deactivate Wireless Network Interfaces
  • CCE-84066-0
• xwindows_runlevel_target: Disable Graphical Environment Startup By Setting Default Target
  • CCE-84105-6

CR 4.1: Information confidentiality

Description: None

• sl1

Automated: yes

• configure_custom_crypto_policy_cis: Implement Custom Crypto Policy Modules for CIS Benchmark
  • CCE-88900-6

CR 4.2: Information persistence

Description: None

• sl2

Automated: no

No rules selected

CR 4.3: Use of cryptography

Description: None

• sl1

Automated: yes

• configure_custom_crypto_policy_cis: Implement Custom Crypto Policy Modules for CIS Benchmark
  • CCE-88900-6

CR 3.1: Communication integrity

Description: None

• sl1

Automated: yes

• configure_custom_crypto_policy_cis: Implement Custom Crypto Policy Modules for CIS Benchmark
  • CCE-88900-6

CR 3.1 RE(1): Communication authentication

Description: None

• sl2

Automated: yes

• configure_custom_crypto_policy_cis: Implement Custom Crypto Policy Modules for CIS Benchmark
  • CCE-88900-6

HDR 3.2: Protection from malicious code

Description: None

• sl1

Automated: yes

• kernel_module_usb-storage_disabled: Disable Modprobe Loading of USB Storage Driver
  • CCE-83851-6
• service_autofs_disabled: Disable the Automounter
  • CCE-83850-8

HDR 3.2 RE(1): Report version of code protection

Description: None

• sl2

Automated: yes

• aide_build_database: Build and Test AIDE Database
  • CCE-83438-2
• aide_periodic_cron_checking: Configure Periodic Execution of AIDE
  • CCE-83437-4
• audit_rules_execution_chacl: Record Any Attempts to Run chacl
  • CCE-87685-4
• audit_rules_execution_chcon: Record Any Attempts to Run chcon
  • CCE-83748-4
• audit_rules_execution_setfacl: Record Any Attempts to Run setfacl
  • CCE-90482-1
• audit_rules_privileged_commands_usermod: Ensure auditd Collects Information on the Use of Privileged Commands - usermod
  • CCE-87212-7
• auditd_data_disk_error_action: Configure auditd Disk Error Action on Disk Error
  • CCE-83690-8
• auditd_data_disk_full_action: Configure auditd Disk Full Action when Disk Space Is Full
  • CCE-83684-1
• auditd_data_retention_action_mail_acct: Configure auditd mail_acct Action on Low Disk Space
  • CCE-83698-1
• auditd_data_retention_admin_space_left_action: Configure auditd admin_space_left Action on Low Disk Space
  • CCE-83700-5
• auditd_data_retention_space_left_action: Configure auditd space_left Action on Low Disk Space
  • CCE-83703-9
• ensure_journald_and_rsyslog_not_active_together: Ensure journald and rsyslog Are Not Active Together
  • CCE-90715-4
• grub2_audit_backlog_limit_argument: Extend Audit Backlog Limit for the Audit Daemon
  • CCE-83652-8
• kernel_module_usb-storage_disabled: Disable Modprobe Loading of USB Storage Driver
  • CCE-83851-6
• package_aide_installed: Install AIDE
  • CCE-90843-4
• package_audit-libs_installed: Ensure the audit-libs package as a part of audit Subsystem is Installed
  • CCE-86772-1
• package_audit_installed: Ensure the audit Subsystem is Installed
  • CCE-83649-4
• package_systemd-journal-remote_installed: Install systemd-journal-remote Package
  • CCE-86760-6
• service_auditd_enabled: Enable auditd Service
  • CCE-90829-3
• service_autofs_disabled: Disable the Automounter
  • CCE-83850-8
• service_systemd-journald_enabled: Enable systemd-journald Service
  • CCE-85941-3
• socket_systemd-journal-remote_disabled: Disable systemd-journal-remote Socket
  • CCE-87606-0
• var_audit_backlog_limit = 8192
• var_auditd_action_mail_acct = root
• var_auditd_admin_space_left_action = cis_rhel9
• var_auditd_space_left_action = cis_rhel9

CR 3.3: Security functionality verification

Description: None

• sl1

Automated: no

No rules selected

CR 3.4: Software and information integrity

Description: None

• sl1

Automated: no

No rules selected

CR 3.4 RE(1): Authenticity of software and information

Description: None

• sl2

Automated: no

No rules selected

CR 3.5: Input validation

Description: None

• sl1

Automated: no

No rules selected

CR 3.6: Deterministic output

Description: None

• sl1

Automated: yes

• service_systemd-journald_enabled: Enable systemd-journald Service
  • CCE-85941-3

CR 3.7: Error handling

Description: None

• sl1

Automated: no

No rules selected

CR 3.8: Session integrity

Description: None

• sl2

Automated: no

No rules selected

CR 3.9: Protection of audit information

Description: None

• sl2

Automated: yes

• audit_rules_immutable: Make the auditd Configuration Immutable
  • CCE-83716-1
• file_group_ownership_var_log_audit: System Audit Logs Must Be Group Owned By Root
  • CCE-89603-5
• file_groupownership_audit_configuration: Audit Configuration Files Must Be Owned By Group root
  • CCE-86446-2
• file_ownership_audit_binaries: Verify that audit tools are owned by root
  • CCE-86454-6
• file_ownership_audit_configuration: Audit Configuration Files Must Be Owned By Root
  • CCE-86445-4
• file_permissions_var_log_audit: System Audit Logs Must Have Mode 0640 or Less Permissive
  • CCE-83720-3

HDR 3.10: Support for updates

Description: None

• sl1

Automated: yes

• ensure_gpgcheck_globally_activated: Ensure gpgcheck Enabled In Main dnf Configuration
  • CCE-83457-2
• ensure_gpgcheck_never_disabled: Ensure gpgcheck Enabled for All dnf Package Repositories
  • CCE-83464-8
• ensure_redhat_gpgkey_installed: Ensure Red Hat GPG Key Installed
  • CCE-84180-9

HDR 3.10 RE(1): Update authenticity and integrity

Description: None

• sl2

Automated: yes

• ensure_gpgcheck_globally_activated: Ensure gpgcheck Enabled In Main dnf Configuration
  • CCE-83457-2
• ensure_gpgcheck_never_disabled: Ensure gpgcheck Enabled for All dnf Package Repositories
  • CCE-83464-8
• ensure_redhat_gpgkey_installed: Ensure Red Hat GPG Key Installed
  • CCE-84180-9

HDR 3.11: Physical tamper resistance and detection

Description: None

• sl2

Automated: yes

• kernel_module_dccp_disabled: Disable DCCP Support
  • CCE-84136-1
• kernel_module_rds_disabled: Disable RDS Support
  • CCE-84064-5
• kernel_module_sctp_disabled: Disable SCTP Support
  • CCE-84139-5
• kernel_module_tipc_disabled: Disable TIPC Support
  • CCE-84065-2
• service_avahi-daemon_disabled: Disable Avahi Server Software
  • CCE-90824-4

HDR 3.12: Provisioning product supplier roots of trust

Description: None

• sl2

Automated: no

No rules selected

HDR 3.13: Provisioning asset owner roots of trust

Description: None

• sl2

Automated: no

No rules selected

HDR 3.14: Integrity of the boot process

Description: None

• sl1

Automated: no

No rules selected

HDR 3.14 RE(1): Authenticity of the boot process

Description: None

• sl2

Automated: no

No rules selected

CR 1.1: Human user identification and authentication

Description: None

• sl1

Automated: yes

• account_unique_id: Ensure All Accounts on the System Have Unique User IDs
  • CCE-88493-2

CR 1.1 RE(1): Unique identification and authentication

Description: None

• sl2

Automated: yes

• account_disable_post_pw_expiration: Set Account Expiration Following Inactivity
  • CCE-83627-0
• account_unique_id: Ensure All Accounts on the System Have Unique User IDs
  • CCE-88493-2
• accounts_set_post_pw_existing: Set existing passwords a period of inactivity before they been locked
  • CCE-86759-8
• var_account_disable_post_pw_expiration = 45

CR 1.2: Software process and device identification and authentication

Description: None

• sl2

Automated: yes

• dconf_gnome_disable_automount: Disable GNOME3 Automounting
  • CCE-87734-0
• dconf_gnome_disable_automount_open: Disable GNOME3 Automount Opening
  • CCE-90128-0
• kernel_module_usb-storage_disabled: Disable Modprobe Loading of USB Storage Driver
  • CCE-83851-6

CR 1.3: Account management

Description: None

• sl1

Automated: no

No rules selected

CR 1.4: Identifier management

Description: None

• sl1

Automated: yes

• account_disable_post_pw_expiration: Set Account Expiration Following Inactivity
  • CCE-83627-0
• accounts_set_post_pw_existing: Set existing passwords a period of inactivity before they been locked
  • CCE-86759-8
• var_account_disable_post_pw_expiration = 45

CR 1.5: Authenticator management

Description: None

• sl1

Automated: yes

• accounts_minimum_age_login_defs: Set Password Minimum Age
  • CCE-83610-6
• accounts_password_all_shadowed: Verify All Account Password Hashes are Shadowed
  • CCE-83618-9
• accounts_password_last_change_is_in_past: Ensure all users last password change date is in the past
  • CCE-86526-1
• accounts_password_pam_dictcheck: Ensure PAM Enforces Password Requirements - Prevent the Use of Dictionary Words
  • CCE-88413-0
• accounts_password_pam_difok: Ensure PAM Enforces Password Requirements - Minimum Different Characters
  • CCE-83564-5
• accounts_password_pam_enforce_root: Ensure PAM Enforces Password Requirements - Enforce for root User
  • CCE-86356-3
• accounts_password_pam_maxrepeat: Set Password Maximum Consecutive Repeating Characters
  • CCE-83567-8
• accounts_password_pam_maxsequence: Limit the maximum number of sequential characters in passwords
  • CCE-86444-7
• accounts_password_pam_minclass: Ensure PAM Enforces Password Requirements - Minimum Different Categories
  • CCE-83563-7
• accounts_password_pam_minlen: Ensure PAM Enforces Password Requirements - Minimum Length
  • CCE-83579-3
• accounts_password_pam_pwhistory_enforce_for_root: Ensure Password History Is Enforced for the Root User
  • CCE-86742-4
• accounts_password_set_min_life_existing: Set Existing Passwords Minimum Age
  • CCE-89069-9
• accounts_password_set_warn_age_existing: Set Existing Passwords Warning Age
  • CCE-86915-6
• accounts_password_warn_age_login_defs: Set Password Warning Age
  • CCE-83609-8
• ensure_root_password_configured: Ensure Authentication Required for Single User Mode
  • CCE-87101-2
• no_empty_passwords_etc_shadow: Ensure There Are No Accounts With Blank or Null Passwords
  • CCE-85972-8
• set_password_hashing_algorithm_libuserconf: Set Password Hashing Algorithm in /etc/libuser.conf
  • CCE-88865-1
• set_password_hashing_algorithm_logindefs: Set Password Hashing Algorithm in /etc/login.defs
  • CCE-90590-1
• set_password_hashing_algorithm_passwordauth: Set PAM Password Hashing Algorithm - password-auth
  • CCE-85946-2
• set_password_hashing_algorithm_systemauth: Set PAM Password Hashing Algorithm - system-auth
  • CCE-83581-9
• var_accounts_maximum_age_login_defs = 365
• var_accounts_minimum_age_login_defs = 1
• var_accounts_password_warn_age_login_defs = 7
• var_password_hashing_algorithm = SHA512
• var_password_hashing_algorithm_pam = sha512
• var_password_pam_dictcheck = 1
• var_password_pam_difok = 2
• var_password_pam_maxrepeat = 3
• var_password_pam_maxsequence = 3
• var_password_pam_minclass = 4
• var_password_pam_minlen = 14

CR 1.7: Strength of password-based authentication

Description: None

• sl1

Automated: yes

• accounts_minimum_age_login_defs: Set Password Minimum Age
  • CCE-83610-6
• accounts_password_all_shadowed: Verify All Account Password Hashes are Shadowed
  • CCE-83618-9
• accounts_password_last_change_is_in_past: Ensure all users last password change date is in the past
  • CCE-86526-1
• accounts_password_pam_dictcheck: Ensure PAM Enforces Password Requirements - Prevent the Use of Dictionary Words
  • CCE-88413-0
• accounts_password_pam_difok: Ensure PAM Enforces Password Requirements - Minimum Different Characters
  • CCE-83564-5
• accounts_password_pam_enforce_root: Ensure PAM Enforces Password Requirements - Enforce for root User
  • CCE-86356-3
• accounts_password_pam_maxrepeat: Set Password Maximum Consecutive Repeating Characters
  • CCE-83567-8
• accounts_password_pam_maxsequence: Limit the maximum number of sequential characters in passwords
  • CCE-86444-7
• accounts_password_pam_minclass: Ensure PAM Enforces Password Requirements - Minimum Different Categories
  • CCE-83563-7
• accounts_password_pam_minlen: Ensure PAM Enforces Password Requirements - Minimum Length
  • CCE-83579-3
• accounts_password_pam_pwhistory_enforce_for_root: Ensure Password History Is Enforced for the Root User
  • CCE-86742-4
• accounts_password_pam_pwhistory_remember_password_auth: Limit Password Reuse: password-auth
  • CCE-86354-8
• accounts_password_pam_pwhistory_remember_system_auth: Limit Password Reuse: system-auth
  • CCE-89176-2
• accounts_password_pam_unix_no_remember: Avoid using remember in pam_unix module
  • CCE-90726-1
• accounts_password_set_min_life_existing: Set Existing Passwords Minimum Age
  • CCE-89069-9
• accounts_password_set_warn_age_existing: Set Existing Passwords Warning Age
  • CCE-86915-6
• accounts_password_warn_age_login_defs: Set Password Warning Age
  • CCE-83609-8
• ensure_root_password_configured: Ensure Authentication Required for Single User Mode
  • CCE-87101-2
• no_empty_passwords_etc_shadow: Ensure There Are No Accounts With Blank or Null Passwords
  • CCE-85972-8
• set_password_hashing_algorithm_libuserconf: Set Password Hashing Algorithm in /etc/libuser.conf
  • CCE-88865-1
• set_password_hashing_algorithm_logindefs: Set Password Hashing Algorithm in /etc/login.defs
  • CCE-90590-1
• set_password_hashing_algorithm_passwordauth: Set PAM Password Hashing Algorithm - password-auth
  • CCE-85946-2
• set_password_hashing_algorithm_systemauth: Set PAM Password Hashing Algorithm - system-auth
  • CCE-83581-9
• var_accounts_maximum_age_login_defs = 365
• var_accounts_minimum_age_login_defs = 1
• var_accounts_password_warn_age_login_defs = 7
• var_password_hashing_algorithm = SHA512
• var_password_hashing_algorithm_pam = sha512
• var_password_pam_dictcheck = 1
• var_password_pam_difok = 2
• var_password_pam_maxrepeat = 3
• var_password_pam_maxsequence = 3
• var_password_pam_minclass = 4
• var_password_pam_minlen = 14
• var_password_pam_remember = 24
• var_password_pam_remember_control_flag = requisite_or_required

CR 1.8: Public key infrastructure certificates

Description: None

• sl2

Automated: yes

• accounts_minimum_age_login_defs: Set Password Minimum Age
  • CCE-83610-6
• accounts_password_all_shadowed: Verify All Account Password Hashes are Shadowed
  • CCE-83618-9
• accounts_password_last_change_is_in_past: Ensure all users last password change date is in the past
  • CCE-86526-1
• accounts_password_pam_dictcheck: Ensure PAM Enforces Password Requirements - Prevent the Use of Dictionary Words
  • CCE-88413-0
• accounts_password_pam_difok: Ensure PAM Enforces Password Requirements - Minimum Different Characters
  • CCE-83564-5
• accounts_password_pam_enforce_root: Ensure PAM Enforces Password Requirements - Enforce for root User
  • CCE-86356-3
• accounts_password_pam_maxrepeat: Set Password Maximum Consecutive Repeating Characters
  • CCE-83567-8
• accounts_password_pam_maxsequence: Limit the maximum number of sequential characters in passwords
  • CCE-86444-7
• accounts_password_pam_minclass: Ensure PAM Enforces Password Requirements - Minimum Different Categories
  • CCE-83563-7
• accounts_password_pam_minlen: Ensure PAM Enforces Password Requirements - Minimum Length
  • CCE-83579-3
• accounts_password_pam_pwhistory_enforce_for_root: Ensure Password History Is Enforced for the Root User
  • CCE-86742-4
• accounts_password_set_min_life_existing: Set Existing Passwords Minimum Age
  • CCE-89069-9
• accounts_password_set_warn_age_existing: Set Existing Passwords Warning Age
  • CCE-86915-6
• accounts_password_warn_age_login_defs: Set Password Warning Age
  • CCE-83609-8
• ensure_root_password_configured: Ensure Authentication Required for Single User Mode
  • CCE-87101-2
• no_empty_passwords_etc_shadow: Ensure There Are No Accounts With Blank or Null Passwords
  • CCE-85972-8
• set_password_hashing_algorithm_libuserconf: Set Password Hashing Algorithm in /etc/libuser.conf
  • CCE-88865-1
• set_password_hashing_algorithm_logindefs: Set Password Hashing Algorithm in /etc/login.defs
  • CCE-90590-1
• set_password_hashing_algorithm_passwordauth: Set PAM Password Hashing Algorithm - password-auth
  • CCE-85946-2
• set_password_hashing_algorithm_systemauth: Set PAM Password Hashing Algorithm - system-auth
  • CCE-83581-9
• var_accounts_maximum_age_login_defs = 365
• var_accounts_minimum_age_login_defs = 1
• var_accounts_password_warn_age_login_defs = 7
• var_password_hashing_algorithm = SHA512
• var_password_hashing_algorithm_pam = sha512
• var_password_pam_dictcheck = 1
• var_password_pam_difok = 2
• var_password_pam_maxrepeat = 3
• var_password_pam_maxsequence = 3
• var_password_pam_minclass = 4
• var_password_pam_minlen = 14

CR 1.9: Strength of public key-based authentication

Description: None

• sl2

Automated: yes

• accounts_minimum_age_login_defs: Set Password Minimum Age
  • CCE-83610-6
• accounts_password_all_shadowed: Verify All Account Password Hashes are Shadowed
  • CCE-83618-9
• accounts_password_last_change_is_in_past: Ensure all users last password change date is in the past
  • CCE-86526-1
• accounts_password_pam_dictcheck: Ensure PAM Enforces Password Requirements - Prevent the Use of Dictionary Words
  • CCE-88413-0
• accounts_password_pam_difok: Ensure PAM Enforces Password Requirements - Minimum Different Characters
  • CCE-83564-5
• accounts_password_pam_enforce_root: Ensure PAM Enforces Password Requirements - Enforce for root User
  • CCE-86356-3
• accounts_password_pam_maxrepeat: Set Password Maximum Consecutive Repeating Characters
  • CCE-83567-8
• accounts_password_pam_maxsequence: Limit the maximum number of sequential characters in passwords
  • CCE-86444-7
• accounts_password_pam_minclass: Ensure PAM Enforces Password Requirements - Minimum Different Categories
  • CCE-83563-7
• accounts_password_pam_minlen: Ensure PAM Enforces Password Requirements - Minimum Length
  • CCE-83579-3
• accounts_password_pam_pwhistory_enforce_for_root: Ensure Password History Is Enforced for the Root User
  • CCE-86742-4
• accounts_password_set_min_life_existing: Set Existing Passwords Minimum Age
  • CCE-89069-9
• accounts_password_set_warn_age_existing: Set Existing Passwords Warning Age
  • CCE-86915-6
• accounts_password_warn_age_login_defs: Set Password Warning Age
  • CCE-83609-8
• ensure_root_password_configured: Ensure Authentication Required for Single User Mode
  • CCE-87101-2
• no_empty_passwords_etc_shadow: Ensure There Are No Accounts With Blank or Null Passwords
  • CCE-85972-8
• set_password_hashing_algorithm_libuserconf: Set Password Hashing Algorithm in /etc/libuser.conf
  • CCE-88865-1
• set_password_hashing_algorithm_logindefs: Set Password Hashing Algorithm in /etc/login.defs
  • CCE-90590-1
• set_password_hashing_algorithm_passwordauth: Set PAM Password Hashing Algorithm - password-auth
  • CCE-85946-2
• set_password_hashing_algorithm_systemauth: Set PAM Password Hashing Algorithm - system-auth
  • CCE-83581-9
• var_accounts_maximum_age_login_defs = 365
• var_accounts_minimum_age_login_defs = 1
• var_accounts_password_warn_age_login_defs = 7
• var_password_hashing_algorithm = SHA512
• var_password_hashing_algorithm_pam = sha512
• var_password_pam_dictcheck = 1
• var_password_pam_difok = 2
• var_password_pam_maxrepeat = 3
• var_password_pam_maxsequence = 3
• var_password_pam_minclass = 4
• var_password_pam_minlen = 14

CR 1.10: Authenticator feedback

Description: None

• sl1

Automated: no

No rules selected

CR 1.11: Unsuccessful login attempts

Description: None

• sl1

Automated: yes

• account_password_pam_faillock_password_auth: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/password-auth File.
  • CCE-86932-1
• account_password_pam_faillock_system_auth: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/system-auth File.
  • CCE-86917-2
• accounts_passwords_pam_faillock_deny: Lock Accounts After Failed Password Attempts
  • CCE-83587-6
• accounts_passwords_pam_faillock_even_deny_root_or_root_unlock_time: Ensure Root Account Lockout on Failed Password Attempts
  • CCE-86630-1
• accounts_passwords_pam_faillock_unlock_time: Set Lockout Time for Failed Password Attempts
  • CCE-83588-4
• var_accounts_passwords_pam_faillock_deny = 5
• var_accounts_passwords_pam_faillock_dir = run
• var_accounts_passwords_pam_faillock_root_unlock_time = 60
• var_accounts_passwords_pam_faillock_unlock_time = 900

CR 1.12: System use notification

Description: None

• sl1

Automated: yes

• dconf_gnome_banner_enabled: Enable GNOME3 Login Warning Banner
  • CCE-87599-7
• dconf_gnome_login_banner_text: Set the GNOME3 Login Warning Banner Text
  • CCE-86529-5

CR 1.14: Strength of symmetric key-based authentication

Description: None

• sl2

Automated: no

No rules selected