Definition of Red Hat Enterprise Linux 9 Security Technical Implementation Guide for rhel9
based on https://public.cyber.mil/stigs/downloads/
needed_rules: None
Description: None
Levels:
Automated: no
Selections:
RHEL-09-211010: RHEL 9 must be a vendor-supported release.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-211015: RHEL 9 vendor packaged system security patches and updates must be installed and up to date.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-211020: RHEL 9 must display the Standard Mandatory DOD Notice and Consent Banner before granting local or remote access to the system via a command line user logon.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-211025: RHEL 9 must implement the Endpoint Security for Linux Threat Prevention tool.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-211030: The graphical display manager must not be the default target on RHEL 9 unless approved.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-211035: RHEL 9 must enable the hardware random number generator entropy gatherer service.
Description: None
Levels:
Automated: no
No rules selected
RHEL-09-211040: RHEL 9 systemd-journald service must be enabled.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-211045: The systemd Ctrl-Alt-Delete burst key sequence in RHEL 9 must be disabled.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-211050: The x86 Ctrl-Alt-Delete key sequence must be disabled on RHEL 9.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-211055: RHEL 9 debug-shell systemd service must be disabled.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-212010: RHEL 9 must require a boot loader superuser password.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-212015: RHEL 9 must disable the ability of systemd to spawn an interactive boot process.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-212020: RHEL 9 must require a unique superusers name upon booting into single-user and maintenance modes.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-212025: RHEL 9 /boot/grub2/grub.cfg file must be group-owned by root.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-212030: RHEL 9 /boot/grub2/grub.cfg file must be owned by root.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-212035: RHEL 9 must disable virtual system calls.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-212040: RHEL 9 must clear the page allocator to prevent use-after-free attacks.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-212045: RHEL 9 must clear SLUB/SLAB objects to prevent use-after-free attacks.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-212050: RHEL 9 must enable mitigations against processor-based vulnerabilities.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-212055: RHEL 9 must enable auditing of processes that start prior to the audit daemon.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-213010: RHEL 9 must restrict access to the kernel message buffer.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-213015: RHEL 9 must prevent kernel profiling by nonprivileged users.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-213020: RHEL 9 must prevent the loading of a new kernel for later execution.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-213025: RHEL 9 must restrict exposed kernel pointer addresses access.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-213030: RHEL 9 must enable kernel parameters to enforce discretionary access control on hardlinks.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-213035: RHEL 9 must enable kernel parameters to enforce discretionary access control on symlinks.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-213040: RHEL 9 must disable the kernel.core_pattern.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-213045: RHEL 9 must be configured to disable the Asynchronous Transfer Mode kernel module.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-213050: RHEL 9 must be configured to disable the Controller Area Network kernel module.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-213055: RHEL 9 must be configured to disable the FireWire kernel module.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-213060: RHEL 9 must disable the Stream Control Transmission Protocol (SCTP) kernel module.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-213065: RHEL 9 must disable the Transparent Inter Process Communication (TIPC) kernel module.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-213070: RHEL 9 must implement address space layout randomization (ASLR) to protect its memory from unauthorized code execution.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-213075: RHEL 9 must disable access to network bpf system call from nonprivileged processes.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-213080: RHEL 9 must restrict usage of ptrace to descendant processes.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-213085: RHEL 9 must disable core dump backtraces.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-213090: RHEL 9 must disable storing core dumps.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-213095: RHEL 9 must disable core dumps for all users.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-213100: RHEL 9 must disable acquiring, saving, and processing core dumps.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-213105: RHEL 9 must disable the use of user namespaces.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-213110: RHEL 9 must implement nonexecutable data to protect its memory from unauthorized code execution.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-213115: The kdump service on RHEL 9 must be disabled.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-214010: RHEL 9 must ensure cryptographic verification of vendor software packages.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-214015: RHEL 9 must check the GPG signature of software packages originating from external software repositories before installation.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-214020: RHEL 9 must check the GPG signature of locally installed software packages before installation.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-214025: RHEL 9 must have GPG signature verification enabled for all software repositories.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-214030: RHEL 9 must be configured so that the cryptographic hashes of system files match vendor values.
Description: None
Levels:
Automated: no
No rules selected
RHEL-09-214035: RHEL 9 must remove all software components after updated versions have been installed.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-215010: RHEL 9 subscription-manager package must be installed.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-215015: RHEL 9 must not have a File Transfer Protocol (FTP) server package installed.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-215020: RHEL 9 must not have the sendmail package installed.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-215025: RHEL 9 must not have the nfs-utils package installed.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-215030: RHEL 9 must not have the ypserv package installed.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-215035: RHEL 9 must not have the rsh-server package installed.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-215040: RHEL 9 must not have the telnet-server package installed.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-215045: RHEL 9 must not have the gssproxy package installed.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-215050: RHEL 9 must not have the iprutils package installed.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-215055: RHEL 9 must not have the tuned package installed.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-215060: RHEL 9 must not have a Trivial File Transfer Protocol (TFTP) server package installed.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-215065: RHEL 9 must not have the quagga package installed.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-215070: A graphical display manager must not be installed on RHEL 9 unless approved.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-215075: RHEL 9 must have the openssl-pkcs11 package installed.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-215080: RHEL 9 must have the gnutls-utils package installed.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-215085: RHEL 9 must have the nss-tools package installed.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-215090: RHEL 9 must have the rng-tools package installed.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-215095: RHEL 9 must have the s-nail package installed.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-231010: A separate RHEL 9 file system must be used for user home directories (such as /home or an equivalent).
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-231015: RHEL 9 must use a separate file system for /tmp.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-231020: RHEL 9 must use a separate file system for /var.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-231025: RHEL 9 must use a separate file system for /var/log.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-231030: RHEL 9 must use a separate file system for the system audit data path.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-231035: RHEL 9 must use a separate file system for /var/tmp.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-231040: RHEL 9 file system automount function must be disabled unless required.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-231045: RHEL 9 must prevent device files from being interpreted on file systems that contain user home directories.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-231050: RHEL 9 must prevent files with the setuid and setgid bit set from being executed on file systems that contain user home directories.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-231055: RHEL 9 must prevent code from being executed on file systems that contain user home directories.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-231060: RHEL 9 must be configured so that the Network File System (NFS) is configured to use RPCSEC_GSS.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-231065: RHEL 9 must prevent special devices on file systems that are imported via Network File System (NFS).
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-231070: RHEL 9 must prevent code from being executed on file systems that are imported via Network File System (NFS).
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-231075: RHEL 9 must prevent files with the setuid and setgid bit set from being executed on file systems that are imported via Network File System (NFS).
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-231080: RHEL 9 must prevent code from being executed on file systems that are used with removable media.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-231085: RHEL 9 must prevent special devices on file systems that are used with removable media.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-231090: RHEL 9 must prevent files with the setuid and setgid bit set from being executed on file systems that are used with removable media.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-231095: RHEL 9 must mount /boot with the nodev option.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-231100: RHEL 9 must prevent files with the setuid and setgid bit set from being executed on the /boot directory.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-231105: RHEL 9 must prevent files with the setuid and setgid bit set from being executed on the /boot/efi directory.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-231110: RHEL 9 must mount /dev/shm with the nodev option.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-231115: RHEL 9 must mount /dev/shm with the noexec option.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-231120: RHEL 9 must mount /dev/shm with the nosuid option.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-231125: RHEL 9 must mount /tmp with the nodev option.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-231130: RHEL 9 must mount /tmp with the noexec option.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-231135: RHEL 9 must mount /tmp with the nosuid option.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-231140: RHEL 9 must mount /var with the nodev option.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-231145: RHEL 9 must mount /var/log with the nodev option.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-231150: RHEL 9 must mount /var/log with the noexec option.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-231155: RHEL 9 must mount /var/log with the nosuid option.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-231160: RHEL 9 must mount /var/log/audit with the nodev option.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-231165: RHEL 9 must mount /var/log/audit with the noexec option.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-231170: RHEL 9 must mount /var/log/audit with the nosuid option.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-231175: RHEL 9 must mount /var/tmp with the nodev option.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-231180: RHEL 9 must mount /var/tmp with the noexec option.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-231185: RHEL 9 must mount /var/tmp with the nosuid option.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-231190: RHEL 9 local disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at rest protection.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-231195: RHEL 9 must disable mounting of cramfs.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-231200: RHEL 9 must prevent special devices on non-root local partitions.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-232010: RHEL 9 system commands must have mode 755 or less permissive.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-232015: RHEL 9 library directories must have mode 755 or less permissive.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-232020: RHEL 9 library files must have mode 755 or less permissive.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-232025: RHEL 9 /var/log directory must have mode 0755 or less permissive.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-232030: RHEL 9 /var/log/messages file must have mode 0640 or less permissive.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-232035: RHEL 9 audit tools must have a mode of 0755 or less permissive.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-232040: RHEL 9 cron configuration directories must have a mode of 0700 or less permissive.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-232045: All RHEL 9 local initialization files must have mode 0740 or less permissive.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-232050: All RHEL 9 local interactive user home directories must have mode 0750 or less permissive.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-232055: RHEL 9 /etc/group file must have mode 0644 or less permissive to prevent unauthorized access.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-232060: RHEL 9 /etc/group- file must have mode 0644 or less permissive to prevent unauthorized access.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-232065: RHEL 9 /etc/gshadow file must have mode 0000 or less permissive to prevent unauthorized access.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-232070: RHEL 9 /etc/gshadow- file must have mode 0000 or less permissive to prevent unauthorized access.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-232075: RHEL 9 /etc/passwd file must have mode 0644 or less permissive to prevent unauthorized access.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-232080: RHEL 9 /etc/passwd- file must have mode 0644 or less permissive to prevent unauthorized access.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-232085: RHEL 9 /etc/shadow- file must have mode 0000 or less permissive to prevent unauthorized access.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-232090: RHEL 9 /etc/group file must be owned by root.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-232095: RHEL 9 /etc/group file must be group-owned by root.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-232100: RHEL 9 /etc/group- file must be owned by root.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-232105: RHEL 9 /etc/group- file must be group-owned by root.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-232110: RHEL 9 /etc/gshadow file must be owned by root.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-232115: RHEL 9 /etc/gshadow file must be group-owned by root.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-232120: RHEL 9 /etc/gshadow- file must be owned by root.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-232125: RHEL 9 /etc/gshadow- file must be group-owned by root.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-232130: RHEL 9 /etc/passwd file must be owned by root.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-232135: RHEL 9 /etc/passwd file must be group-owned by root.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-232140: RHEL 9 /etc/passwd- file must be owned by root.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-232145: RHEL 9 /etc/passwd- file must be group-owned by root.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-232150: RHEL 9 /etc/shadow file must be owned by root.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-232155: RHEL 9 /etc/shadow file must be group-owned by root.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-232160: RHEL 9 /etc/shadow- file must be owned by root.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-232165: RHEL 9 /etc/shadow- file must be group-owned by root.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-232170: RHEL 9 /var/log directory must be owned by root.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-232175: RHEL 9 /var/log directory must be group-owned by root.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-232180: RHEL 9 /var/log/messages file must be owned by root.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-232185: RHEL 9 /var/log/messages file must be group-owned by root.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-232190: RHEL 9 system commands must be owned by root.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-232195: RHEL 9 system commands must be group-owned by root or a system account.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-232200: RHEL 9 library files must be owned by root.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-232205: RHEL 9 library files must be group-owned by root or a system account.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-232210: RHEL 9 library directories must be owned by root.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-232215: RHEL 9 library directories must be group-owned by root or a system account.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-232220: RHEL 9 audit tools must be owned by root.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-232225: RHEL 9 audit tools must be group-owned by root.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-232230: RHEL 9 cron configuration files directory must be owned by root.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-232235: RHEL 9 cron configuration files directory must be group-owned by root.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-232240: All RHEL 9 world-writable directories must be owned by root, sys, bin, or an application user.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-232245: A sticky bit must be set on all RHEL 9 public directories.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-232250: All RHEL 9 local files and directories must have a valid group owner.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-232255: All RHEL 9 local files and directories must have a valid owner.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-232260: RHEL 9 must be configured so that all system device files are correctly labeled to prevent unauthorized modification.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-232265: RHEL 9 /etc/crontab file must have mode 0600.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-232270: RHEL 9 /etc/shadow file must have mode 0000 to prevent unauthorized access.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-251010: RHEL 9 must have the firewalld package installed.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-251015: The firewalld service on RHEL 9 must be active.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-251020: A RHEL 9 firewall must employ a deny-all, allow-by-exception policy for allowing connections to other systems.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-251025: RHEL 9 must control remote access methods.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-251030: RHEL 9 must protect against or limit the effects of denial-of-service (DoS) attacks by ensuring rate-limiting measures on impacted network interfaces are implemented.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-251035: RHEL 9 must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services, as defined in the Ports, Protocols, and Services Management (PPSM) Category Assignments List (CAL) and vulnerability assessments.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-251040: RHEL 9 network interfaces must not be in promiscuous mode.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-251045: RHEL 9 must enable hardening for the Berkeley Packet Filter just-in-time compiler.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-252010: RHEL 9 must have the chrony package installed.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-252015: RHEL 9 chronyd service must be enabled.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-252020: RHEL 9 must securely compare internal information system clocks at least every 24 hours.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-252025: RHEL 9 must disable the chrony daemon from acting as a server.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-252030: RHEL 9 must disable network management of the chrony daemon.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-252035: RHEL 9 systems using Domain Name Servers (DNS) resolution must have at least two name servers configured.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-252040: RHEL 9 must configure a DNS processing mode set be Network Manager.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-252045: RHEL 9 must not have unauthorized IP tunnels configured.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-252050: RHEL 9 must be configured to prevent unrestricted mail relaying.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-252055: If the Trivial File Transfer Protocol (TFTP) server is required, RHEL 9 TFTP daemon must be configured to operate in secure mode.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-252060: RHEL 9 must forward mail from postmaster to the root account using a postfix alias.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-252065: RHEL 9 libreswan package must be installed.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-252070: There must be no shosts.equiv files on RHEL 9.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-252075: There must be no .shosts files on RHEL 9.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-253010: RHEL 9 must be configured to use TCP syncookies.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-253015: RHEL 9 must ignore Internet Protocol version 4 (IPv4) Internet Control Message Protocol (ICMP) redirect messages.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-253020: RHEL 9 must not forward Internet Protocol version 4 (IPv4) source-routed packets.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-253025: RHEL 9 must log IPv4 packets with impossible addresses.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-253030: RHEL 9 must log IPv4 packets with impossible addresses by default.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-253035: RHEL 9 must use reverse path filtering on all IPv4 interfaces.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-253040: RHEL 9 must prevent IPv4 Internet Control Message Protocol (ICMP) redirect messages from being accepted.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-253045: RHEL 9 must not forward IPv4 source-routed packets by default.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-253050: RHEL 9 must use a reverse-path filter for IPv4 network traffic when possible by default.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-253055: RHEL 9 must not respond to Internet Control Message Protocol (ICMP) echoes sent to a broadcast address.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-253060: RHEL 9 must limit the number of bogus Internet Control Message Protocol (ICMP) response errors logs.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-253065: RHEL 9 must not send Internet Control Message Protocol (ICMP) redirects.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-253070: RHEL 9 must not allow interfaces to perform Internet Control Message Protocol (ICMP) redirects by default.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-253075: RHEL 9 must not enable IPv4 packet forwarding unless the system is a router.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-254010: RHEL 9 must not accept router advertisements on all IPv6 interfaces.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-254015: RHEL 9 must ignore IPv6 Internet Control Message Protocol (ICMP) redirect messages.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-254020: RHEL 9 must not forward IPv6 source-routed packets.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-254025: RHEL 9 must not enable IPv6 packet forwarding unless the system is a router.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-254030: RHEL 9 must not accept router advertisements on all IPv6 interfaces by default.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-254035: RHEL 9 must prevent IPv6 Internet Control Message Protocol (ICMP) redirect messages from being accepted.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-254040: RHEL 9 must not forward IPv6 source-routed packets by default.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-255010: All RHEL 9 networked systems must have SSH installed.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-255015: All RHEL 9 networked systems must have and implement SSH to protect the confidentiality and integrity of transmitted and received information, as well as information during preparation for transmission.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-255020: RHEL 9 must have the openssh-clients package installed.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-255025: RHEL 9 must display the Standard Mandatory DOD Notice and Consent Banner before granting local or remote access to the system via a SSH logon.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-255030: RHEL 9 must log SSH connection attempts and failures to the server.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-255035: RHEL 9 SSHD must accept public key authentication.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-255040: RHEL 9 SSHD must not allow blank passwords.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-255045: RHEL 9 must not permit direct logons to the root account using remote access via SSH.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-255050: RHEL 9 must enable the Pluggable Authentication Module (PAM) interface for SSHD.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-255055: RHEL 9 SSH daemon must be configured to use system-wide crypto policies.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-255060: RHEL 9 must implement DOD-approved encryption ciphers to protect the confidentiality of SSH client connections.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-255065: RHEL 9 must implement DOD-approved encryption ciphers to protect the confidentiality of SSH server connections.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-255075: RHEL 9 SSH server must be configured to use only Message Authentication Codes (MACs) employing FIPS 140-3 validated cryptographic hash algorithms.
Description: None
Levels:
Automated: no
No rules selected
RHEL-09-255080: RHEL 9 must not allow a noncertificate trusted host SSH logon to the system.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-255085: RHEL 9 must not allow users to override SSH environment variables.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-255090: RHEL 9 must force a frequent session key renegotiation for SSH connections to the server.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-255095: RHEL 9 must be configured so that all network connections associated with SSH traffic terminate after becoming unresponsive.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-255100: RHEL 9 must be configured so that all network connections associated with SSH traffic are terminated after 10 minutes of becoming unresponsive.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-255105: RHEL 9 SSH server configuration file must be group-owned by root.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-255110: RHEL 9 SSH server configuration file must be owned by root.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-255115: RHEL 9 SSH server configuration file must have mode 0600 or less permissive.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-255120: RHEL 9 SSH private host key files must have mode 0640 or less permissive.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-255125: RHEL 9 SSH public host key files must have mode 0644 or less permissive.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-255130: RHEL 9 SSH daemon must not allow compression or must only allow compression after successful authentication.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-255135: RHEL 9 SSH daemon must not allow GSSAPI authentication.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-255140: RHEL 9 SSH daemon must not allow Kerberos authentication.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-255145: RHEL 9 SSH daemon must not allow rhosts authentication.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-255150: RHEL 9 SSH daemon must not allow known hosts authentication.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-255155: RHEL 9 SSH daemon must disable remote X connections for interactive users.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-255160: RHEL 9 SSH daemon must perform strict mode checking of home directory configuration files.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-255165: RHEL 9 SSH daemon must display the date and time of the last successful account logon upon an SSH logon.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-255170: RHEL 9 SSH daemon must be configured to use privilege separation.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-255175: RHEL 9 SSH daemon must prevent remote hosts from connecting to the proxy display.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-271010: RHEL 9 must display the Standard Mandatory DOD Notice and Consent Banner before granting local or remote access to the system via a graphical user logon.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-271015: RHEL 9 must prevent a user from overriding the banner-message-enable setting for the graphical user interface.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-271020: RHEL 9 must disable the graphical user interface automount function unless required.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-271025: RHEL 9 must prevent a user from overriding the disabling of the graphical user interface automount function.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-271030: RHEL 9 must disable the graphical user interface autorun function unless required.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-271035: RHEL 9 must prevent a user from overriding the disabling of the graphical user interface autorun function.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-271040: RHEL 9 must not allow unattended or automatic logon via the graphical user interface.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-271045: RHEL 9 must be able to initiate directly a session lock for all connection types using smart card when the smart card is removed.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-271050: RHEL 9 must prevent a user from overriding the disabling of the graphical user smart card removal action.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-271055: RHEL 9 must enable a user session lock until that user re-establishes access using established identification and authentication procedures for graphical user sessions.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-271060: RHEL 9 must prevent a user from overriding the screensaver lock-enabled setting for the graphical user interface.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-271065: RHEL 9 must automatically lock graphical user sessions after 15 minutes of inactivity.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-271070: RHEL 9 must prevent a user from overriding the session idle-delay setting for the graphical user interface.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-271075: RHEL 9 must initiate a session lock for graphical user interfaces when the screensaver is activated.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-271080: RHEL 9 must prevent a user from overriding the session lock-delay setting for the graphical user interface.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-271085: RHEL 9 must conceal, via the session lock, information previously visible on the display with a publicly viewable image.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-271090: RHEL 9 effective dconf policy must match the policy keyfiles.
Description: None
Levels:
Automated: yes
Selections:
- dconf_db_up_to_date: Make sure that the dconf databases are up-to-date with regards to respective keyfiles
RHEL-09-271095: RHEL 9 must disable the ability of a user to restart the system from the login screen.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-271100: RHEL 9 must prevent a user from overriding the disable-restart-buttons setting for the graphical user interface.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-271105: RHEL 9 must disable the ability of a user to accidentally press Ctrl-Alt-Del and cause a system to shut down or reboot.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-271110: RHEL 9 must prevent a user from overriding the Ctrl-Alt-Del sequence settings for the graphical user interface.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-271115: RHEL 9 must disable the user list at logon for graphical user interfaces.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-291010: RHEL 9 must be configured to disable USB mass storage.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-291015: RHEL 9 must have the USBGuard package installed.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-291020: RHEL 9 must have the USBGuard package enabled.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-291025: RHEL 9 must enable Linux audit logging for the USBGuard daemon.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-291030: RHEL 9 must block unauthorized peripherals before establishing a connection.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-291035: RHEL 9 Bluetooth must be disabled.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-291040: RHEL 9 wireless network adapters must be disabled.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-411010: RHEL 9 user account passwords for new users or password changes must have a 60-day maximum password lifetime restriction in /etc/login.defs.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-411015: RHEL 9 user account passwords must have a 60-day maximum password lifetime restriction.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-411020: All RHEL 9 local interactive user accounts must be assigned a home directory upon creation.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-411025: RHEL 9 must set the umask value to 077 for all local interactive user accounts.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-411030: RHEL 9 duplicate User IDs (UIDs) must not exist for interactive users.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-411035: RHEL 9 system accounts must not have an interactive login shell.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-411040: RHEL 9 must automatically expire temporary accounts within 72 hours.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-411045: All RHEL 9 interactive users must have a primary group that exists.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-411050: RHEL 9 must disable account identifiers (individuals, groups, roles, and devices) after 35 days of inactivity.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-411055: Executable search paths within the initialization files of all local interactive RHEL 9 users must only contain paths that resolve to the system default or the users home directory.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-411060: All RHEL 9 local interactive users must have a home directory assigned in the /etc/passwd file.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-411065: All RHEL 9 local interactive user home directories defined in the /etc/passwd file must exist.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-411070: All RHEL 9 local interactive user home directories must be group-owned by the home directory owner's primary group.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-411075: RHEL 9 must automatically lock an account when three unsuccessful logon attempts occur.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-411080: RHEL 9 must automatically lock the root account until the root account is released by an administrator when three unsuccessful logon attempts occur during a 15-minute time period.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-411085: RHEL 9 must automatically lock an account when three unsuccessful logon attempts occur during a 15-minute time period.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-411090: RHEL 9 must maintain an account lock until the locked account is released by an administrator.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-411095: RHEL 9 must not have unauthorized accounts.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-411100: The root account must be the only account having unrestricted access to RHEL 9 system.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-411105: RHEL 9 must ensure account lockouts persist.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-411110: RHEL 9 groups must have unique Group ID (GID).
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-411115: Local RHEL 9 initialization files must not execute world-writable programs.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-412010: RHEL 9 must have the tmux package installed.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-412015: RHEL 9 must ensure session control is automatically started at shell initialization.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-412020: RHEL 9 must enable a user session lock until that user re-establishes access using established identification and authentication procedures for command line sessions.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-412025: RHEL 9 must automatically lock command line user sessions after 15 minutes of inactivity.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-412030: RHEL 9 must prevent users from disabling session control mechanisms.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-412035: RHEL 9 must automatically exit interactive command shell user sessions after 15 minutes of inactivity.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-412040: RHEL 9 must limit the number of concurrent sessions to ten for all accounts and/or account types.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-412045: RHEL 9 must log username information when unsuccessful logon attempts occur.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-412050: RHEL 9 must enforce a delay of at least four seconds between logon prompts following a failed logon attempt.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-412055: RHEL 9 must define default permissions for the bash shell.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-412060: RHEL 9 must define default permissions for the c shell.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-412065: RHEL 9 must define default permissions for all authenticated users in such a way that the user can only read and modify their own files.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-412070: RHEL 9 must define default permissions for the system default profile.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-412075: RHEL 9 must display the date and time of the last successful account logon upon logon.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-412080: RHEL 9 must terminate idle user sessions.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-431010: RHEL 9 must use a Linux Security Module configured to enforce limits on system services.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-431015: RHEL 9 must enable the SELinux targeted policy.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-431020: RHEL 9 must configure SELinux context type to allow the use of a nondefault faillock tally directory.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-431025: RHEL 9 must have policycoreutils package installed.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-431030: RHEL 9 policycoreutils-python-utils package must be installed.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-432010: RHEL 9 must have the sudo package installed.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-432015: RHEL 9 must require reauthentication when using the "sudo" command.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-432020: RHEL 9 must use the invoking user's password for privilege escalation when using "sudo".
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-432025: RHEL 9 must require users to reauthenticate for privilege escalation.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-432030: RHEL 9 must restrict privilege elevation to authorized personnel.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-432035: RHEL 9 must restrict the use of the "su" command.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-433010: RHEL 9 fapolicy module must be installed.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-433015: RHEL 9 fapolicy module must be enabled.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-611010: RHEL 9 must ensure the password complexity module in the system-auth file is configured for three retries or less.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-611015: RHEL 9 must be configured in the password-auth file to prohibit password reuse for a minimum of five generations.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-611020: RHEL 9 must be configured in the system-auth file to prohibit password reuse for a minimum of five generations.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-611025: RHEL 9 must not allow blank or null passwords.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-611030: RHEL 9 must configure the use of the pam_faillock.so module in the /etc/pam.d/system-auth file.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-611035: RHEL 9 must configure the use of the pam_faillock.so module in the /etc/pam.d/password-auth file.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-611040: RHEL 9 must ensure the password complexity module is enabled in the password-auth file.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-611045: RHEL 9 must ensure the password complexity module is enabled in the system-auth file.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-611050: RHEL 9 password-auth must be configured to use a sufficient number of hashing rounds.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-611055: RHEL 9 system-auth must be configured to use a sufficient number of hashing rounds.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-611060: RHEL 9 must enforce password complexity rules for the root account.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-611065: RHEL 9 must enforce password complexity by requiring that at least one lowercase character be used.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-611070: RHEL 9 must enforce password complexity by requiring that at least one numeric character be used.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-611075: RHEL 9 passwords for new users or password changes must have a 24 hours minimum password lifetime restriction in /etc/login.defs.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-611080: RHEL 9 passwords must have a 24 hours minimum password lifetime restriction in /etc/shadow.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-611085: RHEL 9 must require users to provide a password for privilege escalation.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-611090: RHEL 9 passwords must be created with a minimum of 15 characters.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-611095: RHEL 9 passwords for new users must have a minimum of 15 characters.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-611100: RHEL 9 must enforce password complexity by requiring that at least one special character be used.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-611105: RHEL 9 must prevent the use of dictionary words for passwords.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-611110: RHEL 9 must enforce password complexity by requiring that at least one uppercase character be used.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-611115: RHEL 9 must require the change of at least eight characters when passwords are changed.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-611120: RHEL 9 must require the maximum number of repeating characters of the same character class be limited to four when passwords are changed.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-611125: RHEL 9 must require the maximum number of repeating characters be limited to three when passwords are changed.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-611130: RHEL 9 must require the change of at least four character classes when passwords are changed.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-611135: RHEL 9 must be configured so that user and group account administration utilities are configured to store only encrypted representations of passwords.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-611140: RHEL 9 must be configured to use the shadow file to store only encrypted representations of passwords.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-611145: RHEL 9 must not be configured to bypass password requirements for privilege escalation.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-611150: RHEL 9 shadow password suite must be configured to use a sufficient number of hashing rounds.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-611155: RHEL 9 must not have accounts configured with blank or null passwords.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-611160: RHEL 9 must use the CAC smart card driver.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-611165: RHEL 9 must enable certificate based smart card authentication.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-611170: RHEL 9 must implement certificate status checking for multifactor authentication.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-611175: RHEL 9 must have the pcsc-lite package installed.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-611180: The pcscd service on RHEL 9 must be active.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-611185: RHEL 9 must have the opensc package installed.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-611190: RHEL 9, for PKI-based authentication, must enforce authorized access to the corresponding private key.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-611195: RHEL 9 must require authentication to access emergency mode.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-611200: RHEL 9 must require authentication to access single-user mode.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-611205: RHEL 9 must prevent system daemons from using Kerberos for authentication.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-631010: RHEL 9, for PKI-based authentication, must validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-631015: RHEL 9 must map the authenticated identity to the user or group account for PKI-based authentication.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-631020: RHEL 9 must prohibit the use of cached authenticators after one day.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-651010: RHEL 9 must have the AIDE package installed.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-651015: RHEL 9 must routinely check the baseline configuration for unauthorized changes and notify the system administrator when anomalies in the operation of any security functions are discovered.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-651020: RHEL 9 must use a file integrity tool that is configured to use FIPS 140-3-approved cryptographic hashes for validating file contents and directories.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-651025: RHEL 9 must use cryptographic mechanisms to protect the integrity of audit tools.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-651030: RHEL 9 must be configured so that the file integrity tool verifies Access Control Lists (ACLs).
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-651035: RHEL 9 must be configured so that the file integrity tool verifies extended attributes.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-652010: RHEL 9 must have the rsyslog package installed.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-652015: RHEL 9 must have the packages required for encrypting offloaded audit logs installed.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-652020: The rsyslog service on RHEL 9 must be active.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-652025: RHEL 9 must be configured so that the rsyslog daemon does not accept log messages from other servers unless the server is being used for log aggregation.
Description: None
Levels:
Automated: yes
Selections:
- rsyslog_nolisten: Ensure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
RHEL-09-652030: All RHEL 9 remote access methods must be monitored.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-652035: RHEL 9 must be configured to offload audit records onto a different system from the system being audited via syslog.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-652040: RHEL 9 must authenticate the remote logging server for offloading audit logs via rsyslog.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-652045: RHEL 9 must encrypt the transfer of audit records offloaded onto a different system or media from the system being audited via rsyslog.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-652050: RHEL 9 must encrypt via the gtls driver the transfer of audit records offloaded onto a different system or media from the system being audited via rsyslog.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-652055: RHEL 9 must be configured to forward audit records via TCP to a different system or media from the system being audited via rsyslog.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-652060: RHEL 9 must use cron logging.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-653010: RHEL 9 audit package must be installed.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-653015: RHEL 9 audit service must be enabled.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-653020: RHEL 9 audit system must take appropriate action when an error writing to the audit storage volume occurs.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-653025: RHEL 9 audit system must take appropriate action when the audit storage volume is full.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-653030: RHEL 9 must allocate audit record storage capacity to store at least one week's worth of audit records.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-653035: RHEL 9 must take action when allocated audit record storage volume reaches 75 percent of the repository maximum audit record storage capacity.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-653040: RHEL 9 must notify the system administrator (SA) and information system security officer (ISSO) (at a minimum) when allocated audit record storage volume 75 percent utilization.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-653045: RHEL 9 must take action when allocated audit record storage volume reaches 95 percent of the audit record storage capacity.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-653050: RHEL 9 must take action when allocated audit record storage volume reaches 95 percent of the repository maximum audit record storage capacity.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-653055: RHEL 9 audit system must take appropriate action when the audit files have reached maximum size.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-653060: RHEL 9 must label all offloaded audit logs before sending them to the central log server.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-653065: RHEL 9 must take appropriate action when the internal event queue is full.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-653070: RHEL 9 System Administrator (SA) and/or information system security officer (ISSO) (at a minimum) must be alerted of an audit processing failure event.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-653075: RHEL 9 audit system must audit local events.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-653080: RHEL 9 audit logs must be group-owned by root or by a restricted logging group to prevent unauthorized read access.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-653085: RHEL 9 audit log directory must be owned by root to prevent unauthorized read access.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-653090: RHEL 9 audit logs file must have mode 0600 or less permissive to prevent unauthorized access to the audit log.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-653095: RHEL 9 must periodically flush audit records to disk to prevent the loss of audit records.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-653100: RHEL 9 must produce audit records containing information to establish the identity of any individual or process associated with the event.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-653105: RHEL 9 must write audit records to disk.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-653110: RHEL 9 must allow only the information system security manager (ISSM) (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-653115: RHEL 9 /etc/audit/auditd.conf file must have 0640 or less permissive to prevent unauthorized access.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-653120: RHEL 9 must allocate an audit_backlog_limit of sufficient size to capture processes that start prior to the audit daemon.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-653125: RHEL 9 must have mail aliases to notify the information system security officer (ISSO) and system administrator (SA) (at a minimum) in the event of an audit processing failure.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-653130: RHEL 9 audispd-plugins package must be installed.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-654010: RHEL 9 must audit uses of the "execve" system call.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-654015: RHEL 9 must audit all uses of the chmod, fchmod, and fchmodat system calls.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-654020: RHEL 9 must audit all uses of the chown, fchown, fchownat, and lchown system calls.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-654025: RHEL 9 must audit all uses of the setxattr, fsetxattr, lsetxattr, removexattr, fremovexattr, and lremovexattr system calls.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-654030: RHEL 9 must audit all uses of umount system calls.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-654035: RHEL 9 must audit all uses of the chacl command.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-654040: RHEL 9 must audit all uses of the setfacl command.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-654045: RHEL 9 must audit all uses of the chcon command.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-654050: RHEL 9 must audit all uses of the semanage command.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-654055: RHEL 9 must audit all uses of the setfiles command.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-654060: RHEL 9 must audit all uses of the setsebool command.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-654065: RHEL 9 must audit all uses of the rename, unlink, rmdir, renameat, and unlinkat system calls.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-654070: RHEL 9 must audit all uses of the truncate, ftruncate, creat, open, openat, and open_by_handle_at system calls.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-654075: RHEL 9 must audit all uses of the delete_module system call.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-654080: RHEL 9 must audit all uses of the init_module and finit_module system calls.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-654085: RHEL 9 must audit all uses of the chage command.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-654090: RHEL 9 must audit all uses of the chsh command.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-654095: RHEL 9 must audit all uses of the crontab command.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-654100: RHEL 9 must audit all uses of the gpasswd command.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-654105: RHEL 9 must audit all uses of the kmod command.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-654110: RHEL 9 must audit all uses of the newgrp command.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-654115: RHEL 9 must audit all uses of the pam_timestamp_check command.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-654120: RHEL 9 must audit all uses of the passwd command.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-654125: RHEL 9 must audit all uses of the postdrop command.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-654130: RHEL 9 must audit all uses of the postqueue command.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-654135: RHEL 9 must audit all uses of the ssh-agent command.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-654140: RHEL 9 must audit all uses of the ssh-keysign command.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-654145: RHEL 9 must audit all uses of the su command.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-654150: RHEL 9 must audit all uses of the sudo command.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-654155: RHEL 9 must audit all uses of the sudoedit command.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-654160: RHEL 9 must audit all uses of the unix_chkpwd command.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-654165: RHEL 9 must audit all uses of the unix_update command.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-654170: RHEL 9 must audit all uses of the userhelper command.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-654175: RHEL 9 must audit all uses of the usermod command.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-654180: RHEL 9 must audit all uses of the mount command.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-654185: Successful/unsuccessful uses of the init command in RHEL 9 must generate an audit record.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-654190: Successful/unsuccessful uses of the poweroff command in RHEL 9 must generate an audit record.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-654195: Successful/unsuccessful uses of the reboot command in RHEL 9 must generate an audit record.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-654200: Successful/unsuccessful uses of the shutdown command in RHEL 9 must generate an audit record.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-654205: Successful/unsuccessful uses of the umount system call in RHEL 9 must generate an audit record.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-654210: Successful/unsuccessful uses of the umount2 system call in RHEL 9 must generate an audit record.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-654215: RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/sudoers.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-654220: RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/sudoers.d/ directory.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-654225: RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/group.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-654230: RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/gshadow.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-654235: RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/opasswd.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-654240: RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/passwd.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-654245: RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/shadow.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-654250: RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /var/log/faillock.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-654255: RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /var/log/lastlog.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-654260: RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /var/log/tallylog.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-654265: RHEL 9 must take appropriate action when a critical audit processing failure occurs.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-654270: RHEL 9 audit system must protect logon UIDs from unauthorized change.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-654275: RHEL 9 audit system must protect auditing rules from unauthorized change.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-671010: RHEL 9 must enable FIPS mode.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-671015: RHEL 9 must employ FIPS 140-3 approved cryptographic hashing algorithms for all stored passwords.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-671020: RHEL 9 IP tunnels must use FIPS 140-2/140-3 approved cryptographic algorithms.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-671025: RHEL 9 pam_unix.so module must be configured in the password-auth file to use a FIPS 140-3 approved cryptographic hashing algorithm for system authentication.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-672010: RHEL 9 must have the crypto-policies package installed.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-672015: RHEL 9 crypto policy files must match files shipped with the operating system.
Description: None
Levels:
Automated: no
No rules selected
RHEL-09-672020: RHEL 9 crypto policy must not be overridden.
Description: None
Levels:
Automated: no
No rules selected
RHEL-09-672025: RHEL 9 must use mechanisms meeting the requirements of applicable federal laws, executive orders, directives, policies, regulations, standards, and guidance for authentication to a cryptographic module.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-672030: RHEL 9 must implement DOD-approved TLS encryption in the GnuTLS package.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-672035: RHEL 9 must implement DOD-approved encryption in the OpenSSL package.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-672040: RHEL 9 must implement DOD-approved TLS encryption in the OpenSSL package.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-672045: RHEL 9 must implement a system-wide encryption policy.
Description: None
Levels:
Automated: yes
Selections:
RHEL-09-672050: RHEL 9 must implement DOD-approved encryption in the bind package.
Description: None
Levels:
Automated: yes
Selections: