Definition of NIST Special Publication 800-172 Revision 3 (Enhanced Security Requirements for Protecting CUI) for rhel9

03.01.01E: Dual Authorization

Description: None

• default

Automated: no

• accounts_umask_etc_bashrc: Ensure the Default Bash Umask is Set Correctly
  • CCE-83644-5
• accounts_umask_etc_login_defs: Ensure the Default Umask is Set Correctly in login.defs
  • CCE-83647-8
• accounts_umask_etc_profile: Ensure the Default Umask is Set Correctly in /etc/profile
  • CCE-90828-5
• audit_rules_immutable: Make the auditd Configuration Immutable
  • CCE-83716-1
• dir_perms_world_writable_sticky_bits: Verify that All World-Writable Directories Have Sticky Bits Set
  • CCE-83895-3
• ensure_pam_wheel_group_empty: Ensure the Group Used by pam_wheel.so Module Exists on System and is Empty
  • CCE-86072-6
• file_at_allow_exists: Ensure that /etc/at.allow exists
  • CCE-86856-2
• file_at_deny_not_exist: Ensure that /etc/at.deny does not exist
  • CCE-86946-1
• file_cron_allow_exists: Ensure that /etc/cron.allow exists
  • CCE-86185-6
• file_cron_deny_not_exist: Ensure that /etc/cron.deny does not exist
  • CCE-86850-5
• file_etc_security_opasswd: Verify Permissions and Ownership of Old Passwords File
  • CCE-86762-2
• file_groupowner_at_allow: Verify Group Who Owns /etc/at.allow file
  • CCE-87103-8
• file_groupowner_backup_etc_group: Verify Group Who Owns Backup group File
  • CCE-83928-2
• file_groupowner_backup_etc_gshadow: Verify Group Who Owns Backup gshadow File
  • CCE-83951-4
• file_groupowner_backup_etc_passwd: Verify Group Who Owns Backup passwd File
  • CCE-83933-2
• file_groupowner_backup_etc_shadow: Verify User Who Owns Backup shadow File
  • CCE-83938-1
• file_groupowner_cron_allow: Verify Group Who Owns /etc/cron.allow file
  • CCE-86830-7
• file_groupowner_cron_d: Verify Group Who Owns cron.d
  • CCE-84177-5
• file_groupowner_cron_daily: Verify Group Who Owns cron.daily
  • CCE-84170-0
• file_groupowner_cron_hourly: Verify Group Who Owns cron.hourly
  • CCE-84186-6
• file_groupowner_cron_monthly: Verify Group Who Owns cron.monthly
  • CCE-84189-0
• file_groupowner_cron_weekly: Verify Group Who Owns cron.weekly
  • CCE-84174-2
• file_groupowner_crontab: Verify Group Who Owns Crontab
  • CCE-84171-8
• file_groupowner_etc_group: Verify Group Who Owns group File
  • CCE-83945-6
• file_groupowner_etc_gshadow: Verify Group Who Owns gshadow File
  • CCE-83948-0
• file_groupowner_etc_issue: Verify Group Ownership of System Login Banner
  • CCE-86699-6
• file_groupowner_etc_issue_net: Verify Group Ownership of System Login Banner for Remote Connections
  • CCE-86052-8
• file_groupowner_etc_motd: Verify Group Ownership of Message of the Day Banner
  • CCE-86697-0
• file_groupowner_etc_passwd: Verify Group Who Owns passwd File
  • CCE-83950-6
• file_groupowner_etc_shadow: Verify Group Who Owns shadow File
  • CCE-83930-8
• file_groupowner_etc_shells: Verify Group Who Owns /etc/shells File
  • CCE-90434-2
• file_groupowner_grub2_cfg: Verify /boot/grub2/grub.cfg Group Ownership
  • CCE-83848-2
• file_groupowner_sshd_config: Verify Group Who Owns SSH Server config file
  • CCE-90817-8
• file_groupowner_user_cfg: Verify /boot/grub2/user.cfg Group Ownership
  • CCE-86010-6
• file_groupownership_sshd_private_key: Verify Group Ownership on SSH Server Private *_key Key Files
  • CCE-86127-8
• file_groupownership_sshd_pub_key: Verify Group Ownership on SSH Server Public *.pub Key Files
  • CCE-86136-9
• file_owner_backup_etc_group: Verify User Who Owns Backup group File
  • CCE-83944-9
• file_owner_backup_etc_gshadow: Verify User Who Owns Backup gshadow File
  • CCE-83929-0
• file_owner_backup_etc_passwd: Verify User Who Owns Backup passwd File
  • CCE-83947-2
• file_owner_backup_etc_shadow: Verify Group Who Owns Backup shadow File
  • CCE-83949-8
• file_owner_cron_allow: Verify User Who Owns /etc/cron.allow file
  • CCE-86844-8
• file_owner_cron_d: Verify Owner on cron.d
  • CCE-84169-2
• file_owner_cron_daily: Verify Owner on cron.daily
  • CCE-84188-2
• file_owner_cron_hourly: Verify Owner on cron.hourly
  • CCE-84168-4
• file_owner_cron_monthly: Verify Owner on cron.monthly
  • CCE-84179-1
• file_owner_cron_weekly: Verify Owner on cron.weekly
  • CCE-84190-8
• file_owner_crontab: Verify Owner on crontab
  • CCE-84167-6
• file_owner_etc_group: Verify User Who Owns group File
  • CCE-83925-8
• file_owner_etc_gshadow: Verify User Who Owns gshadow File
  • CCE-83924-1
• file_owner_etc_issue: Verify ownership of System Login Banner
  • CCE-86700-2
• file_owner_etc_issue_net: Verify ownership of System Login Banner for Remote Connections
  • CCE-86057-7
• file_owner_etc_motd: Verify ownership of Message of the Day Banner
  • CCE-86698-8
• file_owner_etc_passwd: Verify User Who Owns passwd File
  • CCE-83943-1
• file_owner_etc_shadow: Verify User Who Owns shadow File
  • CCE-83926-6
• file_owner_etc_shells: Verify Who Owns /etc/shells File
  • CCE-90435-9
• file_owner_grub2_cfg: Verify /boot/grub2/grub.cfg User Ownership
  • CCE-83845-8
• file_owner_sshd_config: Verify Owner on SSH Server config file
  • CCE-90821-0
• file_owner_user_cfg: Verify /boot/grub2/user.cfg User Ownership
  • CCE-86016-3
• file_ownership_sshd_private_key: Verify Ownership on SSH Server Private *_key Key Files
  • CCE-86119-5
• file_ownership_sshd_pub_key: Verify Ownership on SSH Server Public *.pub Key Files
  • CCE-86130-2
• file_permissions_at_allow: Verify Permissions on /etc/at.allow file
  • CCE-86904-0
• file_permissions_backup_etc_group: Verify Permissions on Backup group File
  • CCE-83939-9
• file_permissions_backup_etc_gshadow: Verify Permissions on Backup gshadow File
  • CCE-83942-3
• file_permissions_backup_etc_passwd: Verify Permissions on Backup passwd File
  • CCE-83940-7
• file_permissions_backup_etc_shadow: Verify Permissions on Backup shadow File
  • CCE-83935-7
• file_permissions_cron_allow: Verify Permissions on /etc/cron.allow file
  • CCE-86877-8
• file_permissions_cron_d: Verify Permissions on cron.d
  • CCE-84183-3
• file_permissions_cron_daily: Verify Permissions on cron.daily
  • CCE-84175-9
• file_permissions_cron_hourly: Verify Permissions on cron.hourly
  • CCE-84173-4
• file_permissions_cron_monthly: Verify Permissions on cron.monthly
  • CCE-84181-7
• file_permissions_cron_weekly: Verify Permissions on cron.weekly
  • CCE-84187-4
• file_permissions_crontab: Verify Permissions on crontab
  • CCE-84176-7
• file_permissions_etc_group: Verify Permissions on group File
  • CCE-83934-0
• file_permissions_etc_gshadow: Verify Permissions on gshadow File
  • CCE-83921-7
• file_permissions_etc_issue: Verify permissions on System Login Banner
  • CCE-83551-2
• file_permissions_etc_issue_net: Verify permissions on System Login Banner for Remote Connections
  • CCE-86048-6
• file_permissions_etc_motd: Verify permissions on Message of the Day Banner
  • CCE-83554-6
• file_permissions_etc_passwd: Verify Permissions on passwd File
  • CCE-83931-6
• file_permissions_etc_shadow: Verify Permissions on shadow File
  • CCE-83941-5
• file_permissions_etc_shells: Verify Permissions on /etc/shells File
  • CCE-90432-6
• file_permissions_grub2_cfg: Verify /boot/grub2/grub.cfg Permissions
  • CCE-83846-6
• file_permissions_sshd_config: Verify Permissions on SSH Server config file
  • CCE-90818-6
• file_permissions_sshd_private_key: Verify Permissions on SSH Server Private *_key Key Files
  • CCE-90820-2
• file_permissions_sshd_pub_key: Verify Permissions on SSH Server Public *.pub Key Files
  • CCE-90819-4
• file_permissions_unauthorized_world_writable: Ensure No World-Writable Files Exist
  • CCE-83902-7
• file_permissions_ungroupowned: Ensure All Files Are Owned by a Group
  • CCE-83906-8
• file_permissions_user_cfg: Verify /boot/grub2/user.cfg Permissions
  • CCE-86025-4
• grub2_enable_selinux: Ensure SELinux Not Disabled in /etc/default/grub
  • CCE-84078-5
• grub2_password: Set Boot Loader Password in grub2
  • CCE-83849-0
• mount_option_dev_shm_nodev: Add nodev Option to /dev/shm
  • CCE-83881-3
• mount_option_dev_shm_noexec: Add noexec Option to /dev/shm
  • CCE-83857-3
• mount_option_dev_shm_nosuid: Add nosuid Option to /dev/shm
  • CCE-83891-2
• mount_option_home_nodev: Add nodev Option to /home
  • CCE-83871-4
• mount_option_home_nosuid: Add nosuid Option to /home
  • CCE-83894-6
• mount_option_tmp_noexec: Add noexec Option to /tmp
  • CCE-83885-4
• mount_option_tmp_nosuid: Add nosuid Option to /tmp
  • CCE-83872-2
• mount_option_var_log_audit_nodev: Add nodev Option to /var/log/audit
  • CCE-83882-1
• mount_option_var_log_audit_noexec: Add noexec Option to /var/log/audit
  • CCE-83878-9
• mount_option_var_log_audit_nosuid: Add nosuid Option to /var/log/audit
  • CCE-83893-8
• mount_option_var_log_nodev: Add nodev Option to /var/log
  • CCE-83886-2
• mount_option_var_log_noexec: Add noexec Option to /var/log
  • CCE-83887-0
• mount_option_var_log_nosuid: Add nosuid Option to /var/log
  • CCE-83870-6
• mount_option_var_nodev: Add nodev Option to /var
  • CCE-83868-0
• mount_option_var_nosuid: Add nosuid Option to /var
  • CCE-83867-2
• mount_option_var_tmp_nodev: Add nodev Option to /var/tmp
  • CCE-83864-9
• mount_option_var_tmp_noexec: Add noexec Option to /var/tmp
  • CCE-83866-4
• mount_option_var_tmp_nosuid: Add nosuid Option to /var/tmp
  • CCE-83863-1
• no_files_unowned_by_user: Ensure All Files Are Owned by a User
  • CCE-83896-1
• package_libselinux_installed: Install libselinux Package
  • CCE-84069-4
• package_mcstrans_removed: Uninstall mcstrans Package
  • CCE-84072-8
• package_setroubleshoot_removed: Uninstall setroubleshoot Package
  • CCE-84073-6
• rsyslog_filecreatemode: Ensure rsyslog Default File Permissions Configured
  • CCE-88322-3
• rsyslog_files_groupownership: Ensure Log Files Are Owned By Appropriate Group
  • CCE-83834-2
• rsyslog_files_ownership: Ensure Log Files Are Owned By Appropriate User
  • CCE-83946-4
• rsyslog_files_permissions: Ensure System Log Files Have Correct Permissions
  • CCE-83689-0
• selinux_not_disabled: Ensure SELinux is Not Disabled
  • CCE-86152-6
• selinux_policytype: Configure SELinux Policy
  • CCE-84074-4
• selinux_state: Ensure SELinux State is Enforcing
  • CCE-84079-3
• sshd_limit_user_access: Limit Users' SSH Access
  • CCE-86817-4
• use_pam_wheel_group_for_su: Enforce Usage of pam_wheel with Group Parameter for su Authentication
  • CCE-86065-0
• var_accounts_user_umask = 027
• var_pam_wheel_group_for_su = cis
• var_selinux_policy_name = targeted
• var_selinux_state = enforcing

03.01.02E: Non-Organizationally Owned Systems - Restricted Use

Description: None

• default

Automated: no

No rules selected

03.01.04E: Concurrent Session Control

Description: None

• default

Automated: no

No rules selected

03.01.05E: Automated Monitoring and Control for Remote Access

Description: None

• default

Automated: no

• configure_custom_crypto_policy_cis: Implement Custom Crypto Policy Modules for CIS Benchmark
  • CCE-88900-6

03.01.06E: Protection of Remote Access Mechanism Information

Description: None

• default

Automated: no

• configure_custom_crypto_policy_cis: Implement Custom Crypto Policy Modules for CIS Benchmark
  • CCE-88900-6

03.01.07E: Automated Audit Actions for Account Management

Description: None

• default

Automated: no

No rules selected

03.01.08E: Account Monitoring for Atypical Usage

Description: None

• default

Automated: no

No rules selected

03.01.09E: Attribute-Based Access Control

Description: None

• default

Automated: no

• accounts_umask_etc_bashrc: Ensure the Default Bash Umask is Set Correctly
  • CCE-83644-5
• accounts_umask_etc_login_defs: Ensure the Default Umask is Set Correctly in login.defs
  • CCE-83647-8
• accounts_umask_etc_profile: Ensure the Default Umask is Set Correctly in /etc/profile
  • CCE-90828-5
• audit_rules_immutable: Make the auditd Configuration Immutable
  • CCE-83716-1
• dir_perms_world_writable_sticky_bits: Verify that All World-Writable Directories Have Sticky Bits Set
  • CCE-83895-3
• ensure_pam_wheel_group_empty: Ensure the Group Used by pam_wheel.so Module Exists on System and is Empty
  • CCE-86072-6
• file_at_allow_exists: Ensure that /etc/at.allow exists
  • CCE-86856-2
• file_at_deny_not_exist: Ensure that /etc/at.deny does not exist
  • CCE-86946-1
• file_cron_allow_exists: Ensure that /etc/cron.allow exists
  • CCE-86185-6
• file_cron_deny_not_exist: Ensure that /etc/cron.deny does not exist
  • CCE-86850-5
• file_etc_security_opasswd: Verify Permissions and Ownership of Old Passwords File
  • CCE-86762-2
• file_groupowner_at_allow: Verify Group Who Owns /etc/at.allow file
  • CCE-87103-8
• file_groupowner_backup_etc_group: Verify Group Who Owns Backup group File
  • CCE-83928-2
• file_groupowner_backup_etc_gshadow: Verify Group Who Owns Backup gshadow File
  • CCE-83951-4
• file_groupowner_backup_etc_passwd: Verify Group Who Owns Backup passwd File
  • CCE-83933-2
• file_groupowner_backup_etc_shadow: Verify User Who Owns Backup shadow File
  • CCE-83938-1
• file_groupowner_cron_allow: Verify Group Who Owns /etc/cron.allow file
  • CCE-86830-7
• file_groupowner_cron_d: Verify Group Who Owns cron.d
  • CCE-84177-5
• file_groupowner_cron_daily: Verify Group Who Owns cron.daily
  • CCE-84170-0
• file_groupowner_cron_hourly: Verify Group Who Owns cron.hourly
  • CCE-84186-6
• file_groupowner_cron_monthly: Verify Group Who Owns cron.monthly
  • CCE-84189-0
• file_groupowner_cron_weekly: Verify Group Who Owns cron.weekly
  • CCE-84174-2
• file_groupowner_crontab: Verify Group Who Owns Crontab
  • CCE-84171-8
• file_groupowner_etc_group: Verify Group Who Owns group File
  • CCE-83945-6
• file_groupowner_etc_gshadow: Verify Group Who Owns gshadow File
  • CCE-83948-0
• file_groupowner_etc_issue: Verify Group Ownership of System Login Banner
  • CCE-86699-6
• file_groupowner_etc_issue_net: Verify Group Ownership of System Login Banner for Remote Connections
  • CCE-86052-8
• file_groupowner_etc_motd: Verify Group Ownership of Message of the Day Banner
  • CCE-86697-0
• file_groupowner_etc_passwd: Verify Group Who Owns passwd File
  • CCE-83950-6
• file_groupowner_etc_shadow: Verify Group Who Owns shadow File
  • CCE-83930-8
• file_groupowner_etc_shells: Verify Group Who Owns /etc/shells File
  • CCE-90434-2
• file_groupowner_grub2_cfg: Verify /boot/grub2/grub.cfg Group Ownership
  • CCE-83848-2
• file_groupowner_sshd_config: Verify Group Who Owns SSH Server config file
  • CCE-90817-8
• file_groupowner_user_cfg: Verify /boot/grub2/user.cfg Group Ownership
  • CCE-86010-6
• file_groupownership_sshd_private_key: Verify Group Ownership on SSH Server Private *_key Key Files
  • CCE-86127-8
• file_groupownership_sshd_pub_key: Verify Group Ownership on SSH Server Public *.pub Key Files
  • CCE-86136-9
• file_owner_backup_etc_group: Verify User Who Owns Backup group File
  • CCE-83944-9
• file_owner_backup_etc_gshadow: Verify User Who Owns Backup gshadow File
  • CCE-83929-0
• file_owner_backup_etc_passwd: Verify User Who Owns Backup passwd File
  • CCE-83947-2
• file_owner_backup_etc_shadow: Verify Group Who Owns Backup shadow File
  • CCE-83949-8
• file_owner_cron_allow: Verify User Who Owns /etc/cron.allow file
  • CCE-86844-8
• file_owner_cron_d: Verify Owner on cron.d
  • CCE-84169-2
• file_owner_cron_daily: Verify Owner on cron.daily
  • CCE-84188-2
• file_owner_cron_hourly: Verify Owner on cron.hourly
  • CCE-84168-4
• file_owner_cron_monthly: Verify Owner on cron.monthly
  • CCE-84179-1
• file_owner_cron_weekly: Verify Owner on cron.weekly
  • CCE-84190-8
• file_owner_crontab: Verify Owner on crontab
  • CCE-84167-6
• file_owner_etc_group: Verify User Who Owns group File
  • CCE-83925-8
• file_owner_etc_gshadow: Verify User Who Owns gshadow File
  • CCE-83924-1
• file_owner_etc_issue: Verify ownership of System Login Banner
  • CCE-86700-2
• file_owner_etc_issue_net: Verify ownership of System Login Banner for Remote Connections
  • CCE-86057-7
• file_owner_etc_motd: Verify ownership of Message of the Day Banner
  • CCE-86698-8
• file_owner_etc_passwd: Verify User Who Owns passwd File
  • CCE-83943-1
• file_owner_etc_shadow: Verify User Who Owns shadow File
  • CCE-83926-6
• file_owner_etc_shells: Verify Who Owns /etc/shells File
  • CCE-90435-9
• file_owner_grub2_cfg: Verify /boot/grub2/grub.cfg User Ownership
  • CCE-83845-8
• file_owner_sshd_config: Verify Owner on SSH Server config file
  • CCE-90821-0
• file_owner_user_cfg: Verify /boot/grub2/user.cfg User Ownership
  • CCE-86016-3
• file_ownership_sshd_private_key: Verify Ownership on SSH Server Private *_key Key Files
  • CCE-86119-5
• file_ownership_sshd_pub_key: Verify Ownership on SSH Server Public *.pub Key Files
  • CCE-86130-2
• file_permissions_at_allow: Verify Permissions on /etc/at.allow file
  • CCE-86904-0
• file_permissions_backup_etc_group: Verify Permissions on Backup group File
  • CCE-83939-9
• file_permissions_backup_etc_gshadow: Verify Permissions on Backup gshadow File
  • CCE-83942-3
• file_permissions_backup_etc_passwd: Verify Permissions on Backup passwd File
  • CCE-83940-7
• file_permissions_backup_etc_shadow: Verify Permissions on Backup shadow File
  • CCE-83935-7
• file_permissions_cron_allow: Verify Permissions on /etc/cron.allow file
  • CCE-86877-8
• file_permissions_cron_d: Verify Permissions on cron.d
  • CCE-84183-3
• file_permissions_cron_daily: Verify Permissions on cron.daily
  • CCE-84175-9
• file_permissions_cron_hourly: Verify Permissions on cron.hourly
  • CCE-84173-4
• file_permissions_cron_monthly: Verify Permissions on cron.monthly
  • CCE-84181-7
• file_permissions_cron_weekly: Verify Permissions on cron.weekly
  • CCE-84187-4
• file_permissions_crontab: Verify Permissions on crontab
  • CCE-84176-7
• file_permissions_etc_group: Verify Permissions on group File
  • CCE-83934-0
• file_permissions_etc_gshadow: Verify Permissions on gshadow File
  • CCE-83921-7
• file_permissions_etc_issue: Verify permissions on System Login Banner
  • CCE-83551-2
• file_permissions_etc_issue_net: Verify permissions on System Login Banner for Remote Connections
  • CCE-86048-6
• file_permissions_etc_motd: Verify permissions on Message of the Day Banner
  • CCE-83554-6
• file_permissions_etc_passwd: Verify Permissions on passwd File
  • CCE-83931-6
• file_permissions_etc_shadow: Verify Permissions on shadow File
  • CCE-83941-5
• file_permissions_etc_shells: Verify Permissions on /etc/shells File
  • CCE-90432-6
• file_permissions_grub2_cfg: Verify /boot/grub2/grub.cfg Permissions
  • CCE-83846-6
• file_permissions_sshd_config: Verify Permissions on SSH Server config file
  • CCE-90818-6
• file_permissions_sshd_private_key: Verify Permissions on SSH Server Private *_key Key Files
  • CCE-90820-2
• file_permissions_sshd_pub_key: Verify Permissions on SSH Server Public *.pub Key Files
  • CCE-90819-4
• file_permissions_unauthorized_world_writable: Ensure No World-Writable Files Exist
  • CCE-83902-7
• file_permissions_ungroupowned: Ensure All Files Are Owned by a Group
  • CCE-83906-8
• file_permissions_user_cfg: Verify /boot/grub2/user.cfg Permissions
  • CCE-86025-4
• grub2_enable_selinux: Ensure SELinux Not Disabled in /etc/default/grub
  • CCE-84078-5
• grub2_password: Set Boot Loader Password in grub2
  • CCE-83849-0
• mount_option_dev_shm_nodev: Add nodev Option to /dev/shm
  • CCE-83881-3
• mount_option_dev_shm_noexec: Add noexec Option to /dev/shm
  • CCE-83857-3
• mount_option_dev_shm_nosuid: Add nosuid Option to /dev/shm
  • CCE-83891-2
• mount_option_home_nodev: Add nodev Option to /home
  • CCE-83871-4
• mount_option_home_nosuid: Add nosuid Option to /home
  • CCE-83894-6
• mount_option_tmp_noexec: Add noexec Option to /tmp
  • CCE-83885-4
• mount_option_tmp_nosuid: Add nosuid Option to /tmp
  • CCE-83872-2
• mount_option_var_log_audit_nodev: Add nodev Option to /var/log/audit
  • CCE-83882-1
• mount_option_var_log_audit_noexec: Add noexec Option to /var/log/audit
  • CCE-83878-9
• mount_option_var_log_audit_nosuid: Add nosuid Option to /var/log/audit
  • CCE-83893-8
• mount_option_var_log_nodev: Add nodev Option to /var/log
  • CCE-83886-2
• mount_option_var_log_noexec: Add noexec Option to /var/log
  • CCE-83887-0
• mount_option_var_log_nosuid: Add nosuid Option to /var/log
  • CCE-83870-6
• mount_option_var_nodev: Add nodev Option to /var
  • CCE-83868-0
• mount_option_var_nosuid: Add nosuid Option to /var
  • CCE-83867-2
• mount_option_var_tmp_nodev: Add nodev Option to /var/tmp
  • CCE-83864-9
• mount_option_var_tmp_noexec: Add noexec Option to /var/tmp
  • CCE-83866-4
• mount_option_var_tmp_nosuid: Add nosuid Option to /var/tmp
  • CCE-83863-1
• no_files_unowned_by_user: Ensure All Files Are Owned by a User
  • CCE-83896-1
• package_libselinux_installed: Install libselinux Package
  • CCE-84069-4
• package_mcstrans_removed: Uninstall mcstrans Package
  • CCE-84072-8
• package_setroubleshoot_removed: Uninstall setroubleshoot Package
  • CCE-84073-6
• rsyslog_filecreatemode: Ensure rsyslog Default File Permissions Configured
  • CCE-88322-3
• rsyslog_files_groupownership: Ensure Log Files Are Owned By Appropriate Group
  • CCE-83834-2
• rsyslog_files_ownership: Ensure Log Files Are Owned By Appropriate User
  • CCE-83946-4
• rsyslog_files_permissions: Ensure System Log Files Have Correct Permissions
  • CCE-83689-0
• selinux_not_disabled: Ensure SELinux is Not Disabled
  • CCE-86152-6
• selinux_policytype: Configure SELinux Policy
  • CCE-84074-4
• selinux_state: Ensure SELinux State is Enforcing
  • CCE-84079-3
• sshd_limit_user_access: Limit Users' SSH Access
  • CCE-86817-4
• use_pam_wheel_group_for_su: Enforce Usage of pam_wheel with Group Parameter for su Authentication
  • CCE-86065-0
• var_accounts_user_umask = 027
• var_pam_wheel_group_for_su = cis
• var_selinux_policy_name = targeted
• var_selinux_state = enforcing

03.01.10E: Object Security Attributes

Description: None

• default

Automated: no

No rules selected

03.01.11E: Role-Based Access Control

Description: None

• default

Automated: no

• accounts_umask_etc_bashrc: Ensure the Default Bash Umask is Set Correctly
  • CCE-83644-5
• accounts_umask_etc_login_defs: Ensure the Default Umask is Set Correctly in login.defs
  • CCE-83647-8
• accounts_umask_etc_profile: Ensure the Default Umask is Set Correctly in /etc/profile
  • CCE-90828-5
• audit_rules_immutable: Make the auditd Configuration Immutable
  • CCE-83716-1
• dir_perms_world_writable_sticky_bits: Verify that All World-Writable Directories Have Sticky Bits Set
  • CCE-83895-3
• ensure_pam_wheel_group_empty: Ensure the Group Used by pam_wheel.so Module Exists on System and is Empty
  • CCE-86072-6
• file_at_allow_exists: Ensure that /etc/at.allow exists
  • CCE-86856-2
• file_at_deny_not_exist: Ensure that /etc/at.deny does not exist
  • CCE-86946-1
• file_cron_allow_exists: Ensure that /etc/cron.allow exists
  • CCE-86185-6
• file_cron_deny_not_exist: Ensure that /etc/cron.deny does not exist
  • CCE-86850-5
• file_etc_security_opasswd: Verify Permissions and Ownership of Old Passwords File
  • CCE-86762-2
• file_groupowner_at_allow: Verify Group Who Owns /etc/at.allow file
  • CCE-87103-8
• file_groupowner_backup_etc_group: Verify Group Who Owns Backup group File
  • CCE-83928-2
• file_groupowner_backup_etc_gshadow: Verify Group Who Owns Backup gshadow File
  • CCE-83951-4
• file_groupowner_backup_etc_passwd: Verify Group Who Owns Backup passwd File
  • CCE-83933-2
• file_groupowner_backup_etc_shadow: Verify User Who Owns Backup shadow File
  • CCE-83938-1
• file_groupowner_cron_allow: Verify Group Who Owns /etc/cron.allow file
  • CCE-86830-7
• file_groupowner_cron_d: Verify Group Who Owns cron.d
  • CCE-84177-5
• file_groupowner_cron_daily: Verify Group Who Owns cron.daily
  • CCE-84170-0
• file_groupowner_cron_hourly: Verify Group Who Owns cron.hourly
  • CCE-84186-6
• file_groupowner_cron_monthly: Verify Group Who Owns cron.monthly
  • CCE-84189-0
• file_groupowner_cron_weekly: Verify Group Who Owns cron.weekly
  • CCE-84174-2
• file_groupowner_crontab: Verify Group Who Owns Crontab
  • CCE-84171-8
• file_groupowner_etc_group: Verify Group Who Owns group File
  • CCE-83945-6
• file_groupowner_etc_gshadow: Verify Group Who Owns gshadow File
  • CCE-83948-0
• file_groupowner_etc_issue: Verify Group Ownership of System Login Banner
  • CCE-86699-6
• file_groupowner_etc_issue_net: Verify Group Ownership of System Login Banner for Remote Connections
  • CCE-86052-8
• file_groupowner_etc_motd: Verify Group Ownership of Message of the Day Banner
  • CCE-86697-0
• file_groupowner_etc_passwd: Verify Group Who Owns passwd File
  • CCE-83950-6
• file_groupowner_etc_shadow: Verify Group Who Owns shadow File
  • CCE-83930-8
• file_groupowner_etc_shells: Verify Group Who Owns /etc/shells File
  • CCE-90434-2
• file_groupowner_grub2_cfg: Verify /boot/grub2/grub.cfg Group Ownership
  • CCE-83848-2
• file_groupowner_sshd_config: Verify Group Who Owns SSH Server config file
  • CCE-90817-8
• file_groupowner_user_cfg: Verify /boot/grub2/user.cfg Group Ownership
  • CCE-86010-6
• file_groupownership_sshd_private_key: Verify Group Ownership on SSH Server Private *_key Key Files
  • CCE-86127-8
• file_groupownership_sshd_pub_key: Verify Group Ownership on SSH Server Public *.pub Key Files
  • CCE-86136-9
• file_owner_backup_etc_group: Verify User Who Owns Backup group File
  • CCE-83944-9
• file_owner_backup_etc_gshadow: Verify User Who Owns Backup gshadow File
  • CCE-83929-0
• file_owner_backup_etc_passwd: Verify User Who Owns Backup passwd File
  • CCE-83947-2
• file_owner_backup_etc_shadow: Verify Group Who Owns Backup shadow File
  • CCE-83949-8
• file_owner_cron_allow: Verify User Who Owns /etc/cron.allow file
  • CCE-86844-8
• file_owner_cron_d: Verify Owner on cron.d
  • CCE-84169-2
• file_owner_cron_daily: Verify Owner on cron.daily
  • CCE-84188-2
• file_owner_cron_hourly: Verify Owner on cron.hourly
  • CCE-84168-4
• file_owner_cron_monthly: Verify Owner on cron.monthly
  • CCE-84179-1
• file_owner_cron_weekly: Verify Owner on cron.weekly
  • CCE-84190-8
• file_owner_crontab: Verify Owner on crontab
  • CCE-84167-6
• file_owner_etc_group: Verify User Who Owns group File
  • CCE-83925-8
• file_owner_etc_gshadow: Verify User Who Owns gshadow File
  • CCE-83924-1
• file_owner_etc_issue: Verify ownership of System Login Banner
  • CCE-86700-2
• file_owner_etc_issue_net: Verify ownership of System Login Banner for Remote Connections
  • CCE-86057-7
• file_owner_etc_motd: Verify ownership of Message of the Day Banner
  • CCE-86698-8
• file_owner_etc_passwd: Verify User Who Owns passwd File
  • CCE-83943-1
• file_owner_etc_shadow: Verify User Who Owns shadow File
  • CCE-83926-6
• file_owner_etc_shells: Verify Who Owns /etc/shells File
  • CCE-90435-9
• file_owner_grub2_cfg: Verify /boot/grub2/grub.cfg User Ownership
  • CCE-83845-8
• file_owner_sshd_config: Verify Owner on SSH Server config file
  • CCE-90821-0
• file_owner_user_cfg: Verify /boot/grub2/user.cfg User Ownership
  • CCE-86016-3
• file_ownership_sshd_private_key: Verify Ownership on SSH Server Private *_key Key Files
  • CCE-86119-5
• file_ownership_sshd_pub_key: Verify Ownership on SSH Server Public *.pub Key Files
  • CCE-86130-2
• file_permissions_at_allow: Verify Permissions on /etc/at.allow file
  • CCE-86904-0
• file_permissions_backup_etc_group: Verify Permissions on Backup group File
  • CCE-83939-9
• file_permissions_backup_etc_gshadow: Verify Permissions on Backup gshadow File
  • CCE-83942-3
• file_permissions_backup_etc_passwd: Verify Permissions on Backup passwd File
  • CCE-83940-7
• file_permissions_backup_etc_shadow: Verify Permissions on Backup shadow File
  • CCE-83935-7
• file_permissions_cron_allow: Verify Permissions on /etc/cron.allow file
  • CCE-86877-8
• file_permissions_cron_d: Verify Permissions on cron.d
  • CCE-84183-3
• file_permissions_cron_daily: Verify Permissions on cron.daily
  • CCE-84175-9
• file_permissions_cron_hourly: Verify Permissions on cron.hourly
  • CCE-84173-4
• file_permissions_cron_monthly: Verify Permissions on cron.monthly
  • CCE-84181-7
• file_permissions_cron_weekly: Verify Permissions on cron.weekly
  • CCE-84187-4
• file_permissions_crontab: Verify Permissions on crontab
  • CCE-84176-7
• file_permissions_etc_group: Verify Permissions on group File
  • CCE-83934-0
• file_permissions_etc_gshadow: Verify Permissions on gshadow File
  • CCE-83921-7
• file_permissions_etc_issue: Verify permissions on System Login Banner
  • CCE-83551-2
• file_permissions_etc_issue_net: Verify permissions on System Login Banner for Remote Connections
  • CCE-86048-6
• file_permissions_etc_motd: Verify permissions on Message of the Day Banner
  • CCE-83554-6
• file_permissions_etc_passwd: Verify Permissions on passwd File
  • CCE-83931-6
• file_permissions_etc_shadow: Verify Permissions on shadow File
  • CCE-83941-5
• file_permissions_etc_shells: Verify Permissions on /etc/shells File
  • CCE-90432-6
• file_permissions_grub2_cfg: Verify /boot/grub2/grub.cfg Permissions
  • CCE-83846-6
• file_permissions_sshd_config: Verify Permissions on SSH Server config file
  • CCE-90818-6
• file_permissions_sshd_private_key: Verify Permissions on SSH Server Private *_key Key Files
  • CCE-90820-2
• file_permissions_sshd_pub_key: Verify Permissions on SSH Server Public *.pub Key Files
  • CCE-90819-4
• file_permissions_unauthorized_world_writable: Ensure No World-Writable Files Exist
  • CCE-83902-7
• file_permissions_ungroupowned: Ensure All Files Are Owned by a Group
  • CCE-83906-8
• file_permissions_user_cfg: Verify /boot/grub2/user.cfg Permissions
  • CCE-86025-4
• grub2_enable_selinux: Ensure SELinux Not Disabled in /etc/default/grub
  • CCE-84078-5
• grub2_password: Set Boot Loader Password in grub2
  • CCE-83849-0
• mount_option_dev_shm_nodev: Add nodev Option to /dev/shm
  • CCE-83881-3
• mount_option_dev_shm_noexec: Add noexec Option to /dev/shm
  • CCE-83857-3
• mount_option_dev_shm_nosuid: Add nosuid Option to /dev/shm
  • CCE-83891-2
• mount_option_home_nodev: Add nodev Option to /home
  • CCE-83871-4
• mount_option_home_nosuid: Add nosuid Option to /home
  • CCE-83894-6
• mount_option_tmp_noexec: Add noexec Option to /tmp
  • CCE-83885-4
• mount_option_tmp_nosuid: Add nosuid Option to /tmp
  • CCE-83872-2
• mount_option_var_log_audit_nodev: Add nodev Option to /var/log/audit
  • CCE-83882-1
• mount_option_var_log_audit_noexec: Add noexec Option to /var/log/audit
  • CCE-83878-9
• mount_option_var_log_audit_nosuid: Add nosuid Option to /var/log/audit
  • CCE-83893-8
• mount_option_var_log_nodev: Add nodev Option to /var/log
  • CCE-83886-2
• mount_option_var_log_noexec: Add noexec Option to /var/log
  • CCE-83887-0
• mount_option_var_log_nosuid: Add nosuid Option to /var/log
  • CCE-83870-6
• mount_option_var_nodev: Add nodev Option to /var
  • CCE-83868-0
• mount_option_var_nosuid: Add nosuid Option to /var
  • CCE-83867-2
• mount_option_var_tmp_nodev: Add nodev Option to /var/tmp
  • CCE-83864-9
• mount_option_var_tmp_noexec: Add noexec Option to /var/tmp
  • CCE-83866-4
• mount_option_var_tmp_nosuid: Add nosuid Option to /var/tmp
  • CCE-83863-1
• no_files_unowned_by_user: Ensure All Files Are Owned by a User
  • CCE-83896-1
• package_libselinux_installed: Install libselinux Package
  • CCE-84069-4
• package_mcstrans_removed: Uninstall mcstrans Package
  • CCE-84072-8
• package_setroubleshoot_removed: Uninstall setroubleshoot Package
  • CCE-84073-6
• rsyslog_filecreatemode: Ensure rsyslog Default File Permissions Configured
  • CCE-88322-3
• rsyslog_files_groupownership: Ensure Log Files Are Owned By Appropriate Group
  • CCE-83834-2
• rsyslog_files_ownership: Ensure Log Files Are Owned By Appropriate User
  • CCE-83946-4
• rsyslog_files_permissions: Ensure System Log Files Have Correct Permissions
  • CCE-83689-0
• selinux_not_disabled: Ensure SELinux is Not Disabled
  • CCE-86152-6
• selinux_policytype: Configure SELinux Policy
  • CCE-84074-4
• selinux_state: Ensure SELinux State is Enforcing
  • CCE-84079-3
• sshd_limit_user_access: Limit Users' SSH Access
  • CCE-86817-4
• use_pam_wheel_group_for_su: Enforce Usage of pam_wheel with Group Parameter for su Authentication
  • CCE-86065-0
• var_accounts_user_umask = 027
• var_pam_wheel_group_for_su = cis
• var_selinux_policy_name = targeted
• var_selinux_state = enforcing

03.01.12E: Physical or Logical Separation of CUI Flows

Description: None

• default

Automated: no

No rules selected

03.01.13E: Metadata

Description: None

• default

Automated: no

No rules selected

03.01.14E: Security Policy Filters

Description: None

• default

Automated: no

No rules selected

03.01.15E: Data Type Identifiers

Description: None

• default

Automated: no

No rules selected

03.01.16E: Decomposition into Policy-Relevant Subcomponents

Description: None

• default

Automated: no

No rules selected

03.01.17E: Detection of Unsanctioned CUI

Description: None

• default

Automated: no

No rules selected

03.02.01E: Advanced Literacy and Awareness Training

Description: None

• default

Automated: no

No rules selected

03.02.02E: Literacy and Awareness Training Practical Exercises

Description: None

• default

Automated: no

No rules selected

03.02.03E: Literacy and Awareness Training Feedback

Description: None

• default

Automated: no

No rules selected

03.02.04E: Anti-Counterfeit Training

Description: None

• default

Automated: no

No rules selected

03.03.01E: Protection of Audit Record Storage in Separate Physical Systems or Components

Description: None

• default

Automated: no

• audit_rules_immutable: Make the auditd Configuration Immutable
  • CCE-83716-1
• file_groupownership_audit_configuration: Audit Configuration Files Must Be Owned By Group root
  • CCE-86446-2
• file_ownership_audit_binaries: Verify that audit tools are owned by root
  • CCE-86454-6
• file_ownership_audit_configuration: Audit Configuration Files Must Be Owned By Root
  • CCE-86445-4

03.03.02E: Real-Time Alerts for Audit Processing Failures

Description: None

• default

Automated: no

• auditd_data_disk_error_action: Configure auditd Disk Error Action on Disk Error
  • CCE-83690-8
• auditd_data_disk_full_action: Configure auditd Disk Full Action when Disk Space Is Full
  • CCE-83684-1
• package_postfix_installed: The Postfix package is installed
  • CCE-85984-3
• var_auditd_disk_error_action = cis_rhel9
• var_auditd_disk_full_action = cis_rhel9

03.03.03E: Dual Authorization for Audit Information and Actions

Description: None

• default

Automated: no

• audit_rules_immutable: Make the auditd Configuration Immutable
  • CCE-83716-1
• file_groupownership_audit_configuration: Audit Configuration Files Must Be Owned By Group root
  • CCE-86446-2
• file_ownership_audit_binaries: Verify that audit tools are owned by root
  • CCE-86454-6
• file_ownership_audit_configuration: Audit Configuration Files Must Be Owned By Root
  • CCE-86445-4

03.03.04E: Integrated Analysis of Audit Records

Description: None

• default

Automated: no

No rules selected

03.04.02E: Automated Unauthorized Component Detection

Description: None

• default

Automated: no

• accounts_password_pam_modules_in_authselect_profile: Ensure Active Authselect Profile Includes PAM Modules
  • CCE-90719-6
• accounts_umask_etc_bashrc: Ensure the Default Bash Umask is Set Correctly
  • CCE-83644-5
• accounts_umask_etc_login_defs: Ensure the Default Umask is Set Correctly in login.defs
  • CCE-83647-8
• accounts_umask_etc_profile: Ensure the Default Umask is Set Correctly in /etc/profile
  • CCE-90828-5
• accounts_user_interactive_home_directory_exists: All Interactive Users Home Directories Must Exist
  • CCE-83639-5
• audit_rules_media_export: Ensure auditd Collects Information on Exporting to Media (successful)
  • CCE-83735-1
• banner_etc_issue_cis: Ensure Local Login Warning Banner Is Configured Properly
  • CCE-86142-7
• banner_etc_issue_net_cis: Ensure Remote Login Warning Banner Is Configured Properly
  • CCE-86143-5
• banner_etc_motd_cis: Ensure Message Of The Day Is Configured Properly
  • CCE-86141-9
• chronyd_run_as_chrony_user: Ensure that chronyd is running under chrony user account
  • CCE-84108-0
• cis_banner_text = cis
• coredump_disable_backtraces: Disable core dump backtraces
  • CCE-83984-5
• coredump_disable_storage: Disable storing core dump
  • CCE-83979-5
• dconf_db_up_to_date: Make sure that the dconf databases are up-to-date with regards to respective keyfiles
  • CCE-87295-2
• dconf_gnome_disable_user_list: Disable the GNOME3 Login User List
  • CCE-88285-2
• dconf_login_banner_contents = cis_default
• dconf_login_banner_text = cis_banners
• disable_host_auth: Disable Host-Based Authentication
  • CCE-90816-0
• enable_authselect: Enable authselect
  • CCE-89732-2
• file_groupowner_grub2_cfg: Verify /boot/grub2/grub.cfg Group Ownership
  • CCE-83848-2
• file_groupowner_user_cfg: Verify /boot/grub2/user.cfg Group Ownership
  • CCE-86010-6
• file_groupownership_sshd_private_key: Verify Group Ownership on SSH Server Private *_key Key Files
  • CCE-86127-8
• file_groupownership_sshd_pub_key: Verify Group Ownership on SSH Server Public *.pub Key Files
  • CCE-86136-9
• file_owner_grub2_cfg: Verify /boot/grub2/grub.cfg User Ownership
  • CCE-83845-8
• file_owner_user_cfg: Verify /boot/grub2/user.cfg User Ownership
  • CCE-86016-3
• file_ownership_sshd_private_key: Verify Ownership on SSH Server Private *_key Key Files
  • CCE-86119-5
• file_ownership_sshd_pub_key: Verify Ownership on SSH Server Public *.pub Key Files
  • CCE-86130-2
• file_permissions_grub2_cfg: Verify /boot/grub2/grub.cfg Permissions
  • CCE-83846-6
• file_permissions_home_directories: All Interactive User Home Directories Must Have mode 0750 Or Less Permissive
  • CCE-83634-6
• file_permissions_sshd_private_key: Verify Permissions on SSH Server Private *_key Key Files
  • CCE-90820-2
• file_permissions_sshd_pub_key: Verify Permissions on SSH Server Public *.pub Key Files
  • CCE-90819-4
• file_permissions_user_cfg: Verify /boot/grub2/user.cfg Permissions
  • CCE-86025-4
• no_empty_passwords: Prevent Login to Accounts With Empty Password
  • CCE-83611-4
• no_empty_passwords_etc_shadow: Ensure There Are No Accounts With Blank or Null Passwords
  • CCE-85972-8
• package_pam_pwquality_installed: Install pam_pwquality Package
  • CCE-86226-8
• package_rsync_removed: Uninstall rsync Package
  • CCE-86336-5
• package_samba_removed: Uninstall Samba Package
  • CCE-85979-3
• package_squid_removed: Uninstall squid Package
  • CCE-84238-5
• partition_for_tmp: Ensure /tmp Located On Separate Partition
  • CCE-90845-9
• partition_for_var_log: Ensure /var/log Located On Separate Partition
  • CCE-90848-3
• service_nfs_disabled: Disable Network File System (nfs)
  • CCE-90850-9
• service_rpcbind_disabled: Disable rpcbind Service
  • CCE-84245-0
• sshd_disable_gssapi_auth: Disable GSSAPI Authentication
  • CCE-90808-7
• sshd_set_login_grace_time: Ensure SSH LoginGraceTime is configured
  • CCE-86552-7
• sysctl_kernel_randomize_va_space: Enable Randomized Layout of Virtual Address Space
  • CCE-83971-2
• sysctl_kernel_yama_ptrace_scope: Restrict usage of ptrace to descendant processes
  • CCE-83965-4
• sysctl_net_ipv4_conf_all_accept_redirects: Disable Accepting ICMP Redirects for All IPv4 Interfaces
  • CCE-84011-6
• sysctl_net_ipv4_conf_all_accept_redirects_value = disabled
• sysctl_net_ipv4_conf_all_accept_source_route: Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
  • CCE-84001-7
• sysctl_net_ipv4_conf_all_accept_source_route_value = disabled
• sysctl_net_ipv4_conf_all_log_martians: Enable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
  • CCE-84000-9
• sysctl_net_ipv4_conf_all_log_martians_value = enabled
• sysctl_net_ipv4_conf_all_rp_filter: Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
  • CCE-84008-2
• sysctl_net_ipv4_conf_all_rp_filter_value = enabled
• sysctl_net_ipv4_conf_all_secure_redirects: Disable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
  • CCE-84016-5
• sysctl_net_ipv4_conf_all_secure_redirects_value = disabled
• sysctl_net_ipv4_conf_all_send_redirects: Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
  • CCE-83997-7
• sysctl_net_ipv4_conf_default_accept_redirects: Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
  • CCE-84003-3
• sysctl_net_ipv4_conf_default_accept_redirects_value = disabled
• sysctl_net_ipv4_conf_default_accept_source_route: Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
  • CCE-84007-4
• sysctl_net_ipv4_conf_default_accept_source_route_value = disabled
• sysctl_net_ipv4_conf_default_log_martians: Enable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces by Default
  • CCE-84014-0
• sysctl_net_ipv4_conf_default_log_martians_value = enabled
• sysctl_net_ipv4_conf_default_rp_filter: Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
  • CCE-84009-0
• sysctl_net_ipv4_conf_default_rp_filter_value = enabled
• sysctl_net_ipv4_conf_default_secure_redirects: Configure Kernel Parameter for Accepting Secure Redirects By Default
  • CCE-84019-9
• sysctl_net_ipv4_conf_default_secure_redirects_value = disabled
• sysctl_net_ipv4_conf_default_send_redirects: Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
  • CCE-83999-3
• sysctl_net_ipv4_icmp_echo_ignore_broadcasts: Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
  • CCE-84004-1
• sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value = enabled
• sysctl_net_ipv4_icmp_ignore_bogus_error_responses: Enable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
  • CCE-84015-7
• sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value = enabled
• sysctl_net_ipv4_ip_forward: Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces
  • CCE-83998-5
• sysctl_net_ipv6_conf_all_accept_ra: Configure Accepting Router Advertisements on All IPv6 Interfaces
  • CCE-84120-5
• sysctl_net_ipv6_conf_all_accept_ra_value = disabled
• sysctl_net_ipv6_conf_all_accept_redirects: Disable Accepting ICMP Redirects for All IPv6 Interfaces
  • CCE-84125-4
• sysctl_net_ipv6_conf_all_accept_redirects_value = disabled
• sysctl_net_ipv6_conf_all_accept_source_route: Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces
  • CCE-84131-2
• sysctl_net_ipv6_conf_all_accept_source_route_value = disabled
• sysctl_net_ipv6_conf_all_forwarding: Disable Kernel Parameter for IPv6 Forwarding
  • CCE-84114-8
• sysctl_net_ipv6_conf_all_forwarding_value = disabled
• sysctl_net_ipv6_conf_default_accept_ra: Disable Accepting Router Advertisements on all IPv6 Interfaces by Default
  • CCE-84124-7
• sysctl_net_ipv6_conf_default_accept_ra_value = disabled
• sysctl_net_ipv6_conf_default_accept_redirects: Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
  • CCE-84113-0
• sysctl_net_ipv6_conf_default_accept_redirects_value = disabled
• sysctl_net_ipv6_conf_default_accept_source_route: Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default
  • CCE-84130-4
• sysctl_net_ipv6_conf_default_accept_source_route_value = disabled
• var_accounts_user_umask = 027
• var_authselect_profile = sssd
• var_sshd_set_login_grace_time = 60

03.04.03E: Automation Maintenance of System Component Inventory

Description: None

• default

Automated: no

No rules selected

03.04.04E: Automation Support for Baseline Configuration

Description: None

• default

Automated: no

No rules selected

03.04.05E: Dual Authorization for System Changes

Description: None

• default

Automated: no

No rules selected

03.04.06E: Retention of Previous Configurations

Description: None

• default

Automated: no

No rules selected

03.04.07E: Testing, Validation, and Documentation of Changes

Description: None

• default

Automated: no

No rules selected

03.04.08E: Centralized Repository

Description: None

• default

Automated: no

No rules selected

03.05.01E: Cryptographic Bidirectional Authentication

Description: None

• default

Automated: no

• dconf_gnome_disable_automount: Disable GNOME3 Automounting
  • CCE-87734-0
• dconf_gnome_disable_automount_open: Disable GNOME3 Automount Opening
  • CCE-90128-0
• kernel_module_usb-storage_disabled: Disable Modprobe Loading of USB Storage Driver
  • CCE-83851-6

03.05.02E: Password Managers

Description: None

• default

Automated: no

• accounts_minimum_age_login_defs: Set Password Minimum Age
  • CCE-83610-6
• accounts_password_all_shadowed: Verify All Account Password Hashes are Shadowed
  • CCE-83618-9
• accounts_password_last_change_is_in_past: Ensure all users last password change date is in the past
  • CCE-86526-1
• accounts_password_pam_dictcheck: Ensure PAM Enforces Password Requirements - Prevent the Use of Dictionary Words
  • CCE-88413-0
• accounts_password_pam_difok: Ensure PAM Enforces Password Requirements - Minimum Different Characters
  • CCE-83564-5
• accounts_password_pam_enforce_root: Ensure PAM Enforces Password Requirements - Enforce for root User
  • CCE-86356-3
• accounts_password_pam_maxrepeat: Set Password Maximum Consecutive Repeating Characters
  • CCE-83567-8
• accounts_password_pam_maxsequence: Limit the maximum number of sequential characters in passwords
  • CCE-86444-7
• accounts_password_pam_minclass: Ensure PAM Enforces Password Requirements - Minimum Different Categories
  • CCE-83563-7
• accounts_password_pam_minlen: Ensure PAM Enforces Password Requirements - Minimum Length
  • CCE-83579-3
• accounts_password_pam_pwhistory_enforce_for_root: Ensure Password History Is Enforced for the Root User
  • CCE-86742-4
• accounts_password_set_min_life_existing: Set Existing Passwords Minimum Age
  • CCE-89069-9
• accounts_password_set_warn_age_existing: Set Existing Passwords Warning Age
  • CCE-86915-6
• accounts_password_warn_age_login_defs: Set Password Warning Age
  • CCE-83609-8
• ensure_root_password_configured: Ensure Authentication Required for Single User Mode
  • CCE-87101-2
• no_empty_passwords_etc_shadow: Ensure There Are No Accounts With Blank or Null Passwords
  • CCE-85972-8
• set_password_hashing_algorithm_libuserconf: Set Password Hashing Algorithm in /etc/libuser.conf
  • CCE-88865-1
• set_password_hashing_algorithm_logindefs: Set Password Hashing Algorithm in /etc/login.defs
  • CCE-90590-1
• set_password_hashing_algorithm_passwordauth: Set PAM Password Hashing Algorithm - password-auth
  • CCE-85946-2
• set_password_hashing_algorithm_systemauth: Set PAM Password Hashing Algorithm - system-auth
  • CCE-83581-9
• var_accounts_maximum_age_login_defs = 365
• var_accounts_minimum_age_login_defs = 1
• var_accounts_password_warn_age_login_defs = 7
• var_password_hashing_algorithm = SHA512
• var_password_hashing_algorithm_pam = sha512
• var_password_pam_dictcheck = 1
• var_password_pam_difok = 2
• var_password_pam_maxrepeat = 3
• var_password_pam_maxsequence = 3
• var_password_pam_minclass = 4
• var_password_pam_minlen = 14

03.05.03E: Device Attestation

Description: None

• default

Automated: no

• dconf_gnome_disable_automount: Disable GNOME3 Automounting
  • CCE-87734-0
• dconf_gnome_disable_automount_open: Disable GNOME3 Automount Opening
  • CCE-90128-0
• kernel_module_usb-storage_disabled: Disable Modprobe Loading of USB Storage Driver
  • CCE-83851-6

03.05.04E: No Embedded Unencrypted Static Authenticators

Description: None

• default

Automated: no

• accounts_minimum_age_login_defs: Set Password Minimum Age
  • CCE-83610-6
• accounts_password_all_shadowed: Verify All Account Password Hashes are Shadowed
  • CCE-83618-9
• accounts_password_last_change_is_in_past: Ensure all users last password change date is in the past
  • CCE-86526-1
• accounts_password_pam_dictcheck: Ensure PAM Enforces Password Requirements - Prevent the Use of Dictionary Words
  • CCE-88413-0
• accounts_password_pam_difok: Ensure PAM Enforces Password Requirements - Minimum Different Characters
  • CCE-83564-5
• accounts_password_pam_enforce_root: Ensure PAM Enforces Password Requirements - Enforce for root User
  • CCE-86356-3
• accounts_password_pam_maxrepeat: Set Password Maximum Consecutive Repeating Characters
  • CCE-83567-8
• accounts_password_pam_maxsequence: Limit the maximum number of sequential characters in passwords
  • CCE-86444-7
• accounts_password_pam_minclass: Ensure PAM Enforces Password Requirements - Minimum Different Categories
  • CCE-83563-7
• accounts_password_pam_minlen: Ensure PAM Enforces Password Requirements - Minimum Length
  • CCE-83579-3
• accounts_password_pam_pwhistory_enforce_for_root: Ensure Password History Is Enforced for the Root User
  • CCE-86742-4
• accounts_password_set_min_life_existing: Set Existing Passwords Minimum Age
  • CCE-89069-9
• accounts_password_set_warn_age_existing: Set Existing Passwords Warning Age
  • CCE-86915-6
• accounts_password_warn_age_login_defs: Set Password Warning Age
  • CCE-83609-8
• ensure_root_password_configured: Ensure Authentication Required for Single User Mode
  • CCE-87101-2
• no_empty_passwords_etc_shadow: Ensure There Are No Accounts With Blank or Null Passwords
  • CCE-85972-8
• set_password_hashing_algorithm_libuserconf: Set Password Hashing Algorithm in /etc/libuser.conf
  • CCE-88865-1
• set_password_hashing_algorithm_logindefs: Set Password Hashing Algorithm in /etc/login.defs
  • CCE-90590-1
• set_password_hashing_algorithm_passwordauth: Set PAM Password Hashing Algorithm - password-auth
  • CCE-85946-2
• set_password_hashing_algorithm_systemauth: Set PAM Password Hashing Algorithm - system-auth
  • CCE-83581-9
• var_accounts_maximum_age_login_defs = 365
• var_accounts_minimum_age_login_defs = 1
• var_accounts_password_warn_age_login_defs = 7
• var_password_hashing_algorithm = SHA512
• var_password_hashing_algorithm_pam = sha512
• var_password_pam_dictcheck = 1
• var_password_pam_difok = 2
• var_password_pam_maxrepeat = 3
• var_password_pam_maxsequence = 3
• var_password_pam_minclass = 4
• var_password_pam_minlen = 14

03.05.05E: Expiration of Cached Authenticators

Description: None

• default

Automated: no

• accounts_minimum_age_login_defs: Set Password Minimum Age
  • CCE-83610-6
• accounts_password_all_shadowed: Verify All Account Password Hashes are Shadowed
  • CCE-83618-9
• accounts_password_last_change_is_in_past: Ensure all users last password change date is in the past
  • CCE-86526-1
• accounts_password_pam_dictcheck: Ensure PAM Enforces Password Requirements - Prevent the Use of Dictionary Words
  • CCE-88413-0
• accounts_password_pam_difok: Ensure PAM Enforces Password Requirements - Minimum Different Characters
  • CCE-83564-5
• accounts_password_pam_enforce_root: Ensure PAM Enforces Password Requirements - Enforce for root User
  • CCE-86356-3
• accounts_password_pam_maxrepeat: Set Password Maximum Consecutive Repeating Characters
  • CCE-83567-8
• accounts_password_pam_maxsequence: Limit the maximum number of sequential characters in passwords
  • CCE-86444-7
• accounts_password_pam_minclass: Ensure PAM Enforces Password Requirements - Minimum Different Categories
  • CCE-83563-7
• accounts_password_pam_minlen: Ensure PAM Enforces Password Requirements - Minimum Length
  • CCE-83579-3
• accounts_password_pam_pwhistory_enforce_for_root: Ensure Password History Is Enforced for the Root User
  • CCE-86742-4
• accounts_password_set_min_life_existing: Set Existing Passwords Minimum Age
  • CCE-89069-9
• accounts_password_set_warn_age_existing: Set Existing Passwords Warning Age
  • CCE-86915-6
• accounts_password_warn_age_login_defs: Set Password Warning Age
  • CCE-83609-8
• ensure_root_password_configured: Ensure Authentication Required for Single User Mode
  • CCE-87101-2
• no_empty_passwords_etc_shadow: Ensure There Are No Accounts With Blank or Null Passwords
  • CCE-85972-8
• set_password_hashing_algorithm_libuserconf: Set Password Hashing Algorithm in /etc/libuser.conf
  • CCE-88865-1
• set_password_hashing_algorithm_logindefs: Set Password Hashing Algorithm in /etc/login.defs
  • CCE-90590-1
• set_password_hashing_algorithm_passwordauth: Set PAM Password Hashing Algorithm - password-auth
  • CCE-85946-2
• set_password_hashing_algorithm_systemauth: Set PAM Password Hashing Algorithm - system-auth
  • CCE-83581-9
• var_accounts_maximum_age_login_defs = 365
• var_accounts_minimum_age_login_defs = 1
• var_accounts_password_warn_age_login_defs = 7
• var_password_hashing_algorithm = SHA512
• var_password_hashing_algorithm_pam = sha512
• var_password_pam_dictcheck = 1
• var_password_pam_difok = 2
• var_password_pam_maxrepeat = 3
• var_password_pam_maxsequence = 3
• var_password_pam_minclass = 4
• var_password_pam_minlen = 14

03.05.06E: Identity Proofing

Description: None

• default

Automated: no

No rules selected

03.05.07E: Identity Providers and Authorization Servers

Description: None

• default

Automated: no

No rules selected

03.06.01E: Security Operations Center

Description: None

• default

Automated: no

No rules selected

03.06.02E: Integrated Incident Response Team

Description: None

• default

Automated: no

No rules selected

03.06.03E: Behavior Analysis

Description: None

• default

Automated: no

No rules selected

03.06.04E: Automated Tracking, Data Collection, and Analysis for Incident Monitoring

Description: None

• default

Automated: no

No rules selected

03.07.01E: Software Updates and Patches for Maintenance Tools

Description: None

• default

Automated: no

No rules selected

03.08.01E: Dual Authorization for Media Sanitization

Description: None

• default

Automated: no

No rules selected

03.08.02E: Dual Authorization for System Backup Deletion and Destruction

Description: None

• default

Automated: no

No rules selected

03.08.03E: Testing System Backups for Reliability and Integrity

Description: None

• default

Automated: no

No rules selected

03.08.04E: System Recovery and Reconstitution

Description: None

• default

Automated: no

No rules selected

03.09.03E: Access Agreements

Description: None

• default

Automated: no

No rules selected

03.09.04E: Citizenship Requirements

Description: None

• default

Automated: no

No rules selected

03.10.01E: Intrusion Alarms and Surveillance Equipment

Description: None

• default

Automated: no

No rules selected

03.10.02E: Delivery and Removal of System Components

Description: None

• default

Automated: no

No rules selected

03.11.01E: Threat Awareness Program

Description: None

• default

Automated: no

No rules selected

03.11.02E: Threat Hunting

Description: None

• default

Automated: no

No rules selected

03.11.03E: Predictive Cyber Analytics

Description: None

• default

Automated: no

No rules selected

03.11.08E: Dynamic Threat Awareness

Description: None

• default

Automated: no

No rules selected

03.11.09E: Indicators of Compromise

Description: None

• default

Automated: no

• kernel_module_dccp_disabled: Disable DCCP Support
  • CCE-84136-1
• kernel_module_rds_disabled: Disable RDS Support
  • CCE-84064-5
• kernel_module_sctp_disabled: Disable SCTP Support
  • CCE-84139-5
• kernel_module_tipc_disabled: Disable TIPC Support
  • CCE-84065-2
• service_avahi-daemon_disabled: Disable Avahi Server Software
  • CCE-90824-4

03.11.10E: Criticality Analysis

Description: None

• default

Automated: no

No rules selected

03.11.11E: Discoverable Information

Description: None

• default

Automated: no

No rules selected

03.11.12E: Automated Means for Sharing Threat Intelligence

Description: None

• default

Automated: no

No rules selected

03.12.01E: Penetration Testing

Description: None

• default

Automated: no

No rules selected

03.12.02E: Independent Assessors

Description: None

• default

Automated: no

No rules selected

03.12.03E: Risk Monitoring

Description: None

• default

Automated: no

No rules selected

03.12.04E: Internal System Connections

Description: None

• default

Automated: yes

• firewalld_loopback_traffic_restricted: Configure Firewalld to Restrict Loopback Traffic
  • CCE-86137-7
• firewalld_loopback_traffic_trusted: Configure Firewalld to Trust Loopback Traffic
  • CCE-86116-1
• package_firewalld_installed: Install firewalld Package
  • CCE-84021-5
• package_nftables_installed: Install nftables Package
  • CCE-86378-7

03.13.01E: Heterogeneity

Description: None

• default

Automated: no

No rules selected

03.13.02E: Randomness

Description: None

• default

Automated: no

No rules selected

03.13.03E: Concealment and Misdirection

Description: None

• default

Automated: no

No rules selected

03.13.04E: Isolation of System Components

Description: None

• default

Automated: no

• package_firewalld_installed: Install firewalld Package
  • CCE-84021-5
• service_firewalld_enabled: Verify firewalld Enabled
  • CCE-90833-5

03.13.05E: Change Processing and Storage Locations

Description: None

• default

Automated: no

No rules selected

03.13.06E: Platform-Independent Applications

Description: None

• default

Automated: no

No rules selected

03.13.07E: Virtualization Techniques

Description: None

• default

Automated: no

No rules selected

03.13.08E: Decoys

Description: None

• default

Automated: no

No rules selected

03.13.09E: Isolation of Security Tool, Mechanism, and Support Component

Description: None

• default

Automated: no

• package_firewalld_installed: Install firewalld Package
  • CCE-84021-5
• service_firewalld_enabled: Verify firewalld Enabled
  • CCE-90833-5

03.13.10E: Separate Subnetworks

Description: None

• default

Automated: no

• package_firewalld_installed: Install firewalld Package
  • CCE-84021-5
• service_firewalld_enabled: Verify firewalld Enabled
  • CCE-90833-5

03.13.11E: Thin Nodes

Description: None

• default

Automated: no

No rules selected

03.13.12E: Denial-of-Service Protection

Description: None

• default

Automated: yes

• sysctl_net_ipv4_tcp_syncookies: Enable Kernel Parameter to Use TCP Syncookies on Network Interfaces
  • CCE-84006-6

03.13.13E: Port and Input/Output Device Access

Description: None

• default

Automated: no

No rules selected

03.13.14E: Detonation Chambers

Description: None

• default

Automated: no

No rules selected

03.13.15E: Separate Subnets to Isolate System Components and Functions

Description: None

• default

Automated: no

• package_firewalld_installed: Install firewalld Package
  • CCE-84021-5
• service_firewalld_enabled: Verify firewalld Enabled
  • CCE-90833-5

03.13.16E: System Partitioning

Description: None

• default

Automated: no

No rules selected

03.14.01E: Software, Firmware, and Information Integrity

Description: None

• default

Automated: no

No rules selected

03.14.04E: Refresh from Trusted Sources

Description: None

• default

Automated: no

No rules selected

03.14.05E: Non-Persistent Information

Description: None

• default

Automated: no

No rules selected

03.14.08E: Integrity Checks

Description: None

• default

Automated: no

No rules selected

03.14.09E: Cryptographic Protection

Description: None

• default

Automated: no

No rules selected

03.14.10E: Protection of Boot Firmware

Description: None

• default

Automated: no

No rules selected

03.14.11E: Integration of Detection and Response

Description: None

• default

Automated: no

No rules selected

03.14.12E: Information Input Validation

Description: None

• default

Automated: no

No rules selected

03.14.13E: Error Handling

Description: None

• default

Automated: no

No rules selected

03.14.14E: Memory Protection

Description: None

• default

Automated: yes

• sysctl_kernel_randomize_va_space: Enable Randomized Layout of Virtual Address Space
  • CCE-83971-2

03.14.15E: Non-Persistent System Components and Services

Description: None

• default

Automated: no

No rules selected

03.14.16E: Tainting

Description: None

• default

Automated: no

No rules selected

03.14.17E: System-Generated Alerts

Description: None

• default

Automated: no

• kernel_module_dccp_disabled: Disable DCCP Support
  • CCE-84136-1
• kernel_module_rds_disabled: Disable RDS Support
  • CCE-84064-5
• kernel_module_sctp_disabled: Disable SCTP Support
  • CCE-84139-5
• kernel_module_tipc_disabled: Disable TIPC Support
  • CCE-84065-2
• service_avahi-daemon_disabled: Disable Avahi Server Software
  • CCE-90824-4

03.14.18E: Automated Organization-Generated Alerts

Description: None

• default

Automated: no

• kernel_module_dccp_disabled: Disable DCCP Support
  • CCE-84136-1
• kernel_module_rds_disabled: Disable RDS Support
  • CCE-84064-5
• kernel_module_sctp_disabled: Disable SCTP Support
  • CCE-84139-5
• kernel_module_tipc_disabled: Disable TIPC Support
  • CCE-84065-2
• service_avahi-daemon_disabled: Disable Avahi Server Software
  • CCE-90824-4

03.14.19E: Wireless Intrusion Detection

Description: None

• default

Automated: no

• kernel_module_dccp_disabled: Disable DCCP Support
  • CCE-84136-1
• kernel_module_rds_disabled: Disable RDS Support
  • CCE-84064-5
• kernel_module_sctp_disabled: Disable SCTP Support
  • CCE-84139-5
• kernel_module_tipc_disabled: Disable TIPC Support
  • CCE-84065-2
• service_avahi-daemon_disabled: Disable Avahi Server Software
  • CCE-90824-4

03.15.01E: Security Architecture

Description: None

• default

Automated: no

No rules selected

03.15.02E: Defense In Depth

Description: None

• default

Automated: no

No rules selected

03.15.03E: Supplier Diversity

Description: None

• default

Automated: no

No rules selected

03.16.01E: Specialization

Description: None

• default

Automated: no

No rules selected

03.17.01E: Notification Agreements

Description: None

• default

Automated: no

No rules selected

03.17.02E: Inspection of Systems or Components

Description: None

• default

Automated: no

No rules selected

03.17.03E: Component Authenticity

Description: None

• default

Automated: no

No rules selected

03.17.04E: Provenance

Description: None

• default

Automated: no

No rules selected

03.17.05E: Supply Chain Integrity - Pedigree

Description: None

• default

Automated: no

No rules selected