Definition of Canonical Ubuntu 24.04 LTS Security Technical Implementation Guide (STIG) for ubuntu2404

UBTU-24-100010: Ubuntu 24.04 LTS must not have the "systemd-timesyncd" package installed.

Description: None

• low

Automated: yes

• package_timesyncd_removed: Remove the systemd_timesyncd Service

UBTU-24-100020: Ubuntu 24.04 LTS must not have the "ntp" package installed.

Description: None

• low

Automated: yes

• package_ntp_removed: Remove the ntp service

UBTU-24-100030: Ubuntu 24.04 LTS must not have the telnet package installed.

Description: None

• high

Automated: yes

• package_telnetd_removed: Uninstall the telnet server

UBTU-24-100040: Ubuntu 24.04 LTS must not have the rsh-server package installed.

Description: None

• high

Automated: yes

• package_rsh-server_removed: Uninstall rsh-server Package

UBTU-24-100100: Ubuntu 24.04 LTS must use a file integrity tool to verify correct operation of all security functions.

Description: None

• medium

Automated: yes

• package_aide_installed: Install AIDE

UBTU-24-100110: Ubuntu 24.04 LTS must configure AIDE to preform file integrity checking on the file system.

Description: None

• medium

Automated: yes

• aide_build_database: Build and Test AIDE Database

UBTU-24-100120: Ubuntu 24.04 LTS must be configured so that the script which runs each 30 days or less to check file integrity is the default one.

Description: None

• medium

Automated: no

No rules selected

UBTU-24-100130: Ubuntu 24.04 LTS must notify designated personnel if baseline configurations are changed in an unauthorized manner. The file integrity tool must notify the system administrator (SA) when changes to the baseline configuration or anomalies in the operation of any security functions are discovered.

Description: None

• medium

Automated: yes

• aide_disable_silentreports: Configure AIDE To Notify Personnel if Baseline Configurations Are Altered

UBTU-24-100200: Ubuntu 24.04 LTS must be configured to preserve log records from failure events.

Description: None

• medium

Automated: yes

• service_rsyslog_enabled: Enable rsyslog Service

UBTU-24-100300: Ubuntu 24.04 LTS must have an application firewall installed in order to control remote access methods.

Description: None

• medium

Automated: yes

• package_ufw_installed: Install ufw Package

UBTU-24-100310: Ubuntu 24.04 LTS must enable and run the Uncomplicated Firewall (ufw).

Description: None

• medium

Automated: yes

• check_ufw_active: Verify ufw Active

UBTU-24-100400: Ubuntu 24.04 LTS must have the "auditd" package installed.

Description: None

• medium

Automated: yes

• package_audit_installed: Ensure the audit Subsystem is Installed

UBTU-24-100410: Ubuntu 24.04 LTS must produce audit records and reports containing information to establish when, where, what type, the source, and the outcome for all DOD-defined auditable events and actions in near real time.

Description: None

• medium

Automated: yes

• service_auditd_enabled: Enable auditd Service

UBTU-24-100450: Ubuntu 24.04 LTS audit event multiplexor must be configured to offload audit logs onto a different system or storage media from the system being audited.

Description: None

• low

Automated: yes

• auditd_audispd_configure_remote_server: Configure audispd Plugin To Send Logs To Remote Server
• package_audit-audispd-plugins_installed: Ensure the default plugins for the audit dispatcher are Installed

UBTU-24-100500: Ubuntu 24.04 LTS must have AppArmor installed.

Description: None

• medium

Automated: yes

• package_apparmor_installed: Ensure AppArmor is installed

UBTU-24-100510: Ubuntu 24.04 LTS must be configured to use AppArmor.

Description: None

• medium

Automated: yes

• apparmor_configured: Ensure AppArmor is Active and Configured

UBTU-24-100600: Ubuntu 24.04 LTS must have the "libpam-pwquality" package installed.

Description: None

• medium

Automated: yes

• package_pam_pwquality_installed: Install pam_pwquality Package

UBTU-24-100650: Ubuntu 24.04 LTS must have the "SSSD" package installed.

Description: None

• medium

Automated: yes

• package_nss_sss_installed: Install nss-sss Package
• package_pam_sss_installed: Install pam-sss Package
• package_sssd_installed: Install the SSSD Package

UBTU-24-100660: Ubuntu 24.04 LTS must use the "SSSD" package for multifactor authentication services.

Description: None

• medium

Automated: yes

• service_sssd_enabled: Enable the SSSD Service

UBTU-24-100700: Ubuntu 24.04 LTS must have the "chrony" package installed.

Description: None

• low

Automated: yes

• package_chrony_installed: The Chrony package is installed

UBTU-24-100800: Ubuntu 24.04 LTS must have SSH installed.

Description: None

• high

Automated: yes

• package_openssh-server_installed: Install the OpenSSH Server Package

UBTU-24-100810: Ubuntu 24.04 LTS must use SSH to protect the confidentiality and integrity of transmitted information.

Description: None

• high

Automated: yes

• service_sshd_enabled: Enable the OpenSSH Service

UBTU-24-100820: Ubuntu 24.04 LTS must configure the SSH daemon to use FIPS 140-3 approved ciphers to prevent the unauthorized disclosure of information and/or detect changes to information during transmission.

Description: None

• medium

Automated: yes

• sshd_use_approved_ciphers_ordered_stig: Use Only FIPS 140-2 Validated Ciphers

UBTU-24-100830: Ubuntu 24.04 LTS must configure the SSH daemon to use Message Authentication Codes (MACs) employing FIPS 140-3 approved cryptographic hashes to prevent the unauthorized disclosure of information and/or detect changes to information during transmission.

Description: None

• medium

Automated: yes

• sshd_use_approved_macs_ordered_stig: Use Only FIPS 140-2 Validated MACs

UBTU-24-100840: Ubuntu 24.04 LTS SSH server must be configured to use only FIPS 140-3 validated key exchange algorithms.

Description: None

• medium

Automated: yes

• sshd_use_approved_kex_ordered_stig: Use Only FIPS 140-2 Validated Key Exchange Algorithms

UBTU-24-100850: Ubuntu 24.04 LTS must configure the SSH client to use FIPS 140-3 approved ciphers to prevent the unauthorized disclosure of information and/or detect changes to information during transmission.

Description: None

• medium

Automated: yes

No rules selected

UBTU-24-100860: Ubuntu 24.04 LTS SSH client must be configured to use only Message Authentication Codes (MACs) employing FIPS 140-3 validated cryptographic hash algorithms.

Description: None

• medium

Automated: yes

No rules selected

UBTU-24-100900: Ubuntu 24.04 LTS must accept Personal Identity Verification (PIV) credentials.

Description: None

• medium

Automated: yes

• package_opensc_installed: Install the opensc Package For Multifactor Authentication

UBTU-24-100910: Ubuntu 24.04 LTS must accept Personal Identity Verification (PIV) credentials managed through the Privileged Access Management (PAM)  framework.

Description: None

• medium

Automated: yes

• install_smartcard_packages: Install Smart Card Packages For Multifactor Authentication

UBTU-24-101000: Ubuntu 24.04 LTS must allow users to directly initiate a session lock for all connection types.

Description: None

• medium

Automated: yes

• vlock_installed: Check that vlock is installed to allow session locking

UBTU-24-102000: Ubuntu 24.04 LTS when booted must require authentication upon booting into single-user and maintenance modes.

Description: None

• high

Automated: yes

• grub2_password: Set Boot Loader Password in grub2
• grub2_uefi_password: Set the UEFI Boot Loader Password

UBTU-24-102010: Ubuntu 24.04 LTS must initiate session audits at system startup.

Description: None

• medium

Automated: yes

• grub2_audit_argument: Enable Auditing for Processes Which Start Prior to the Audit Daemon

UBTU-24-200000: Ubuntu 24.04 LTS must limit the number of concurrent sessions to 10 for all accounts and/or account types.

Description: None

• low

Automated: yes

• accounts_max_concurrent_login_sessions: Limit the Number of Concurrent Login Sessions Allowed Per User
• var_accounts_max_concurrent_login_sessions = 10

UBTU-24-200020: Ubuntu 24.04 LTS must initiate a graphical session lock after 10 minutes of inactivity.

Description: None

• medium

Automated: yes

• dconf_gnome_screensaver_idle_delay: Set GNOME3 Screensaver Inactivity Timeout
• dconf_gnome_screensaver_lock_delay: Set GNOME3 Screensaver Lock Delay After Activation Period
• inactivity_timeout_value = 10_minutes
• var_screensaver_lock_delay = immediate

UBTU-24-200040: Ubuntu 24.04 LTS must retain a user's session lock until the user reestablishes access using established identification and authentication procedures.

Description: None

• medium

Automated: yes

• dconf_gnome_screensaver_lock_enabled: Enable GNOME3 Screensaver Lock After Idle Period

UBTU-24-200060: Ubuntu 24.04 LTS must automatically terminate a user session after inactivity timeouts have expired.

Description: None

• medium

Automated: yes

• accounts_tmout: Set Interactive Session Timeout
• var_accounts_tmout = 10_min

UBTU-24-200090: Ubuntu 24.04 LTS must monitor remote access methods.

Description: None

• medium

Automated: yes

• rsyslog_remote_access_monitoring: Ensure remote access methods are monitored in Rsyslog

UBTU-24-200250: Ubuntu 24.04 LTS must automatically remove or disable emergency accounts after 72 hours.

Description: None

• medium

Automated: yes

• account_temp_expire_date: Assign Expiration Date to Temporary Accounts

UBTU-24-200260: Ubuntu 24.04 LTS must disable account identifiers (individuals, groups, roles, and devices) after 35 days of inactivity.

Description: None

• medium

Automated: yes

• account_disable_post_pw_expiration: Set Account Expiration Following Inactivity

UBTU-24-200280: Ubuntu 24.04 LTS must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/passwd.

Description: None

• medium

Automated: yes

• audit_rules_usergroup_modification_passwd: Record Events that Modify User/Group Information - /etc/passwd

UBTU-24-200290: Ubuntu 24.04 LTS must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/group.

Description: None

• medium

Automated: yes

• audit_rules_usergroup_modification_group: Record Events that Modify User/Group Information - /etc/group

UBTU-24-200300: Ubuntu 24.04 LTS must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/shadow.

Description: None

• medium

Automated: yes

• audit_rules_usergroup_modification_shadow: Record Events that Modify User/Group Information - /etc/shadow

UBTU-24-200310: Ubuntu 24.04 LTS must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/gshadow.

Description: None

• medium

Automated: yes

• audit_rules_usergroup_modification_gshadow: Record Events that Modify User/Group Information - /etc/gshadow

UBTU-24-200320: Ubuntu 24.04 LTS must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/opasswd.

Description: None

• medium

Automated: yes

• audit_rules_usergroup_modification_opasswd: Record Events that Modify User/Group Information - /etc/security/opasswd

UBTU-24-200580: Ubuntu 24.04 LTS must prevent all software from executing at higher privilege levels than users executing the software and the audit system must be configured to audit the execution of privileged functions.

Description: None

• medium

Automated: yes

• audit_rules_suid_privilege_function: Record Events When Privileged Executables Are Run

UBTU-24-200610: Ubuntu 24.04 LTS must automatically lock an account until the locked account is released by an administrator when three unsuccessful logon attempts have been made.

Description: None

• low

Automated: no

No rules selected

UBTU-24-200640: Ubuntu 24.04 LTS must display the Standard Mandatory DOD Notice and Consent Banner before granting access to via an SSH logon.

Description: None

• medium

Automated: yes

• banner_etc_issue_net: Modify the System Login Banner for Remote Connections
• remote_login_banner_text = dod_banners
• sshd_enable_warning_banner_net: Enable SSH Warning Banner

UBTU-24-200650: Ubuntu 24.04 LTS must enable the graphical user logon banner to display the Standard Mandatory DOD Notice and Consent Banner before granting local access to the system via a graphical user logon.

Description: None

• medium

Automated: yes

• dconf_gnome_banner_enabled: Enable GNOME3 Login Warning Banner

UBTU-24-200660: Ubuntu 24.04 LTS must display the Standard Mandatory DOD Notice and Consent Banner before granting local access to the system via a graphical user logon.

Description: None

• medium

Automated: yes

• dconf_gnome_login_banner_text: Set the GNOME3 Login Warning Banner Text
• login_banner_text = dod_banners

UBTU-24-200680: Ubuntu 24.04 LTS must be configured to enforce the acknowledgement of the Standard Mandatory DOD Notice and Consent Banner for all SSH connections.

Description: None

• medium

Automated: yes

• banner_etc_profiled_ssh_confirm: Enable the SSH login confirmation banner
• var_ssh_confirm_text = dod_default

UBTU-24-300001: Ubuntu 24.04 LTS Advance Package Tool (APT) must be configured to prevent the installation of patches, service packs, device drivers, or Ubuntu 24.04 LTS components without verification they have been digitally signed using a certificate that is recognized and approved by the organization.

Description: None

• low

Automated: yes

• apt_conf_disallow_unauthenticated: Disable unauthenticated repositories in APT configuration

UBTU-24-300006: Ubuntu 24.04 LTS library files must have mode 0755 or less permissive.

Description: None

• medium

Automated: yes

• file_permissions_library_dirs: Verify that Shared Library Files Have Restrictive Permissions

UBTU-24-300007: Ubuntu 24.04 LTS library files must be owned by root.

Description: None

• medium

Automated: yes

• file_ownership_library_dirs: Verify that Shared Library Files Have Root Ownership

UBTU-24-300008: Ubuntu 24.04 LTS library directories must be owned by root.

Description: None

• medium

Automated: yes

• dir_ownership_library_dirs: Verify that Shared Library Directories Have Root Ownership

UBTU-24-300009: Ubuntu 24.04 LTS library files must be group-owned by root or a system account.

Description: None

• medium

Automated: yes

• root_permissions_syslibrary_files: Verify the system-wide library files in directories "/lib", "/lib64", "/usr/lib/" and "/usr/lib64" are group-owned by root.

UBTU-24-300010: Ubuntu 24.04 LTS library directories must be group-owned by root.

Description: None

• medium

Automated: yes

• dir_group_ownership_library_dirs: Verify that Shared Library Directories Have Root Group Ownership

UBTU-24-300011: Ubuntu 24.04 LTS must have system commands set to a mode of 0755 or less permissive.

Description: None

• medium

Automated: yes

• file_permissions_binary_dirs: Verify that System Executables Have Restrictive Permissions

UBTU-24-300012: Ubuntu 24.04 LTS must have system commands owned by root or a system account.

Description: None

• medium

Automated: yes

• file_ownership_binary_dirs: Verify that System Executables Have Root Ownership

UBTU-24-300013: Ubuntu 24.04 LTS must have system commands group-owned by root or a system account.

Description: None

• medium

Automated: no

No rules selected

UBTU-24-300014: Ubuntu 24.04 LTS must prevent the use of dictionary words for passwords.

Description: None

• medium

Automated: yes

• accounts_password_pam_dictcheck: Ensure PAM Enforces Password Requirements - Prevent the Use of Dictionary Words
• var_password_pam_dictcheck = 1

UBTU-24-300016: Ubuntu 24.04 LTS must be configured so that when passwords are changed or new passwords are established, pwquality must be used.

Description: None

• medium

Automated: yes

• accounts_password_pam_enforcing: Ensure PAM Enforces Password Requirements - Enforcing
• accounts_password_pam_retry: Ensure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session
• var_password_pam_retry = 3

UBTU-24-300017: Ubuntu 24.04 LTS must enforce a delay of at least four seconds between logon prompts following a failed logon attempt.

Description: None

• low

Automated: yes

• accounts_passwords_pam_faildelay_delay: Enforce Delay After Failed Logon Attempts
• var_password_pam_delay = 4000000

UBTU-24-300021: Ubuntu 24.04 LTS must require users to reauthenticate for privilege escalation or when changing roles.

Description: None

• medium

Automated: yes

• sudo_require_authentication: Ensure Users Re-Authenticate for Privilege Escalation - sudo

UBTU-24-300022: Ubuntu 24.04 LTS must be configured so that remote X connections are disabled, unless to fulfill documented and validated mission requirements.

Description: None

• high

Automated: yes

• sshd_disable_x11_forwarding: Disable X11 Forwarding

UBTU-24-300023: Ubuntu 24.04 LTS SSH daemon must prevent remote hosts from connecting to the proxy display.

Description: None

• medium

Automated: yes

• sshd_x11_use_localhost: Prevent remote hosts from connecting to the proxy display

UBTU-24-300024: Ubuntu 24.04 LTS must display the date and time of the last successful account logon upon logon.

Description: None

• low

Automated: yes

• display_login_attempts: Ensure PAM Displays Last Logon/Access Notification

UBTU-24-300025: Ubuntu 24.04 LTS must disable the x86 Ctrl-Alt-Delete key sequence if a graphical user interface is installed.

Description: None

• high

Automated: yes

• dconf_gnome_disable_ctrlaltdel_reboot: Disable Ctrl-Alt-Del Reboot Key Sequence in GNOME3

UBTU-24-300026: Ubuntu 24.04 LTS must disable the x86 Ctrl-Alt-Delete key sequence.

Description: None

• high

Automated: yes

• disable_ctrlaltdel_reboot: Disable Ctrl-Alt-Del Reboot Activation

UBTU-24-300027: Ubuntu 24.04 LTS must not have accounts configured with blank or null passwords.

Description: None

• high

Automated: yes

• no_empty_passwords_etc_shadow: Ensure There Are No Accounts With Blank or Null Passwords

UBTU-24-300028: Ubuntu 24.04 LTS must not allow accounts configured in Pluggable Authentication Modules (PAM) with blank or null passwords.

Description: None

• high

Automated: yes

• no_empty_passwords: Prevent Login to Accounts With Empty Password

UBTU-24-300029: Ubuntu 24.04 LTS must generate audit records for all events that affect the systemd journal files.

Description: None

• medium

Automated: yes

• audit_rules_var_log_journal: Ensure auditd Collects records for events that affect "/var/log/journal"

UBTU-24-300030: Ubuntu 24.04 LTS default filesystem permissions must be defined in such a way that all authenticated users can read and modify only their own files.

Description: None

• medium

Automated: yes

• accounts_umask_etc_login_defs: Ensure the Default Umask is Set Correctly in login.defs
• var_accounts_user_umask = 077

UBTU-24-300031: Ubuntu 24.04 LTS must not allow unattended or automatic login via SSH.

Description: None

• high

Automated: yes

• sshd_disable_empty_passwords: Disable SSH Access via Empty Passwords
• sshd_do_not_permit_user_env: Do Not Allow SSH Environment Options

UBTU-24-300039: Ubuntu 24.04 LTS must disable automatic mounting of Universal Serial Bus (USB) mass storage driver.

Description: None

• medium

Automated: yes

• kernel_module_usb-storage_disabled: Disable Modprobe Loading of USB Storage Driver

UBTU-24-300041: Ubuntu 24.04 LTS must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services, as defined in the Ports, Protocols, and Services Management Category Assurance List (PPSM CAL) and vulnerability assessments.

Description: None

• medium

Automated: yes

• ufw_only_required_services: Only Allow Authorized Network Services in ufw

UBTU-24-400000: Ubuntu 24.04 LTS must uniquely identify interactive users.

Description: None

• medium

Automated: yes

• no_duplicate_uids: Ensure no duplicate UIDs exist

UBTU-24-400020: Ubuntu 24.04 LTS must implement smart card logins for multifactor authentication for local and network access to privileged and nonprivileged accounts.

Description: None

• medium

Automated: no

No rules selected

UBTU-24-400030: Ubuntu 24.04 LTS must implement smart card logins for multifactor authentication for local and network access to privileged and nonprivileged accounts over SSH.

Description: None

• medium

Automated: yes

No rules selected

UBTU-24-400060: Ubuntu 24.04 LTS must electronically verify Personal Identity Verification (PIV) credentials.

Description: None

• medium

Automated: yes

• smartcard_configure_cert_checking: Configure Smart Card Certificate Status Checking

UBTU-24-400110: Ubuntu 24.04 LTS must prevent direct login to the root account.

Description: None

• medium

Automated: yes

• prevent_direct_root_logins: Direct root Logins Are Not Allowed

UBTU-24-400220: Ubuntu 24.04 LTS must store only encrypted representations of passwords.

Description: None

• medium

Automated: yes

• accounts_password_pam_unix_rounds_password_auth: Set number of Password Hashing Rounds - password-auth
• set_password_hashing_algorithm_auth_stig: Set Password Hashing Algorithm for PAM
• var_password_pam_unix_rounds = 100000

UBTU-24-400260: Ubuntu 24.04 LTS must enforce password complexity by requiring that at least one uppercase character be used.

Description: None

• medium

Automated: yes

• accounts_password_pam_ucredit: Ensure PAM Enforces Password Requirements - Minimum Uppercase Characters
• var_password_pam_ucredit = 1

UBTU-24-400270: Ubuntu 24.04 LTS must enforce password complexity by requiring that at least one lowercase character be used.

Description: None

• medium

Automated: yes

• accounts_password_pam_lcredit: Ensure PAM Enforces Password Requirements - Minimum Lowercase Characters
• var_password_pam_lcredit = 1

UBTU-24-400280: Ubuntu 24.04 LTS must enforce password complexity by requiring that at least one numeric character be used.

Description: None

• medium

Automated: yes

• accounts_password_pam_dcredit: Ensure PAM Enforces Password Requirements - Minimum Digit Characters
• var_password_pam_dcredit = 1

UBTU-24-400290: Ubuntu 24.04 LTS must require the change of at least eight characters when passwords are changed.

Description: None

• medium

Automated: yes

• accounts_password_pam_difok: Ensure PAM Enforces Password Requirements - Minimum Different Characters
• var_password_pam_difok = 8

UBTU-24-400300: Ubuntu 24.04 LTS must enforce 24 hours/1 day as the minimum password lifetime. Passwords for new users must have a 24 hours/1 day minimum password lifetime restriction.

Description: None

• medium

Automated: yes

• accounts_minimum_age_login_defs: Set Password Minimum Age
• var_accounts_minimum_age_login_defs = 1

UBTU-24-400310: Ubuntu 24.04 LTS must enforce a 60-day maximum password lifetime restriction. Passwords for new users must have a 60-day maximum password lifetime restriction.

Description: None

• medium

Automated: yes

• accounts_maximum_age_login_defs: Set Password Maximum Age
• var_accounts_maximum_age_login_defs = 60

UBTU-24-400320: Ubuntu 24.04 LTS must enforce a minimum 15-character password length.

Description: None

• medium

Automated: yes

• accounts_password_pam_minlen: Ensure PAM Enforces Password Requirements - Minimum Length
• var_password_pam_minlen = 15

UBTU-24-400330: Ubuntu 24.04 LTS must enforce password complexity by requiring that at least one special character be used.

Description: None

• medium

Automated: yes

• accounts_password_pam_ocredit: Ensure PAM Enforces Password Requirements - Minimum Special Characters
• var_password_pam_ocredit = 1

UBTU-24-400340: Ubuntu 24.04 LTS must be configured such that Pluggable Authentication Module (PAM) prohibits the use of cached authentications after one day.

Description: None

• low

Automated: yes

• sssd_offline_cred_expiration: Configure SSSD to Expire Offline Credentials

UBTU-24-400360: Ubuntu 24.04 LTS, for PKI-based authentication, SSSD must validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor.

Description: None

• medium

Automated: yes

• sssd_certification_path_trust_anchor: Certificate trust path in SSSD
• sssd_enable_pam_services: Configure PAM in SSSD Services
• sssd_enable_smartcards: Enable Smartcards in SSSD

UBTU-24-400370: Ubuntu 24.04 LTS must map the authenticated identity to the user or group account for PKI-based authentication.

Description: None

• high

Automated: yes

• sssd_enable_user_cert: Enable Certificates Mapping in SSSD

UBTU-24-400375: Ubuntu 24.04 LTS, for PKI-based authentication, Privileged Access Management (PAM) must validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor.

Description: None

• medium

Automated: yes

• smartcard_configure_ca: Configure Smart Card Certificate Authority Validation

UBTU-24-400380: Ubuntu 24.04 LTS for PKI-based authentication, must implement a local cache of revocation data in case of the inability to access revocation information via the network.

Description: None

• medium

Automated: yes

• smartcard_configure_crl: Configure Smart Card Local Cache of Revocation Data

UBTU-24-400400: Ubuntu 24.04 LTS must encrypt all stored passwords with a FIPS 140-3 approved cryptographic hashing algorithm.

Description: None

• medium

Automated: yes

• set_password_hashing_algorithm_logindefs: Set Password Hashing Algorithm in /etc/login.defs

UBTU-24-500010: Ubuntu 24.04 LTS must generate audit records for privileged activities, nonlocal maintenance, diagnostic sessions, and other system-level access.

Description: None

• medium

Automated: yes

• audit_sudo_log_events: Record Attempts to perform maintenance activities

UBTU-24-500050: Ubuntu 24.04 LTS must use strong authenticators in establishing nonlocal maintenance and diagnostic sessions.

Description: None

• medium

Automated: yes

• sshd_enable_pam: Enable PAM

UBTU-24-600000: Ubuntu 24.04 LTS must immediately terminate all network connections associated with SSH traffic after a period of inactivity.

Description: None

• medium

Automated: yes

No rules selected

UBTU-24-600010: Ubuntu 24.04 LTS must immediately terminate all network connections associated with SSH traffic at the end of the session or after 10 minutes of inactivity.

Description: None

• medium

Automated: yes

No rules selected

UBTU-24-600030: Ubuntu 24.04 LTS must implement NIST FIPS-validated cryptography to protect classified information and for the following: To provision digital signatures, to generate cryptographic hashes, and to protect unclassified information requiring confidentiality and cryptographic protection in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.

Description: None

• high

Automated: yes

• is_fips_mode_enabled: Verify '/proc/sys/crypto/fips_enabled' exists

UBTU-24-600060: Ubuntu 24.04 LTS must use DOD PKI-established certificate authorities (CAs) for verification of the establishment of protected sessions.

Description: None

• medium

Automated: yes

• only_allow_dod_certs: Only Allow DoD PKI-established CAs

UBTU-24-600070: Ubuntu 24.04 LTS must disable kernel core dumps.

Description: None

• medium

Automated: yes

• service_kdump_disabled: Disable KDump Kernel Crash Analyzer (kdump)

UBTU-24-600090: Ubuntu 24.04 LTS handling data requiring "data at rest" protections must employ cryptographic mechanisms to prevent unauthorized disclosure and modification of the information at rest.

Description: None

• medium

Automated: yes

• encrypt_partitions: Encrypt Partitions

UBTU-24-600130: Ubuntu 24.04 LTS must ensure only users who need access to security functions are part of sudo group.

Description: None

• high

Automated: yes

• ensure_sudo_group_restricted: Ensure sudo group has only necessary members

UBTU-24-600140: Ubuntu 24.04 LTS must restrict access to the kernel message buffer.

Description: None

• low

Automated: yes

• sysctl_kernel_dmesg_restrict: Restrict Access to Kernel Message Buffer

UBTU-24-600150: Ubuntu 24.04 LTS must set a sticky bit on all public directories to prevent unauthorized and unintended information transferred via shared system resources.

Description: None

• medium

Automated: yes

• dir_perms_world_writable_sticky_bits: Verify that All World-Writable Directories Have Sticky Bits Set

UBTU-24-600160: Ubuntu 24.04 LTS must compare internal information system clocks at least every 24 hours with an authoritative time server.

Description: None

• low

Automated: yes

• chronyd_or_ntpd_set_maxpoll: Configure Time Service Maxpoll Interval
• var_time_service_set_maxpoll = 18_hours

UBTU-24-600180: Ubuntu 24.04 LTS must synchronize internal information system clocks to the authoritative time source when the time difference is greater than one second.

Description: None

• low

Automated: yes

• chronyd_sync_clock: Synchronize internal information system clocks

UBTU-24-600190: Ubuntu 24.04 LTS must be configured to use TCP syncookies.

Description: None

• medium

Automated: yes

• sysctl_net_ipv4_tcp_syncookies: Enable Kernel Parameter to Use TCP Syncookies on Network Interfaces

UBTU-24-600200: Ubuntu 24.04 LTS must configure the uncomplicated firewall to rate-limit impacted network interfaces.

Description: None

• medium

Automated: yes

• ufw_rate_limit: ufw Must rate-limit network interfaces

UBTU-24-600230: Ubuntu 24.04 LTS must disable all wireless network adapters.

Description: None

• medium

Automated: yes

• wireless_disable_interfaces: Deactivate Wireless Network Interfaces

UBTU-24-700010: Ubuntu 24.04 LTS must generate error messages that provide information necessary for corrective actions without revealing information that could be exploited by adversaries.

Description: None

• medium

Automated: yes

• file_permissions_var_log_stig: Verify permissions of log files

UBTU-24-700020: Ubuntu 24.04 LTS must generate system journal entries without revealing information that could be exploited by adversaries.

Description: None

• medium

Automated: yes

• dir_permissions_system_journal: Verify Permissions on the system journal directories
• file_permissions_system_journal: Verify Permissions on the system journal

UBTU-24-700030: Ubuntu 24.04 LTS must be configured so that the "journalctl" command is not accessible by unauthorized users.

Description: None

• medium

Automated: yes

• file_permissions_journalctl: Verify Permissions on the journal command

UBTU-24-700040: Ubuntu 24.04 LTS must be configured so that the "journalctl" command is owned by "root".

Description: None

• medium

Automated: yes

• file_owner_journalctl: Verify Owner on the journalctl Command

UBTU-24-700050: Ubuntu 24.04 LTS must be configured so that the "journalctl" command is group-owned by "root".

Description: None

• medium

Automated: yes

• file_groupowner_journalctl: Verify Groupowner on the journalctl command

UBTU-24-700060: Ubuntu 24.04 LTS must configure the directories used by the system journal to be group-owned by "systemd-journal".

Description: None

• medium

Automated: yes

• dir_groupowner_system_journal: Verify group-owner of system journal directories

UBTU-24-700070: Ubuntu 24.04 LTS must configure the files used by the system journal to be group-owned by "systemd-journal".

Description: None

• medium

Automated: yes

• file_groupowner_system_journal: Verify Group Who Owns the system journal

UBTU-24-700080: Ubuntu 24.04 LTS must configure the directories used by the system journal to be owned by "root".

Description: None

• medium

Automated: yes

• dir_owner_system_journal: Verify owner of system journal directories

UBTU-24-700090: Ubuntu 24.04 LTS must configure the files used by the system journal to be owned by "root"

Description: None

• medium

Automated: yes

• file_owner_system_journal: Verify Owner on the system journal

UBTU-24-700100: Ubuntu 24.04 LTS must configure the /var/log directory to be group-owned by syslog.

Description: None

• medium

Automated: yes

• file_groupowner_var_log: Verify Group Who Owns /var/log Directory

UBTU-24-700110: Ubuntu 24.04 LTS must configure the /var/log directory to be owned by root.

Description: None

• medium

Automated: yes

• file_owner_var_log: Verify User Who Owns /var/log Directory

UBTU-24-700120: Ubuntu 24.04 LTS must configure the /var/log directory to have mode "0755" or less permissive.

Description: None

• medium

Automated: yes

• file_permissions_var_log: Verify Permissions on /var/log Directory

UBTU-24-700130: Ubuntu 24.04 LTS must configure the /var/log/syslog file to be group-owned by adm.

Description: None

• medium

Automated: yes

• file_groupowner_var_log_syslog: Verify Group Who Owns /var/log/syslog File

UBTU-24-700140: Ubuntu 24.04 LTS must configure /var/log/syslog file to be owned by syslog.

Description: None

• medium

Automated: yes

• file_owner_var_log_syslog: Verify User Who Owns /var/log/syslog File

UBTU-24-700150: Ubuntu 24.04 LTS must configure /var/log/syslog file with mode "0640" or less permissive.

Description: None

• medium

Automated: yes

• file_permissions_var_log_syslog: Verify Permissions on /var/log/syslog File

UBTU-24-700300: Ubuntu 24.04 LTS must implement nonexecutable data to protect its memory from unauthorized code execution.

Description: None

• medium

Automated: yes

• bios_enable_execution_restrictions: Enable NX or XD Support in the BIOS

UBTU-24-700310: Ubuntu 24.04 LTS must implement address space layout randomization to protect its memory from unauthorized code execution.

Description: None

• medium

Automated: yes

• sysctl_kernel_randomize_va_space: Enable Randomized Layout of Virtual Address Space

UBTU-24-700320: Ubuntu 24.04 LTS must be configured so that Advance Package Tool (APT) removes all software components after updated versions have been installed.

Description: None

• medium

Automated: yes

• clean_components_post_updating: Ensure apt_get Removes Previous Package Versions

UBTU-24-700400: Ubuntu 24.04 LTS must be a vendor-supported release.

Description: None

• medium

Automated: yes

• installed_OS_is_vendor_supported: The Installed Operating System Is Vendor Supported

UBTU-24-900040: Ubuntu 24.04 LTS must be configured so that audit configuration files are not write-accessible by unauthorized users.

Description: None

• medium

Automated: yes

• file_permissions_etc_audit_auditd: Verify Permissions on /etc/audit/auditd.conf
• file_permissions_etc_audit_rules: Verify Permissions on /etc/audit/audit.rules
• file_permissions_etc_audit_rulesd: Verify Permissions on /etc/audit/rules.d/*.rules

UBTU-24-900050: Ubuntu 24.04 LTS must permit only authorized accounts to own the audit configuration files.

Description: None

• medium

Automated: yes

• file_ownership_audit_configuration: Audit Configuration Files Must Be Owned By Root

UBTU-24-900060: Ubuntu 24.04 LTS must permit only authorized groups to own the audit configuration files.

Description: None

• medium

Automated: yes

• file_groupownership_audit_configuration: Audit Configuration Files Must Be Owned By Group root

UBTU-24-900070: Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the su command.

Description: None

• medium

Automated: yes

• audit_rules_privileged_commands_su: Ensure auditd Collects Information on the Use of Privileged Commands - su

UBTU-24-900080: Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the chfn command.

Description: None

• medium

Automated: yes

• audit_rules_privileged_commands_chfn: Ensure auditd Collects Information on the Use of Privileged Commands - chfn

UBTU-24-900090: Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the mount command.

Description: None

• medium

Automated: yes

• audit_rules_privileged_commands_mount: Ensure auditd Collects Information on the Use of Privileged Commands - mount

UBTU-24-900100: Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the umount command.

Description: None

• medium

Automated: yes

• audit_rules_privileged_commands_umount: Ensure auditd Collects Information on the Use of Privileged Commands - umount

UBTU-24-900110: Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the ssh-agent command.

Description: None

• medium

Automated: yes

• audit_rules_privileged_commands_ssh_agent: Record Any Attempts to Run ssh-agent

UBTU-24-900120: Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the ssh-keysign command.

Description: None

• medium

Automated: yes

• audit_rules_privileged_commands_ssh_keysign: Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign

UBTU-24-900130: Ubuntu 24.04 LTS must generate audit records for any use of the setxattr, fsetxattr, lsetxattr, removexattr, fremovexattr, and lremovexattr system calls.

Description: None

• medium

Automated: yes

• audit_rules_dac_modification_fremovexattr: Record Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattr: Record Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lremovexattr: Record Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattr: Record Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattr: Record Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattr: Record Events that Modify the System's Discretionary Access Controls - setxattr

UBTU-24-900140: Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the chown, fchown, fchownat, and lchown system calls.

Description: None

• medium

Automated: yes

• audit_rules_dac_modification_chown: Record Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchown: Record Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownat: Record Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_lchown: Record Events that Modify the System's Discretionary Access Controls - lchown

UBTU-24-900150: Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the chmod, fchmod, and fchmodat system calls.

Description: None

• medium

Automated: yes

• audit_rules_dac_modification_chmod: Record Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_fchmod: Record Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodat: Record Events that Modify the System's Discretionary Access Controls - fchmodat

UBTU-24-900160: Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the creat, open, openat, open_by_handle_at, truncate, and ftruncate system calls.

Description: None

• medium

Automated: yes

• audit_rules_unsuccessful_file_modification_creat: Record Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncate: Record Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_open: Record Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_at: Record Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_openat: Record Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_truncate: Record Unsuccessful Access Attempts to Files - truncate

UBTU-24-900170: Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the sudo command.

Description: None

• medium

Automated: yes

• audit_rules_privileged_commands_sudo: Ensure auditd Collects Information on the Use of Privileged Commands - sudo

UBTU-24-900180: Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the sudoedit command.

Description: None

• medium

Automated: yes

• audit_rules_privileged_commands_sudoedit: Ensure auditd Collects Information on the Use of Privileged Commands - sudoedit

UBTU-24-900190: Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the chsh command.

Description: None

• medium

Automated: yes

• audit_rules_privileged_commands_chsh: Ensure auditd Collects Information on the Use of Privileged Commands - chsh

UBTU-24-900200: Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the newgrp command.

Description: None

• medium

Automated: yes

• audit_rules_privileged_commands_newgrp: Ensure auditd Collects Information on the Use of Privileged Commands - newgrp

UBTU-24-900210: Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the chcon command.

Description: None

• medium

Automated: yes

• audit_rules_execution_chcon: Record Any Attempts to Run chcon

UBTU-24-900220: Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the apparmor_parser command.

Description: None

• medium

Automated: yes

• audit_rules_privileged_commands_apparmor_parser: Record Any Attempts to Run apparmor_parser

UBTU-24-900230: Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the setfacl command.

Description: None

• medium

Automated: yes

• audit_rules_execution_setfacl: Record Any Attempts to Run setfacl

UBTU-24-900240: Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the chacl command.

Description: None

• medium

Automated: yes

• audit_rules_execution_chacl: Record Any Attempts to Run chacl

UBTU-24-900250: Ubuntu 24.04 LTS must generate audit records for the use and modification of faillog file.

Description: None

• medium

Automated: yes

• audit_rules_login_events_faillog: Record Attempts to Alter Logon and Logout Events - faillog

UBTU-24-900260: Ubuntu 24.04 LTS must generate audit records for the use and modification of the lastlog file.

Description: None

• medium

Automated: yes

• audit_rules_login_events_lastlog: Record Attempts to Alter Logon and Logout Events - lastlog

UBTU-24-900270: Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the passwd command.

Description: None

• medium

Automated: yes

• audit_rules_privileged_commands_passwd: Ensure auditd Collects Information on the Use of Privileged Commands - passwd

UBTU-24-900280: Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the unix_update command.

Description: None

• medium

Automated: yes

• audit_rules_privileged_commands_unix_update: Ensure auditd Collects Information on the Use of Privileged Commands - unix_update

UBTU-24-900290: Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the gpasswd command.

Description: None

• medium

Automated: yes

• audit_rules_privileged_commands_gpasswd: Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd

UBTU-24-900300: Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the chage command.

Description: None

• medium

Automated: yes

• audit_rules_privileged_commands_chage: Ensure auditd Collects Information on the Use of Privileged Commands - chage

UBTU-24-900310: Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the usermod command.

Description: None

• medium

Automated: yes

• audit_rules_privileged_commands_usermod: Ensure auditd Collects Information on the Use of Privileged Commands - usermod

UBTU-24-900320: Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the crontab command.

Description: None

• medium

Automated: yes

• audit_rules_privileged_commands_crontab: Ensure auditd Collects Information on the Use of Privileged Commands - crontab

UBTU-24-900330: Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the pam_timestamp_check command.

Description: None

• medium

Automated: yes

• audit_rules_privileged_commands_pam_timestamp_check: Ensure auditd Collects Information on the Use of Privileged Commands - pam_timestamp_check

UBTU-24-900340: Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the init_module and finit_module syscalls.

Description: None

• medium

Automated: yes

• audit_rules_kernel_module_loading_finit: Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
• audit_rules_kernel_module_loading_init: Ensure auditd Collects Information on Kernel Module Loading - init_module

UBTU-24-900350: Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the delete_module syscall.

Description: None

• medium

Automated: yes

• audit_rules_kernel_module_loading_delete: Ensure auditd Collects Information on Kernel Module Unloading - delete_module

UBTU-24-900510: Ubuntu 24.04 LTS must generate audit records when successful/unsuccessful attempts to modify the /etc/sudoers file occur.

Description: None

• medium

Automated: yes

• audit_rules_sudoers: Ensure auditd Collects System Administrator Actions - /etc/sudoers

UBTU-24-900520: Ubuntu 24.04 LTS must generate audit records when successful/unsuccessful attempts to modify the /etc/sudoers.d directory occur.

Description: None

• medium

Automated: yes

• audit_rules_sudoers_d: Ensure auditd Collects System Administrator Actions - /etc/sudoers.d/

UBTU-24-900540: Ubuntu 24.04 LTS must generate audit records for any successful/unsuccessful use of unlink, unlinkat, rename, renameat, and rmdir system calls.

Description: None

• medium

Automated: yes

• audit_rules_file_deletion_events_rename: Ensure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameat: Ensure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdir: Ensure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlink: Ensure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkat: Ensure auditd Collects File Deletion Events by User - unlinkat

UBTU-24-900590: Ubuntu 24.04 LTS must generate audit records for the /var/log/wtmp file.

Description: None

• medium

Automated: yes

• audit_rules_session_events_wtmp: Record Attempts to Alter Process and Session Initiation Information wtmp

UBTU-24-900600: Ubuntu 24.04 LTS must generate audit records for the /var/run/utmp file.

Description: None

• medium

Automated: yes

• audit_rules_session_events_utmp: Record Attempts to Alter Process and Session Initiation Information utmp

UBTU-24-900610: Ubuntu 24.04 LTS must generate audit records for the /var/log/btmp file.

Description: None

• medium

Automated: yes

• audit_rules_session_events_btmp: Record Attempts to Alter Process and Session Initiation Information btmp

UBTU-24-900730: Ubuntu 24.04 LTS must generate audit records when successful/unsuccessful attempts to use modprobe command.

Description: None

• medium

Automated: yes

• audit_rules_privileged_commands_modprobe: Ensure auditd Collects Information on the Use of Privileged Commands - modprobe

UBTU-24-900740: Ubuntu 24.04 LTS must generate audit records when successful/unsuccessful attempts to use the kmod command.

Description: None

• medium

Automated: yes

• audit_rules_privileged_commands_kmod: Ensure auditd Collects Information on the Use of Privileged Commands - kmod

UBTU-24-900750: Ubuntu 24.04 LTS must generate audit records when successful/unsuccessful attempts to use the fdisk command.

Description: None

• medium

Automated: yes

• audit_rules_privileged_commands_fdisk: Ensure auditd Collects Information on the Use of Privileged Commands - fdisk

UBTU-24-900920: Ubuntu 24.04 LTS must allocate audit record storage capacity to store at least one week's worth of audit records, when audit records are not immediately sent to a central audit record storage facility.

Description: None

• low

Automated: yes

• auditd_audispd_configure_sufficiently_large_partition: Configure a Sufficiently Large Partition for Audit Logs

UBTU-24-900950: Ubuntu 24.04 LTS must have a crontab script running weekly to offload audit events of standalone systems.

Description: None

• low

Automated: no

No rules selected

UBTU-24-900960: Ubuntu 24.04 LTS must immediately notify the system administrator (SA) and information system security officer (ISSO) (at a minimum) when allocated audit record storage volume reaches 75 percent of the repository maximum audit record storage capacity.

Description: None

• low

Automated: yes

• auditd_data_retention_space_left_action: Configure auditd space_left Action on Low Disk Space
• auditd_data_retention_space_left_percentage: Configure auditd space_left on Low Disk Space
• var_auditd_space_left_action = email
• var_auditd_space_left_percentage = 25pc

UBTU-24-900980: Ubuntu 24.04 LTS must alert the system administrator (SA) and information system security officer (ISSO) (at a minimum) in the event of an audit processing failure.

Description: None

• low

Automated: yes

• auditd_data_retention_action_mail_acct: Configure auditd mail_acct Action on Low Disk Space
• var_auditd_action_mail_acct = root

UBTU-24-901220: Ubuntu 24.04 LTS must record time stamps for audit records that can be mapped to Coordinated Universal Time (UTC) or Greenwich Mean Time (GMT).

Description: None

• low

Automated: yes

• ensure_rtc_utc_configuration: Ensure real-time clock is set to UTC

UBTU-24-901230: Ubuntu 24.04 LTS must configure audit tools with a mode of "0755" or less permissive.

Description: None

• medium

Automated: yes

• file_permissions_audit_binaries: Verify that audit tools Have Mode 0755 or less

UBTU-24-901240: Ubuntu 24.04 LTS must configure audit tools to be owned by root.

Description: None

• medium

Automated: yes

• file_ownership_audit_binaries: Verify that audit tools are owned by root

UBTU-24-901250: Ubuntu 24.04 LTS must configure the audit tools to be group-owned by root.

Description: None

• medium

Automated: yes

• file_groupownership_audit_binaries: Verify that audit tools are owned by group root

UBTU-24-901260: Ubuntu 24.04 LTS must have directories that contain system commands set to a mode of "0755" or less permissive.

Description: None

• medium

Automated: yes

• dir_permissions_binary_dirs: Verify that System Executable Directories Have Restrictive Permissions

UBTU-24-901270: Ubuntu 24.04 LTS must have directories that contain system commands owned by root.

Description: None

• medium

Automated: yes

• dir_ownership_binary_dirs: Verify that System Executable Have Root Ownership

UBTU-24-901280: Ubuntu 24.04 LTS must have directories that contain system commands group-owned by root.

Description: None

• medium

Automated: yes

• dir_groupownership_binary_dirs: Verify that system commands directories are group owned by root

UBTU-24-901300: Ubuntu 24.04 LTS must be configured so that audit log files are not read or write-accessible by unauthorized users.

Description: None

• medium

Automated: yes

• file_permissions_var_log_audit_stig: System Audit Logs Must Have Mode 0600 or Less Permissive

UBTU-24-901310: Ubuntu 24.04 LTS must be configured to permit only authorized users ownership of the audit log files.

Description: None

• medium

Automated: yes

• file_ownership_var_log_audit_stig: System Audit Logs Must Be Owned By Root

UBTU-24-901350: Ubuntu 24.04 LTS must permit only authorized groups ownership of the audit log files.

Description: None

• medium

Automated: yes

• file_group_ownership_var_log_audit: System Audit Logs Must Be Group Owned By Root
• file_group_ownership_var_log_audit_stig: System Audit Logs Must Be Group Owned By Root

UBTU-24-901380: Ubuntu 24.04 LTS must be configured so that the audit log directory is not write-accessible by unauthorized users.

Description: None

• medium

Automated: yes

• directory_permissions_var_log_audit: System Audit Logs Must Have Mode 0750 or Less Permissive

UBTU-24-90890: Ubuntu 24.04 LTS must use cryptographic mechanisms to protect the integrity of audit tools.

Description: None

• medium

Automated: yes

• aide_check_audit_tools: Configure AIDE to Verify the Audit Tools

UBTU-24-909000: Ubuntu 24.04 LTS audit system must protect auditing rules from unauthorized change.

Description: None

• medium

Automated: yes

• audit_rules_immutable: Make the auditd Configuration Immutable