CCE Identifiers in Guide to the Secure Configuration of Red Hat Enterprise Linux 9

Mapping	Rule Title	Description	Rationale
CCE-83437-4	Configure Periodic Execution of AIDE	At a minimum, AIDE should be configured to run a weekly scan. To implement a daily execution of AIDE at 4:05am using cron, add the following line to `/etc/crontab`: 05 4 * * * root /usr/sbin/aide --check To implement a weekly execution of AIDE at 4:05am using cron, add the following line to `/etc/crontab`: 05 4 * * 0 root /usr/sbin/aide --check AIDE can be executed periodically through other means; this is merely one example. The usage of cron's special time codes, such as `@daily` and `@weekly` is acceptable.	By default, AIDE does not install itself for periodic execution. Periodically running AIDE is necessary to reveal unexpected changes in installed files. Unauthorized changes to the baseline configuration could make the system vulnerable to various attacks or allow unauthorized access to the operating system. Changes to operating system configurations can have unintended side effects, some of which may be relevant to security. Detecting such changes and providing an automated response can help avoid unintended, negative consequences that could ultimately affect the security state of the operating system. The operating system's Information Management Officer (IMO)/Information System Security Officer (ISSO) and System Administrators (SAs) must be notified via email and/or monitoring system trap when there is an unauthorized modification of a configuration item.
CCE-83438-2	Build and Test AIDE Database	Run the following command to generate a new database: $ sudo /usr/sbin/aide --init By default, the database will be written to the file `/var/lib/aide/aide.db.new.gz`. Storing the database, the configuration file `/etc/aide.conf`, and the binary `/usr/sbin/aide` (or hashes of these files), in a secure location (such as on read-only media) provides additional assurance about their integrity. The newly-generated database can be installed as follows: $ sudo cp /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz To initiate a manual check, run the following command: $ sudo /usr/sbin/aide --check If this check produces any unexpected output, investigate.	For AIDE to be effective, an initial database of "known-good" information about files must be captured and it should be able to be verified against the installed files.
CCE-83439-0	Configure AIDE to Verify Extended Attributes	By default, the `xattrs` option is added to the `FIPSR` ruleset in AIDE. If using a custom ruleset or the `xattrs` option is missing, add `xattrs` to the appropriate ruleset. For example, add `xattrs` to the following line in `/etc/aide.conf`: FIPSR = p+i+n+u+g+s+m+c+acl+selinux+xattrs+sha256 AIDE rules can be configured in multiple ways; this is merely one example that is already configured by default. The remediation provided with this rule adds `xattrs` to all rule sets available in `/etc/aide.conf`	Extended attributes in file systems are used to contain arbitrary data and file metadata with security implications.
CCE-83441-6	Set kernel parameter 'crypto.fips_enabled' to 1	System running in FIPS mode is indicated by kernel parameter `'crypto.fips_enabled'`. This parameter should be set to `1` in FIPS mode. Red Hat Enterprise Linux 9 has an installation-time kernel flag that can enable FIPS mode. The installer must be booted with `fips=1` for the system to have FIPS mode enabled. Enabling FIPS mode on a preexisting system is not supported. If this rule fails on an installed system, then this is a permanent finding and cannot be fixed. To enable strict FIPS compliance, the fips=1 kernel option needs to be added to the kernel boot parameters during system installation so key generation is done with FIPS-approved algorithms and continuous monitoring tests in place.	Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. The operating system must implement cryptographic modules adhering to the higher standards approved by the federal government since this provides assurance they have been tested and validated.
CCE-83442-4	Install crypto-policies package	The `crypto-policies` package can be installed with the following command: $ sudo dnf install crypto-policies	Centralized cryptographic policies simplify applying secure ciphers across an operating system and the applications that run on that operating system. Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data.
CCE-83445-7	Configure SSH to use System Crypto Policy	Crypto Policies provide a centralized control over crypto algorithms usage of many packages. SSH is supported by crypto policy, but the SSH configuration may be set up to ignore it. To check that Crypto Policies settings are configured correctly, ensure that the `CRYPTO_POLICY` variable is either commented or not set at all in the `/etc/sysconfig/sshd`.	Overriding the system crypto policy makes the behavior of the SSH service violate expectations, and makes system configuration more fragmented.
CCE-83446-5	Configure Libreswan to use System Crypto Policy	Crypto Policies provide a centralized control over crypto algorithms usage of many packages. Libreswan is supported by system crypto policy, but the Libreswan configuration may be set up to ignore it. To check that Crypto Policies settings are configured correctly, ensure that the `/etc/ipsec.conf` includes the appropriate configuration file. In `/etc/ipsec.conf`, make sure that the following line is not commented out or superseded by later includes: `include /etc/crypto-policies/back-ends/libreswan.config`	Overriding the system crypto policy makes the behavior of the Libreswan service violate expectations, and makes system configuration more fragmented.
CCE-83448-1	Configure OpenSSL library to use TLS Encryption	Crypto Policies are means of enforcing certain cryptographic settings for selected applications including OpenSSL. OpenSSL is by default configured to modify its configuration based on currently configured Crypto Policy. Editing the Crypto Policy back-end is not recommended. Check the crypto-policies(7) man page and choose a policy that configures TLS protocol to version 1.2 or higher, for example DEFAULT, FUTURE or FIPS policy. Or create and apply a custom policy that restricts minimum TLS version to 1.2. For example for versions prior to crypto-policies-20210617-1.gitc776d3e.el8.noarch this is expected: $ sudo grep -i MinProtocol /etc/crypto-policies/back-ends/opensslcnf.config MinProtocol = TLSv1.2 Or for version crypto-policies-20210617-1.gitc776d3e.el8.noarch and newer this is expected: $ sudo grep -i MinProtocol /etc/crypto-policies/back-ends/opensslcnf.config TLS.MinProtocol = TLSv1.2 DTLS.MinProtocol = DTLSv1.2	Without cryptographic integrity protections, information can be altered by unauthorized users without detection.
CCE-83449-9	Configure Kerberos to use System Crypto Policy	Crypto Policies provide a centralized control over crypto algorithms usage of many packages. Kerberos is supported by crypto policy, but it's configuration may be set up to ignore it. To check that Crypto Policies settings for Kerberos are configured correctly, examine that there is a symlink at /etc/krb5.conf.d/crypto-policies targeting /etc/cypto-policies/back-ends/krb5.config. If the symlink exists, Kerberos is configured to use the system-wide crypto policy settings.	Overriding the system crypto policy makes the behavior of Kerberos violate expectations, and makes system configuration more fragmented.
CCE-83450-7	Configure System Cryptography Policy	To configure the system cryptography policy to use ciphers only from the `DEFAULT` policy, run the following command: $ sudo update-crypto-policies --set `DEFAULT` The rule checks if settings for selected crypto policy are configured as expected. Configuration files in the `/etc/crypto-policies/back-ends` are either symlinks to correct files provided by Crypto-policies package or they are regular files in case crypto policy customizations are applied. Crypto policies may be customized by crypto policy modules, in which case it is delimited from the base policy using a colon.	Centralized cryptographic policies simplify applying secure ciphers across an operating system and the applications that run on that operating system. Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data.
CCE-83451-5	Configure BIND to use System Crypto Policy	Crypto Policies provide a centralized control over crypto algorithms usage of many packages. BIND is supported by crypto policy, but the BIND configuration may be set up to ignore it. To check that Crypto Policies settings are configured correctly, ensure that the `/etc/named.conf` includes the appropriate configuration: In the `options` section of `/etc/named.conf`, make sure that the following line is not commented out or superseded by later includes: `include "/etc/crypto-policies/back-ends/bind.config";`	Overriding the system crypto policy makes the behavior of the BIND service violate expectations, and makes system configuration more fragmented.
CCE-83452-3	Configure OpenSSL library to use System Crypto Policy	Crypto Policies provide a centralized control over crypto algorithms usage of many packages. OpenSSL is supported by crypto policy, but the OpenSSL configuration may be set up to ignore it. To check that Crypto Policies settings are configured correctly, you have to examine the OpenSSL config file available under `/etc/pki/tls/openssl.cnf`. This file has the `ini` format, and it enables crypto policy support if there is a `[ crypto_policy ]` section that contains the `.include = /etc/crypto-policies/back-ends/opensslcnf.config` directive.	Overriding the system crypto policy makes the behavior of the Java runtime violates expectations, and makes system configuration more fragmented.
CCE-83453-1	The Installed Operating System Is Vendor Supported	The installed operating system must be maintained by a vendor. Red Hat Enterprise Linux is supported by Red Hat, Inc. As the Red Hat Enterprise Linux vendor, Red Hat, Inc. is responsible for providing security patches.	An operating system is considered "supported" if the vendor continues to provide security patches for the product. With an unsupported release, it will not be possible to resolve any security issue discovered in the system software.
CCE-83454-9	Install dnf-automatic Package	The `dnf-automatic` package can be installed with the following command: $ sudo dnf install dnf-automatic	`dnf-automatic` is an alternative command line interface (CLI) to `dnf upgrade` suitable for automatic, regular execution.
CCE-83456-4	Configure dnf-automatic to Install Available Updates Automatically	To ensure that the packages comprising the available updates will be automatically installed by `dnf-automatic`, set `apply_updates` to `yes` under `[commands]` section in `/etc/dnf/automatic.conf`.	Installing software updates is a fundamental mitigation against the exploitation of publicly-known vulnerabilities. If the most recent security patches and updates are not installed, unauthorized users may take advantage of weaknesses in the unpatched software. The lack of prompt attention to patching could result in a system compromise. The automated installation of updates ensures that recent security patches are applied in a timely manner.
CCE-83457-2	Ensure gpgcheck Enabled In Main dnf Configuration	The `gpgcheck` option controls whether RPM packages' signatures are always checked prior to installation. To configure dnf to check package signatures before installing them, ensure the following line appears in `/etc/dnf/dnf.conf` in the `[main]` section: gpgcheck=1	Changes to any software components can have significant effects on the overall security of the operating system. This requirement ensures the software has not been tampered with and that it has been provided by a trusted vendor. Accordingly, patches, service packs, device drivers, or operating system components must be signed with a certificate recognized and approved by the organization. Verifying the authenticity of the software prior to installation validates the integrity of the patch or upgrade received from a vendor. This ensures the software has not been tampered with and that it has been provided by a trusted vendor. Self-signed certificates are disallowed by this requirement. Certificates used to verify the software must be from an approved Certificate Authority (CA).
CCE-83458-0	Ensure dnf Removes Previous Package Versions	`dnf` should be configured to remove previous software components after new versions have been installed. To configure `dnf` to remove the previous software components after updating, set the `clean_requirements_on_remove` to `1` in `/etc/dnf/dnf.conf`.	Previous versions of software components that are not removed from the information system after updates have been installed may be exploited by some adversaries.
CCE-83459-8	Enable dnf-automatic Timer	The `dnf-automatic` timer can be enabled with the following command: $ sudo systemctl enable dnf-automatic.timer	The `dnf-automatic` is an alternative command line interface (CLI) to `dnf upgrade` with specific facilities to make it suitable to be executed automatically and regularly from systemd timers, cron jobs and similar. The tool is controlled by `dnf-automatic.timer` SystemD timer.
CCE-83461-4	Configure dnf-automatic to Install Only Security Updates	To configure `dnf-automatic` to install only security updates automatically, set `upgrade_type` to `security` under `[commands]` section in `/etc/dnf/automatic.conf`.	By default, `dnf-automatic` installs all available updates. Reducing the amount of updated packages only to updates that were issued as a part of a security advisory increases the system stability.
CCE-83463-0	Ensure gpgcheck Enabled for Local Packages	`dnf` should be configured to verify the signature(s) of local packages prior to installation. To configure `dnf` to verify signatures of local packages, set the `localpkg_gpgcheck` to `1` in `/etc/dnf/dnf.conf`.	Changes to any software components can have significant effects to the overall security of the operating system. This requirement ensures the software has not been tampered and has been provided by a trusted vendor. Accordingly, patches, service packs, device drivers, or operating system components must be signed with a certificate recognized and approved by the organization.
CCE-83464-8	Ensure gpgcheck Enabled for All dnf Package Repositories	To ensure signature checking is not disabled for any repos, remove any lines from files in `/etc/yum.repos.d` of the form: gpgcheck=0	Verifying the authenticity of the software prior to installation validates the integrity of the patch or upgrade received from a vendor. This ensures the software has not been tampered with and that it has been provided by a trusted vendor. Self-signed certificates are disallowed by this requirement. Certificates used to verify the software must be from an approved Certificate Authority (CA)."
CCE-83466-3	Ensure /var Located On Separate Partition	The `/var` directory is used by daemons and other system services to store frequently-changing data. Ensure that `/var` has its own partition or logical volume at installation time, or migrate it using LVM.	Ensuring that `/var` is mounted on its own partition enables the setting of more restrictive mount options. This helps protect system services such as daemons or other programs which use it. It is not uncommon for the `/var` directory to contain world-writable directories installed by other software packages.
CCE-83468-9	Ensure /home Located On Separate Partition	If user home directories will be stored locally, create a separate partition for `/home` at installation time (or migrate it later using LVM). If `/home` will be mounted from another system such as an NFS server, then creating a separate partition is not necessary at installation time, and the mountpoint can instead be configured later.	Ensuring that `/home` is mounted on its own partition enables the setting of more restrictive mount options, and also helps ensure that users cannot trivially fill partitions used for log or audit data storage.
CCE-83487-9	Ensure /var/tmp Located On Separate Partition	The `/var/tmp` directory is a world-writable directory used for temporary file storage. Ensure it has its own partition or logical volume at installation time, or migrate it using LVM.	The `/var/tmp` partition is used as temporary storage by many programs. Placing `/var/tmp` in its own partition enables the setting of more restrictive mount options, which can help protect programs which use it.
CCE-83494-5	Ensure gnutls-utils is installed	The `gnutls-utils` package can be installed with the following command: $ sudo dnf install gnutls-utils	GnuTLS is a secure communications library implementing the SSL, TLS and DTLS protocols and technologies around them. It provides a simple C language application programming interface (API) to access the secure communications protocols as well as APIs to parse and write X.509, PKCS #12, OpenPGP and other required structures. This package contains command line TLS client and server and certificate manipulation tools.
CCE-83502-5	Install openscap-scanner Package	The `openscap-scanner` package can be installed with the following command: $ sudo dnf install openscap-scanner	`openscap-scanner` contains the `oscap` command line tool. This tool is a configuration and vulnerability scanner, capable of performing compliance checking using SCAP content.
CCE-83503-3	Install rear Package	The `rear` package can be installed with the following command: $ sudo dnf install rear	`rear` contains the Relax-and-Recover (ReaR) utility. ReaR produces a bootable image of a system and restores from backup using this image.
CCE-83504-1	Install rng-tools Package	The `rng-tools` package can be installed with the following command: $ sudo dnf install rng-tools	`rng-tools` provides hardware random number generator tools, such as those used in the formation of x509/PKI certificates.
CCE-83505-8	Install scap-security-guide Package	The `scap-security-guide` package can be installed with the following command: $ sudo dnf install scap-security-guide	The `scap-security-guide` package provides a guide for configuration of the system from the final system's security point of view. The guidance is specified in the Security Content Automation Protocol (SCAP) format and constitutes a catalog of practical hardening advice, linked to government requirements where applicable. The SCAP Security Guide project bridges the gap between generalized policy requirements and specific implementation guidelines. A system administrator can use the `oscap` CLI tool from the `openscap-scanner` package, or the SCAP Workbench GUI tool from the `scap-workbench` package, to verify that the system conforms to provided guidelines. Refer to the scap-security-guide(8) manual page for further information.
CCE-83506-6	Install subscription-manager Package	The `subscription-manager` package can be installed with the following command: $ sudo dnf install subscription-manager	Red Hat Subscription Manager is a local service which tracks installed products and subscriptions on a local system to help manage subscription assignments. It communicates with the backend subscription service (the Customer Portal or an on-premise server such as Subscription Asset Manager) and works with content management tools such as . The package provides, among other things, plugins to interact with repositories and subscriptions from the Red Hat entitlement platform - the subscription-manager and product-id plugins.
CCE-83507-4	Uninstall abrt-addon-ccpp Package	The `abrt-addon-ccpp` package can be removed with the following command: $ sudo dnf remove abrt-addon-ccpp	`abrt-addon-ccpp` contains hooks for C/C++ crashed programs and `abrt`'s C/C++ analyzer plugin.
CCE-83508-2	Uninstall abrt-addon-kerneloops Package	The `abrt-addon-kerneloops` package can be removed with the following command: $ sudo dnf remove abrt-addon-kerneloops	`abrt-addon-kerneloops` contains plugins for collecting kernel crash information and reporter plugin which sends this information to a specified server, usually to kerneloops.org.
CCE-83512-4	Uninstall abrt-cli Package	The `abrt-cli` package can be removed with the following command: $ sudo dnf remove abrt-cli	`abrt-cli` contains a command line client for controlling abrt daemon over sockets.
CCE-83513-2	Uninstall abrt-plugin-logger Package	The `abrt-plugin-logger` package can be removed with the following command: $ sudo dnf remove abrt-plugin-logger	`abrt-plugin-logger` is an ABRT plugin which writes a report to a specified file.
CCE-83514-0	Uninstall abrt-plugin-rhtsupport Package	The `abrt-plugin-rhtsupport` package can be removed with the following command: $ sudo dnf remove abrt-plugin-rhtsupport	`abrt-plugin-rhtsupport` is a ABRT plugin to report bugs into the Red Hat Support system.
CCE-83515-7	Uninstall abrt-plugin-sosreport Package	The `abrt-plugin-sosreport` package can be removed with the following command: $ sudo dnf remove abrt-plugin-sosreport	`abrt-plugin-sosreport` provides a plugin to include an sosreport in an ABRT report.
CCE-83516-5	Uninstall gssproxy Package	The `gssproxy` package can be removed with the following command: $ sudo dnf remove gssproxy	`gssproxy` is a proxy for GSS API credential handling. Kerberos relies on some key derivation functions that may not be compatible with some site policies such as FIPS 140.
CCE-83519-9	Uninstall iprutils Package	The `iprutils` package can be removed with the following command: $ sudo dnf remove iprutils	`iprutils` provides a suite of utlilities to manage and configure SCSI devices supported by the ipr SCSI storage device driver.
CCE-83520-7	Uninstall krb5-workstation Package	The `krb5-workstation` package can be removed with the following command: $ sudo dnf remove krb5-workstation	Kerberos is a network authentication system. The `krb5-workstation` package contains the basic Kerberos programs (`kinit`, `klist`, `kdestroy`, `kpasswd`).
CCE-83521-5	Uninstall tuned Package	The `tuned` package can be removed with the following command: $ sudo dnf remove tuned	`tuned` contains a daemon that tunes the system settings dynamically. It does so by monitoring the usage of several system components periodically. Based on that information, components will then be put into lower or higher power savings modes to adapt to the current usage.
CCE-83523-1	Install sudo Package	The `sudo` package can be installed with the following command: $ sudo dnf install sudo	`sudo` is a program designed to allow a system administrator to give limited root privileges to users and log root activity. The basic philosophy is to give as few privileges as possible but still allow system users to get their work done.
CCE-83524-9	Don't define allowed commands in sudoers by means of exclusion	Policies applied by sudo through the sudoers file should not involve negation. Each user specification in the `sudoers` file contains a comma-delimited list of command specifications. The definition can make use glob patterns, as well as of negations. Indirect definition of those commands by means of exclusion of a set of commands is trivial to bypass, so it is not allowed to use such constructs.	Specifying access right using negation is inefficient and can be easily circumvented. For example, it is expected that a specification like # To avoid absolutely , this rule can be easily circumvented! user ALL = ALL ,!/ bin/sh prevents the execution of the shell but that’s not the case: just copy the binary `/bin/sh` to a different name to make it executable again through the rule keyword `ALL`.
CCE-83525-6	The operating system must restrict privilege elevation to authorized personnel	The sudo command allows a user to execute programs with elevated (administrator) privileges. It prompts the user for their password and confirms your request to execute a command by checking a file, called sudoers. Restrict privileged actions by removing the following entries from the sudoers file: `ALL ALL=(ALL) ALL` `ALL ALL=(ALL:ALL) ALL`	If the "sudoers" file is not configured correctly, any user defined on the system can initiate privileged actions on the target system.
CCE-83527-2	Ensure Sudo Logfile Exists - sudo logfile	A custom log sudo file can be configured with the 'logfile' tag. This rule configures a sudo custom logfile at the default location suggested by CIS, which uses /var/log/sudo.log.	A sudo log file simplifies auditing of sudo commands.
CCE-83528-0	Only the VDSM User Can Use sudo NOPASSWD	The sudo `NOPASSWD` tag, when specified, allows a user to execute commands using sudo without having to authenticate. Only the `vdsm` user should have this capability in any sudo configuration snippets in `/etc/sudoers.d/`.	Without re-authentication, users may access resources or perform tasks for which they do not have authorization. When operating systems provide the capability to escalate a functional capability, it is critical that the user re-authenticate.
CCE-83529-8	Ensure invoking users password for privilege escalation when using sudo	The sudoers security policy requires that users authenticate themselves before they can use sudo. When sudoers requires authentication, it validates the invoking user's credentials. The expected output for: sudo cvtsudoers -f sudoers /etc/sudoers \| grep -E '^Defaults !?(rootpw\|targetpw\|runaspw)$' Defaults !targetpw Defaults !rootpw Defaults !runaspw or if cvtsudoers not supported: sudo find /etc/sudoers /etc/sudoers.d $ \! -name '~' -a \! -name '.' $ -exec grep -E --with-filename '^[[:blank:]]Defaults[[:blank:]](.*[[:blank:]])?!?\b(rootpw\|targetpw\|runaspw)' -- {} \; /etc/sudoers:Defaults !targetpw /etc/sudoers:Defaults !rootpw /etc/sudoers:Defaults !runaspw	If the rootpw, targetpw, or runaspw flags are defined and not disabled, by default the operating system will prompt the invoking user for the "root" user password.
CCE-83531-4	Don't target root user in the sudoers file	The targeted users of a user specification should be, as much as possible, non privileged users (i.e.: non-root). User specifications have to explicitly list the runas spec (i.e. the list of target users that can be impersonated), and `ALL` or `root` should not be used.	It is common that the command to be executed does not require superuser rights (editing a file whose the owner is not root, sending a signal to an unprivileged process,etc.). In order to limit any attempt of privilege escalation through a command, it is better to apply normal user rights.
CCE-83536-3	Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD	The sudo `NOPASSWD` tag, when specified, allows a user to execute commands using sudo without having to authenticate. This should be disabled by making sure that the `NOPASSWD` tag does not exist in `/etc/sudoers` configuration file or any sudo configuration snippets in `/etc/sudoers.d/`.	Without re-authentication, users may access resources or perform tasks for which they do not have authorization. When operating systems provide the capability to escalate a functional capability, it is critical that the user re-authenticate.
CCE-83537-1	Ensure Privileged Escalated Commands Cannot Execute Other Commands - sudo NOEXEC	The sudo `NOEXEC` tag, when specified, prevents user executed commands from executing other commands, like a shell for example. This should be enabled by making sure that the `NOEXEC` tag exists in `/etc/sudoers` configuration file or any sudo configuration snippets in `/etc/sudoers.d/`.	Restricting the capability of sudo allowed commands to execute sub-commands prevents users from running programs with privileges they wouldn't have otherwise.
CCE-83538-9	Ensure Only Users Logged In To Real tty Can Execute Sudo - sudo use_pty	The sudo `use_pty` tag, when specified, will only execute sudo commands from users logged in to a real tty. This should be enabled by making sure that the `use_pty` tag exists in `/etc/sudoers` configuration file or any sudo configuration snippets in `/etc/sudoers.d/`.	Requiring that sudo commands be run in a pseudo-terminal can prevent an attacker from retaining access to the user's terminal after the main program has finished executing.
CCE-83539-7	Ensure Only Users Logged In To Real tty Can Execute Sudo - sudo requiretty	The sudo `requiretty` tag, when specified, will only execute sudo commands from users logged in to a real tty. This should be enabled by making sure that the `requiretty` tag exists in `/etc/sudoers` configuration file or any sudo configuration snippets in `/etc/sudoers.d/`.	Restricting the use cases in which a user is allowed to execute sudo commands reduces the attack surface.
CCE-83543-9	Ensure Users Re-Authenticate for Privilege Escalation - sudo	The sudo `NOPASSWD` and `!authenticate` option, when specified, allows a user to execute commands using sudo without having to authenticate. This should be disabled by making sure that `NOPASSWD` and/or `!authenticate` do not exist in `/etc/sudoers` configuration file or any sudo configuration snippets in `/etc/sudoers.d/`."	Without re-authentication, users may access resources or perform tasks for which they do not have authorization. When operating systems provide the capability to escalate a functional capability, it is critical that the user re-authenticate.
CCE-83544-7	Ensure Users Re-Authenticate for Privilege Escalation - sudo !authenticate	The sudo `!authenticate` option, when specified, allows a user to execute commands using sudo without having to authenticate. This should be disabled by making sure that the `!authenticate` option does not exist in `/etc/sudoers` configuration file or any sudo configuration snippets in `/etc/sudoers.d/`.	Without re-authentication, users may access resources or perform tasks for which they do not have authorization. When operating systems provide the capability to escalate a functional capability, it is critical that the user re-authenticate.
CCE-83545-4	Explicit arguments in sudo specifications	All commands in the sudoers file must strictly specify the arguments allowed to be used for a given user. If the command is supposed to be executed only without arguments, pass "" as an argument in the corresponding user specification.	Any argument can modify quite significantly the behavior of a program, whether regarding the realized operation (read, write, delete, etc.) or accessed resources (path in a file system tree). To avoid any possibility of misuse of a command by a user, the ambiguities must be removed at the level of its specification. For example, on some systems, the kernel messages are only accessible by root. If a user nevertheless must have the privileges to read them, the argument of the dmesg command has to be restricted in order to prevent the user from flushing the buffer through the -c option: user ALL = dmesg ""
CCE-83549-6	Remove the GDM Package Group	By removing the `gdm` package, the system no longer has GNOME installed. If X Windows is not installed then the system cannot boot into graphical user mode. This prevents the system from being accidentally or maliciously booted into a `graphical.target` mode. To do so, run the following command: $ sudo yum remove gdm	Unnecessary service packages must not be installed to decrease the attack surface of the system. A graphical environment is unnecessary for certain types of systems including a virtualization hypervisor.
CCE-83551-2	Verify permissions on System Login Banner	To properly set the permissions of `/etc/issue`, run the command: $ sudo chmod 0644 /etc/issue	Display of a standardized and approved use notification before granting access to the operating system ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. Proper permissions will ensure that only root user can modify the banner.
CCE-83554-6	Verify permissions on Message of the Day Banner	To properly set the permissions of `/etc/motd`, run the command: $ sudo chmod 0644 /etc/motd	Display of a standardized and approved use notification before granting access to the operating system ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. Proper permissions will ensure that only root user can modify the banner.
CCE-83557-9	Modify the System Login Banner	To configure the system login banner edit `/etc/issue`. Replace the default text with a message compliant with the local site policy or a legal disclaimer. The DoD required text is either: You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests -- not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details. OR: `I've read & consent to terms in IS user agreem't.`	Display of a standardized and approved use notification before granting access to the operating system ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. System use notifications are required only for access via login interfaces with human users and are not required when such human interfaces do not exist.
CCE-83559-5	Modify the System Message of the Day Banner	To configure the system message banner edit `/etc/motd`. Replace the default text with a message compliant with the local site policy or a legal disclaimer. The DoD required text is either: You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests -- not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details. OR: `I've read & consent to terms in IS user agreem't.`	Display of a standardized and approved use notification before granting access to the operating system ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. System use notifications are required only for access via login interfaces with human users and are not required when such human interfaces do not exist.
CCE-83560-3	Ensure PAM Displays Last Logon/Access Notification	To configure the system to notify users of last logon/access using `pam_lastlog`, add or correct the `pam_lastlog` settings in `/etc/pam.d/postlogin` to include `showfailed` option, such as: session [default=1] pam_lastlog.so showfailed And make sure that the `silent` option is not set for this specific line.	Users need to be aware of activity that occurs regarding their account. Providing users with information regarding the number of unsuccessful attempts that were made to login to their account allows the user to determine if any unauthorized activity has occurred and gives them an opportunity to notify administrators.
CCE-83563-7	Ensure PAM Enforces Password Requirements - Minimum Different Categories	The pam_pwquality module's `minclass` parameter controls requirements for usage of different character classes, or types, of character that must exist in a password before it is considered valid. For example, setting this value to three (3) requires that any password must have characters from at least three different categories in order to be approved. The default value is zero (0), meaning there are no required classes. There are four categories available: * Upper-case characters * Lower-case characters * Digits * Special characters (for example, punctuation) Modify the `minclass` setting in `/etc/security/pwquality.conf` entry to require `3` differing categories of characters when changing passwords.	Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised. Requiring a minimum number of character categories makes password guessing attacks more difficult by ensuring a larger search space.
CCE-83564-5	Ensure PAM Enforces Password Requirements - Minimum Different Characters	The pam_pwquality module's `difok` parameter sets the number of characters in a password that must not be present in and old password during a password change. Modify the `difok` setting in `/etc/security/pwquality.conf` to equal `8` to require differing characters when changing passwords.	Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute–force attacks. Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised. Requiring a minimum number of different characters during password changes ensures that newly changed passwords should not resemble previously compromised ones. Note that passwords which are changed on compromised systems will still be compromised, however.
CCE-83565-2	Ensure PAM Enforces Password Requirements - Minimum Special Characters	The pam_pwquality module's `ocredit=` parameter controls requirements for usage of special (or "other") characters in a password. When set to a negative number, any password will be required to contain that many special characters. When set to a positive number, pam_pwquality will grant +1 additional length credit for each special character. Modify the `ocredit` setting in `/etc/security/pwquality.conf` to equal `-1` to require use of a special character in passwords.	Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised. Requiring a minimum number of special characters makes password guessing attacks more difficult by ensuring a larger search space.
CCE-83566-0	Ensure PAM Enforces Password Requirements - Minimum Digit Characters	The pam_pwquality module's `dcredit` parameter controls requirements for usage of digits in a password. When set to a negative number, any password will be required to contain that many digits. When set to a positive number, pam_pwquality will grant +1 additional length credit for each digit. Modify the `dcredit` setting in `/etc/security/pwquality.conf` to require the use of a digit in passwords.	Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised. Requiring digits makes password guessing attacks more difficult by ensuring a larger search space.
CCE-83567-8	Set Password Maximum Consecutive Repeating Characters	The pam_pwquality module's `maxrepeat` parameter controls requirements for consecutive repeating characters. When set to a positive number, it will reject passwords which contain more than that number of consecutive characters. Modify the `maxrepeat` setting in `/etc/security/pwquality.conf` to equal `3` to prevent a run of (`3` + 1) or more identical characters.	Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised. Passwords with excessive repeating characters may be more vulnerable to password-guessing attacks.
CCE-83568-6	Ensure PAM Enforces Password Requirements - Minimum Uppercase Characters	The pam_pwquality module's `ucredit=` parameter controls requirements for usage of uppercase letters in a password. When set to a negative number, any password will be required to contain that many uppercase characters. When set to a positive number, pam_pwquality will grant +1 additional length credit for each uppercase character. Modify the `ucredit` setting in `/etc/security/pwquality.conf` to require the use of an uppercase character in passwords.	Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised.
CCE-83569-4	Ensure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session	To configure the number of retry prompts that are permitted per-session: Edit the `/etc/security/pwquality.conf` to include `retry=3`, or a lower value if site policy is more restrictive. The profile requirement is a maximum of `retry=3` prompts per session.	Setting the password retry prompts that are permitted on a per-session basis to a low value requires some software, such as SSH, to re-connect. This can slow down and draw additional attention to some types of password-guessing attacks. Note that this is different from account lockout, which is provided by the pam_faillock module.
CCE-83570-2	Ensure PAM Enforces Password Requirements - Minimum Lowercase Characters	The pam_pwquality module's `lcredit` parameter controls requirements for usage of lowercase letters in a password. When set to a negative number, any password will be required to contain that many lowercase characters. When set to a positive number, pam_pwquality will grant +1 additional length credit for each lowercase character. Modify the `lcredit` setting in `/etc/security/pwquality.conf` to require the use of a lowercase character in passwords.	Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised. Requiring a minimum number of lowercase characters makes password guessing attacks more difficult by ensuring a larger search space.
CCE-83575-1	Ensure PAM Enforces Password Requirements - Maximum Consecutive Repeating Characters from Same Character Class	The pam_pwquality module's `maxclassrepeat` parameter controls requirements for consecutive repeating characters from the same character class. When set to a positive number, it will reject passwords which contain more than that number of consecutive characters from the same character class. Modify the `maxclassrepeat` setting in `/etc/security/pwquality.conf` to equal `4` to prevent a run of (`4` + 1) or more identical characters.	Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password complexity is one factor of several that determines how long it takes to crack a password. The more complex a password, the greater the number of possible combinations that need to be tested before the password is compromised.
CCE-83579-3	Ensure PAM Enforces Password Requirements - Minimum Length	The pam_pwquality module's `minlen` parameter controls requirements for minimum characters required in a password. Add `minlen=15` after pam_pwquality to set minimum password length requirements.	The shorter the password, the lower the number of possible combinations that need to be tested before the password is compromised. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password length is one factor of several that helps to determine strength and how long it takes to crack a password. Use of more characters in a password helps to exponentially increase the time and/or resources required to compromise the password.
CCE-83581-9	Set PAM Password Hashing Algorithm - system-auth	The PAM system service can be configured to only store encrypted representations of passwords. In "/etc/pam.d/system-auth", the `password` section of the file controls which PAM modules to execute during a password change. Set the `pam_unix.so` module in the `password` section to include the option `sha512` and no other hashing algorithms as shown below: password sufficient pam_unix.so `sha512` other arguments... This will help ensure that new passwords for local users will be stored using the `sha512` algorithm.	Passwords need to be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. Passwords that are encrypted with a weak algorithm are no more protected than if they are kept in plain text. This setting ensures user and group account administration utilities are configured to store only encrypted representations of passwords. Additionally, the `crypt_style` configuration option in `/etc/libuser.conf` ensures the use of a strong hashing algorithm that makes password cracking attacks more difficult.
CCE-83583-5	Set Interval For Counting Failed Password Attempts	Utilizing `pam_faillock.so`, the `fail_interval` directive configures the system to lock out an account after a number of incorrect login attempts within a specified time period. Ensure that the file `/etc/security/faillock.conf` contains the following entry: `fail_interval = <interval-in-seconds>` where `interval-in-seconds` is `900` or greater. In order to avoid errors when manually editing these files, it is recommended to use the appropriate tools, such as `authselect` or `authconfig`, depending on the OS version.	By limiting the number of failed logon attempts the risk of unauthorized system access via user password guessing, otherwise known as brute-forcing, is reduced. Limits are imposed by locking the account.
CCE-83584-3	Limit Password Reuse	Do not allow users to reuse recent passwords. This can be accomplished by using the `remember` option for the `pam_unix` or `pam_pwhistory` PAM modules.	Preventing reuse of previous passwords helps ensure that a compromised password is not reused by a user.
CCE-83587-6	Lock Accounts After Failed Password Attempts	This rule configures the system to lock out accounts after a number of incorrect login attempts using `pam_faillock.so`. pam_faillock.so module requires multiple entries in pam files. These entries must be carefully defined to work as expected. Ensure that the file `/etc/security/faillock.conf` contains the following entry: `deny = <count>` Where count should be less than or equal to `3` and greater than 0. In order to avoid errors when manually editing these files, it is recommended to use the appropriate tools, such as `authselect` or `authconfig`, depending on the OS version.	By limiting the number of failed logon attempts, the risk of unauthorized system access via user password guessing, also known as brute-forcing, is reduced. Limits are imposed by locking the account.
CCE-83588-4	Set Lockout Time for Failed Password Attempts	This rule configures the system to lock out accounts during a specified time period after a number of incorrect login attempts using `pam_faillock.so`. Ensure that the file `/etc/security/faillock.conf` contains the following entry: `unlock_time=<interval-in-seconds>` where `interval-in-seconds` is `0` or greater. pam_faillock.so module requires multiple entries in pam files. These entries must be carefully defined to work as expected. In order to avoid any errors when manually editing these files, it is recommended to use the appropriate tools, such as `authselect` or `authconfig`, depending on the OS version. If `unlock_time` is set to `0`, manual intervention by an administrator is required to unlock a user. This should be done using the `faillock` tool.	By limiting the number of failed logon attempts the risk of unauthorized system access via user password guessing, otherwise known as brute-forcing, is reduced. Limits are imposed by locking the account.
CCE-83589-2	Configure the root Account for Failed Password Attempts	This rule configures the system to lock out the `root` account after a number of incorrect login attempts using `pam_faillock.so`. pam_faillock.so module requires multiple entries in pam files. These entries must be carefully defined to work as expected. In order to avoid errors when manually editing these files, it is recommended to use the appropriate tools, such as `authselect` or `authconfig`, depending on the OS version.	By limiting the number of failed logon attempts, the risk of unauthorized system access via user password guessing, also known as brute-forcing, is reduced. Limits are imposed by locking the account.
CCE-83592-6	Require Authentication for Emergency Systemd Target	Emergency mode is intended as a system recovery method, providing a single user root access to the system during a failed boot sequence. By default, Emergency mode is protected by requiring a password and is set in `/usr/lib/systemd/system/emergency.service`.	This prevents attackers with physical access from trivially bypassing security on the machine and gaining root access. Such accesses are further prevented by configuring the bootloader password.
CCE-83594-2	Require Authentication for Single User Mode	Single-user mode is intended as a system recovery method, providing a single user root access to the system by providing a boot option at startup. By default, single-user mode is protected by requiring a password and is set in `/usr/lib/systemd/system/rescue.service`.	This prevents attackers with physical access from trivially bypassing security on the machine and gaining root access. Such accesses are further prevented by configuring the bootloader password.
CCE-83595-9	Install the opensc Package For Multifactor Authentication	The `opensc` package can be installed with the following command: $ sudo dnf install opensc	Using an authentication device, such as a CAC or token that is separate from the information system, ensures that even if the information system is compromised, that compromise will not affect credentials stored on the authentication device. Multifactor solutions that require devices separate from information systems gaining access include, for example, hardware tokens providing time-based or challenge-response authenticators and smart cards or similar secure authentication devices issued by an organization or identity provider.
CCE-83596-7	Install Smart Card Packages For Multifactor Authentication	Configure the operating system to implement multifactor authentication by installing the required package with the following command: The `openssl-pkcs11` package can be installed with the following command: $ sudo dnf install openssl-pkcs11	Using an authentication device, such as a CAC or token that is separate from the information system, ensures that even if the information system is compromised, that compromise will not affect credentials stored on the authentication device. Multifactor solutions that require devices separate from information systems gaining access include, for example, hardware tokens providing time-based or challenge-response authenticators and smart cards or similar secure authentication devices issued by an organization or identity provider.
CCE-83599-1	Install the tmux Package	To enable console screen locking, install the `tmux` package. The `tmux` package can be installed with the following command: $ sudo dnf install tmux A session lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not want to log out because of the temporary nature of the absence. The session lock is implemented at the point where session activity can be determined. Rather than be forced to wait for a period of time to expire before the user session can be locked, Red Hat Enterprise Linux 9 needs to provide users with the ability to manually invoke a session lock so users can secure their session if it is necessary to temporarily vacate the immediate physical vicinity. Instruct users to begin new terminal sessions with the following command: $ tmux The console can now be locked with the following key combination: ctrl+b :lock-session	A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not logout because of the temporary nature of the absence. Rather than relying on the user to manually lock their operation system session prior to vacating the vicinity, operating systems need to be able to identify when a user's session has idled and take action to initiate the session lock. The `tmux` package allows for a session lock to be implemented and configured.
CCE-83606-4	Set Password Maximum Age	To specify password maximum age for new accounts, edit the file `/etc/login.defs` and add or correct the following line: PASS_MAX_DAYS `60` The profile requirement is `60`.	Any password, no matter how complex, can eventually be cracked. Therefore, passwords need to be changed periodically. If the operating system does not limit the lifetime of passwords and force users to change their passwords, there is the risk that the operating system passwords could be compromised. Setting the password maximum age ensures users are required to periodically change their passwords. Requiring shorter password lifetimes increases the risk of users writing down the password in a convenient location subject to physical compromise.
CCE-83608-0	Set Password Minimum Length in login.defs	To specify password length requirements for new accounts, edit the file `/etc/login.defs` and add or correct the following line: PASS_MIN_LEN `15` The profile requirement is `15`. If a program consults `/etc/login.defs` and also another PAM module (such as `pam_pwquality`) during a password change operation, then the most restrictive must be satisfied. See PAM section for more information about enforcing password quality requirements.	Requiring a minimum password length makes password cracking attacks more difficult by ensuring a larger search space. However, any security benefit from an onerous requirement must be carefully weighed against usability problems, support costs, or counterproductive behavior that may result.
CCE-83609-8	Set Password Warning Age	To specify how many days prior to password expiration that a warning will be issued to users, edit the file `/etc/login.defs` and add or correct the following line: PASS_WARN_AGE `7` The profile requirement is `7`.	Setting the password warning age enables users to make the change at a practical time.
CCE-83610-6	Set Password Minimum Age	To specify password minimum age for new accounts, edit the file `/etc/login.defs` and add or correct the following line: PASS_MIN_DAYS `7` A value of 1 day is considered sufficient for many environments. The profile requirement is `7`.	Enforcing a minimum password lifetime helps to prevent repeated password changes to defeat the password reuse or history enforcement requirement. If users are allowed to immediately and continually change their password, then the password could be repeatedly changed in a short period of time to defeat the organization's policy regarding password reuse. Setting the minimum password age protects against users cycling back to a favorite password after satisfying the password reuse requirement.
CCE-83611-4	Prevent Login to Accounts With Empty Password	If an account is configured for password authentication but does not have an assigned password, it may be possible to log into the account without authentication. Remove any instances of the `nullok` in `/etc/pam.d/system-auth` and `/etc/pam.d/password-auth` to prevent logins with empty passwords.	If an account has an empty password, anyone could log in and run commands with the privileges of that account. Accounts with empty passwords should never be used in operational environments.
CCE-83612-2	Ensure there are no legacy + NIS entries in /etc/shadow	The `+` character in `/etc/shadow` file marks a place where entries from a network information service (NIS) should be directly inserted.	Using this method to include entries into `/etc/shadow` is considered legacy and should be avoided. These entries may provide a way for an attacker to gain access to the system.
CCE-83613-0	All GIDs referenced in /etc/passwd must be defined in /etc/group	Add a group to the system for each GID referenced without a corresponding group.	If a user is assigned the Group Identifier (GID) of a group not existing on the system, and a group with the Group Identifier (GID) is subsequently created, the user may have unintended rights to any files associated with the group.
CCE-83615-5	Set number of Password Hashing Rounds - password-auth	Configure the number or rounds for the password hashing algorithm. This can be accomplished by using the `rounds` option for the `pam_unix` PAM module. In file `/etc/pam.d/password-auth` append `rounds=5000` to the `pam_unix.so` entry, as shown below: password sufficient pam_unix.so ...existing_options... rounds=`5000` The system's default number of rounds is 5000.	Using a higher number of rounds makes password cracking attacks more difficult.
CCE-83616-3	Ensure there are no legacy + NIS entries in /etc/group	The `+` character in `/etc/group` file marks a place where entries from a network information service (NIS) should be directly inserted.	Using this method to include entries into `/etc/group` is considered legacy and should be avoided. These entries may provide a way for an attacker to gain access to the system.
CCE-83617-1	Verify No netrc Files Exist	The `.netrc` files contain login information used to auto-login into FTP servers and reside in the user's home directory. These files may contain unencrypted passwords to remote FTP servers making them susceptible to access by unauthorized users and should not be used. Any `.netrc` files should be removed.	Unencrypted passwords for remote FTP servers may be stored in `.netrc` files.
CCE-83618-9	Verify All Account Password Hashes are Shadowed	If any password hashes are stored in `/etc/passwd` (in the second field, instead of an `x` or `*`), the cause of this misconfiguration should be investigated. The account should have its password reset and the hash should be properly stored, or the account should be deleted entirely.	The hashes for all user account passwords should be stored in the file `/etc/shadow` and never in `/etc/passwd`, which is readable by all users.
CCE-83620-5	Ensure there are no legacy + NIS entries in /etc/passwd	The `+` character in `/etc/passwd` file marks a place where entries from a network information service (NIS) should be directly inserted.	Using this method to include entries into `/etc/passwd` is considered legacy and should be avoided. These entries may provide a way for an attacker to gain access to the system.
CCE-83621-3	Set number of Password Hashing Rounds - system-auth	Configure the number or rounds for the password hashing algorithm. This can be accomplished by using the `rounds` option for the `pam_unix` PAM module. In file `/etc/pam.d/system-auth` append `rounds=5000` to the `pam_unix.so` entry, as shown below: password sufficient pam_unix.so ...existing_options... rounds=`5000` The system's default number of rounds is 5000.	Using a higher number of rounds makes password cracking attacks more difficult.
CCE-83622-1	Restrict Serial Port Root Logins	To restrict root logins on serial ports, ensure lines of this form do not appear in `/etc/securetty`: ttyS0 ttyS1	Preventing direct root login to serial port interfaces helps ensure accountability for actions taken on the systems using the root account.
CCE-83623-9	Ensure that System Accounts Do Not Run a Shell Upon Login	Some accounts are not associated with a human user of the system, and exist to perform some administrative functions. Should an attacker be able to log into these accounts, they should not be granted access to a shell. The login shell for each local account is stored in the last field of each line in `/etc/passwd`. System accounts are those user accounts with a user ID less than `1000`. The user ID is stored in the third field. If any system account other than `root` has a login shell, disable it with the command: $ sudo usermod -s /sbin/nologin account	Ensuring shells are not given to system accounts upon login makes it more difficult for attackers to make use of system accounts.
CCE-83624-7	Verify Only Root Has UID 0	If any account other than root has a UID of 0, this misconfiguration should be investigated and the accounts other than root should be removed or have their UID changed. If the account is associated with system commands or applications the UID should be changed to one greater than "0" but less than "1000." Otherwise assign a UID greater than "1000" that has not already been assigned.	An account has root authority if it has a UID of 0. Multiple accounts with a UID of 0 afford more opportunity for potential intruders to guess a password for a privileged account. Proper configuration of sudo is recommended to afford multiple system administrators access to root privileges in an accountable manner.
CCE-83625-4	Direct root Logins Not Allowed	To further limit access to the `root` account, administrators can disable root logins at the console by editing the `/etc/securetty` file. This file lists all devices the root user is allowed to login to. If the file does not exist at all, the root user can login through any communication device on the system, whether via the console or via a raw network interface. This is dangerous as user can login to the system as root via Telnet, which sends the password in plain text over the network. By default, Red Hat Enterprise Linux 9's `/etc/securetty` file only allows the root user to login at the console physically attached to the system. To prevent root from logging in, remove the contents of this file. To prevent direct root logins, remove the contents of this file by typing the following command: $ sudo echo > /etc/securetty	Disabling direct root logins ensures proper accountability and multifactor authentication to privileged accounts. Users will first login, then escalate to privileged (root) access via su / sudo. This is required for FISMA Low and FISMA Moderate systems.
CCE-83626-2	Restrict Virtual Console Root Logins	To restrict root logins through the (deprecated) virtual console devices, ensure lines of this form do not appear in `/etc/securetty`: vc/1 vc/2 vc/3 vc/4	Preventing direct root login to virtual console devices helps ensure accountability for actions taken on the system using the root account.
CCE-83627-0	Set Account Expiration Following Inactivity	To specify the number of days after a password expires (which signifies inactivity) until an account is permanently disabled, add or correct the following line in `/etc/default/useradd`: INACTIVE=`35` If a password is currently on the verge of expiration, then `35` day(s) remain(s) until the account is automatically disabled. However, if the password will not expire for another 60 days, then 60 days plus `35` day(s) could elapse until the account would be automatically disabled. See the `useradd` man page for more information.	Inactive identifiers pose a risk to systems and applications because attackers may exploit an inactive identifier and potentially obtain undetected access to the system. Disabling inactive accounts ensures that accounts which may not have been responsibly removed are not available to attackers who may have compromised their credentials. Owners of inactive accounts will not notice if unauthorized access to their user account has been obtained.
CCE-83628-8	Ensure All Accounts on the System Have Unique Names	Ensure accounts on the system have unique names. To ensure all accounts have unique names, run the following command: $ sudo getent passwd \| awk -F: '{ print $1}' \| uniq -d If a username is returned, change or delete the username.	Unique usernames allow for accountability on the system.
CCE-83629-6	All Interactive User Home Directories Must Be Group-Owned By The Primary Group	Change the group owner of interactive users home directory to the group found in `/etc/passwd`. To change the group owner of interactive users home directory, use the following command: $ sudo chgrp USER_GROUP /home/USER This rule ensures every home directory related to an interactive user is group-owned by an interactive user. It also ensures that interactive users are group-owners of one and only one home directory.	If the Group Identifier (GID) of a local interactive users home directory is not the same as the primary GID of the user, this would allow unauthorized access to the users files, and users that share the same group may not be able to access files that they legitimately should.
CCE-83633-8	Set Interactive Session Timeout	Setting the `TMOUT` option in `/etc/profile` ensures that all user sessions will terminate based on inactivity. A value of `0` (zero) disables the automatic logout feature and is therefore not a compliant setting. The value of TMOUT should be a positive integer, exported, and read only. The `TMOUT` setting in a file loaded by `/etc/profile`, e.g. `/etc/profile.d/tmout.sh` should read as follows: typeset -xr TMOUT=`600` or declare -xr TMOUT=`600` Using the `typeset` keyword is preferred for wider compatibility with ksh and other shells.	Terminating an idle session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled on the console or console port that has been left unattended.
CCE-83634-6	All Interactive User Home Directories Must Have mode 0750 Or Less Permissive	Change the mode of interactive users home directories to `0750`. To change the mode of interactive users home directory, use the following command: $ sudo chmod 0750 /home/USER	Excessive permissions on local interactive user home directories may allow unauthorized access to user files by other users.
CCE-83635-3	Ensure the Logon Failure Delay is Set Correctly in login.defs	To ensure the logon failure delay controlled by `/etc/login.defs` is set properly, add or correct the `FAIL_DELAY` setting in `/etc/login.defs` to read as follows: FAIL_DELAY `4`	Increasing the time between a failed authentication attempt and re-prompting to enter credentials helps to slow a single-threaded brute force attack.
CCE-83637-9	Ensure All User Initialization Files Have Mode 0740 Or Less Permissive	Set the mode of the user initialization files to `0740` with the following command: $ sudo chmod 0740 /home/USER/.INIT_FILE	Local initialization files are used to configure the user's shell environment upon logon. Malicious modification of these files could compromise accounts upon logon.
CCE-83638-7	Ensure that User Home Directories are not Group-Writable or World-Readable	For each human user of the system, view the permissions of the user's home directory: # ls -ld /home/USER Ensure that the directory is not group-writable and that it is not world-readable. If necessary, repair the permissions: # chmod g-w /home/USER # chmod o-rwx /home/USER	User home directories contain many configuration files which affect the behavior of a user's account. No user should ever have write permission to another user's home directory. Group shared directories can be configured in sub-directories or elsewhere in the filesystem if they are needed. Typically, user home directories should not be world-readable, as it would disclose file names to other users. If a subset of users need read access to one another's home directories, this can be provided using groups or ACLs.
CCE-83639-5	All Interactive Users Home Directories Must Exist	Create home directories to all local interactive users that currently do not have a home directory assigned. Use the following commands to create the user home directory assigned in `/etc/passwd`: $ sudo mkdir /home/USER	If a local interactive user has a home directory defined that does not exist, the user may be given access to the / directory as the current working directory upon logon. This could create a Denial of Service because the user would not be able to access their logon configuration files, and it may give them visibility to system files they normally would not be able to access.
CCE-83641-1	Limit the Number of Concurrent Login Sessions Allowed Per User	Limiting the number of allowed users and sessions per user can limit risks related to Denial of Service attacks. This addresses concurrent sessions for a single account and does not address concurrent sessions by a single user via multiple accounts. To set the number of concurrent sessions per user add the following line in `/etc/security/limits.conf` or a file under `/etc/security/limits.d/`: * hard maxlogins `1`	Limiting simultaneous user logins can insulate the system from denial of service problems caused by excessive logins. Automated login processes operating improperly or maliciously may result in an exceptional number of simultaneous login sessions.
CCE-83642-9	Configure Polyinstantiation of /var/tmp Directories	To configure polyinstantiated /tmp directories, first create the parent directories which will hold the polyinstantiation child directories. Use the following command: $ sudo mkdir --mode 000 /var/tmp/tmp-inst Then, add the following entry to `/etc/security/namespace.conf`: /var/tmp /var/tmp/tmp-inst/ level root,adm	Polyinstantiation of temporary directories is a proactive security measure which reduces chances of attacks that are made possible by /var/tmp directories being world-writable.
CCE-83643-7	Ensure that Root's Path Does Not Include World or Group-Writable Directories	For each element in root's path, run: # ls -ld DIR and ensure that write permissions are disabled for group and other.	Such entries increase the risk that root could execute code provided by unprivileged users, and potentially malicious code.
CCE-83644-5	Ensure the Default Bash Umask is Set Correctly	To ensure the default umask for users of the Bash shell is set properly, add or correct the `umask` setting in `/etc/bashrc` to read as follows: umask `027`	The umask value influences the permissions assigned to files when they are created. A misconfigured umask value could result in files with excessive permissions that can be read or written to by unauthorized users.
CCE-83647-8	Ensure the Default Umask is Set Correctly in login.defs	To ensure the default umask controlled by `/etc/login.defs` is set properly, add or correct the `UMASK` setting in `/etc/login.defs` to read as follows: UMASK `027`	The umask value influences the permissions assigned to files when they are created. A misconfigured umask value could result in files with excessive permissions that can be read and written to by unauthorized users.
CCE-83648-6	Install audispd-plugins Package	The `audispd-plugins` package can be installed with the following command: $ sudo dnf install audispd-plugins	`audispd-plugins` provides plugins for the real-time interface to the audit subsystem, `audispd`. These plugins can do things like relay events to remote machines or analyze events for suspicious behavior.
CCE-83649-4	Ensure the audit Subsystem is Installed	The audit package should be installed.	The auditd service is an access monitoring and accounting daemon, watching system calls to audit any access, in comparison with potential local access control policy such as SELinux policy.
CCE-83651-0	Enable Auditing for Processes Which Start Prior to the Audit Daemon	To ensure all processes can be audited, even those which start prior to the audit daemon, add the argument `audit=1` to the default GRUB 2 command line for the Linux operating system. To ensure that `audit=1` is added as a kernel command line argument to newly installed kernels, add `audit=1` to the default Grub2 command line for Linux operating systems. Modify the line within `/etc/default/grub` as shown below: GRUB_CMDLINE_LINUX="... audit=1 ..." Run the following command to update command line for already installed kernels: # grubby --update-kernel=ALL --args="audit=1" If the system is distributed as a bootable container image, GRUB2 can't be configured using the method described above, but the following method needs to be used instead. The kernel arguments should be set in `/usr/lib/bootc/kargs.d` in a TOML file that has the following form: # /usr/lib/bootc/kargs.d/10-example.toml kargs = ["audit=1"] For more details on configuring kernel arguments in bootable container images, please refer to Bootc documentation.	Each process on the system carries an "auditable" flag which indicates whether its activities can be audited. Although `auditd` takes care of enabling this for all processes which launch after it does, adding the kernel argument ensures it is set for every process during boot.
CCE-83652-8	Extend Audit Backlog Limit for the Audit Daemon	To improve the kernel capacity to queue all log events, even those which occurred prior to the audit daemon, add the argument `audit_backlog_limit=8192` to the default GRUB 2 command line for the Linux operating system. To ensure that `audit_backlog_limit=8192` is added as a kernel command line argument to newly installed kernels, add `audit_backlog_limit=8192` to the default Grub2 command line for Linux operating systems. Modify the line within `/etc/default/grub` as shown below: GRUB_CMDLINE_LINUX="... audit_backlog_limit=`8192` ..." Run the following command to update command line for already installed kernels: # grubby --update-kernel=ALL --args="audit_backlog_limit=`8192`" If the system is distributed as a bootable container image, GRUB2 can't be configured using the method described above, but the following method needs to be used instead. The kernel arguments should be set in `/usr/lib/bootc/kargs.d` in a TOML file that has the following form: # /usr/lib/bootc/kargs.d/10-example.toml kargs = ["audit_backlog_limit=`8192`"] For more details on configuring kernel arguments in bootable container images, please refer to Bootc documentation.	audit_backlog_limit sets the queue length for audit events awaiting transfer to the audit daemon. Until the audit daemon is up and running, all log messages are stored in this queue. If the queue is overrun during boot process, the action defined by audit failure flag is taken.
CCE-83653-6	Configure auditing of successful file accesses	Ensure that successful attempts to access a file are audited. The following rules configure audit as described above: ## Successful file access (any other opens) This has to go last. ## These next two are likely to result in a whole lot of events -a always,exit -F arch=b32 -S open,openat,openat2,open_by_handle_at -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-access -a always,exit -F arch=b64 -S open,openat,openat2,open_by_handle_at -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-access Load new Audit rules into kernel by running: augenrules --load Note: This rule uses a special set of Audit rules to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are aligned with your needs.	Auditing of successful attempts to access a file helps in investigation of activities performed on the system.
CCE-83655-1	Perform general configuration of Audit for OSPP	Configure some basic `Audit` parameters specific for OSPP profile. In particular, configure `Audit` to watch for direct modification of files storing system user and group information, and usage of applications with special rights which can change system configuration. Further audited events include access to audit log it self, attempts to Alter Process and Session Initiation Information, and attempts to modify MAC controls. The following rules configure audit as described above: ## The purpose of these rules is to meet the requirements for Operating ## System Protection Profile (OSPP)v4.2. These rules depends on having ## the following rule files copied to /etc/audit/rules.d: ## ## 10-base-config.rules, 11-loginuid.rules, ## 30-ospp-v42-1-create-failed.rules, 30-ospp-v42-1-create-success.rules, ## 30-ospp-v42-2-modify-failed.rules, 30-ospp-v42-2-modify-success.rules, ## 30-ospp-v42-3-access-failed.rules, 30-ospp-v42-3-access-success.rules, ## 30-ospp-v42-4-delete-failed.rules, 30-ospp-v42-4-delete-success.rules, ## 30-ospp-v42-5-perm-change-failed.rules, ## 30-ospp-v42-5-perm-change-success.rules, ## 30-ospp-v42-6-owner-change-failed.rules, ## 30-ospp-v42-6-owner-change-success.rules ## ## original copies may be found in /usr/share/audit/sample-rules/ ## User add delete modify. This is covered by pam. However, someone could ## open a file and directly create or modify a user, so we'll watch passwd and ## shadow for writes -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=user-modify -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=user-modify -a always,exit -F arch=b32 -S open -F a1&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=user-modify -a always,exit -F arch=b64 -S open -F a1&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=user-modify -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify -a always,exit -F arch=b32 -S open -F a1&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify -a always,exit -F arch=b64 -S open -F a1&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify ## User enable and disable. This is entirely handled by pam. ## Group add delete modify. This is covered by pam. However, someone could ## open a file and directly create or modify a user, so we'll watch group and ## gshadow for writes -a always,exit -F arch=b32 -F path=/etc/passwd -F perm=wa -F auid>=1000 -F auid!=unset -F key=user-modify -a always,exit -F arch=b64 -F path=/etc/passwd -F perm=wa -F auid>=1000 -F auid!=unset -F key=user-modify -a always,exit -F arch=b32 -F path=/etc/shadow -F perm=wa -F auid>=1000 -F auid!=unset -F key=user-modify -a always,exit -F arch=b64 -F path=/etc/shadow -F perm=wa -F auid>=1000 -F auid!=unset -F key=user-modify -a always,exit -F arch=b32 -F path=/etc/group -F perm=wa -F auid>=1000 -F auid!=unset -F key=group-modify -a always,exit -F arch=b64 -F path=/etc/group -F perm=wa -F auid>=1000 -F auid!=unset -F key=group-modify -a always,exit -F arch=b32 -F path=/etc/gshadow -F perm=wa -F auid>=1000 -F auid!=unset -F key=group-modify -a always,exit -F arch=b64 -F path=/etc/gshadow -F perm=wa -F auid>=1000 -F auid!=unset -F key=group-modify ## Use of special rights for config changes. This would be use of setuid ## programs that relate to user accts. This is not all setuid apps because ## requirements are only for ones that affect system configuration. -a always,exit -F arch=b32 -F path=/usr/sbin/unix_chkpwd -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F arch=b64 -F path=/usr/sbin/unix_chkpwd -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F arch=b32 -F path=/usr/sbin/usernetctl -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F arch=b64 -F path=/usr/sbin/usernetctl -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F arch=b32 -F path=/usr/sbin/userhelper -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F arch=b64 -F path=/usr/sbin/userhelper -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F arch=b32 -F path=/usr/sbin/seunshare -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F arch=b64 -F path=/usr/sbin/seunshare -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F arch=b32 -F path=/usr/bin/mount -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F arch=b64 -F path=/usr/bin/mount -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F arch=b32 -F path=/usr/bin/newgrp -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F arch=b64 -F path=/usr/bin/newgrp -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F arch=b32 -F path=/usr/bin/newuidmap -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F arch=b64 -F path=/usr/bin/newuidmap -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F arch=b32 -F path=/usr/bin/gpasswd -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F arch=b64 -F path=/usr/bin/gpasswd -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F arch=b32 -F path=/usr/bin/newgidmap -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F arch=b64 -F path=/usr/bin/newgidmap -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F arch=b32 -F path=/usr/bin/umount -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F arch=b64 -F path=/usr/bin/umount -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F arch=b32 -F path=/usr/bin/passwd -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F arch=b64 -F path=/usr/bin/passwd -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F arch=b32 -F path=/usr/bin/crontab -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F arch=b64 -F path=/usr/bin/crontab -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F arch=b32 -F path=/usr/bin/at -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F arch=b64 -F path=/usr/bin/at -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F arch=b32 -F path=/usr/sbin/grub2-set-bootflag -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F arch=b64 -F path=/usr/sbin/grub2-set-bootflag -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes ## Privilege escalation via su or sudo. This is entirely handled by pam. ## Special case for systemd-run. It is not audit aware, specifically watch it -a always,exit -F arch=b32 -F path=/usr/bin/systemd-run -F perm=x -F auid!=unset -F key=maybe-escalation -a always,exit -F arch=b64 -F path=/usr/bin/systemd-run -F perm=x -F auid!=unset -F key=maybe-escalation ## Special case for pkexec. It is not audit aware, specifically watch it -a always,exit -F arch=b32 -F path=/usr/bin/pkexec -F perm=x -F key=maybe-escalation -a always,exit -F arch=b64 -F path=/usr/bin/pkexec -F perm=x -F key=maybe-escalation ## Watch for configuration changes to privilege escalation. -a always,exit -F arch=b32 -F path=/etc/sudoers -F perm=wa -F key=special-config-changes -a always,exit -F arch=b64 -F path=/etc/sudoers -F perm=wa -F key=special-config-changes -a always,exit -F arch=b32 -F dir=/etc/sudoers.d/ -F perm=wa -F key=special-config-changes -a always,exit -F arch=b64 -F dir=/etc/sudoers.d/ -F perm=wa -F key=special-config-changes ## Audit log access -a always,exit -F arch=b32 -F dir=/var/log/audit/ -F perm=r -F auid>=1000 -F auid!=unset -F key=access-audit-trail -a always,exit -F arch=b64 -F dir=/var/log/audit/ -F perm=r -F auid>=1000 -F auid!=unset -F key=access-audit-trail ## Attempts to Alter Process and Session Initiation Information -a always,exit -F arch=b32 -F path=/var/run/utmp -F perm=wa -F auid>=1000 -F auid!=unset -F key=session -a always,exit -F arch=b64 -F path=/var/run/utmp -F perm=wa -F auid>=1000 -F auid!=unset -F key=session -a always,exit -F arch=b32 -F path=/var/log/btmp -F perm=wa -F auid>=1000 -F auid!=unset -F key=session -a always,exit -F arch=b64 -F path=/var/log/btmp -F perm=wa -F auid>=1000 -F auid!=unset -F key=session -a always,exit -F arch=b32 -F path=/var/log/wtmp -F perm=wa -F auid>=1000 -F auid!=unset -F key=session -a always,exit -F arch=b64 -F path=/var/log/wtmp -F perm=wa -F auid>=1000 -F auid!=unset -F key=session ## Attempts to modify MAC controls -a always,exit -F arch=b32 -F dir=/etc/selinux/ -F perm=wa -F auid>=1000 -F auid!=unset -F key=MAC-policy -a always,exit -F arch=b64 -F dir=/etc/selinux/ -F perm=wa -F auid>=1000 -F auid!=unset -F key=MAC-policy ## Software updates. This is entirely handled by rpm. ## System start and shutdown. This is entirely handled by systemd ## Kernel Module loading. This is handled in 43-module-load.rules ## Application invocation. The requirements list an optional requirement ## FPT_SRP_EXT.1 Software Restriction Policies. This event is intended to ## state results from that policy. This would be handled entirely by ## that daemon. Load new Audit rules into kernel by running: augenrules --load Note: This rule uses a special set of Audit rules to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are aligned with your needs.	Auditing of events listed in the description provides data for monitoring and investigation of potentially malicious events e.g. tampering with `Audit` logs, malicious access to files storing information about system users and groups etc.
CCE-83658-5	Configure auditing of successful ownership changes	Ensure that successful attempts to change an ownership of files or directories are audited. The following rules configure audit as described above: ## Successful ownership change -a always,exit -F arch=b32 -S lchown,fchown,chown,fchownat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-owner-change -a always,exit -F arch=b64 -S lchown,fchown,chown,fchownat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-owner-change Load new Audit rules into kernel by running: augenrules --load Note: This rule uses a special set of Audit rules to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are aligned with your needs.	Auditing of successful ownership changes of files or directories helps in monitoring or investigating of activities performed on the system.
CCE-83667-6	Configure auditing of unsuccessful file deletions	Ensure that unsuccessful attempts to delete a file are audited. The following rules configure audit as described above: ## Unsuccessful file delete -a always,exit -F arch=b32 -S unlink,unlinkat,rename,renameat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete -a always,exit -F arch=b64 -S unlink,unlinkat,rename,renameat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete -a always,exit -F arch=b32 -S unlink,unlinkat,rename,renameat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete -a always,exit -F arch=b64 -S unlink,unlinkat,rename,renameat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete Load new Audit rules into kernel by running: augenrules --load Note: This rule uses a special set of Audit rules to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are aligned with your needs.	Unsuccessful attempts to delete a file might be signs of malicious activities. Auditing of such events help in monitoring and investigating of such activities.
CCE-83668-4	Configure auditing of successful file creations	Ensure that successful attempts to create a file are audited. The following rules configure audit as described above: ## Successful file creation (open with O_CREAT) -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&0100 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-create -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&0100 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-create -a always,exit -F arch=b32 -S open -F a1&0100 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-create -a always,exit -F arch=b64 -S open -F a1&0100 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-create -a always,exit -F arch=b32 -S creat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-create -a always,exit -F arch=b64 -S creat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-create Load new Audit rules into kernel by running: augenrules --load Note: This rule uses a special set of Audit rules to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are aligned with your needs.	Auditing of successful attempts to create a file helps in investigation of actions which happened on the system.
CCE-83669-2	Configure auditing of unsuccessful file creations	Ensure that unsuccessful attempts to create a file are audited. The following rules configure audit as described above: ## Unsuccessful file creation (open with O_CREAT) -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-create -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-create -a always,exit -F arch=b32 -S open -F a1&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-create -a always,exit -F arch=b64 -S open -F a1&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-create -a always,exit -F arch=b32 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-create -a always,exit -F arch=b64 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-create -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-create -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-create -a always,exit -F arch=b32 -S open -F a1&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-create -a always,exit -F arch=b64 -S open -F a1&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-create -a always,exit -F arch=b32 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-create -a always,exit -F arch=b64 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-create Load new Audit rules into kernel by running: augenrules --load Note: This rule uses a special set of Audit rules to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are aligned with your needs.	Unsuccessful file creations might be a sign of a malicious action being performed on the system. Keeping log of such events helps in monitoring and investigation of such actions.
CCE-83670-0	Configure basic parameters of Audit system	Perform basic configuration of Audit system. Make sure that any previously defined rules are cleared, the auditing system is configured to handle sudden bursts of events, and in cases of failure, messages are configured to be directed to system log. The following rules configure audit as described above: ## First rule - delete all -D ## Increase the buffers to survive stress events. ## Make this bigger for busy systems -b 8192 ## This determine how long to wait in burst of events --backlog_wait_time 60000 ## Set failure mode to syslog -f 1 Load new Audit rules into kernel by running: augenrules --load	Without basic configurations, audit may not perform as expected. It may not be able to correctly handle events under stressful conditions, or log events in case of failure.
CCE-83671-8	Configure auditing of unsuccessful file modifications	Ensure that unsuccessful attempts to modify a file are audited. The following rules configure audit as described above: ## Unsuccessful file modifications (open for write or truncate) -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification -a always,exit -F arch=b32 -S open -F a1&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification -a always,exit -F arch=b64 -S open -F a1&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification -a always,exit -F arch=b32 -S truncate,ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification -a always,exit -F arch=b64 -S truncate,ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification -a always,exit -F arch=b32 -S open -F a1&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification -a always,exit -F arch=b64 -S open -F a1&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification -a always,exit -F arch=b32 -S truncate,ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification -a always,exit -F arch=b64 -S truncate,ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification Load new Audit rules into kernel by running: augenrules --load Note: This rule uses a special set of Audit rules to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are aligned with your needs.	Unsuccessful file modifications might be a sign of a malicious action being performed on the system. Auditing of such events helps in detection and investigation of such actions.
CCE-83672-6	Configure auditing of unsuccessful file accesses	Ensure that unsuccessful attempts to access a file are audited. The following rules configure audit as described above: ## Unsuccessful file access (any other opens) This has to go last. -a always,exit -F arch=b32 -S open,openat,openat2,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-access -a always,exit -F arch=b64 -S open,openat,openat2,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-access -a always,exit -F arch=b32 -S open,openat,openat2,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-access -a always,exit -F arch=b64 -S open,openat,openat2,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-access Load new Audit rules into kernel by running: augenrules --load Note: This rule uses a special set of Audit rules to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are aligned with your needs.	Unsuccessful attempts to access a file might be signs of malicious activity happening within the system. Auditing of such activities helps in their monitoring and investigation.
CCE-83673-4	Configure immutable Audit login UIDs	Configure kernel to prevent modification of login UIDs once they are set. Changing login UIDs while this configuration is enforced requires special capabilities which are not available to unprivileged users. The following rules configure audit as described above: ## Make the loginuid immutable. This prevents tampering with the auid. --loginuid-immutable Load new Audit rules into kernel by running: augenrules --load	If modification of login UIDs is not prevented, they can be changed by unprivileged users and make auditing complicated or impossible.
CCE-83675-9	Configure auditing of unsuccessful ownership changes	Ensure that unsuccessful attempts to change an ownership of files or directories are audited. The following rules configure audit as described above: ## Unsuccessful ownership change -a always,exit -F arch=b32 -S lchown,fchown,chown,fchownat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-owner-change -a always,exit -F arch=b64 -S lchown,fchown,chown,fchownat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-owner-change -a always,exit -F arch=b32 -S lchown,fchown,chown,fchownat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-owner-change -a always,exit -F arch=b64 -S lchown,fchown,chown,fchownat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-owner-change Load new Audit rules into kernel by running: augenrules --load Note: This rule uses a special set of Audit rules to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are aligned with your needs.	Unsuccessful attempts to change an ownership of files or directories might be signs of a malicious activity. Having such events audited helps in monitoring and investigation of such activities.
CCE-83676-7	Configure auditing of unsuccessful permission changes	Ensure that unsuccessful attempts to change file or directory permissions are audited. The following rules configure audit as described above: ## Unsuccessful permission change -a always,exit -F arch=b32 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-perm-change -a always,exit -F arch=b64 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-perm-change -a always,exit -F arch=b32 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-perm-change -a always,exit -F arch=b64 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-perm-change Load new Audit rules into kernel by running: augenrules --load Note: This rule uses a special set of Audit rules to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are aligned with your needs.	Unsuccessful attempts to change permissions of files or directories might be signs of malicious activity. Having such events audited helps in monitoring and investigation of such activities.
CCE-83678-3	Configure auditing of successful permission changes	Ensure that successful attempts to modify permissions of files or directories are audited. The following rules configure audit as described above: ## Successful permission change -a always,exit -F arch=b32 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change -a always,exit -F arch=b64 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change Load new Audit rules into kernel by running: augenrules --load Note: This rule uses a special set of Audit rules to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are aligned with your needs.	Auditing successful file or directory permission changes helps in monitoring and investigating of activities performed on the system.
CCE-83680-9	Configure auditing of successful file deletions	Ensure that successful attempts to delete a file are audited. The following rules configure audit as described above: ## Successful file delete -a always,exit -F arch=b32 -S unlink,unlinkat,rename,renameat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-delete -a always,exit -F arch=b64 -S unlink,unlinkat,rename,renameat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-delete Load new Audit rules into kernel by running: augenrules --load Note: This rule uses a special set of Audit rules to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are aligned with your needs.	Auditing of successful attempts to delete a file may help in monitoring and investigation of activities performed on the system.
CCE-83681-7	Configure auditing of successful file modifications	Ensure that successful attempts to modify a file are audited. The following rules configure audit as described above: ## Successful file modifications (open for write or truncate) -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&01003 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-modification -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&01003 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-modification -a always,exit -F arch=b32 -S open -F a1&01003 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-modification -a always,exit -F arch=b64 -S open -F a1&01003 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-modification -a always,exit -F arch=b32 -S truncate,ftruncate -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-modification -a always,exit -F arch=b64 -S truncate,ftruncate -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-modification Load new Audit rules into kernel by running: augenrules --load Note: This rule uses a special set of Audit rules to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are aligned with your needs.	Auditing of successful attempts to modify a file helps in investigation of actions which happened on the system.
CCE-83682-5	Include Local Events in Audit Logs	To configure Audit daemon to include local events in Audit logs, set `local_events` to `yes` in `/etc/audit/auditd.conf`. This is the default setting.	If option `local_events` isn't set to `yes` only events from network will be aggregated.
CCE-83683-3	Configure auditd Max Log File Size	Determine the amount of audit data (in megabytes) which should be retained in each log file. Edit the file `/etc/audit/auditd.conf`. Add or modify the following line, substituting the correct value of `6` for STOREMB: max_log_file = STOREMB Set the value to `6` (MB) or higher for general-purpose systems. Larger values, of course, support retention of even more audit data.	The total storage for audit log files must be large enough to retain log information over the period required. This is a function of the maximum log file size and the number of logs retained.
CCE-83684-1	Configure auditd Disk Full Action when Disk Space Is Full	The `auditd` service can be configured to take an action when disk space is running low but prior to running out of space completely. Edit the file `/etc/audit/auditd.conf`. Add or modify the following line, substituting ACTION appropriately: disk_full_action = ACTION Set this value to `single` to cause the system to switch to single-user mode for corrective action. Acceptable values also include `syslog`, `exec`, `single`, and `halt` For certain systems, the need for availability outweighs the need to log all actions, and a different setting should be determined. Details regarding all possible values for ACTION are described in the `auditd.conf` man page.	Taking appropriate action in case of a filled audit storage volume will minimize the possibility of losing audit records.
CCE-83685-8	Configure auditd flush priority	The `auditd` service can be configured to synchronously write audit event data to disk. Add or correct the following line in `/etc/audit/auditd.conf` to ensure that audit event data is fully synchronized with the log files on the disk: flush = `data`	Audit data should be synchronously written to disk to ensure log integrity. These parameters assure that all audit event data is fully synchronized with the log files on the disk.
CCE-83686-6	Set type of computer node name logging in audit logs	To configure Audit daemon to use a unique identifier as computer node name in the audit events, set `name_format` to `hostname` in `/etc/audit/auditd.conf`.	If option `name_format` is left at its default value of `none`, audit events from different computers may be hard to distinguish.
CCE-83688-2	Configure auditd Number of Logs Retained	Determine how many log files `auditd` should retain when it rotates logs. Edit the file `/etc/audit/auditd.conf`. Add or modify the following line, substituting NUMLOGS with the correct value of `5`: num_logs = NUMLOGS Set the value to 5 for general-purpose systems. Note that values less than 2 result in no log rotation.	The total storage for audit log files must be large enough to retain log information over the period required. This is a function of the maximum log file size and the number of logs retained.
CCE-83689-0	Ensure System Log Files Have Correct Permissions	The file permissions for all log files written by `rsyslog` should be set to 640, or more restrictive. These log files are determined by the second part of each Rule line in `/etc/rsyslog.conf` and typically all appear in `/var/log`. For each log file LOGFILE referenced in `/etc/rsyslog.conf`, run the following command to inspect the file's permissions: $ ls -l LOGFILE If the permissions are not 640 or more restrictive, run the following command to correct this: $ sudo chmod 640 LOGFILE "	Log files can contain valuable information regarding system configuration. If the system log files are not protected unauthorized users could change the logged data, eliminating their forensic value.
CCE-83690-8	Configure auditd Disk Error Action on Disk Error	The `auditd` service can be configured to take an action when there is a disk error. Edit the file `/etc/audit/auditd.conf`. Add or modify the following line, substituting ACTION appropriately: disk_error_action = ACTION Set this value to `single` to cause the system to switch to single-user mode for corrective action. Acceptable values also include `syslog`, `exec`, `single`, and `halt` For certain systems, the need for availability outweighs the need to log all actions, and a different setting should be determined. Details regarding all possible values for ACTION are described in the `auditd.conf` man page.	Taking appropriate action in case of disk errors will minimize the possibility of losing audit records.
CCE-83695-7	Configure auditd to use audispd's syslog plugin	To configure the `auditd` service to use the `syslog` plug-in of the `audispd` audit event multiplexor, set the `active` line in `/etc/audit/plugins.d/syslog.conf` to `yes`. Restart the `auditd` service: $ sudo service auditd restart	The auditd service does not include the ability to send audit records to a centralized server for management directly. It does, however, include a plug-in for audit event multiplexor (audispd) to pass audit records to the local syslog server.
CCE-83696-5	Resolve information before writing to audit logs	To configure Audit daemon to resolve all uid, gid, syscall, architecture, and socket address information before writing the events to disk, set `log_format` to `ENRICHED` in `/etc/audit/auditd.conf`.	If option `log_format` isn't set to `ENRICHED`, the audit records will be stored in a format exactly as the kernel sends them.
CCE-83698-1	Configure auditd mail_acct Action on Low Disk Space	The `auditd` service can be configured to send email to a designated account in certain situations. Add or correct the following line in `/etc/audit/auditd.conf` to ensure that administrators are notified via email for those situations: action_mail_acct = `root`	Email sent to the root account is typically aliased to the administrators of the system, who can take appropriate action.
CCE-83700-5	Configure auditd admin_space_left Action on Low Disk Space	The `auditd` service can be configured to take an action when disk space is running low but prior to running out of space completely. Edit the file `/etc/audit/auditd.conf`. Add or modify the following line, substituting ACTION appropriately: admin_space_left_action = ACTION Set this value to `single` to cause the system to switch to single user mode for corrective action. Acceptable values also include `suspend` and `halt`. For certain systems, the need for availability outweighs the need to log all actions, and a different setting should be determined. Details regarding all possible values for ACTION are described in the `auditd.conf` man page.	Administrators should be made aware of an inability to record audit records. If a separate partition or logical volume of adequate size is used, running low on space for audit records should never occur.
CCE-83701-3	Configure auditd max_log_file_action Upon Reaching Maximum Log Size	The default action to take when the logs reach their maximum size is to rotate the log files, discarding the oldest one. To configure the action taken by `auditd`, add or correct the line in `/etc/audit/auditd.conf`: max_log_file_action = ACTION Possible values for ACTION are described in the `auditd.conf` man page. These include: `ignore` `syslog` `suspend` `rotate` `keep_logs` Set the `ACTION` to `rotate`. The setting is case-insensitive.	Automatically rotating logs (by setting this to `rotate`) minimizes the chances of the system unexpectedly running out of disk space by being overwhelmed with log data. However, for systems that must never discard log data, or which use external processes to transfer it and reclaim space, `keep_logs` can be employed.
CCE-83703-9	Configure auditd space_left Action on Low Disk Space	The `auditd` service can be configured to take an action when disk space starts to run low. Edit the file `/etc/audit/auditd.conf`. Modify the following line, substituting ACTION appropriately: space_left_action = ACTION Possible values for ACTION are described in the `auditd.conf` man page. These include: `syslog` `email` `exec` `suspend` `single` `halt` Set this to `email` (instead of the default, which is `suspend`) as it is more likely to get prompt attention. Acceptable values also include `suspend`, `single`, and `halt`.	Notifying administrators of an impending disk space problem may allow them to take corrective action prior to any disruption.
CCE-83704-7	Set number of records to cause an explicit flush to audit logs	To configure Audit daemon to issue an explicit flush to disk command after writing `50` records, set `freq` to `50` in `/etc/audit/auditd.conf`.	If option `freq` isn't set to , the flush to disk may happen after higher number of records, increasing the danger of audit loss.
CCE-83705-4	Write Audit Logs to the Disk	To configure Audit daemon to write Audit logs to the disk, set `write_logs` to `yes` in `/etc/audit/auditd.conf`. This is the default setting.	If `write_logs` isn't set to `yes`, the Audit logs will not be written to the disk.
CCE-83706-2	Record Events that Modify the System's Network Environment	If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`, setting ARCH to either b32 for 32-bit system, or having two lines for both b32 and b64 in case your system is 64-bit: -a always,exit -F arch=ARCH -S sethostname,setdomainname -F key=audit_rules_networkconfig_modification -w /etc/issue -p wa -k audit_rules_networkconfig_modification -w /etc/issue.net -p wa -k audit_rules_networkconfig_modification -w /etc/hosts -p wa -k audit_rules_networkconfig_modification -w /etc/sysconfig/network -p wa -k audit_rules_networkconfig_modification If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file, setting ARCH to either b32 for 32-bit system, or having two lines for both b32 and b64 in case your system is 64-bit: -a always,exit -F arch=ARCH -S sethostname,setdomainname -F key=audit_rules_networkconfig_modification -w /etc/issue -p wa -k audit_rules_networkconfig_modification -w /etc/issue.net -p wa -k audit_rules_networkconfig_modification -w /etc/hosts -p wa -k audit_rules_networkconfig_modification -w /etc/sysconfig/network -p wa -k audit_rules_networkconfig_modification	The network environment should not be modified by anything other than administrator action. Any change to network parameters should be audited.
CCE-83709-6	Shutdown System When Auditing Failures Occur	If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following line to to the bottom of a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -f `2` If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following line to the bottom of the `/etc/audit/audit.rules` file: -f `2`	It is critical for the appropriate personnel to be aware if a system is at risk of failing to process audit logs as required. Without this notification, the security personnel may be unaware of an impending failure of the audit capability, and system operation may be adversely affected. Audit processing failures include software/hardware errors, failures in the audit capturing mechanisms, and audit storage capacity being reached or exceeded.
CCE-83712-0	Record Events that Modify User/Group Information - /etc/security/opasswd	If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -w /etc/security/opasswd -p wa -k audit_rules_usergroup_modification If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules`: -w /etc/security/opasswd -p wa -k audit_rules_usergroup_modification	In addition to auditing new user and group accounts, these watches will alert the system administrator(s) to any modifications. Any unexpected users, groups, or modifications should be investigated for legitimacy.
CCE-83713-8	Record Attempts to Alter Process and Session Initiation Information	The audit system already collects process information for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d` in order to watch for attempted manual edits of files involved in storing such process information: -w /var/run/utmp -p wa -k session -w /var/log/btmp -p wa -k session -w /var/log/wtmp -p wa -k session If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file in order to watch for attempted manual edits of files involved in storing such process information: -w /var/run/utmp -p wa -k session -w /var/log/btmp -p wa -k session -w /var/log/wtmp -p wa -k session	Manual editing of these files may indicate nefarious activity, such as an attacker attempting to remove evidence of an intrusion.
CCE-83714-6	Record Events that Modify User/Group Information - /etc/passwd	If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -w /etc/passwd -p wa -k audit_rules_usergroup_modification If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules`: -w /etc/passwd -p wa -k audit_rules_usergroup_modification	In addition to auditing new user and group accounts, these watches will alert the system administrator(s) to any modifications. Any unexpected users, groups, or modifications should be investigated for legitimacy.
CCE-83715-3	Record Events that Modify User/Group Information	If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`, in order to capture events that modify account changes: -w /etc/group -p wa -k audit_rules_usergroup_modification -w /etc/passwd -p wa -k audit_rules_usergroup_modification -w /etc/gshadow -p wa -k audit_rules_usergroup_modification -w /etc/shadow -p wa -k audit_rules_usergroup_modification -w /etc/security/opasswd -p wa -k audit_rules_usergroup_modification If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file, in order to capture events that modify account changes: -w /etc/group -p wa -k audit_rules_usergroup_modification -w /etc/passwd -p wa -k audit_rules_usergroup_modification -w /etc/gshadow -p wa -k audit_rules_usergroup_modification -w /etc/shadow -p wa -k audit_rules_usergroup_modification -w /etc/security/opasswd -p wa -k audit_rules_usergroup_modification	In addition to auditing new user and group accounts, these watches will alert the system administrator(s) to any modifications. Any unexpected users, groups, or modifications should be investigated for legitimacy.
CCE-83716-1	Make the auditd Configuration Immutable	If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following line to a file with suffix `.rules` in the directory `/etc/audit/rules.d` in order to make the auditd configuration immutable: -e 2 If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following line to `/etc/audit/audit.rules` file in order to make the auditd configuration immutable: -e 2 With this setting, a reboot will be required to change any audit rules.	Making the audit configuration immutable prevents accidental as well as malicious modification of the audit rules, although it may be problematic if legitimate changes are needed during system operation.
CCE-83720-3	System Audit Logs Must Have Mode 0640 or Less Permissive	Determine where the audit logs are stored with the following command: $ sudo grep -iw log_file /etc/audit/auditd.conf log_file = /var/log/audit/audit.log Configure the audit log to be protected from unauthorized read access by setting the correct permissive mode with the following command: $ sudo chmod 0600 audit_log_file By default, audit_log_file is "/var/log/audit/audit.log".	If users can write to audit logs, audit trails can be modified or destroyed.
CCE-83721-1	Record Events that Modify the System's Mandatory Access Controls	If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -w /etc/selinux/ -p wa -k MAC-policy If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following line to `/etc/audit/audit.rules` file: -w /etc/selinux/ -p wa -k MAC-policy	The system's mandatory access policy (SELinux or Apparmor) should not be arbitrarily changed by anything other than administrator action. All changes to MAC policy should be audited.
CCE-83722-9	Record Events that Modify User/Group Information - /etc/group	If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -w /etc/group -p wa -k audit_rules_usergroup_modification If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules`: -w /etc/group -p wa -k audit_rules_usergroup_modification	In addition to auditing new user and group accounts, these watches will alert the system administrator(s) to any modifications. Any unexpected users, groups, or modifications should be investigated for legitimacy.
CCE-83723-7	Record Events that Modify User/Group Information - /etc/gshadow	If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -w /etc/gshadow -p wa -k audit_rules_usergroup_modification If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules`: -w /etc/gshadow -p wa -k audit_rules_usergroup_modification	In addition to auditing new user and group accounts, these watches will alert the system administrator(s) to any modifications. Any unexpected users, groups, or modifications should be investigated for legitimacy.
CCE-83725-2	Record Events that Modify User/Group Information - /etc/shadow	If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -w /etc/shadow -p wa -k audit_rules_usergroup_modification If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules`: -w /etc/shadow -p wa -k audit_rules_usergroup_modification	In addition to auditing new user and group accounts, these watches will alert the system administrator(s) to any modifications. Any unexpected users, groups, or modifications should be investigated for legitimacy.
CCE-83726-0	System Audit Logs Must Be Owned By Root	All audit logs must be owned by root user and group. By default, the path for audit log is /var/log/audit/ . To properly set the owner of `/var/log/audit`, run the command: $ sudo chown root /var/log/audit To properly set the owner of `/var/log/audit/`, run the command: $ sudo chown root /var/log/audit/	Unauthorized disclosure of audit records can reveal system and configuration data to attackers, thus compromising its confidentiality.
CCE-83729-4	Ensure auditd Collects System Administrator Actions	If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -w /etc/sudoers -p wa -k actions If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules`: -w /etc/sudoers -p wa -k actions If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -w /etc/sudoers.d/ -p wa -k actions If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules`: -w /etc/sudoers.d/ -p wa -k actions	The actions taken by system administrators should be audited to keep a record of what was executed on the system, as well as, for accountability purposes.
CCE-83734-4	System Audit Logs Must Have Mode 0750 or Less Permissive	If `log_group` in `/etc/audit/auditd.conf` is set to a group other than the `root` group account, change the mode of the audit log files with the following command: $ sudo chmod 0750 /var/log/audit Otherwise, change the mode of the audit log files with the following command: $ sudo chmod 0700 /var/log/audit	If users can write to audit logs, audit trails can be modified or destroyed.
CCE-83735-1	Ensure auditd Collects Information on Exporting to Media (successful)	At a minimum, the audit system should collect media exportation events for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`, setting ARCH to either b32 for 32-bit system, or having two lines for both b32 and b64 in case your system is 64-bit: -a always,exit -F arch=ARCH -S mount -F auid>=1000 -F auid!=unset -F key=export If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following line to `/etc/audit/audit.rules` file, setting ARCH to either b32 for 32-bit system, or having two lines for both b32 and b64 in case your system is 64-bit: -a always,exit -F arch=ARCH -S mount -F auid>=1000 -F auid!=unset -F key=export	The unauthorized exportation of data to external media could result in an information leak where classified information, Privacy Act information, and intellectual property could be lost. An audit trail should be created each time a filesystem is mounted to help identify and guard against information loss.
CCE-83736-9	Record Any Attempts to Run setfiles	At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -a always,exit -F path=/usr/sbin/setfiles -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`: -a always,exit -F path=/usr/sbin/setfiles -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged	Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider and advanced persistent threats. Privileged programs are subject to escalation-of-privilege attacks, which attempt to subvert their normal role of providing some necessary but limited capability. As such, motivation exists to monitor these programs for unusual activity.
CCE-83746-8	Record Any Attempts to Run seunshare	At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -a always,exit -F path=/usr/sbin/seunshare -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`: -a always,exit -F path=/usr/sbin/seunshare -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged	Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider and advanced persistent threats. Privileged programs are subject to escalation-of-privilege attacks, which attempt to subvert their normal role of providing some necessary but limited capability. As such, motivation exists to monitor these programs for unusual activity.
CCE-83748-4	Record Any Attempts to Run chcon	At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -a always,exit -F path=/usr/bin/chcon -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`: -a always,exit -F path=/usr/bin/chcon -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged	Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider and advanced persistent threats. Privileged programs are subject to escalation-of-privilege attacks, which attempt to subvert their normal role of providing some necessary but limited capability. As such, motivation exists to monitor these programs for unusual activity.
CCE-83749-2	Record Any Attempts to Run restorecon	At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -a always,exit -F path=/usr/sbin/restorecon -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`: -a always,exit -F path=/usr/sbin/restorecon -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged	Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider and advanced persistent threats. Privileged programs are subject to escalation-of-privilege attacks, which attempt to subvert their normal role of providing some necessary but limited capability. As such, motivation exists to monitor these programs for unusual activity.
CCE-83750-0	Record Any Attempts to Run semanage	At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -a always,exit -F path=/usr/sbin/semanage -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`: -a always,exit -F path=/usr/sbin/semanage -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged	Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider and advanced persistent threats. Privileged programs are subject to escalation-of-privilege attacks, which attempt to subvert their normal role of providing some necessary but limited capability. As such, motivation exists to monitor these programs for unusual activity.
CCE-83751-8	Record Any Attempts to Run setsebool	At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -a always,exit -F path=/usr/sbin/setsebool -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`: -a always,exit -F path=/usr/sbin/setsebool -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged	Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider and advanced persistent threats. Privileged programs are subject to escalation-of-privilege attacks, which attempt to subvert their normal role of providing some necessary but limited capability. As such, motivation exists to monitor these programs for unusual activity.
CCE-83752-6	Ensure auditd Collects File Deletion Events by User	At a minimum the audit system should collect file deletion events for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`, setting ARCH to either b32 for 32-bit system, or having two lines for both b32 and b64 in case your system is 64-bit: -a always,exit -F arch=ARCH -S rmdir,unlink,unlinkat,rename,renameat,renameat2 -F auid>=1000 -F auid!=unset -F key=delete If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following line to `/etc/audit/audit.rules` file, setting ARCH to either b32 for 32-bit system, or having two lines for both b32 and b64 in case your system is 64-bit: -a always,exit -F arch=ARCH -S rmdir,unlink,unlinkat,rename,renameat2 -S renameat -F auid>=1000 -F auid!=unset -F key=delete	Auditing file deletions will create an audit trail for files that are removed from the system. The audit trail could aid in system troubleshooting, as well as, detecting malicious processes that attempt to delete log files to conceal their presence.
CCE-83754-2	Ensure auditd Collects File Deletion Events by User - rename	At a minimum, the audit system should collect file deletion events for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`, setting ARCH to either b32 for 32-bit system, or having two lines for both b32 and b64 in case your system is 64-bit: -a always,exit -F arch=ARCH -S rename -F auid>=1000 -F auid!=unset -F key=delete If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following line to `/etc/audit/audit.rules` file, setting ARCH to either b32 for 32-bit system, or having two lines for both b32 and b64 in case your system is 64-bit: -a always,exit -F arch=ARCH -S rename -F auid>=1000 -F auid!=unset -F key=delete	Auditing file deletions will create an audit trail for files that are removed from the system. The audit trail could aid in system troubleshooting, as well as, detecting malicious processes that attempt to delete log files to conceal their presence.
CCE-83755-9	Ensure auditd Collects File Deletion Events by User - unlinkat	At a minimum, the audit system should collect file deletion events for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`, setting ARCH to either b32 for 32-bit system, or having two lines for both b32 and b64 in case your system is 64-bit: -a always,exit -F arch=ARCH -S unlinkat -F auid>=1000 -F auid!=unset -F key=delete If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following line to `/etc/audit/audit.rules` file, setting ARCH to either b32 for 32-bit system, or having two lines for both b32 and b64 in case your system is 64-bit: -a always,exit -F arch=ARCH -S unlinkat -F auid>=1000 -F auid!=unset -F key=delete	Auditing file deletions will create an audit trail for files that are removed from the system. The audit trail could aid in system troubleshooting, as well as, detecting malicious processes that attempt to delete log files to conceal their presence.
CCE-83756-7	Ensure auditd Collects File Deletion Events by User - renameat	At a minimum, the audit system should collect file deletion events for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`, setting ARCH to either b32 for 32-bit system, or having two lines for both b32 and b64 in case your system is 64-bit: -a always,exit -F arch=ARCH -S renameat -F auid>=1000 -F auid!=unset -F key=delete If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following line to `/etc/audit/audit.rules` file, setting ARCH to either b32 for 32-bit system, or having two lines for both b32 and b64 in case your system is 64-bit: -a always,exit -F arch=ARCH -S renameat -F auid>=1000 -F auid!=unset -F key=delete	Auditing file deletions will create an audit trail for files that are removed from the system. The audit trail could aid in system troubleshooting, as well as, detecting malicious processes that attempt to delete log files to conceal their presence.
CCE-83757-5	Ensure auditd Collects File Deletion Events by User - unlink	At a minimum, the audit system should collect file deletion events for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`, setting ARCH to either b32 for 32-bit system, or having two lines for both b32 and b64 in case your system is 64-bit: -a always,exit -F arch=ARCH -S unlink -F auid>=1000 -F auid!=unset -F key=delete If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following line to `/etc/audit/audit.rules` file, setting ARCH to either b32 for 32-bit system, or having two lines for both b32 and b64 in case your system is 64-bit: -a always,exit -F arch=ARCH -S unlink -F auid>=1000 -F auid!=unset -F key=delete	Auditing file deletions will create an audit trail for files that are removed from the system. The audit trail could aid in system troubleshooting, as well as, detecting malicious processes that attempt to delete log files to conceal their presence.
CCE-83758-3	Ensure auditd Collects File Deletion Events by User - rmdir	At a minimum, the audit system should collect file deletion events for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`, setting ARCH to either b32 for 32-bit system, or having two lines for both b32 and b64 in case your system is 64-bit: -a always,exit -F arch=ARCH -S rmdir -F auid>=1000 -F auid!=unset -F key=delete If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following line to `/etc/audit/audit.rules` file, setting ARCH to either b32 for 32-bit system, or having two lines for both b32 and b64 in case your system is 64-bit: -a always,exit -F arch=ARCH -S rmdir -F auid>=1000 -F auid!=unset -F key=delete	Auditing file deletions will create an audit trail for files that are removed from the system. The audit trail could aid in system troubleshooting, as well as, detecting malicious processes that attempt to delete log files to conceal their presence.
CCE-83759-1	Ensure auditd Collects Information on the Use of Privileged Commands	The audit system should collect information about usage of privileged commands for all users. These are commands with suid or sgid bits on and they are specially risky in local block device partitions not mounted with noexec and nosuid options. Therefore, these partitions should be first identified by the following command: findmnt -n -l -k -it $(awk '/nodev/ { print $2 }' /proc/filesystems \| paste -sd,) \| grep -Pv "noexec\|nosuid" For all partitions listed by the previous command, it is necessary to search for setuid / setgid programs using the following command: $ sudo find PARTITION -xdev -perm /6000 -type f 2>/dev/null For each setuid / setgid program identified by the previous command, an audit rule must be present in the appropriate place using the following line structure, setting ARCH to either b32 for 32-bit system, or having two lines for both b32 and b64 in case your system is 64-bit: -a always,exit -F arch=ARCH -F path=PROG_PATH -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup, add the line to a file with suffix `.rules` in the `/etc/audit/rules.d` directory, replacing the PROG_PATH part with the full path of that setuid / setgid identified program. If the `auditd` daemon is configured to use the `auditctl` utility instead, add the line to the `/etc/audit/audit.rules` file, also replacing the PROG_PATH part with the full path of that setuid / setgid identified program.	Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised system accounts, is a serious and ongoing concern that can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider and advanced persistent threats. Privileged programs are subject to escalation-of-privilege attacks, which attempt to subvert their normal role of providing some necessary but limited capability. As such, motivation exists to monitor these programs for unusual activity.
CCE-83760-9	Ensure auditd Collects Information on the Use of Privileged Commands - userhelper	At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -a always,exit -F path=/usr/sbin/userhelper -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`: -a always,exit -F path=/usr/sbin/userhelper -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged	Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider and advanced persistent threats. Privileged programs are subject to escalation-of-privilege attacks, which attempt to subvert their normal role of providing some necessary but limited capability. As such, motivation exists to monitor these programs for unusual activity.
CCE-83761-7	Ensure auditd Collects Information on the Use of Privileged Commands - crontab	At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -a always,exit -F path=/usr/bin/crontab -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`: -a always,exit -F path=/usr/bin/crontab -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged	Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider and advanced persistent threats. Privileged programs are subject to escalation-of-privilege attacks, which attempt to subvert their normal role of providing some necessary but limited capability. As such, motivation exists to monitor these programs for unusual activity.
CCE-83762-5	Ensure auditd Collects Information on the Use of Privileged Commands - umount	At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -a always,exit -F path=/usr/bin/umount -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`: -a always,exit -F path=/usr/bin/umount -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged	Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider and advanced persistent threats. Privileged programs are subject to escalation-of-privilege attacks, which attempt to subvert their normal role of providing some necessary but limited capability. As such, motivation exists to monitor these programs for unusual activity.
CCE-83763-3	Ensure auditd Collects Information on the Use of Privileged Commands - chsh	At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -a always,exit -F path=/usr/bin/chsh -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`: -a always,exit -F path=/usr/bin/chsh -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged	Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider and advanced persistent threats. Privileged programs are subject to escalation-of-privilege attacks, which attempt to subvert their normal role of providing some necessary but limited capability. As such, motivation exists to monitor these programs for unusual activity.
CCE-83764-1	Ensure auditd Collects Information on the Use of Privileged Commands - sudoedit	At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -a always,exit -F path=/usr/bin/sudoedit -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`: -a always,exit -F path=/usr/bin/sudoedit -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged	Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider and advanced persistent threats. Privileged programs are subject to escalation-of-privilege attacks, which attempt to subvert their normal role of providing some necessary but limited capability. As such, motivation exists to monitor these programs for unusual activity.
CCE-83765-8	Ensure auditd Collects Information on the Use of Privileged Commands - chage	At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -a always,exit -F path=/usr/bin/chage -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`: -a always,exit -F path=/usr/bin/chage -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged	Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider and advanced persistent threats. Privileged programs are subject to escalation-of-privilege attacks, which attempt to subvert their normal role of providing some necessary but limited capability. As such, motivation exists to monitor these programs for unusual activity.
CCE-83766-6	Ensure auditd Collects Information on the Use of Privileged Commands - newgrp	At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -a always,exit -F path=/usr/bin/newgrp -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`: -a always,exit -F path=/usr/bin/newgrp -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged	Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider and advanced persistent threats. Privileged programs are subject to escalation-of-privilege attacks, which attempt to subvert their normal role of providing some necessary but limited capability. As such, motivation exists to monitor these programs for unusual activity.
CCE-83767-4	Ensure auditd Collects Information on the Use of Privileged Commands - pam_timestamp_check	At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -a always,exit -F path=/usr/sbin/pam_timestamp_check -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`: -a always,exit -F path=/usr/sbin/pam_timestamp_check -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged	Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider and advanced persistent threats. Privileged programs are subject to escalation-of-privilege attacks, which attempt to subvert their normal role of providing some necessary but limited capability. As such, motivation exists to monitor these programs for unusual activity.
CCE-83768-2	Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd	At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -a always,exit -F path=/sbin/unix_chkpwd -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`: -a always,exit -F path=/sbin/unix_chkpwd -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged	Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider and advanced persistent threats. Privileged programs are subject to escalation-of-privilege attacks, which attempt to subvert their normal role of providing some necessary but limited capability. As such, motivation exists to monitor these programs for unusual activity.
CCE-83769-0	Ensure auditd Collects Information on the Use of Privileged Commands - postdrop	At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -a always,exit -F path=/usr/sbin/postdrop -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`: -a always,exit -F path=/usr/sbin/postdrop -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged	Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider and advanced persistent threats. Privileged programs are subject to escalation-of-privilege attacks, which attempt to subvert their normal role of providing some necessary but limited capability. As such, motivation exists to monitor these programs for unusual activity.
CCE-83770-8	Ensure auditd Collects Information on the Use of Privileged Commands - postqueue	At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -a always,exit -F path=/usr/sbin/postqueue -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`: -a always,exit -F path=/usr/sbin/postqueue -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged	Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider and advanced persistent threats. Privileged programs are subject to escalation-of-privilege attacks, which attempt to subvert their normal role of providing some necessary but limited capability. As such, motivation exists to monitor these programs for unusual activity.
CCE-83771-6	Ensure auditd Collects Information on the Use of Privileged Commands - su	At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -a always,exit -F path=/usr/bin/su -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`: -a always,exit -F path=/usr/bin/su -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged	Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider and advanced persistent threats. Privileged programs are subject to escalation-of-privilege attacks, which attempt to subvert their normal role of providing some necessary but limited capability. As such, motivation exists to monitor these programs for unusual activity.
CCE-83773-2	Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd	At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -a always,exit -F path=/usr/bin/gpasswd -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`: -a always,exit -F path=/usr/bin/gpasswd -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged	Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider and advanced persistent threats. Privileged programs are subject to escalation-of-privilege attacks, which attempt to subvert their normal role of providing some necessary but limited capability. As such, motivation exists to monitor these programs for unusual activity.
CCE-83776-5	Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign	At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -a always,exit -F path=/usr/libexec/openssh/ssh-keysign -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`: -a always,exit -F path=/usr/libexec/openssh/ssh-keysign -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged	Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider and advanced persistent threats. Privileged programs are subject to escalation-of-privilege attacks, which attempt to subvert their normal role of providing some necessary but limited capability. As such, motivation exists to monitor these programs for unusual activity.
CCE-83780-7	Ensure auditd Collects Information on the Use of Privileged Commands - sudo	At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -a always,exit -F path=/usr/bin/sudo -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`: -a always,exit -F path=/usr/bin/sudo -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged	Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider and advanced persistent threats. Privileged programs are subject to escalation-of-privilege attacks, which attempt to subvert their normal role of providing some necessary but limited capability. As such, motivation exists to monitor these programs for unusual activity.
CCE-83781-5	Ensure auditd Collects Information on the Use of Privileged Commands - passwd	At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -a always,exit -F path=/usr/bin/passwd -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`: -a always,exit -F path=/usr/bin/passwd -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged	Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider and advanced persistent threats. Privileged programs are subject to escalation-of-privilege attacks, which attempt to subvert their normal role of providing some necessary but limited capability. As such, motivation exists to monitor these programs for unusual activity.
CCE-83782-3	Record Attempts to Alter Logon and Logout Events - tallylog	The audit system already collects login information for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -w /var/log/tallylog -p wa -k logins If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules`: -w /var/log/tallylog -p wa -k logins	Manual editing of these files may indicate nefarious activity, such as an attacker attempting to remove evidence of an intrusion.
CCE-83783-1	Record Attempts to Alter Logon and Logout Events - faillock	The audit system already collects login information for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -w `/var/log/faillock` -p wa -k logins If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules`: -w `/var/log/faillock` -p wa -k logins	Manual editing of these files may indicate nefarious activity, such as an attacker attempting to remove evidence of an intrusion.
CCE-83784-9	Record Attempts to Alter Logon and Logout Events	The audit system already collects login information for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d` in order to watch for attempted manual edits of files involved in storing logon events: -w /var/log/tallylog -p wa -k logins -w `/var/log/faillock` -p wa -k logins -w /var/log/lastlog -p wa -k logins If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file in order to watch for unattempted manual edits of files involved in storing logon events: -w /var/log/tallylog -p wa -k logins -w `/var/log/faillock` -p wa -k logins -w /var/log/lastlog -p wa -k logins	Manual editing of these files may indicate nefarious activity, such as an attacker attempting to remove evidence of an intrusion.
CCE-83785-6	Record Attempts to Alter Logon and Logout Events - lastlog	The audit system already collects login information for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -w /var/log/lastlog -p wa -k logins If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules`: -w /var/log/lastlog -p wa -k logins	Manual editing of these files may indicate nefarious activity, such as an attacker attempting to remove evidence of an intrusion.
CCE-83786-4	Record Unsuccessful Access Attempts to Files - creat	At a minimum, the audit system should collect unauthorized file accesses for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -a always,exit -F arch=b32 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access -a always,exit -F arch=b32 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access If the system is 64 bit then also add the following lines: -a always,exit -F arch=b64 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access -a always,exit -F arch=b64 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file: -a always,exit -F arch=b32 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access -a always,exit -F arch=b32 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access If the system is 64 bit then also add the following lines: -a always,exit -F arch=b64 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access -a always,exit -F arch=b64 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access	Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing these events could serve as evidence of potential system compromise.
CCE-83792-2	Record Unsuccessful Access Attempts to Files - truncate	At a minimum, the audit system should collect unauthorized file accesses for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -a always,exit -F arch=b32 -S truncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access -a always,exit -F arch=b32 -S truncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access If the system is 64 bit then also add the following lines: -a always,exit -F arch=b64 -S truncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access -a always,exit -F arch=b64 -S truncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file: -a always,exit -F arch=b32 -S truncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access -a always,exit -F arch=b32 -S truncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access If the system is 64 bit then also add the following lines: -a always,exit -F arch=b64 -S truncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access -a always,exit -F arch=b64 -S truncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access	Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing these events could serve as evidence of potential system compromise.
CCE-83793-0	Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)	At a minimum the audit system should collect unauthorized file accesses for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -a always,exit -F arch=b32 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access -a always,exit -F arch=b32 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access If the system is 64 bit then also add the following lines: -a always,exit -F arch=b64 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access -a always,exit -F arch=b64 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file: -a always,exit -F arch=b32 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access -a always,exit -F arch=b32 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access If the system is 64 bit then also add the following lines: -a always,exit -F arch=b64 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access -a always,exit -F arch=b64 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access	Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing these events could serve as evidence of potential system compromise.
CCE-83794-8	Record Unsuccessful Access Attempts to Files - openat	At a minimum, the audit system should collect unauthorized file accesses for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -a always,exit -F arch=b32 -S openat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access -a always,exit -F arch=b32 -S openat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access If the system is 64 bit then also add the following lines: -a always,exit -F arch=b64 -S openat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access -a always,exit -F arch=b64 -S openat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file: -a always,exit -F arch=b32 -S openat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access -a always,exit -F arch=b32 -S openat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access If the system is 64 bit then also add the following lines: -a always,exit -F arch=b64 -S openat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access -a always,exit -F arch=b64 -S openat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access	Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing these events could serve as evidence of potential system compromise.
CCE-83796-3	Record Unsuccessful Access Attempts to Files - open_by_handle_at	At a minimum, the audit system should collect unauthorized file accesses for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -a always,exit -F arch=b32 -S open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access -a always,exit -F arch=b32 -S open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access If the system is 64 bit then also add the following lines: -a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access -a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file: -a always,exit -F arch=b32 -S open_by_handle_at,truncate,ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access -a always,exit -F arch=b32 -S open_by_handle_at,truncate,ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access If the system is 64 bit then also add the following lines: -a always,exit -F arch=b64 -S open_by_handle_at,truncate,ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access -a always,exit -F arch=b64 -S open_by_handle_at,truncate,ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access	Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing these events could serve as evidence of potential system compromise.
CCE-83800-3	Record Unsuccessful Access Attempts to Files - ftruncate	At a minimum, the audit system should collect unauthorized file accesses for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -a always,exit -F arch=b32 -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access -a always,exit -F arch=b32 -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access If the system is 64 bit then also add the following lines: -a always,exit -F arch=b64 -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access -a always,exit -F arch=b64 -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file: -a always,exit -F arch=b32 -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access -a always,exit -F arch=b32 -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access If the system is 64 bit then also add the following lines: -a always,exit -F arch=b64 -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access -a always,exit -F arch=b64 -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access	Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing these events could serve as evidence of potential system compromise.
CCE-83801-1	Record Unsuccessful Access Attempts to Files - open	At a minimum, the audit system should collect unauthorized file accesses for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -a always,exit -F arch=b32 -S open -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access -a always,exit -F arch=b32 -S open -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access If the system is 64 bit then also add the following lines: -a always,exit -F arch=b64 -S open -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access -a always,exit -F arch=b64 -S open -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file: -a always,exit -F arch=b32 -S open -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access -a always,exit -F arch=b32 -S open -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access If the system is 64 bit then also add the following lines: -a always,exit -F arch=b64 -S open -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access -a always,exit -F arch=b64 -S open -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access	Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing these events could serve as evidence of potential system compromise.
CCE-83802-9	Ensure auditd Collects Information on Kernel Module Unloading - delete_module	To capture kernel module loading and unloading events, use the following line, setting ARCH to either b32 for 32-bit system, or having two lines for both b32 and b64 in case your system is 64-bit: -a always,exit -F arch=ARCH -S delete_module -F auid>=1000 -F auid!=unset -F key=modules Place to add the line depends on a way `auditd` daemon is configured. If it is configured to use the `augenrules` program (the default), add the line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`. If the `auditd` daemon is configured to use the `auditctl` utility, add the line to file `/etc/audit/audit.rules`.	The removal of kernel modules can be used to alter the behavior of the kernel and potentially introduce malicious code into kernel space. It is important to have an audit trail of modules that have been introduced into the kernel.
CCE-83803-7	Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module	To capture kernel module loading and unloading events, use the following line, setting ARCH to either b32 for 32-bit system, or having two lines for both b32 and b64 in case your system is 64-bit: -a always,exit -F arch=ARCH -S finit_module -F auid>=1000 -F auid!=unset -F key=modules Place to add the line depends on a way `auditd` daemon is configured. If it is configured to use the `augenrules` program (the default), add the line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`. If the `auditd` daemon is configured to use the `auditctl` utility, add the line to file `/etc/audit/audit.rules`.	The addition/removal of kernel modules can be used to alter the behavior of the kernel and potentially introduce malicious code into kernel space. It is important to have an audit trail of modules that have been introduced into the kernel.
CCE-83804-5	Ensure auditd Collects Information on Kernel Module Loading and Unloading	To capture kernel module loading and unloading events, use following lines, setting ARCH to either b32 for 32-bit system, or having two lines for both b32 and b64 in case your system is 64-bit: -a always,exit -F arch=ARCH -S init_module,finit_module,delete_module -F auid>=1000 -F auid!=unset -F key=modules The place to add the lines depends on a way `auditd` daemon is configured. If it is configured to use the `augenrules` program (the default), add the lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`. If the `auditd` daemon is configured to use the `auditctl` utility, add the lines to file `/etc/audit/audit.rules`.	The addition/removal of kernel modules can be used to alter the behavior of the kernel and potentially introduce malicious code into kernel space. It is important to have an audit trail of modules that have been introduced into the kernel.
CCE-83807-8	Record Events that Modify the System's Discretionary Access Controls - removexattr	At a minimum, the audit system should collect file permission changes for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -a always,exit -F arch=b32 -S removexattr -F auid>=1000 -F auid!=unset -F key=perm_mod -a always,exit -F arch=b32 -S removexattr -F auid=0 -F key=perm_mod If the system is 64 bit then also add the following line: -a always,exit -F arch=b64 -S removexattr -F auid>=1000 -F auid!=unset -F key=perm_mod -a always,exit -F arch=b64 -S removexattr -F auid=0 -F key=perm_mod If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following line to `/etc/audit/audit.rules` file: -a always,exit -F arch=b32 -S removexattr -F auid>=1000 -F auid!=unset -F key=perm_mod -a always,exit -F arch=b32 -S removexattr -F auid=0 -F key=perm_mod If the system is 64 bit then also add the following line: -a always,exit -F arch=b64 -S removexattr -F auid>=1000 -F auid!=unset -F key=perm_mod -a always,exit -F arch=b64 -S removexattr -F auid=0 -F key=perm_mod	The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications can facilitate the identification of patterns of abuse among both authorized and unauthorized users.
CCE-83808-6	Record Events that Modify the System's Discretionary Access Controls - lsetxattr	At a minimum, the audit system should collect file permission changes for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -a always,exit -F arch=b32 -S lsetxattr -F auid>=1000 -F auid!=unset -F key=perm_mod -a always,exit -F arch=b32 -S lsetxattr -F auid=0 -F key=perm_mod If the system is 64 bit then also add the following line: -a always,exit -F arch=b64 -S lsetxattr -F auid>=1000 -F auid!=unset -F key=perm_mod -a always,exit -F arch=b64 -S lsetxattr -F auid=0 -F key=perm_mod If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following line to `/etc/audit/audit.rules` file: -a always,exit -F arch=b32 -S lsetxattr -F auid>=1000 -F auid!=unset -F key=perm_mod -a always,exit -F arch=b32 -S lsetxattr -F auid=0 -F key=perm_mod If the system is 64 bit then also add the following line: -a always,exit -F arch=b64 -S lsetxattr -F auid>=1000 -F auid!=unset -F key=perm_mod -a always,exit -F arch=b64 -S lsetxattr -F auid=0 -F key=perm_mod	The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications can facilitate the identification of patterns of abuse among both authorized and unauthorized users.
CCE-83811-0	Record Events that Modify the System's Discretionary Access Controls - setxattr	At a minimum, the audit system should collect file permission changes for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -a always,exit -F arch=b32 -S setxattr -F auid>=1000 -F auid!=unset -F key=perm_mod -a always,exit -F arch=b32 -S setxattr -F auid=0 -F key=perm_mod If the system is 64 bit then also add the following line: -a always,exit -F arch=b64 -S setxattr -F auid>=1000 -F auid!=unset -F key=perm_mod -a always,exit -F arch=b64 -S setxattr -F auid=0 -F key=perm_mod If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following line to `/etc/audit/audit.rules` file: -a always,exit -F arch=b32 -S setxattr -F auid>=1000 -F auid!=unset -F key=perm_mod -a always,exit -F arch=b32 -S setxattr -F auid=0 -F key=perm_mod If the system is 64 bit then also add the following line: -a always,exit -F arch=b64 -S setxattr -F auid>=1000 -F auid!=unset -F key=perm_mod -a always,exit -F arch=b64 -S setxattr -F auid=0 -F key=perm_mod	The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications can facilitate the identification of patterns of abuse among both authorized and unauthorized users.
CCE-83812-8	Record Events that Modify the System's Discretionary Access Controls - chown	At a minimum, the audit system should collect file permission changes for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -a always,exit -F arch=b32 -S chown -F auid>=1000 -F auid!=unset -F key=perm_mod If the system is 64 bit then also add the following line: -a always,exit -F arch=b64 -S chown -F auid>=1000 -F auid!=unset -F key=perm_mod If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following line to `/etc/audit/audit.rules` file: -a always,exit -F arch=b32 -S chown -F auid>=1000 -F auid!=unset -F key=perm_mod If the system is 64 bit then also add the following line: -a always,exit -F arch=b64 -S chown -F auid>=1000 -F auid!=unset -F key=perm_mod	The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications can facilitate the identification of patterns of abuse among both authorized and unauthorized users.
CCE-83814-4	Record Events that Modify the System's Discretionary Access Controls - lremovexattr	At a minimum, the audit system should collect file permission changes for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -a always,exit -F arch=b32 -S lremovexattr -F auid>=1000 -F auid!=unset -F key=perm_mod -a always,exit -F arch=b32 -S lremovexattr -F auid=0 -F key=perm_mod If the system is 64 bit then also add the following line: -a always,exit -F arch=b64 -S lremovexattr -F auid>=1000 -F auid!=unset -F key=perm_mod -a always,exit -F arch=b64 -S lremovexattr -F auid=0 -F key=perm_mod If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following line to `/etc/audit/audit.rules` file: -a always,exit -F arch=b32 -S lremovexattr -F auid>=1000 -F auid!=unset -F key=perm_mod -a always,exit -F arch=b32 -S lremovexattr -F auid=0 -F key=perm_mod If the system is 64 bit then also add the following line: -a always,exit -F arch=b64 -S lremovexattr -F auid>=1000 -F auid!=unset -F key=perm_mod -a always,exit -F arch=b64 -S lremovexattr -F auid=0 -F key=perm_mod	The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications can facilitate the identification of patterns of abuse among both authorized and unauthorized users.
CCE-83817-7	Record Events that Modify the System's Discretionary Access Controls - fsetxattr	At a minimum, the audit system should collect file permission changes for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -a always,exit -F arch=b32 -S fsetxattr -F auid>=1000 -F auid!=unset -F key=perm_mod -a always,exit -F arch=b32 -S fsetxattr -F auid=0 -F key=perm_mod If the system is 64 bit then also add the following line: -a always,exit -F arch=b64 -S fsetxattr -F auid>=1000 -F auid!=unset -F key=perm_mod -a always,exit -F arch=b64 -S fsetxattr -F auid=0 -F key=perm_mod If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following line to `/etc/audit/audit.rules` file: -a always,exit -F arch=b32 -S fsetxattr -F auid>=1000 -F auid!=unset -F key=perm_mod -a always,exit -F arch=b32 -S fsetxattr -F auid=0 -F key=perm_mod If the system is 64 bit then also add the following line: -a always,exit -F arch=b64 -S fsetxattr -F auid>=1000 -F auid!=unset -F key=perm_mod -a always,exit -F arch=b64 -S fsetxattr -F auid=0 -F key=perm_mod	The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications can facilitate the identification of patterns of abuse among both authorized and unauthorized users.
CCE-83821-9	Record Events that Modify the System's Discretionary Access Controls - fremovexattr	At a minimum, the audit system should collect file permission changes for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -a always,exit -F arch=b32 -S fremovexattr -F auid>=1000 -F auid!=unset -F key=perm_mod -a always,exit -F arch=b32 -S fremovexattr -F auid=0 -F key=perm_mod If the system is 64 bit then also add the following line: -a always,exit -F arch=b64 -S fremovexattr -F auid>=1000 -F auid!=unset -F key=perm_mod -a always,exit -F arch=b64 -S fremovexattr -F auid=0 -F key=perm_mod If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following line to `/etc/audit/audit.rules` file: -a always,exit -F arch=b32 -S fremovexattr -F auid>=1000 -F auid!=unset -F key=perm_mod -a always,exit -F arch=b32 -S fremovexattr -F auid=0 -F key=perm_mod If the system is 64 bit then also add the following line: -a always,exit -F arch=b64 -S fremovexattr -F auid>=1000 -F auid!=unset -F key=perm_mod -a always,exit -F arch=b64 -S fremovexattr -F auid=0 -F key=perm_mod	The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications can facilitate the identification of patterns of abuse among both authorized and unauthorized users.
CCE-83822-7	Record Events that Modify the System's Discretionary Access Controls - fchmodat	At a minimum, the audit system should collect file permission changes for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -a always,exit -F arch=b32 -S fchmodat -F auid>=1000 -F auid!=unset -F key=perm_mod If the system is 64 bit then also add the following line: -a always,exit -F arch=b64 -S fchmodat -F auid>=1000 -F auid!=unset -F key=perm_mod If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following line to `/etc/audit/audit.rules` file: -a always,exit -F arch=b32 -S fchmodat -F auid>=1000 -F auid!=unset -F key=perm_mod If the system is 64 bit then also add the following line: -a always,exit -F arch=b64 -S fchmodat -F auid>=1000 -F auid!=unset -F key=perm_mod	The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications can facilitate the identification of patterns of abuse among both authorized and unauthorized users.
CCE-83829-2	Record Events that Modify the System's Discretionary Access Controls - fchown	At a minimum, the audit system should collect file permission changes for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -a always,exit -F arch=b32 -S fchown -F auid>=1000 -F auid!=unset -F key=perm_mod If the system is 64 bit then also add the following line: -a always,exit -F arch=b64 -S fchown -F auid>=1000 -F auid!=unset -F key=perm_mod If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following line to `/etc/audit/audit.rules` file: -a always,exit -F arch=b32 -S fchown -F auid>=1000 -F auid!=unset -F key=perm_mod If the system is 64 bit then also add the following line: -a always,exit -F arch=b64 -S fchown -F auid>=1000 -F auid!=unset -F key=perm_mod	The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications can facilitate the identification of patterns of abuse among both authorized and unauthorized users.
CCE-83830-0	Record Events that Modify the System's Discretionary Access Controls - chmod	At a minimum, the audit system should collect file permission changes for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -a always,exit -F arch=b32 -S chmod -F auid>=1000 -F auid!=unset -F key=perm_mod If the system is 64 bit then also add the following line: -a always,exit -F arch=b64 -S chmod -F auid>=1000 -F auid!=unset -F key=perm_mod If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following line to `/etc/audit/audit.rules` file: -a always,exit -F arch=b32 -S chmod -F auid>=1000 -F auid!=unset -F key=perm_mod If the system is 64 bit then also add the following line: -a always,exit -F arch=b64 -S chmod -F auid>=1000 -F auid!=unset -F key=perm_mod	The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications can facilitate the identification of patterns of abuse among both authorized and unauthorized users.
CCE-83831-8	Record Events that Modify the System's Discretionary Access Controls - fchownat	At a minimum, the audit system should collect file permission changes for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -a always,exit -F arch=b32 -S fchownat -F auid>=1000 -F auid!=unset -F key=perm_mod If the system is 64 bit then also add the following line: -a always,exit -F arch=b64 -S fchownat -F auid>=1000 -F auid!=unset -F key=perm_mod If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following line to `/etc/audit/audit.rules` file: -a always,exit -F arch=b32 -S fchownat -F auid>=1000 -F auid!=unset -F key=perm_mod If the system is 64 bit then also add the following line: -a always,exit -F arch=b64 -S fchownat -F auid>=1000 -F auid!=unset -F key=perm_mod	The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications can facilitate the identification of patterns of abuse among both authorized and unauthorized users.
CCE-83832-6	Record Events that Modify the System's Discretionary Access Controls - fchmod	At a minimum, the audit system should collect file permission changes for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -a always,exit -F arch=b32 -S fchmod -F auid>=1000 -F auid!=unset -F key=perm_mod If the system is 64 bit then also add the following line: -a always,exit -F arch=b64 -S fchmod -F auid>=1000 -F auid!=unset -F key=perm_mod If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following line to `/etc/audit/audit.rules` file: -a always,exit -F arch=b32 -S fchmod -F auid>=1000 -F auid!=unset -F key=perm_mod If the system is 64 bit then also add the following line: -a always,exit -F arch=b64 -S fchmod -F auid>=1000 -F auid!=unset -F key=perm_mod	The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications can facilitate the identification of patterns of abuse among both authorized and unauthorized users.
CCE-83833-4	Record Events that Modify the System's Discretionary Access Controls - lchown	At a minimum, the audit system should collect file permission changes for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -a always,exit -F arch=b32 -S lchown -F auid>=1000 -F auid!=unset -F key=perm_mod If the system is 64 bit then also add the following line: -a always,exit -F arch=b64 -S lchown -F auid>=1000 -F auid!=unset -F key=perm_mod If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following line to `/etc/audit/audit.rules` file: -a always,exit -F arch=b32 -S lchown -F auid>=1000 -F auid!=unset -F key=perm_mod If the system is 64 bit then also add the following line: -a always,exit -F arch=b64 -S lchown -F auid>=1000 -F auid!=unset -F key=perm_mod	The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications can facilitate the identification of patterns of abuse among both authorized and unauthorized users.
CCE-83834-2	Ensure Log Files Are Owned By Appropriate Group	The group-owner of all log files written by `rsyslog` should be `root`. These log files are determined by the second part of each Rule line in `/etc/rsyslog.conf` and typically all appear in `/var/log`. For each log file LOGFILE referenced in `/etc/rsyslog.conf`, run the following command to inspect the file's group owner: $ ls -l LOGFILE If the owner is not `root`, run the following command to correct this: $ sudo chgrp root LOGFILE	The log files generated by rsyslog contain valuable information regarding system configuration, user authentication, and other such information. Log files should be protected from unauthorized access.
CCE-83835-9	Record Attempts to Alter Time Through stime	If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following line to a file with suffix `.rules` in the directory `/etc/audit/rules.d` for both 32 bit and 64 bit systems: -a always,exit -F arch=b32 -S stime -F key=audit_time_rules Since the 64 bit version of the "stime" system call is not defined in the audit lookup table, the corresponding "-F arch=b64" form of this rule is not expected to be defined on 64 bit systems (the aforementioned "-F arch=b32" stime rule form itself is sufficient for both 32 bit and 64 bit systems). If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following line to `/etc/audit/audit.rules` file for both 32 bit and 64 bit systems: -a always,exit -F arch=b32 -S stime -F key=audit_time_rules Since the 64 bit version of the "stime" system call is not defined in the audit lookup table, the corresponding "-F arch=b64" form of this rule is not expected to be defined on 64 bit systems (the aforementioned "-F arch=b32" stime rule form itself is sufficient for both 32 bit and 64 bit systems). The -k option allows for the specification of a key in string form that can be used for better reporting capability through ausearch and aureport. Multiple system calls can be defined on the same line to save space if desired, but is not required. See an example of multiple combined system calls: -a always,exit -F arch=b64 -S adjtimex,settimeofday -F key=audit_time_rules	Arbitrary changes to the system time can be used to obfuscate nefarious activities in log files, as well as to confuse network services that are highly dependent upon an accurate system time (such as sshd). All changes to the system time should be audited.
CCE-83836-7	Record attempts to alter time through settimeofday	If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -a always,exit -F arch=b32 -S settimeofday -F key=audit_time_rules If the system is 64 bit then also add the following line: -a always,exit -F arch=b64 -S settimeofday -F key=audit_time_rules If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following line to `/etc/audit/audit.rules` file: -a always,exit -F arch=b32 -S settimeofday -F key=audit_time_rules If the system is 64 bit then also add the following line: -a always,exit -F arch=b64 -S settimeofday -F key=audit_time_rules The -k option allows for the specification of a key in string form that can be used for better reporting capability through ausearch and aureport. Multiple system calls can be defined on the same line to save space if desired, but is not required. See an example of multiple combined syscalls: -a always,exit -F arch=b64 -S adjtimex,settimeofday -F key=audit_time_rules	Arbitrary changes to the system time can be used to obfuscate nefarious activities in log files, as well as to confuse network services that are highly dependent upon an accurate system time (such as sshd). All changes to the system time should be audited.
CCE-83837-5	Record Attempts to Alter Time Through clock_settime	If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -a always,exit -F arch=b32 -S clock_settime -F a0=0x0 -F key=time-change If the system is 64 bit then also add the following line: -a always,exit -F arch=b64 -S clock_settime -F a0=0x0 -F key=time-change If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following line to `/etc/audit/audit.rules` file: -a always,exit -F arch=b32 -S clock_settime -F a0=0x0 -F key=time-change If the system is 64 bit then also add the following line: -a always,exit -F arch=b64 -S clock_settime -F a0=0x0 -F key=time-change The -k option allows for the specification of a key in string form that can be used for better reporting capability through ausearch and aureport. Multiple system calls can be defined on the same line to save space if desired, but is not required. See an example of multiple combined syscalls: -a always,exit -F arch=b64 -S adjtimex,settimeofday -F key=audit_time_rules	Arbitrary changes to the system time can be used to obfuscate nefarious activities in log files, as well as to confuse network services that are highly dependent upon an accurate system time (such as sshd). All changes to the system time should be audited.
CCE-83839-1	Record Attempts to Alter the localtime File	If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -w /etc/localtime -p wa -k audit_time_rules If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules`: -w /etc/localtime -p wa -k audit_time_rules	Arbitrary changes to the system time can be used to obfuscate nefarious activities in log files, as well as to confuse network services that are highly dependent upon an accurate system time (such as sshd). All changes to the system time should be audited.
CCE-83840-9	Record attempts to alter time through adjtimex	If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -a always,exit -F arch=b32 -S adjtimex -F key=audit_time_rules If the system is 64 bit then also add the following line: -a always,exit -F arch=b64 -S adjtimex -F key=audit_time_rules If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following line to `/etc/audit/audit.rules` file: -a always,exit -F arch=b32 -S adjtimex -F key=audit_time_rules If the system is 64 bit then also add the following line: -a always,exit -F arch=b64 -S adjtimex -F key=audit_time_rules The -k option allows for the specification of a key in string form that can be used for better reporting capability through ausearch and aureport. Multiple system calls can be defined on the same line to save space if desired, but is not required. See an example of multiple combined syscalls: -a always,exit -F arch=b64 -S adjtimex,settimeofday -F key=audit_time_rules	Arbitrary changes to the system time can be used to obfuscate nefarious activities in log files, as well as to confuse network services that are highly dependent upon an accurate system time (such as sshd). All changes to the system time should be audited.
CCE-83841-7	Configure kernel to trust the CPU random number generator	There exist two ways how to ensure that the Linux kernel trusts the CPU hardware random number generator. If the option is configured during kernel compilation, e.g. the option `CONFIG_RANDOM_TRUST_CPU` is set to `Y`, make sure that it is not overridden with the boot parameter. There must not exist the boot parameter `random.trust_cpu=off`. If the option is not compiled in, make sure that `random.trust_cpu=on` is configured as a boot parameter. To ensure that `random.trust_cpu=on` is added as a kernel command line argument to newly installed kernels, add `random.trust_cpu=on` to the default Grub2 command line for Linux operating systems. Modify the line within `/etc/default/grub` as shown below: GRUB_CMDLINE_LINUX="... random.trust_cpu=on ..." Run the following command to update command line for already installed kernels: # grubby --update-kernel=ALL --args="random.trust_cpu=on" If the system is distributed as a bootable container image, GRUB2 can't be configured using the method described above, but the following method needs to be used instead. The kernel arguments should be set in `/usr/lib/bootc/kargs.d` in a TOML file that has the following form: # /usr/lib/bootc/kargs.d/10-example.toml kargs = ["random.trust_cpu=on"] For more details on configuring kernel arguments in bootable container images, please refer to Bootc documentation.	The Linux kernel offers an option which signifies if the kernel should trust data provided by CPU hardware random number generator. Hardware random number generators can provide random data very quickly and are used to generate random cryptographic keys. They can be useful during boot time when other means of getting random data can be slow because there is not yet enough entropy in the system.
CCE-83842-5	Disable vsyscalls	To disable use of virtual syscalls, add the argument `vsyscall=none` to the default GRUB 2 command line for the Linux operating system. To ensure that `vsyscall=none` is added as a kernel command line argument to newly installed kernels, add `vsyscall=none` to the default Grub2 command line for Linux operating systems. Modify the line within `/etc/default/grub` as shown below: GRUB_CMDLINE_LINUX="... vsyscall=none ..." Run the following command to update command line for already installed kernels: # grubby --update-kernel=ALL --args="vsyscall=none" If the system is distributed as a bootable container image, GRUB2 can't be configured using the method described above, but the following method needs to be used instead. The kernel arguments should be set in `/usr/lib/bootc/kargs.d` in a TOML file that has the following form: # /usr/lib/bootc/kargs.d/10-example.toml kargs = ["vsyscall=none"] For more details on configuring kernel arguments in bootable container images, please refer to Bootc documentation.	Virtual Syscalls provide an opportunity of attack for a user who has control of the return instruction pointer.
CCE-83843-3	Enable Kernel Page-Table Isolation (KPTI)	To enable Kernel page-table isolation, add the argument `pti=on` to the default GRUB 2 command line for the Linux operating system. To ensure that `pti=on` is added as a kernel command line argument to newly installed kernels, add `pti=on` to the default Grub2 command line for Linux operating systems. Modify the line within `/etc/default/grub` as shown below: GRUB_CMDLINE_LINUX="... pti=on ..." Run the following command to update command line for already installed kernels: # grubby --update-kernel=ALL --args="pti=on" If the system is distributed as a bootable container image, GRUB2 can't be configured using the method described above, but the following method needs to be used instead. The kernel arguments should be set in `/usr/lib/bootc/kargs.d` in a TOML file that has the following form: # /usr/lib/bootc/kargs.d/10-example.toml kargs = ["pti=on"] For more details on configuring kernel arguments in bootable container images, please refer to Bootc documentation.	Kernel page-table isolation is a kernel feature that mitigates the Meltdown security vulnerability and hardens the kernel against attempts to bypass kernel address space layout randomization (KASLR).
CCE-83844-1	IOMMU configuration directive	On x86 architecture supporting VT-d, the IOMMU manages the access control policy between the hardware devices and some of the system critical units such as the memory. To ensure that `iommu=force` is added as a kernel command line argument to newly installed kernels, add `iommu=force` to the default Grub2 command line for Linux operating systems. Modify the line within `/etc/default/grub` as shown below: GRUB_CMDLINE_LINUX="... iommu=force ..." Run the following command to update command line for already installed kernels: # grubby --update-kernel=ALL --args="iommu=force" If the system is distributed as a bootable container image, GRUB2 can't be configured using the method described above, but the following method needs to be used instead. The kernel arguments should be set in `/usr/lib/bootc/kargs.d` in a TOML file that has the following form: # /usr/lib/bootc/kargs.d/10-example.toml kargs = ["iommu=force"] For more details on configuring kernel arguments in bootable container images, please refer to Bootc documentation.	On x86 architectures, activating the I/OMMU prevents the system from arbitrary accesses potentially made by hardware devices.
CCE-83845-8	Verify /boot/grub2/grub.cfg User Ownership	The file `/boot/grub2/grub.cfg` should be owned by the `root` user to prevent destruction or modification of the file. To properly set the owner of `/boot/grub2/grub.cfg`, run the command: $ sudo chown root /boot/grub2/grub.cfg	Only root should be able to modify important boot parameters.
CCE-83846-6	Verify /boot/grub2/grub.cfg Permissions	File permissions for `/boot/grub2/grub.cfg` should be set to 600. To properly set the permissions of `/boot/grub2/grub.cfg`, run the command: $ sudo chmod 600 /boot/grub2/grub.cfg	Proper permissions ensure that only the root user can modify important boot parameters.
CCE-83848-2	Verify /boot/grub2/grub.cfg Group Ownership	The file `/boot/grub2/grub.cfg` should be group-owned by the `root` group to prevent destruction or modification of the file. To properly set the group owner of `/boot/grub2/grub.cfg`, run the command: $ sudo chgrp root /boot/grub2/grub.cfg	The `root` group is a highly-privileged group. Furthermore, the group-owner of this file should not have any access privileges anyway.
CCE-83849-0	Set Boot Loader Password in grub2	The grub2 boot loader should have a superuser account and password protection enabled to protect boot-time settings. Since plaintext passwords are a security risk, generate a hash for the password by running the following command: # grub2-setpassword When prompted, enter the password that was selected.	Password protection on the boot loader configuration ensures users with physical access cannot trivially alter important bootloader settings. These include which kernel to use, and whether to enter single-user mode.
CCE-83850-8	Disable the Automounter	The `autofs` daemon mounts and unmounts filesystems, such as user home directories shared via NFS, on demand. In addition, autofs can be used to handle removable media, and the default configuration provides the cdrom device as `/misc/cd`. However, this method of providing access to removable media is not common, so autofs can almost always be disabled if NFS is not in use. Even if NFS is required, it may be possible to configure filesystem mounts statically by editing `/etc/fstab` rather than relying on the automounter. The `autofs` service can be disabled with the following command: $ sudo systemctl mask --now autofs.service	Disabling the automounter permits the administrator to statically control filesystem mounting through `/etc/fstab`. Additionally, automatically mounting filesystems permits easy introduction of unknown devices, thereby facilitating malicious activity.
CCE-83851-6	Disable Modprobe Loading of USB Storage Driver	To prevent USB storage devices from being used, configure the kernel module loading system to prevent automatic loading of the USB storage driver. To configure the system to prevent the `usb-storage` kernel module from being loaded, add the following line to the file `/etc/modprobe.d/usb-storage.conf`: install usb-storage /bin/false This entry will cause a non-zero return value during a `usb-storage` module installation and additionally convey the meaning of the entry to the user in form of an error message. If you would like to omit a non-zero return value and an error message, you may want to add a different line instead (both `/bin/true` and `/bin/false` are allowed by OVAL and will be accepted by the scan): install usb-storage /bin/true This will prevent the `modprobe` program from loading the `usb-storage` module, but will not prevent an administrator (or another program) from using the `insmod` program to load the module manually.	USB storage devices such as thumb drives can be used to introduce malicious software.
CCE-83852-4	Disable Mounting of udf	To configure the system to prevent the `udf` kernel module from being loaded, add the following line to the file `/etc/modprobe.d/udf.conf`: install udf /bin/false This entry will cause a non-zero return value during a `udf` module installation and additionally convey the meaning of the entry to the user in form of an error message. If you would like to omit a non-zero return value and an error message, you may want to add a different line instead (both `/bin/true` and `/bin/false` are allowed by OVAL and will be accepted by the scan): install udf /bin/true This effectively prevents usage of this uncommon filesystem. The `udf` filesystem type is the universal disk format used to implement the ISO/IEC 13346 and ECMA-167 specifications. This is an open vendor filesystem type for data storage on a broad range of media. This filesystem type is necessary to support writing DVDs and newer optical disc formats.	Removing support for unneeded filesystem types reduces the local attack surface of the system.
CCE-83853-2	Disable Mounting of cramfs	To configure the system to prevent the `cramfs` kernel module from being loaded, add the following line to the file `/etc/modprobe.d/cramfs.conf`: install cramfs /bin/false This entry will cause a non-zero return value during a `cramfs` module installation and additionally convey the meaning of the entry to the user in form of an error message. If you would like to omit a non-zero return value and an error message, you may want to add a different line instead (both `/bin/true` and `/bin/false` are allowed by OVAL and will be accepted by the scan): install cramfs /bin/true This effectively prevents usage of this uncommon filesystem. The `cramfs` filesystem type is a compressed read-only Linux filesystem embedded in small footprint systems. A `cramfs` image can be used without having to first decompress the image.	Removing support for unneeded filesystem types reduces the local attack surface of the server.
CCE-83855-7	Disable Mounting of squashfs	To configure the system to prevent the `squashfs` kernel module from being loaded, add the following line to the file `/etc/modprobe.d/squashfs.conf`: install squashfs /bin/false This entry will cause a non-zero return value during a `squashfs` module installation and additionally convey the meaning of the entry to the user in form of an error message. If you would like to omit a non-zero return value and an error message, you may want to add a different line instead (both `/bin/true` and `/bin/false` are allowed by OVAL and will be accepted by the scan): install squashfs /bin/true This effectively prevents usage of this uncommon filesystem. The `squashfs` filesystem type is a compressed read-only Linux filesystem embedded in small footprint systems (similar to `cramfs`). A `squashfs` image can be used without having to first decompress the image.	Removing support for unneeded filesystem types reduces the local attack surface of the system.
CCE-83856-5	Add nodev Option to Removable Media Partitions	The `nodev` mount option prevents files from being interpreted as character or block devices. Legitimate character and block devices should exist only in the `/dev` directory on the root partition or within chroot jails built for system services. Add the `nodev` option to the fourth column of `/etc/fstab` for the line which controls mounting of any removable media partitions.	The only legitimate location for device files is the `/dev` directory located on the root partition. An exception to this is chroot jails, and it is not advised to set `nodev` on partitions which contain their root filesystems.
CCE-83857-3	Add noexec Option to /dev/shm	The `noexec` mount option can be used to prevent binaries from being executed out of `/dev/shm`. It can be dangerous to allow the execution of binaries from world-writable temporary storage directories such as `/dev/shm`. Add the `noexec` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/dev/shm`.	Allowing users to execute binaries from world-writable directories such as `/dev/shm` can expose the system to potential compromise.
CCE-83862-3	Add nosuid Option to /srv	The `nosuid` mount option can be used to prevent execution of setuid programs in `/srv`. The SUID and SGID permissions should not be required in this directory. Add the `nosuid` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/srv`.	The presence of SUID and SGID executables should be tightly controlled. The `/srv` directory contains files served by various network services such as FTP. Users should not be able to execute SUID or SGID binaries from this directory.
CCE-83863-1	Add nosuid Option to /var/tmp	The `nosuid` mount option can be used to prevent execution of setuid programs in `/var/tmp`. The SUID and SGID permissions should not be required in these world-writable directories. Add the `nosuid` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/var/tmp`.	The presence of SUID and SGID executables should be tightly controlled. Users should not be able to execute SUID or SGID binaries from temporary storage partitions.
CCE-83864-9	Add nodev Option to /var/tmp	The `nodev` mount option can be used to prevent device files from being created in `/var/tmp`. Legitimate character and block devices should not exist within temporary directories like `/var/tmp`. Add the `nodev` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/var/tmp`.	The only legitimate location for device files is the `/dev` directory located on the root partition. The only exception to this is chroot jails.
CCE-83865-6	Add noexec Option to /var	The `noexec` mount option can be used to prevent binaries from being executed out of `/var`. Add the `noexec` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/var`.	The `/var` directory contains variable system data such as logs, mails and caches. No binaries should be executed from this directory.
CCE-83866-4	Add noexec Option to /var/tmp	The `noexec` mount option can be used to prevent binaries from being executed out of `/var/tmp`. Add the `noexec` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/var/tmp`.	Allowing users to execute binaries from world-writable directories such as `/var/tmp` should never be necessary in normal operation and can expose the system to potential compromise.
CCE-83867-2	Add nosuid Option to /var	The `nosuid` mount option can be used to prevent execution of setuid programs in `/var`. The SUID and SGID permissions should not be required for this directory. Add the `nosuid` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/var`.	The presence of SUID and SGID executables should be tightly controlled.
CCE-83868-0	Add nodev Option to /var	The `nodev` mount option can be used to prevent device files from being created in `/var`. Legitimate character and block devices should exist only in the `/dev` directory on the root partition or within chroot jails built for system services. Add the `nodev` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/var`.	The only legitimate location for device files is the `/dev` directory located on the root partition. The only exception to this is chroot jails.
CCE-83869-8	Add nodev Option to /tmp	The `nodev` mount option can be used to prevent device files from being created in `/tmp`. Legitimate character and block devices should not exist within temporary directories like `/tmp`. Add the `nodev` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/tmp`.	The only legitimate location for device files is the `/dev` directory located on the root partition. The only exception to this is chroot jails.
CCE-83870-6	Add nosuid Option to /var/log	The `nosuid` mount option can be used to prevent execution of setuid programs in `/var/log`. The SUID and SGID permissions should not be required in directories containing log files. Add the `nosuid` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/var/log`.	The presence of SUID and SGID executables should be tightly controlled. Users should not be able to execute SUID or SGID binaries from partitions designated for log files.
CCE-83871-4	Add nodev Option to /home	The `nodev` mount option can be used to prevent device files from being created in `/home`. Legitimate character and block devices should exist only in the `/dev` directory on the root partition or within chroot jails built for system services. Add the `nodev` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/home`.	The only legitimate location for device files is the `/dev` directory located on the root partition. The only exception to this is chroot jails.
CCE-83872-2	Add nosuid Option to /tmp	The `nosuid` mount option can be used to prevent execution of setuid programs in `/tmp`. The SUID and SGID permissions should not be required in these world-writable directories. Add the `nosuid` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/tmp`.	The presence of SUID and SGID executables should be tightly controlled. Users should not be able to execute SUID or SGID binaries from temporary storage partitions.
CCE-83873-0	Add nodev Option to Non-Root Local Partitions	The `nodev` mount option prevents files from being interpreted as character or block devices. Legitimate character and block devices should exist only in the `/dev` directory on the root partition or within chroot jails built for system services. Add the `nodev` option to the fourth column of `/etc/fstab` for the line which controls mounting of any non-root local partitions.	The `nodev` mount option prevents files from being interpreted as character or block devices. The only legitimate location for device files is the `/dev` directory located on the root partition. The only exception to this is chroot jails, for which it is not advised to set `nodev` on these filesystems.
CCE-83874-8	Add nosuid Option to Removable Media Partitions	The `nosuid` mount option prevents set-user-identifier (SUID) and set-group-identifier (SGID) permissions from taking effect. These permissions allow users to execute binaries with the same permissions as the owner and group of the file respectively. Users should not be allowed to introduce SUID and SGID files into the system via partitions mounted from removable media. Add the `nosuid` option to the fourth column of `/etc/fstab` for the line which controls mounting of any removable media partitions.	The presence of SUID and SGID executables should be tightly controlled. Allowing users to introduce SUID or SGID binaries from partitions mounted off of removable media would allow them to introduce their own highly-privileged programs.
CCE-83875-5	Add noexec Option to /home	The `noexec` mount option can be used to prevent binaries from being executed out of `/home`. Add the `noexec` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/home`.	The `/home` directory contains data of individual users. Binaries in this directory should not be considered as trusted and users should not be able to execute them.
CCE-83877-1	Add nosuid Option to /boot	The `nosuid` mount option can be used to prevent execution of setuid programs in `/boot`. The SUID and SGID permissions should not be required on the boot partition. Add the `nosuid` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/boot`.	The presence of SUID and SGID executables should be tightly controlled. Users should not be able to execute SUID or SGID binaries from boot partitions.
CCE-83878-9	Add noexec Option to /var/log/audit	The `noexec` mount option can be used to prevent binaries from being executed out of `/var/log/audit`. Add the `noexec` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/var/log/audit`.	Allowing users to execute binaries from directories containing audit log files such as `/var/log/audit` should never be necessary in normal operation and can expose the system to potential compromise.
CCE-83880-5	Add nosuid Option to /opt	The `nosuid` mount option can be used to prevent execution of setuid programs in `/opt`. The SUID and SGID permissions should not be required in this directory. Add the `nosuid` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/opt`.	The presence of SUID and SGID executables should be tightly controlled. The `/opt` directory contains additional software packages. Users should not be able to execute SUID or SGID binaries from this directory.
CCE-83881-3	Add nodev Option to /dev/shm	The `nodev` mount option can be used to prevent creation of device files in `/dev/shm`. Legitimate character and block devices should not exist within temporary directories like `/dev/shm`. Add the `nodev` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/dev/shm`.	The only legitimate location for device files is the `/dev` directory located on the root partition. The only exception to this is chroot jails.
CCE-83882-1	Add nodev Option to /var/log/audit	The `nodev` mount option can be used to prevent device files from being created in `/var/log/audit`. Legitimate character and block devices should exist only in the `/dev` directory on the root partition or within chroot jails built for system services. Add the `nodev` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/var/log/audit`.	The only legitimate location for device files is the `/dev` directory located on the root partition. The only exception to this is chroot jails.
CCE-83883-9	Add noexec Option to Removable Media Partitions	The `noexec` mount option prevents the direct execution of binaries on the mounted filesystem. Preventing the direct execution of binaries from removable media (such as a USB key) provides a defense against malicious software that may be present on such untrusted media. Add the `noexec` option to the fourth column of `/etc/fstab` for the line which controls mounting of any removable media partitions.	Allowing users to execute binaries from removable media such as USB keys exposes the system to potential compromise.
CCE-83884-7	Add nodev Option to /boot	The `nodev` mount option can be used to prevent device files from being created in `/boot`. Legitimate character and block devices should exist only in the `/dev` directory on the root partition or within chroot jails built for system services. Add the `nodev` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/boot`.	The only legitimate location for device files is the `/dev` directory located on the root partition. The only exception to this is chroot jails.
CCE-83885-4	Add noexec Option to /tmp	The `noexec` mount option can be used to prevent binaries from being executed out of `/tmp`. Add the `noexec` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/tmp`.	Allowing users to execute binaries from world-writable directories such as `/tmp` should never be necessary in normal operation and can expose the system to potential compromise.
CCE-83886-2	Add nodev Option to /var/log	The `nodev` mount option can be used to prevent device files from being created in `/var/log`. Legitimate character and block devices should exist only in the `/dev` directory on the root partition or within chroot jails built for system services. Add the `nodev` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/var/log`.	The only legitimate location for device files is the `/dev` directory located on the root partition. The only exception to this is chroot jails.
CCE-83887-0	Add noexec Option to /var/log	The `noexec` mount option can be used to prevent binaries from being executed out of `/var/log`. Add the `noexec` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/var/log`.	Allowing users to execute binaries from directories containing log files such as `/var/log` should never be necessary in normal operation and can expose the system to potential compromise.
CCE-83891-2	Add nosuid Option to /dev/shm	The `nosuid` mount option can be used to prevent execution of setuid programs in `/dev/shm`. The SUID and SGID permissions should not be required in these world-writable directories. Add the `nosuid` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/dev/shm`.	The presence of SUID and SGID executables should be tightly controlled. Users should not be able to execute SUID or SGID binaries from temporary storage partitions.
CCE-83892-0	Add noexec Option to /boot	The `noexec` mount option can be used to prevent binaries from being executed out of `/boot`. Add the `noexec` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/boot`.	The `/boot` partition contains the kernel and the bootloader. No binaries should be executed from this partition after the booting process finishes.
CCE-83893-8	Add nosuid Option to /var/log/audit	The `nosuid` mount option can be used to prevent execution of setuid programs in `/var/log/audit`. The SUID and SGID permissions should not be required in directories containing audit log files. Add the `nosuid` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/var/log/audit`.	The presence of SUID and SGID executables should be tightly controlled. Users should not be able to execute SUID or SGID binaries from partitions designated for audit log files.
CCE-83894-6	Add nosuid Option to /home	The `nosuid` mount option can be used to prevent execution of setuid programs in `/home`. The SUID and SGID permissions should not be required in these user data directories. Add the `nosuid` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/home`.	The presence of SUID and SGID executables should be tightly controlled. Users should not be able to execute SUID or SGID binaries from user home directory partitions.
CCE-83895-3	Verify that All World-Writable Directories Have Sticky Bits Set	When the so-called 'sticky bit' is set on a directory, only the owner of a given file may remove that file from the directory. Without the sticky bit, any user with write access to a directory may remove any file in the directory. Setting the sticky bit prevents users from removing each other's files. In cases where there is no reason for a directory to be world-writable, a better solution is to remove that permission rather than to set the sticky bit. However, if a directory is used by a particular application, consult that application's documentation instead of blindly changing modes. To set the sticky bit on a world-writable directory DIR, run the following command: $ sudo chmod +t DIR	Failing to set the sticky bit on public directories allows unauthorized users to delete files in the directory structure. The only authorized public directories are those temporary directories supplied with the system, or those designed to be temporary file repositories. The setting is normally reserved for directories used by the system, by users for temporary file storage (such as `/tmp`), and for directories requiring global read/write access.
CCE-83896-1	Ensure All Files Are Owned by a User	If any files are not owned by a user, then the cause of their lack of ownership should be investigated. Following this, the files should be deleted or assigned to an appropriate user. Locate the mount points related to local devices by the following command: $ findmnt -n -l -k -it $(awk '/nodev/ { print $2 }' /proc/filesystems \| paste -sd,) For all mount points listed by the previous command, it is necessary to search for files which do not belong to a valid user using the following command: $ sudo find MOUNTPOINT -xdev -nouser 2>/dev/null	Unowned files do not directly imply a security problem, but they are generally a sign that something is amiss. They may be caused by an intruder, by incorrect software installation or draft software removal, or by failure to remove all files belonging to a deleted account, or other similar cases. The files should be repaired so they will not cause problems when accounts are created in the future, and the cause should be discovered and addressed.
CCE-83897-9	Ensure All SUID Executables Are Authorized	The SUID (set user id) bit should be set only on files that were installed via authorized means. A straightforward means of identifying unauthorized SUID files is determine if any were not installed as part of an RPM package, which is cryptographically verified. Investigate the origin of any unpackaged SUID files. This configuration check considers authorized SUID files those which were installed via RPM. It is assumed that when an individual has sudo access to install an RPM and all packages are signed with an organizationally-recognized GPG key, the software should be considered an approved package on the system. Any SUID file not deployed through an RPM will be flagged for further review.	Executable files with the SUID permission run with the privileges of the owner of the file. SUID files of uncertain provenance could allow for unprivileged users to elevate privileges. The presence of these files should be strictly controlled on the system.
CCE-83900-1	Enable Kernel Parameter to Enforce DAC on Symlinks	To set the runtime status of the `fs.protected_symlinks` kernel parameter, run the following command: $ sudo sysctl -w fs.protected_symlinks=1 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: fs.protected_symlinks = 1	By enabling this kernel parameter, symbolic links are permitted to be followed only when outside a sticky world-writable directory, or when the UID of the link and follower match, or when the directory owner matches the symlink's owner. Disallowing such symlinks helps mitigate vulnerabilities based on insecure file system accessed by privileged programs, avoiding an exploitation vector exploiting unsafe use of `open()` or `creat()`.
CCE-83901-9	Ensure All SGID Executables Are Authorized	The SGID (set group id) bit should be set only on files that were installed via authorized means. A straightforward means of identifying unauthorized SGID files is determine if any were not installed as part of an RPM package, which is cryptographically verified. Investigate the origin of any unpackaged SGID files. This configuration check considers authorized SGID files those which were installed via RPM. It is assumed that when an individual has sudo access to install an RPM and all packages are signed with an organizationally-recognized GPG key, the software should be considered an approved package on the system. Any SGID file not deployed through an RPM will be flagged for further review.	Executable files with the SGID permission run with the privileges of the owner of the file. SGID files of uncertain provenance could allow for unprivileged users to elevate privileges. The presence of these files should be strictly controlled on the system.
CCE-83902-7	Ensure No World-Writable Files Exist	It is generally a good idea to remove global (other) write access to a file when it is discovered. However, check with documentation for specific applications before making changes. Also, monitor for recurring world-writable files, as these may be symptoms of a misconfigured application or user account. Finally, this applies to real files and not virtual files that are a part of pseudo file systems such as `sysfs` or `procfs`.	Data in world-writable files can be modified by any user on the system. In almost all circumstances, files can be configured using a combination of user and group permissions to support whatever legitimate access is needed without the risk caused by world-writable files.
CCE-83903-5	Ensure All World-Writable Directories Are Owned by root User	All directories in local partitions which are world-writable should be owned by root. If any world-writable directories are not owned by root, this should be investigated. Following this, the files should be deleted or assigned to root user.	Allowing a user account to own a world-writable directory is undesirable because it allows the owner of that directory to remove or replace any files that may be placed in the directory by other users.
CCE-83906-8	Ensure All Files Are Owned by a Group	If any file is not group-owned by a valid defined group, the cause of the lack of group-ownership must be investigated. Following this, those files should be deleted or assigned to an appropriate group. The groups need to be defined in `/etc/group` or in `/usr/lib/group` if `nss-altfiles` are configured to be used in `/etc/nsswitch.conf`. Locate the mount points related to local devices by the following command: $ findmnt -n -l -k -it $(awk '/nodev/ { print $2 }' /proc/filesystems \| paste -sd,) For all mount points listed by the previous command, it is necessary to search for files which do not belong to a valid group using the following command: $ sudo find MOUNTPOINT -xdev -nogroup 2>/dev/null	Unowned files do not directly imply a security problem, but they are generally a sign that something is amiss. They may be caused by an intruder, by incorrect software installation or draft software removal, or by failure to remove all files belonging to a deleted account, or other similar cases. The files should be repaired so they will not cause problems when accounts are created in the future, and the cause should be discovered and addressed.
CCE-83907-6	Verify that Shared Library Files Have Root Ownership	System-wide shared library files, which are linked to executables during process load time or run time, are stored in the following directories by default: /lib /lib64 /usr/lib /usr/lib64 Kernel modules, which can be added to the kernel during runtime, are also stored in `/lib/modules`. All files in these directories should be owned by the `root` user. If the directory, or any file in these directories, is found to be owned by a user other than root correct its ownership with the following command: $ sudo chown root FILE	Files from shared library directories are loaded into the address space of processes (including privileged ones) or of the kernel itself at runtime. Proper ownership is necessary to protect the integrity of the system.
CCE-83908-4	Verify that System Executables Have Root Ownership	System executables are stored in the following directories by default: /bin /sbin /usr/bin /usr/libexec /usr/local/bin /usr/local/sbin /usr/sbin All files in these directories should be owned by the `root` user. If any file FILE in these directories is found to be owned by a user other than root, correct its ownership with the following command: $ sudo chown root FILE	System binaries are executed by privileged users as well as system services, and restrictive permissions are necessary to ensure that their execution of these programs cannot be co-opted.
CCE-83909-2	Verify that Shared Library Files Have Restrictive Permissions	System-wide shared library files, which are linked to executables during process load time or run time, are stored in the following directories by default: /lib /lib64 /usr/lib /usr/lib64 Kernel modules, which can be added to the kernel during runtime, are stored in `/lib/modules`. All files in these directories should not be group-writable or world-writable. If any file in these directories is found to be group-writable or world-writable, correct its permission with the following command: $ sudo chmod go-w FILE	Files from shared library directories are loaded into the address space of processes (including privileged ones) or of the kernel itself at runtime. Restrictive permissions are necessary to protect the integrity of the system.
CCE-83911-8	Verify that System Executables Have Restrictive Permissions	System executables are stored in the following directories by default: /bin /sbin /usr/bin /usr/libexec /usr/local/bin /usr/local/sbin /usr/sbin All files in these directories should not be group-writable or world-writable. If any file FILE in these directories is found to be group-writable or world-writable, correct its permission with the following command: $ sudo chmod go-w FILE	System binaries are executed by privileged users, as well as system services, and restrictive permissions are necessary to ensure execution of these programs cannot be co-opted.
CCE-83912-6	Verify Group Who Owns /var/log Directory	To properly set the group owner of `/var/log`, run the command: $ sudo chgrp root /var/log	The `/var/log` directory contains files with logs of error messages in the system and should only be accessed by authorized personnel.
CCE-83913-4	Verify Permissions on /var/log/messages File	To properly set the permissions of `/var/log/messages`, run the command: $ sudo chmod 0600 /var/log/messages	The `/var/log/messages` file contains logs of error messages in the system and should only be accessed by authorized personnel.
CCE-83914-2	Verify User Who Owns /var/log Directory	To properly set the owner of `/var/log`, run the command: $ sudo chown root /var/log	The `/var/log` directory contains files with logs of error messages in the system and should only be accessed by authorized personnel.
CCE-83915-9	Verify User Who Owns /var/log/messages File	To properly set the owner of `/var/log/messages`, run the command: $ sudo chown root /var/log/messages	The `/var/log/messages` file contains logs of error messages in the system and should only be accessed by authorized personnel.
CCE-83916-7	Verify Group Who Owns /var/log/messages File	To properly set the group owner of `/var/log/messages`, run the command: $ sudo chgrp root /var/log/messages	The `/var/log/messages` file contains logs of error messages in the system and should only be accessed by authorized personnel.
CCE-83917-5	Verify Permissions on /var/log Directory	To properly set the permissions of `/var/log`, run the command: $ sudo chmod 0755 /var/log	The `/var/log` directory contains files with logs of error messages in the system and should only be accessed by authorized personnel.
CCE-83921-7	Verify Permissions on gshadow File	To properly set the permissions of `/etc/gshadow`, run the command: $ sudo chmod 0000 /etc/gshadow	The `/etc/gshadow` file contains group password hashes. Protection of this file is critical for system security.
CCE-83924-1	Verify User Who Owns gshadow File	To properly set the owner of `/etc/gshadow`, run the command: $ sudo chown root /etc/gshadow	The `/etc/gshadow` file contains group password hashes. Protection of this file is critical for system security.
CCE-83925-8	Verify User Who Owns group File	To properly set the owner of `/etc/group`, run the command: $ sudo chown root /etc/group	The `/etc/group` file contains information regarding groups that are configured on the system. Protection of this file is important for system security.
CCE-83926-6	Verify User Who Owns shadow File	To properly set the owner of `/etc/shadow`, run the command: $ sudo chown root /etc/shadow	The `/etc/shadow` file contains the list of local system accounts and stores password hashes. Protection of this file is critical for system security. Failure to give ownership of this file to root provides the designated owner with access to sensitive information which could weaken the system security posture.
CCE-83928-2	Verify Group Who Owns Backup group File	To properly set the group owner of `/etc/group-`, run the command: $ sudo chgrp root /etc/group-	The `/etc/group-` file is a backup file of `/etc/group`, and as such, it contains information regarding groups that are configured on the system. Protection of this file is important for system security.
CCE-83929-0	Verify User Who Owns Backup gshadow File	To properly set the owner of `/etc/gshadow-`, run the command: $ sudo chown root /etc/gshadow-	The `/etc/gshadow-` file is a backup of `/etc/gshadow`, and as such, it contains group password hashes. Protection of this file is critical for system security.
CCE-83930-8	Verify Group Who Owns shadow File	To properly set the group owner of `/etc/shadow`, run the command: $ sudo chgrp root /etc/shadow	The `/etc/shadow` file stores password hashes. Protection of this file is critical for system security.
CCE-83931-6	Verify Permissions on passwd File	To properly set the permissions of `/etc/passwd`, run the command: $ sudo chmod 0644 /etc/passwd	If the `/etc/passwd` file is writable by a group-owner or the world the risk of its compromise is increased. The file contains the list of accounts on the system and associated information, and protection of this file is critical for system security.
CCE-83933-2	Verify Group Who Owns Backup passwd File	To properly set the group owner of `/etc/passwd-`, run the command: $ sudo chgrp root /etc/passwd-	The `/etc/passwd-` file is a backup file of `/etc/passwd`, and as such, it contains information about the users that are configured on the system. Protection of this file is critical for system security.
CCE-83934-0	Verify Permissions on group File	To properly set the permissions of `/etc/group`, run the command: $ sudo chmod 0644 /etc/group	The `/etc/group` file contains information regarding groups that are configured on the system. Protection of this file is important for system security.
CCE-83935-7	Verify Permissions on Backup shadow File	To properly set the permissions of `/etc/shadow-`, run the command: $ sudo chmod 0000 /etc/shadow-	The `/etc/shadow-` file is a backup file of `/etc/shadow`, and as such, it contains the list of local system accounts and password hashes. Protection of this file is critical for system security.
CCE-83938-1	Verify User Who Owns Backup shadow File	To properly set the group owner of `/etc/shadow-`, run the command: $ sudo chgrp root /etc/shadow-	The `/etc/shadow-` file is a backup file of `/etc/shadow`, and as such, it contains the list of local system accounts and password hashes. Protection of this file is critical for system security.
CCE-83939-9	Verify Permissions on Backup group File	To properly set the permissions of `/etc/group-`, run the command: $ sudo chmod 0644 /etc/group-	The `/etc/group-` file is a backup file of `/etc/group`, and as such, it contains information regarding groups that are configured on the system. Protection of this file is important for system security.
CCE-83940-7	Verify Permissions on Backup passwd File	To properly set the permissions of `/etc/passwd-`, run the command: $ sudo chmod 0644 /etc/passwd-	The `/etc/passwd-` file is a backup file of `/etc/passwd`, and as such, it contains information about the users that are configured on the system. Protection of this file is critical for system security.
CCE-83941-5	Verify Permissions on shadow File	To properly set the permissions of `/etc/shadow`, run the command: $ sudo chmod 0000 /etc/shadow	The `/etc/shadow` file contains the list of local system accounts and stores password hashes. Protection of this file is critical for system security. Failure to give ownership of this file to root provides the designated owner with access to sensitive information which could weaken the system security posture.
CCE-83942-3	Verify Permissions on Backup gshadow File	To properly set the permissions of `/etc/gshadow-`, run the command: $ sudo chmod 0000 /etc/gshadow-	The `/etc/gshadow-` file is a backup of `/etc/gshadow`, and as such, it contains group password hashes. Protection of this file is critical for system security.
CCE-83943-1	Verify User Who Owns passwd File	To properly set the owner of `/etc/passwd`, run the command: $ sudo chown root /etc/passwd	The `/etc/passwd` file contains information about the users that are configured on the system. Protection of this file is critical for system security.
CCE-83944-9	Verify User Who Owns Backup group File	To properly set the owner of `/etc/group-`, run the command: $ sudo chown root /etc/group-	The `/etc/group-` file is a backup file of `/etc/group`, and as such, it contains information regarding groups that are configured on the system. Protection of this file is important for system security.
CCE-83945-6	Verify Group Who Owns group File	To properly set the group owner of `/etc/group`, run the command: $ sudo chgrp root /etc/group	The `/etc/group` file contains information regarding groups that are configured on the system. Protection of this file is important for system security.
CCE-83946-4	Ensure Log Files Are Owned By Appropriate User	The owner of all log files written by `rsyslog` should be `root`. These log files are determined by the second part of each Rule line in `/etc/rsyslog.conf` and typically all appear in `/var/log`. For each log file LOGFILE referenced in `/etc/rsyslog.conf`, run the following command to inspect the file's owner: $ ls -l LOGFILE If the owner is not `root`, run the following command to correct this: $ sudo chown root LOGFILE	The log files generated by rsyslog contain valuable information regarding system configuration, user authentication, and other such information. Log files should be protected from unauthorized access.
CCE-83947-2	Verify User Who Owns Backup passwd File	To properly set the owner of `/etc/passwd-`, run the command: $ sudo chown root /etc/passwd-	The `/etc/passwd-` file is a backup file of `/etc/passwd`, and as such, it contains information about the users that are configured on the system. Protection of this file is critical for system security.
CCE-83948-0	Verify Group Who Owns gshadow File	To properly set the group owner of `/etc/gshadow`, run the command: $ sudo chgrp root /etc/gshadow	The `/etc/gshadow` file contains group password hashes. Protection of this file is critical for system security.
CCE-83949-8	Verify Group Who Owns Backup shadow File	To properly set the owner of `/etc/shadow-`, run the command: $ sudo chown root /etc/shadow-	The `/etc/shadow-` file is a backup file of `/etc/shadow`, and as such, it contains the list of local system accounts and password hashes. Protection of this file is critical for system security.
CCE-83950-6	Verify Group Who Owns passwd File	To properly set the group owner of `/etc/passwd`, run the command: $ sudo chgrp root /etc/passwd	The `/etc/passwd` file contains information about the users that are configured on the system. Protection of this file is critical for system security.
CCE-83951-4	Verify Group Who Owns Backup gshadow File	To properly set the group owner of `/etc/gshadow-`, run the command: $ sudo chgrp root /etc/gshadow-	The `/etc/gshadow-` file is a backup of `/etc/gshadow`, and as such, it contains group password hashes. Protection of this file is critical for system security.
CCE-83952-2	Restrict Access to Kernel Message Buffer	To set the runtime status of the `kernel.dmesg_restrict` kernel parameter, run the following command: $ sudo sysctl -w kernel.dmesg_restrict=1 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: kernel.dmesg_restrict = 1	Unprivileged access to the kernel syslog can expose sensitive kernel address information.
CCE-83954-8	Disable Kernel Image Loading	To set the runtime status of the `kernel.kexec_load_disabled` kernel parameter, run the following command: $ sudo sysctl -w kernel.kexec_load_disabled=1 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: kernel.kexec_load_disabled = 1	Disabling kexec_load allows greater control of the kernel memory. It makes it impossible to load another kernel image after it has been disabled.
CCE-83956-3	Disable the use of user namespaces	To set the runtime status of the `user.max_user_namespaces` kernel parameter, run the following command: $ sudo sysctl -w user.max_user_namespaces=0 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: user.max_user_namespaces = 0 When containers are deployed on the machine, the value should be set to large non-zero value.	It is detrimental for operating systems to provide, or install by default, functionality exceeding requirements or system objectives. These unnecessary capabilities or services are often overlooked and therefore may remain unsecured. They increase the risk to the platform by providing additional attack vectors. User namespaces are used primarily for Linux containers. The value 0 disallows the use of user namespaces.
CCE-83957-1	Disable Access to Network bpf() Syscall From Unprivileged Processes	To set the runtime status of the `kernel.unprivileged_bpf_disabled` kernel parameter, run the following command: $ sudo sysctl -w kernel.unprivileged_bpf_disabled=1 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: kernel.unprivileged_bpf_disabled = 1	Loading and accessing the packet filters programs and maps using the bpf() syscall has the potential of revealing sensitive information about the kernel state.
CCE-83958-9	Prevent applications from mapping low portion of virtual memory	To set the runtime status of the `vm.mmap_min_addr` kernel parameter, run the following command: $ sudo sysctl -w vm.mmap_min_addr=65536 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: vm.mmap_min_addr = 65536	The `vm.mmap_min_addr` parameter specifies the minimum virtual address that a process is allowed to mmap. Allowing a process to mmap low portion of virtual memory can have security implications such as such as heightened risk of kernel null pointer dereference defects.
CCE-83959-7	Disallow kernel profiling by unprivileged users	To set the runtime status of the `kernel.perf_event_paranoid` kernel parameter, run the following command: $ sudo sysctl -w kernel.perf_event_paranoid=2 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: kernel.perf_event_paranoid = 2	Kernel profiling can reveal sensitive information about kernel behaviour.
CCE-83960-5	Configure maximum number of process identifiers	To set the runtime status of the `kernel.pid_max` kernel parameter, run the following command: $ sudo sysctl -w kernel.pid_max=65536 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: kernel.pid_max = 65536	The `kernel.pid_max` parameter configures upper limit on process identifiers (PID). If this number is not high enough, it might happen that forking of new processes is not possible, because all available PIDs are exhausted. Increasing this number enhances availability.
CCE-83961-3	Disable storing core dumps	To set the runtime status of the `kernel.core_pattern` kernel parameter, run the following command: $ sudo sysctl -w kernel.core_pattern=\|/bin/false To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: kernel.core_pattern = \|/bin/false	A core dump includes a memory image taken at the time the operating system terminates an application. The memory image could contain sensitive data and is generally useful only for developers trying to debug problems.
CCE-83962-1	Limit sampling frequency of the Perf system	To set the runtime status of the `kernel.perf_event_max_sample_rate` kernel parameter, run the following command: $ sudo sysctl -w kernel.perf_event_max_sample_rate=1 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: kernel.perf_event_max_sample_rate = 1	The `kernel.perf_event_max_sample_rate` parameter configures maximum frequency of collecting of samples for the Perf system. It is expressed in samples per second. Restricting usage of `Perf` system decreases risk of potential availability problems.
CCE-83965-4	Restrict usage of ptrace to descendant processes	To set the runtime status of the `kernel.yama.ptrace_scope` kernel parameter, run the following command: $ sudo sysctl -w kernel.yama.ptrace_scope=1 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: kernel.yama.ptrace_scope = 1	Unrestricted usage of ptrace allows compromised binaries to run ptrace on another processes of the user. Like this, the attacker can steal sensitive information from the target processes (e.g. SSH sessions, web browser, ...) without any additional assistance from the user (i.e. without resorting to phishing).
CCE-83966-2	Harden the operation of the BPF just-in-time compiler	To set the runtime status of the `net.core.bpf_jit_harden` kernel parameter, run the following command: $ sudo sysctl -w net.core.bpf_jit_harden=2 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: net.core.bpf_jit_harden = 2	When hardened, the extended Berkeley Packet Filter just-in-time compiler will randomize any kernel addresses in the BPF programs and maps, and will not expose the JIT addresses in `/proc/kallsyms`.
CCE-83967-0	Disable loading and unloading of kernel modules	To set the runtime status of the `kernel.modules_disabled` kernel parameter, run the following command: $ sudo sysctl -w kernel.modules_disabled=1 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: kernel.modules_disabled = 1	Malicious kernel modules can have a significant impact on system security and availability. Disabling loading of kernel modules prevents this threat. Note that once this option has been set, it cannot be reverted without doing a system reboot. Make sure that all needed kernel modules are loaded before setting this option.
CCE-83968-8	Disallow magic SysRq key	To set the runtime status of the `kernel.sysrq` kernel parameter, run the following command: $ sudo sysctl -w kernel.sysrq=0 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: kernel.sysrq = 0	The Magic SysRq key allows sending certain commands directly to the running kernel. It can dump various system and process information, potentially revealing sensitive information. It can also reboot or shutdown the machine, disturbing its availability.
CCE-83969-6	Limit CPU consumption of the Perf system	To set the runtime status of the `kernel.perf_cpu_time_max_percent` kernel parameter, run the following command: $ sudo sysctl -w kernel.perf_cpu_time_max_percent=1 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: kernel.perf_cpu_time_max_percent = 1	The `kernel.perf_cpu_time_max_percent` configures a threshold of maximum percentile of CPU that can be used by Perf system. Restricting usage of `Perf` system decreases risk of potential availability problems.
CCE-83970-4	Enable ExecShield via sysctl	By default on Red Hat Enterprise Linux 9 64-bit systems, ExecShield is enabled and can only be disabled if the hardware does not support ExecShield or is disabled in `/etc/default/grub`.	ExecShield uses the segmentation feature on all x86 systems to prevent execution in memory higher than a certain address. It writes an address as a limit in the code segment descriptor, to control where code can be executed, on a per-process basis. When the kernel places a process's memory regions such as the stack and heap higher than this address, the hardware prevents execution in that address range. This is enabled by default on the latest Red Hat and Fedora systems if supported by the hardware.
CCE-83971-2	Enable Randomized Layout of Virtual Address Space	To set the runtime status of the `kernel.randomize_va_space` kernel parameter, run the following command: $ sudo sysctl -w kernel.randomize_va_space=2 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: kernel.randomize_va_space = 2	Address space layout randomization (ASLR) makes it more difficult for an attacker to predict the location of attack code they have introduced into a process's address space during an attempt at exploitation. Additionally, ASLR makes it more difficult for an attacker to know the location of existing code in order to re-purpose it using return oriented programming (ROP) techniques.
CCE-83972-0	Restrict Exposed Kernel Pointer Addresses Access	To set the runtime status of the `kernel.kptr_restrict` kernel parameter, run the following command: $ sudo sysctl -w kernel.kptr_restrict=`1` To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: kernel.kptr_restrict = `1`	Exposing kernel pointers (through procfs or `seq_printf()`) exposes kernel writeable structures which may contain functions pointers. If a write vulnerability occurs in the kernel, allowing write access to any of this structure, the kernel can be compromised. This option disallow any program without the CAP_SYSLOG capability to get the addresses of kernel pointers by replacing them with 0.
CCE-83974-6	Disable acquiring, saving, and processing core dumps	The `systemd-coredump.socket` unit is a socket activation of the `systemd-coredump@.service` which processes core dumps. By masking the unit, core dump processing is disabled.	A core dump includes a memory image taken at the time the operating system terminates an application. The memory image could contain sensitive data and is generally useful only for developers trying to debug problems.
CCE-83979-5	Disable storing core dump	The `Storage` option in `[Coredump]` section of `/etc/systemd/coredump.conf` or a drop-in file in `/etc/systemd/coredump.conf.d/*.conf` can be set to `none` to disable storing core dumps permanently.	A core dump includes a memory image taken at the time the operating system terminates an application. The memory image could contain sensitive data and is generally useful only for developers or system operators trying to debug problems. Enabling core dumps on production systems is not recommended, however there may be overriding operational requirements to enable advanced debugging. Permitting temporary enablement of core dumps during such situations should be reviewed through local needs and policy.
CCE-83980-3	Disable Core Dumps for All Users	To disable core dumps for all users, add the following line to `/etc/security/limits.conf`, or to a file within the `/etc/security/limits.d/` directory: * hard core 0	A core dump includes a memory image taken at the time the operating system terminates an application. The memory image could contain sensitive data and is generally useful only for developers trying to debug problems.
CCE-83981-1	Disable Core Dumps for SUID programs	To set the runtime status of the `fs.suid_dumpable` kernel parameter, run the following command: $ sudo sysctl -w fs.suid_dumpable=0 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: fs.suid_dumpable = 0	The core dump of a setuid program is more likely to contain sensitive data, as the program itself runs with greater privileges than the user who initiated execution of the program. Disabling the ability for any setuid program to write a core file decreases the risk of unauthorized access of such data.
CCE-83984-5	Disable core dump backtraces	The `ProcessSizeMax` option in `[Coredump]` section of `/etc/systemd/coredump.conf` or in a drop-in file under `/etc/systemd/coredump.conf.d/` specifies the maximum size in bytes of a core which will be processed. Core dumps exceeding this size may be stored, but the backtrace will not be generated.	A core dump includes a memory image taken at the time the operating system terminates an application. The memory image could contain sensitive data and is generally useful only for developers or system operators trying to debug problems. Enabling core dumps on production systems is not recommended, however there may be overriding operational requirements to enable advanced debugging. Permitting temporary enablement of core dumps during such situations should be reviewed through local needs and policy.
CCE-83985-2	Enable page allocator poisoning	To enable poisoning of free pages, add the argument `page_poison=1` to the default GRUB 2 command line for the Linux operating system. To ensure that `page_poison=1` is added as a kernel command line argument to newly installed kernels, add `page_poison=1` to the default Grub2 command line for Linux operating systems. Modify the line within `/etc/default/grub` as shown below: GRUB_CMDLINE_LINUX="... page_poison=1 ..." Run the following command to update command line for already installed kernels: # grubby --update-kernel=ALL --args="page_poison=1" If the system is distributed as a bootable container image, GRUB2 can't be configured using the method described above, but the following method needs to be used instead. The kernel arguments should be set in `/usr/lib/bootc/kargs.d` in a TOML file that has the following form: # /usr/lib/bootc/kargs.d/10-example.toml kargs = ["page_poison=1"] For more details on configuring kernel arguments in bootable container images, please refer to Bootc documentation.	Poisoning writes an arbitrary value to freed pages, so any modification or reference to that page after being freed or before being initialized will be detected and prevented. This prevents many types of use-after-free vulnerabilities at little performance cost. Also prevents leak of data and detection of corrupted memory.
CCE-83986-0	Enable SLUB/SLAB allocator poisoning	To enable poisoning of SLUB/SLAB objects, add the argument `slub_debug=P` to the default GRUB 2 command line for the Linux operating system. To ensure that `slub_debug=P` is added as a kernel command line argument to newly installed kernels, add `slub_debug=P` to the default Grub2 command line for Linux operating systems. Modify the line within `/etc/default/grub` as shown below: GRUB_CMDLINE_LINUX="... slub_debug=`P` ..." Run the following command to update command line for already installed kernels: # grubby --update-kernel=ALL --args="slub_debug=`P`" If the system is distributed as a bootable container image, GRUB2 can't be configured using the method described above, but the following method needs to be used instead. The kernel arguments should be set in `/usr/lib/bootc/kargs.d` in a TOML file that has the following form: # /usr/lib/bootc/kargs.d/10-example.toml kargs = ["slub_debug=`P`"] For more details on configuring kernel arguments in bootable container images, please refer to Bootc documentation.	Poisoning writes an arbitrary value to freed objects, so any modification or reference to that object after being freed or before being initialized will be detected and prevented. This prevents many types of use-after-free vulnerabilities at little performance cost. Also prevents leak of data and detection of corrupted memory.
CCE-83987-8	Ensure rsyslog-gnutls is installed	TLS protocol support for rsyslog is installed. The `rsyslog-gnutls` package can be installed with the following command: $ sudo dnf install rsyslog-gnutls	The rsyslog-gnutls package provides Transport Layer Security (TLS) support for the rsyslog daemon, which enables secure remote logging.
CCE-83989-4	Enable rsyslog Service	The `rsyslog` service provides syslog-style logging by default on Red Hat Enterprise Linux 9. The `rsyslog` service can be enabled with the following command: $ sudo systemctl enable rsyslog.service	The `rsyslog` service must be running in order to provide logging services, which are essential to system administration.
CCE-83990-2	Ensure Logs Sent To Remote Host	To configure rsyslog to send logs to a remote log server, open `/etc/rsyslog.conf` and read and understand the last section of the file, which describes the multiple directives necessary to activate remote logging. Along with these other directives, the system can be configured to forward its logs to a particular log server by adding or correcting one of the following lines, substituting `logcollector` appropriately. The choice of protocol depends on the environment of the system; although TCP and RELP provide more reliable message delivery, they may not be supported in all environments. To use UDP for log message delivery: . @`logcollector` Or in RainerScript: . action(type="omfwd" ... target="`logcollector`" protocol="udp") To use TCP for log message delivery: . @@`logcollector` Or in RainerScript: . action(type="omfwd" ... target="`logcollector`" protocol="tcp") To use RELP for log message delivery: . :omrelp:`logcollector` Or in RainerScript: . action(type="omfwd" ... target="`logcollector`" protocol="relp") There must be a resolvable DNS CNAME or Alias record set to "`logcollector`" for logs to be sent correctly to the centralized logging utility.	A log server (loghost) receives syslog messages from one or more systems. This data can be used as an additional log source in the event a system is compromised and its local logs are suspect. Forwarding log messages to a remote loghost also provides system administrators with a centralized place to view the status of multiple hosts within the enterprise.
CCE-83991-0	Configure TLS for rsyslog remote logging	Configure `rsyslog` to use Transport Layer Security (TLS) support for logging to remote server for the Forwarding Output Module in `/etc/rsyslog.conf` using action. You can use the following command: echo 'action(type="omfwd" protocol="tcp" Target="<remote system>" port="6514" StreamDriver="gtls" StreamDriverMode="1" StreamDriverAuthMode="x509/name" streamdriver.CheckExtendedKeyPurpose="on")' >> /etc/rsyslog.conf Replace the `<remote system>` in the above command with an IP address or a host name of the remote logging server.	For protection of data being logged, the connection to the remote logging server needs to be authenticated and encrypted.
CCE-83992-8	Configure CA certificate for rsyslog remote logging	Configure CA certificate for `rsyslog` logging to remote server using Transport Layer Security (TLS) using correct path for the `DefaultNetstreamDriverCAFile` global option in `/etc/rsyslog.conf`, for example with the following command: echo 'global(DefaultNetstreamDriverCAFile="/etc/pki/tls/cert.pem")' >> /etc/rsyslog.conf Replace the `/etc/pki/tls/cert.pem` in the above command with the path to the file with CA certificate generated for the purpose of remote logging.	The CA certificate needs to be set or `rsyslog.service` fails to start with error: ca certificate is not set, cannot continue
CCE-83993-6	Ensure Logrotate Runs Periodically	The `logrotate` utility allows for the automatic rotation of log files. The frequency of rotation is specified in `/etc/logrotate.conf`, which triggers a cron task or a timer. To configure logrotate to run daily, add or correct the following line in `/etc/logrotate.conf`: # rotate log files frequency daily	Log files that are not properly rotated run the risk of growing so large that they fill up the /var/log partition. Valuable logging information could be lost if the /var/log partition becomes full.
CCE-83994-4	Ensure cron Is Logging To Rsyslog	Cron logging must be implemented to spot intrusions or trace cron job status. If `cron` is not logging to `rsyslog`, it can be implemented by adding the following to the RULES section of `/etc/rsyslog.conf`: If the legacy syntax is used: cron.* /var/log/cron If the modern syntax (RainerScript) is used: cron.* action(type="omfile" file="/var/log/cron")	Cron logging can be used to trace the successful or unsuccessful execution of cron jobs. It can also be used to spot intrusions into the use of the cron facility by unauthorized and malicious users.
CCE-83995-1	Ensure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server	The `rsyslog` daemon should not accept remote messages unless the system acts as a log server. To ensure that it is not listening on the network, ensure any of the following lines are not found in `rsyslog` configuration files. If using legacy syntax: $ModLoad imtcp $InputTCPServerRun port $ModLoad imudp $UDPServerRun port $ModLoad imrelp $InputRELPServerRun port If using RainerScript syntax: module(load="imtcp") module(load="imudp") input(type="imtcp" port="514") input(type="imudp" port="514")	Any process which receives messages from the network incurs some risk of receiving malicious messages. This risk can be eliminated for rsyslog by configuring it not to listen on the network.
CCE-83996-9	Ensure System is Not Acting as a Network Sniffer	The system should not be acting as a network sniffer, which can capture all traffic on the network to which it is connected. Run the following to determine if any interface is running in promiscuous mode: $ ip link \| grep PROMISC Promiscuous mode of an interface can be disabled with the following command: $ sudo ip link set dev `device_name` multicast off promisc off	Network interfaces in promiscuous mode allow for the capture of all network traffic visible to the system. If unauthorized individuals can access these applications, it may allow them to collect information such as logon IDs, passwords, and key exchanges between systems. If the system is being used to perform a network troubleshooting function, the use of these tools must be documented with the Information Systems Security Manager (ISSM) and restricted to only authorized personnel.
CCE-83997-7	Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces	To set the runtime status of the `net.ipv4.conf.all.send_redirects` kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.all.send_redirects=0 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: net.ipv4.conf.all.send_redirects = 0	ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular destination. These messages contain information from the system's route table possibly revealing portions of the network topology. The ability to send ICMP redirects is only appropriate for systems acting as routers.
CCE-83998-5	Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces	To set the runtime status of the `net.ipv4.ip_forward` kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.ip_forward=0 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: net.ipv4.ip_forward = 0	Routing protocol daemons are typically used on routers to exchange network topology information with other routers. If this capability is used when not required, system network information may be unnecessarily transmitted across the network.
CCE-83999-3	Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default	To set the runtime status of the `net.ipv4.conf.default.send_redirects` kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.default.send_redirects=0 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: net.ipv4.conf.default.send_redirects = 0	ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular destination. These messages contain information from the system's route table possibly revealing portions of the network topology. The ability to send ICMP redirects is only appropriate for systems acting as routers.
CCE-84000-9	Enable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces	To set the runtime status of the `net.ipv4.conf.all.log_martians` kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.all.log_martians=1 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: net.ipv4.conf.all.log_martians = 1	The presence of "martian" packets (which have impossible addresses) as well as spoofed packets, source-routed packets, and redirects could be a sign of nefarious network activity. Logging these packets enables this activity to be detected.
CCE-84001-7	Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces	To set the runtime status of the `net.ipv4.conf.all.accept_source_route` kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.all.accept_source_route=0 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: net.ipv4.conf.all.accept_source_route = 0	Source-routed packets allow the source of the packet to suggest routers forward the packet along a different path than configured on the router, which can be used to bypass network security measures. This requirement applies only to the forwarding of source-routerd traffic, such as when IPv4 forwarding is enabled and the system is functioning as a router. Accepting source-routed packets in the IPv4 protocol has few legitimate uses. It should be disabled unless it is absolutely required.
CCE-84003-3	Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces	To set the runtime status of the `net.ipv4.conf.default.accept_redirects` kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.default.accept_redirects=0 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: net.ipv4.conf.default.accept_redirects = 0	ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular destination. These messages modify the host's route table and are unauthenticated. An illicit ICMP redirect message could result in a man-in-the-middle attack. This feature of the IPv4 protocol has few legitimate uses. It should be disabled unless absolutely required.
CCE-84004-1	Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces	To set the runtime status of the `net.ipv4.icmp_echo_ignore_broadcasts` kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.icmp_echo_ignore_broadcasts=1 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: net.ipv4.icmp_echo_ignore_broadcasts = 1	Responding to broadcast (ICMP) echoes facilitates network mapping and provides a vector for amplification attacks. Ignoring ICMP echo requests (pings) sent to broadcast or multicast addresses makes the system slightly more difficult to enumerate on the network.
CCE-84006-6	Enable Kernel Parameter to Use TCP Syncookies on Network Interfaces	To set the runtime status of the `net.ipv4.tcp_syncookies` kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.tcp_syncookies=1 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: net.ipv4.tcp_syncookies = 1	A TCP SYN flood attack can cause a denial of service by filling a system's TCP connection table with connections in the SYN_RCVD state. Syncookies can be used to track a connection when a subsequent ACK is received, verifying the initiator is attempting a valid connection and is not a flood source. This feature is activated when a flood condition is detected, and enables the system to continue servicing valid connection requests.
CCE-84007-4	Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default	To set the runtime status of the `net.ipv4.conf.default.accept_source_route` kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.default.accept_source_route=0 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: net.ipv4.conf.default.accept_source_route = 0	Source-routed packets allow the source of the packet to suggest routers forward the packet along a different path than configured on the router, which can be used to bypass network security measures. Accepting source-routed packets in the IPv4 protocol has few legitimate uses. It should be disabled unless it is absolutely required, such as when IPv4 forwarding is enabled and the system is legitimately functioning as a router.
CCE-84008-2	Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces	To set the runtime status of the `net.ipv4.conf.all.rp_filter` kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.all.rp_filter=1 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: net.ipv4.conf.all.rp_filter = 1	Enabling reverse path filtering drops packets with source addresses that should not have been able to be received on the interface they were received on. It should not be used on systems which are routers for complicated networks, but is helpful for end hosts and routers serving small networks.
CCE-84009-0	Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default	To set the runtime status of the `net.ipv4.conf.default.rp_filter` kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.default.rp_filter=1 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: net.ipv4.conf.default.rp_filter = 1	Enabling reverse path filtering drops packets with source addresses that should not have been able to be received on the interface they were received on. It should not be used on systems which are routers for complicated networks, but is helpful for end hosts and routers serving small networks.
CCE-84011-6	Disable Accepting ICMP Redirects for All IPv4 Interfaces	To set the runtime status of the `net.ipv4.conf.all.accept_redirects` kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.all.accept_redirects=0 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: net.ipv4.conf.all.accept_redirects = 0	ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular destination. These messages modify the host's route table and are unauthenticated. An illicit ICMP redirect message could result in a man-in-the-middle attack. This feature of the IPv4 protocol has few legitimate uses. It should be disabled unless absolutely required."
CCE-84012-4	Enable Kernel Parameter to Use TCP RFC 1337 on IPv4 Interfaces	To set the runtime status of the `net.ipv4.tcp_rfc1337` kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.tcp_rfc1337=1 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: net.ipv4.tcp_rfc1337 = 1	Enable TCP behavior conformant with RFC 1337. When disabled, if a RST is received in TIME_WAIT state, we close the socket immediately without waiting for the end of the TIME_WAIT period.
CCE-84014-0	Enable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces by Default	To set the runtime status of the `net.ipv4.conf.default.log_martians` kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.default.log_martians=1 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: net.ipv4.conf.default.log_martians = 1	The presence of "martian" packets (which have impossible addresses) as well as spoofed packets, source-routed packets, and redirects could be a sign of nefarious network activity. Logging these packets enables this activity to be detected.
CCE-84015-7	Enable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces	To set the runtime status of the `net.ipv4.icmp_ignore_bogus_error_responses` kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.icmp_ignore_bogus_error_responses=1 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: net.ipv4.icmp_ignore_bogus_error_responses = 1	Ignoring bogus ICMP error responses reduces log size, although some activity would not be logged.
CCE-84016-5	Disable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces	To set the runtime status of the `net.ipv4.conf.all.secure_redirects` kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.all.secure_redirects=0 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: net.ipv4.conf.all.secure_redirects = 0	Accepting "secure" ICMP redirects (from those gateways listed as default gateways) has few legitimate uses. It should be disabled unless it is absolutely required.
CCE-84019-9	Configure Kernel Parameter for Accepting Secure Redirects By Default	To set the runtime status of the `net.ipv4.conf.default.secure_redirects` kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.default.secure_redirects=0 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: net.ipv4.conf.default.secure_redirects = 0	Accepting "secure" ICMP redirects (from those gateways listed as default gateways) has few legitimate uses. It should be disabled unless it is absolutely required.
CCE-84021-5	Install firewalld Package	The `firewalld` package can be installed with the following command: $ sudo dnf install firewalld	"Firewalld" provides an easy and effective way to block/limit remote access to the system via ports, services, and protocols. Remote access services, such as those providing remote access to network devices and information systems, which lack automated control capabilities, increase risk and make remote user access management difficult at best. Remote access is access to nonpublic information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless. Red Hat Enterprise Linux 9 functionality (e.g., SSH) must be capable of taking enforcement action if the audit reveals unauthorized activity. Automated control of remote access sessions allows organizations to ensure ongoing compliance with remote access policies by enforcing connection rules of remote access applications on a variety of information system components (e.g., servers, workstations, notebook computers, smartphones, and tablets)."
CCE-84023-1	Set Default firewalld Zone for Incoming Packets	To set the default zone to `drop` for the built-in default zone which processes incoming IPv4 and IPv6 packets, modify the following line in `/etc/firewalld/firewalld.conf` to be: DefaultZone=drop	In `firewalld` the default zone is applied only after all the applicable rules in the table are examined for a match. Setting the default zone to `drop` implements proper design for a firewall, i.e. any packets which are not explicitly permitted should not be accepted.
CCE-84024-9	Disable IPv6 Networking Support Automatic Loading	To prevent the IPv6 kernel module (`ipv6`) from binding to the IPv6 networking stack, add the following line to `/etc/modprobe.d/disabled.conf` (or another file in `/etc/modprobe.d`): options ipv6 disable=1 This permits the IPv6 module to be loaded (and thus satisfy other modules that depend on it), while disabling support for the IPv6 protocol.	Any unnecessary network stacks - including IPv6 - should be disabled, to reduce the vulnerability to exploitation.
CCE-84026-4	Configure Denying Router Solicitations on All IPv6 Interfaces By Default	To set the runtime status of the `net.ipv6.conf.default.router_solicitations` kernel parameter, run the following command: $ sudo sysctl -w net.ipv6.conf.default.router_solicitations=0 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: net.ipv6.conf.default.router_solicitations = 0	To prevent discovery of the system by other systems, router solicitation requests should be denied.
CCE-84060-3	Disable IEEE 1394 (FireWire) Support	The IEEE 1394 (FireWire) is a serial bus standard for high-speed real-time communication. To configure the system to prevent the `firewire-core` kernel module from being loaded, add the following line to the file `/etc/modprobe.d/firewire-core.conf`: install firewire-core /bin/false This entry will cause a non-zero return value during a `firewire-core` module installation and additionally convey the meaning of the entry to the user in form of an error message. If you would like to omit a non-zero return value and an error message, you may want to add a different line instead (both `/bin/true` and `/bin/false` are allowed by OVAL and will be accepted by the scan): install firewire-core /bin/true	Disabling FireWire protects the system against exploitation of any flaws in its implementation.
CCE-84063-7	Ensure rsyslog is Installed	Rsyslog is installed by default. The `rsyslog` package can be installed with the following command: $ sudo dnf install rsyslog	The rsyslog package provides the rsyslog daemon, which provides system logging services.
CCE-84064-5	Disable RDS Support	The Reliable Datagram Sockets (RDS) protocol is a transport layer protocol designed to provide reliable high-bandwidth, low-latency communications between nodes in a cluster. To configure the system to prevent the `rds` kernel module from being loaded, add the following line to the file `/etc/modprobe.d/rds.conf`: install rds /bin/false This entry will cause a non-zero return value during a `rds` module installation and additionally convey the meaning of the entry to the user in form of an error message. If you would like to omit a non-zero return value and an error message, you may want to add a different line instead (both `/bin/true` and `/bin/false` are allowed by OVAL and will be accepted by the scan): install rds /bin/true	Disabling RDS protects the system against exploitation of any flaws in its implementation.
CCE-84065-2	Disable TIPC Support	The Transparent Inter-Process Communication (TIPC) protocol is designed to provide communications between nodes in a cluster. To configure the system to prevent the `tipc` kernel module from being loaded, add the following line to the file `/etc/modprobe.d/tipc.conf`: install tipc /bin/false This entry will cause a non-zero return value during a `tipc` module installation and additionally convey the meaning of the entry to the user in form of an error message. If you would like to omit a non-zero return value and an error message, you may want to add a different line instead (both `/bin/true` and `/bin/false` are allowed by OVAL and will be accepted by the scan): install tipc /bin/true	Disabling TIPC protects the system against exploitation of any flaws in its implementation.
CCE-84066-0	Deactivate Wireless Network Interfaces	Deactivating wireless network interfaces should prevent normal usage of the wireless capability. Configure the system to disable all wireless network interfaces with the following command: $ sudo nmcli radio all off	The use of wireless networking can introduce many different attack vectors into the organization's network. Common attack vectors such as malicious association and ad hoc networks will allow an attacker to spoof a wireless access point (AP), allowing validated systems to connect to the malicious AP and enabling the attacker to monitor and record network traffic. These malicious APs can also serve to create a man-in-the-middle attack or be used to create a denial of service to valid network resources.
CCE-84067-8	Disable Bluetooth Kernel Module	The kernel's module loading system can be configured to prevent loading of the Bluetooth module. Add the following to the appropriate `/etc/modprobe.d` configuration file to prevent the loading of the Bluetooth module: install bluetooth /bin/true	If Bluetooth functionality must be disabled, preventing the kernel from loading the kernel module provides an additional safeguard against its activation.
CCE-84068-6	Install libreswan Package	The libreswan package provides an implementation of IPsec and IKE, which permits the creation of secure tunnels over untrusted networks. The `libreswan` package can be installed with the following command: $ sudo dnf install libreswan	Providing the ability for remote users or systems to initiate a secure VPN connection protects information when it is transmitted over a wide area network.
CCE-84069-4	Install libselinux Package	The `libselinux` package can be installed with the following command: $ sudo dnf install libselinux	Security-enhanced Linux is a feature of the Linux kernel and a number of utilities with enhanced security functionality designed to add mandatory access controls to Linux. The `libselinux` package contains the core library of the Security-enhanced Linux system.
CCE-84070-2	Install policycoreutils-python-utils package	The `policycoreutils-python-utils` package can be installed with the following command: $ sudo dnf install policycoreutils-python-utils	This package is required to operate and manage an SELinux environment and its policies. It provides utilities such as semanage, audit2allow, audit2why, chcat and sandbox.
CCE-84071-0	Install policycoreutils Package	The `policycoreutils` package can be installed with the following command: $ sudo dnf install policycoreutils	Security-enhanced Linux is a feature of the Linux kernel and a number of utilities with enhanced security functionality designed to add mandatory access controls to Linux. The Security-enhanced Linux kernel contains new architectural components originally developed to improve security of the Flask operating system. These architectural components provide general support for the enforcement of many kinds of mandatory access control policies, including those based on the concepts of Type Enforcement, Role-based Access Control, and Multi-level Security. `policycoreutils` contains the policy core utilities that are required for basic operation of an SELinux-enabled system. These utilities include `load_policy` to load SELinux policies, `setfiles` to label filesystems, `newrole` to switch roles, and so on.
CCE-84072-8	Uninstall mcstrans Package	The `mcstransd` daemon provides category label information to client processes requesting information. The label translations are defined in `/etc/selinux/targeted/setrans.conf`. The `mcstrans` package can be removed with the following command: $ sudo dnf remove mcstrans	Since this service is not used very often, disable it to reduce the amount of potentially vulnerable code running on the system.
CCE-84073-6	Uninstall setroubleshoot Package	The SETroubleshoot service notifies desktop users of SELinux denials. The service provides information around configuration errors, unauthorized intrusions, and other potential errors. The `setroubleshoot` package can be removed with the following command: $ sudo dnf remove setroubleshoot	The SETroubleshoot service is an unnecessary daemon to have running on a server, especially if X Windows is removed or disabled.
CCE-84074-4	Configure SELinux Policy	The SELinux `targeted` policy is appropriate for general-purpose desktops and servers, as well as systems in many other roles. To configure the system to use this policy, add or correct the following line in `/etc/selinux/config`: SELINUXTYPE=`targeted` Other policies, such as `mls`, provide additional security labeling and greater confinement but are not compatible with many general-purpose use cases.	Setting the SELinux policy to `targeted` or a more specialized policy ensures the system will confine processes that are likely to be targeted for exploitation, such as network or system services. Note: During the development or debugging of SELinux modules, it is common to temporarily place non-production systems in `permissive` mode. In such temporary cases, SELinux policies should be developed, and once work is completed, the system should be reconfigured to .
CCE-84075-1	Ensure No Daemons are Unconfined by SELinux	Daemons for which the SELinux policy does not contain rules will inherit the context of the parent process. Because daemons are launched during startup and descend from the `init` process, they inherit the `unconfined_service_t` context. To check for unconfined daemons, run the following command: $ sudo ps -eZ \| grep "unconfined_service_t" It should produce no output in a well-configured system.	Daemons which run with the `unconfined_service_t` context may cause AVC denials, or allow privileges that the daemon does not require.
CCE-84078-5	Ensure SELinux Not Disabled in /etc/default/grub	SELinux can be disabled at boot time by an argument in `/etc/default/grub`. Remove any instances of `selinux=0` from the kernel arguments in that file to prevent SELinux from being disabled at boot.	Disabling a major host protection feature, such as SELinux, at boot time prevents it from confining system services at boot time. Further, it increases the chances that it will remain off during system operation.
CCE-84079-3	Ensure SELinux State is Enforcing	The SELinux state should be set to `enforcing` at system boot time. In the file `/etc/selinux/config`, add or correct the following line to configure the system to boot into enforcing mode: SELINUX=`enforcing` Ensure that all files have correct SELinux labels by running: fixfiles onboot Then reboot the system.	Setting the SELinux state to enforcing ensures SELinux is able to confine potentially compromised processes to the security policy, which is designed to prevent them from causing damage to the system or further elevating their privileges.
CCE-84081-9	Disable the ssh_sysadm_login SELinux Boolean	By default, the SELinux boolean `ssh_sysadm_login` is disabled. If this setting is enabled, it should be disabled. To disable the `ssh_sysadm_login` SELinux boolean, run the following command: $ sudo setsebool -P ssh_sysadm_login off	Preventing non-privileged users from executing privileged functions mitigates the risk that unauthorized individuals or processes may gain unnecessary access to information or privileges. Privileged functions include, for example, establishing accounts, performing system integrity checks, or administering cryptographic key management activities. Non-privileged users are individuals who do not possess appropriate authorizations. Circumventing intrusion detection and prevention mechanisms or malicious code protection mechanisms are examples of privileged functions that require protection from non-privileged users.
CCE-84082-7	Configure the deny_execmem SELinux Boolean	By default, the SELinux boolean `deny_execmem` is disabled. This setting should be configured to `false`. To set the `deny_execmem` SELinux boolean, run the following command: $ sudo setsebool -P deny_execmem `false`	Allowing user domain applications to map a memory region as both writable and executable makes them more susceptible to data execution attacks.
CCE-84083-5	Configure the polyinstantiation_enabled SELinux Boolean	By default, the SELinux boolean `polyinstantiation_enabled` is disabled. This setting should be configured to `false`. To set the `polyinstantiation_enabled` SELinux boolean, run the following command: $ sudo setsebool -P polyinstantiation_enabled `false`
CCE-84084-3	Disable the selinuxuser_execheap SELinux Boolean	By default, the SELinux boolean `selinuxuser_execheap` is disabled. When enabled this boolean is enabled it allows selinuxusers to execute code from the heap. If this setting is enabled, it should be disabled. To disable the `selinuxuser_execheap` SELinux boolean, run the following command: $ sudo setsebool -P selinuxuser_execheap off	Disabling code execution from the heap blocks buffer overflow attacks.
CCE-84086-8	Enable the selinuxuser_execmod SELinux Boolean	By default, the SELinux boolean `selinuxuser_execmod` is enabled. If this setting is disabled, it should be enabled. To enable the `selinuxuser_execmod` SELinux boolean, run the following command: $ sudo setsebool -P selinuxuser_execmod on
CCE-84087-6	Configure the secure_mode_insmod SELinux Boolean	By default, the SELinux boolean `secure_mode_insmod` is disabled. This setting should be configured to `false`. To set the `secure_mode_insmod` SELinux boolean, run the following command: $ sudo setsebool -P secure_mode_insmod `false`
CCE-84089-2	Disable the selinuxuser_execstack SELinux Boolean	By default, the SELinux boolean `selinuxuser_execstack` is enabled. This setting should be disabled as unconfined executables should not be able to make their stack executable. To disable the `selinuxuser_execstack` SELinux boolean, run the following command: $ sudo setsebool -P selinuxuser_execstack off	Disabling code execution from the stack blocks buffer overflow attacks.
CCE-84090-0	Enable the auditadm_exec_content SELinux Boolean	By default, the SELinux boolean `auditadm_exec_content` is enabled. If this setting is disabled, it should be enabled. To enable the `auditadm_exec_content` SELinux boolean, run the following command: $ sudo setsebool -P auditadm_exec_content on
CCE-84092-6	Ensure all zIPL boot entries are BLS compliant	Ensure that zIPL boot entries fully adheres to Boot Loader Specification (BLS) by checking that `/etc/zipl.conf` doesn't contain `image =` .	Red Hat Enterprise Linux 9 adheres to Boot Loader Specification (BLS) and is the preferred method of configuration.
CCE-84094-2	Enable SLUB/SLAB allocator poisoning in zIPL	To enable poisoning of SLUB/SLAB objects, check that all boot entries in `/boot/loader/entries/*.conf` have `slub_debug=P` included in its options. To ensure that new kernels and boot entries continue to enable poisoning of SLUB/SLAB objects, add `slub_debug=P` to `/etc/kernel/cmdline`.	Poisoning writes an arbitrary value to freed objects, so any modification or reference to that object after being freed or before being initialized will be detected and prevented. This prevents many types of use-after-free vulnerabilities at little performance cost. Also prevents leak of data and detection of corrupted memory.
CCE-84096-7	Enable Auditing to Start Prior to the Audit Daemon in zIPL	To ensure all processes can be audited, even those which start prior to the audit daemon, check that all boot entries in `/boot/loader/entries/*.conf` have `audit=1` included in its options. To ensure that new kernels and boot entries continue to enable audit, add `audit=1` to `/etc/kernel/cmdline`.	Each process on the system carries an "auditable" flag which indicates whether its activities can be audited. Although `auditd` takes care of enabling this for all processes which launch after it does, adding the kernel argument ensures it is set for every process during boot.
CCE-84098-3	Ensure zIPL bootmap is up to date	Make sure that `/boot/bootmap` is up to date. Every time a boot entry or zIPL configuration is changed `/boot/bootmap` needs to be updated to reflect the changes. Run `zipl` command to generate an updated `/boot/bootmap`.	The file `/boot/bootmap` contains all boot data, keeping it up to date is crucial to boot correct kernel and options.
CCE-84099-1	Extend Audit Backlog Limit for the Audit Daemon in zIPL	To improve the kernel capacity to queue all log events, even those which start prior to the audit daemon, check that all boot entries in `/boot/loader/entries/*.conf` have `audit_backlog_limit=8192` included in its options. To ensure that new kernels and boot entries continue to extend the audit log events queue, add `audit_backlog_limit=8192` to `/etc/kernel/cmdline`.	audit_backlog_limit sets the queue length for audit events awaiting transfer to the audit daemon. Until the audit daemon is up and running, all log messages are stored in this queue. If the queue is overrun during boot process, the action defined by audit failure flag is taken.
CCE-84100-7	Disable vsyscalls in zIPL	To disable use of virtual syscalls, check that all boot entries in `/boot/loader/entries/*.conf` have `vsyscall=none` included in its options. To ensure that new kernels and boot entries continue to disable virtual syscalls, add `vsyscall=none` to `/etc/kernel/cmdline`.	Virtual Syscalls provide an opportunity of attack for a user who has control of the return instruction pointer.
CCE-84101-5	Enable page allocator poisoning in zIPL	To enable poisoning of free pages, check that all boot entries in `/boot/loader/entries/*.conf` have `page_poison=1` included in its options. To ensure that new kernels and boot entries continue to enable page poisoning, add `page_poison=1` to `/etc/kernel/cmdline`.	Poisoning writes an arbitrary value to freed pages, so any modification or reference to that page after being freed or before being initialized will be detected and prevented. This prevents many types of use-after-free vulnerabilities at little performance cost. Also prevents leak of data and detection of corrupted memory.
CCE-84103-1	Set SSH MaxSessions limit	The `MaxSessions` parameter specifies the maximum number of open sessions permitted from a given connection. To set MaxSessions edit `/etc/ssh/sshd_config` as follows: MaxSessions `10`	To protect a system from denial of service due to a large number of concurrent sessions, use the rate limiting function of MaxSessions to protect availability of sshd logins and prevent overwhelming the daemon.
CCE-84104-9	Remove the X Windows Package Group	By removing the xorg-x11-server-common package, the system no longer has X Windows installed. If X Windows is not installed then the system cannot boot into graphical user mode. This prevents the system from being accidentally or maliciously booted into a `graphical.target` mode. To do so, run the following command: $ sudo dnf groupremove base-x $ sudo dnf remove xorg-x11-server-common	Unnecessary service packages must not be installed to decrease the attack surface of the system. X windows has a long history of security vulnerabilities and should not be installed unless approved and documented.
CCE-84105-6	Disable Graphical Environment Startup By Setting Default Target	Systems that do not require a graphical user interface should only boot by default into `multi-user.target` mode. This prevents accidental booting of the system into a `graphical.target` mode. Setting the system's default target to `multi-user.target` will prevent automatic startup of the graphical environment. To do so, run: $ systemctl set-default multi-user.target You should see the following output: Removed symlink /etc/systemd/system/default.target. Created symlink from /etc/systemd/system/default.target to /usr/lib/systemd/system/multi-user.target.	Services that are not required for system and application processes must not be active to decrease the attack surface of the system.
CCE-84106-4	Disable graphical user interface	By removing the following packages, the system no longer has X Windows installed. `xorg-x11-server-Xorg` `xorg-x11-server-common` `xorg-x11-server-utils` `xorg-x11-server-Xwayland` If X Windows is not installed then the system cannot boot into graphical user mode. This prevents the system from being accidentally or maliciously booted into a `graphical.target` mode. To do so, run the following command: sudo dnf remove xorg-x11-server-Xorg xorg-x11-server-common xorg-x11-server-utils xorg-x11-server-Xwayland	Unnecessary service packages must not be installed to decrease the attack surface of the system. X windows has a long history of security vulnerabilities and should not be installed unless approved and documented.
CCE-84108-0	Ensure that chronyd is running under chrony user account	chrony is a daemon which implements the Network Time Protocol (NTP). It is designed to synchronize system clocks across a variety of systems and use a source that is highly accurate. More information on chrony can be found at https://chrony-project.org/. Chrony can be configured to be a client and/or a server. To ensure that chronyd is running under chrony user account, remove any `-u ...` option from `OPTIONS` other than `-u chrony`, as chrony is run under its own user by default. This recommendation only applies if chrony is in use on the system.	If chrony is in use on the system proper configuration is vital to ensuring time synchronization is working properly.
CCE-84110-6	Enable Kernel Parameter to Enforce DAC on Hardlinks	To set the runtime status of the `fs.protected_hardlinks` kernel parameter, run the following command: $ sudo sysctl -w fs.protected_hardlinks=1 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: fs.protected_hardlinks = 1	By enabling this kernel parameter, users can no longer create soft or hard links to files which they do not own. Disallowing such hardlinks mitigate vulnerabilities based on insecure file system accessed by privileged programs, avoiding an exploitation vector exploiting unsafe use of `open()` or `creat()`.
CCE-84111-4	Configure Accepting Router Preference in Router Advertisements on All IPv6 Interfaces	To set the runtime status of the `net.ipv6.conf.all.accept_ra_rtr_pref` kernel parameter, run the following command: $ sudo sysctl -w net.ipv6.conf.all.accept_ra_rtr_pref=0 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: net.ipv6.conf.all.accept_ra_rtr_pref = 0	An illicit router advertisement message could result in a man-in-the-middle attack.
CCE-84112-2	Configure Maximum Number of Autoconfigured Addresses on All IPv6 Interfaces	To set the runtime status of the `net.ipv6.conf.all.max_addresses` kernel parameter, run the following command: $ sudo sysctl -w net.ipv6.conf.all.max_addresses=1 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: net.ipv6.conf.all.max_addresses = 1	The number of global unicast IPv6 addresses for each interface should be limited exactly to the number of statically configured addresses.
CCE-84113-0	Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces	To set the runtime status of the `net.ipv6.conf.default.accept_redirects` kernel parameter, run the following command: $ sudo sysctl -w net.ipv6.conf.default.accept_redirects=0 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: net.ipv6.conf.default.accept_redirects = 0	An illicit ICMP redirect message could result in a man-in-the-middle attack.
CCE-84114-8	Disable Kernel Parameter for IPv6 Forwarding	To set the runtime status of the `net.ipv6.conf.all.forwarding` kernel parameter, run the following command: $ sudo sysctl -w net.ipv6.conf.all.forwarding=0 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: net.ipv6.conf.all.forwarding = 0	IP forwarding permits the kernel to forward packets from one network interface to another. The ability to forward packets between two networks is only appropriate for systems acting as routers.
CCE-84115-5	Configure Accepting Default Router in Router Advertisements on All IPv6 Interfaces	To set the runtime status of the `net.ipv6.conf.all.accept_ra_defrtr` kernel parameter, run the following command: $ sudo sysctl -w net.ipv6.conf.all.accept_ra_defrtr=0 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: net.ipv6.conf.all.accept_ra_defrtr = 0	An illicit router advertisement message could result in a man-in-the-middle attack.
CCE-84116-3	Configure Accepting Default Router in Router Advertisements on All IPv6 Interfaces By Default	To set the runtime status of the `net.ipv6.conf.default.accept_ra_defrtr` kernel parameter, run the following command: $ sudo sysctl -w net.ipv6.conf.default.accept_ra_defrtr=0 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: net.ipv6.conf.default.accept_ra_defrtr = 0	An illicit router advertisement message could result in a man-in-the-middle attack.
CCE-84117-1	Configure Maximum Number of Autoconfigured Addresses on All IPv6 Interfaces By Default	To set the runtime status of the `net.ipv6.conf.default.max_addresses` kernel parameter, run the following command: $ sudo sysctl -w net.ipv6.conf.default.max_addresses=1 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: net.ipv6.conf.default.max_addresses = 1	The number of global unicast IPv6 addresses for each interface should be limited exactly to the number of statically configured addresses.
CCE-84118-9	Configure Accepting Prefix Information in Router Advertisements on All IPv6 Interfaces By Default	To set the runtime status of the `net.ipv6.conf.default.accept_ra_pinfo` kernel parameter, run the following command: $ sudo sysctl -w net.ipv6.conf.default.accept_ra_pinfo=0 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: net.ipv6.conf.default.accept_ra_pinfo = 0	An illicit router advertisement message could result in a man-in-the-middle attack.
CCE-84120-5	Configure Accepting Router Advertisements on All IPv6 Interfaces	To set the runtime status of the `net.ipv6.conf.all.accept_ra` kernel parameter, run the following command: $ sudo sysctl -w net.ipv6.conf.all.accept_ra=0 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: net.ipv6.conf.all.accept_ra = 0	An illicit router advertisement message could result in a man-in-the-middle attack.
CCE-84121-3	Configure Accepting Router Preference in Router Advertisements on All IPv6 Interfaces By Default	To set the runtime status of the `net.ipv6.conf.default.accept_ra_rtr_pref` kernel parameter, run the following command: $ sudo sysctl -w net.ipv6.conf.default.accept_ra_rtr_pref=0 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: net.ipv6.conf.default.accept_ra_rtr_pref = 0	An illicit router advertisement message could result in a man-in-the-middle attack.
CCE-84122-1	Configure Accepting Prefix Information in Router Advertisements on All IPv6 Interfaces	To set the runtime status of the `net.ipv6.conf.all.accept_ra_pinfo` kernel parameter, run the following command: $ sudo sysctl -w net.ipv6.conf.all.accept_ra_pinfo=0 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: net.ipv6.conf.all.accept_ra_pinfo = 0	An illicit router advertisement message could result in a man-in-the-middle attack.
CCE-84124-7	Disable Accepting Router Advertisements on all IPv6 Interfaces by Default	To set the runtime status of the `net.ipv6.conf.default.accept_ra` kernel parameter, run the following command: $ sudo sysctl -w net.ipv6.conf.default.accept_ra=0 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: net.ipv6.conf.default.accept_ra = 0	An illicit router advertisement message could result in a man-in-the-middle attack.
CCE-84125-4	Disable Accepting ICMP Redirects for All IPv6 Interfaces	To set the runtime status of the `net.ipv6.conf.all.accept_redirects` kernel parameter, run the following command: $ sudo sysctl -w net.ipv6.conf.all.accept_redirects=0 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: net.ipv6.conf.all.accept_redirects = 0	An illicit ICMP redirect message could result in a man-in-the-middle attack.
CCE-84126-2	Configure Auto Configuration on All IPv6 Interfaces	To set the runtime status of the `net.ipv6.conf.all.autoconf` kernel parameter, run the following command: $ sudo sysctl -w net.ipv6.conf.all.autoconf=0 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: net.ipv6.conf.all.autoconf = 0	An illicit router advertisement message could result in a man-in-the-middle attack.
CCE-84128-8	Configure Denying Router Solicitations on All IPv6 Interfaces	To set the runtime status of the `net.ipv6.conf.all.router_solicitations` kernel parameter, run the following command: $ sudo sysctl -w net.ipv6.conf.all.router_solicitations=0 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: net.ipv6.conf.all.router_solicitations = 0	To prevent discovery of the system by other systems, router solicitation requests should be denied.
CCE-84130-4	Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default	To set the runtime status of the `net.ipv6.conf.default.accept_source_route` kernel parameter, run the following command: $ sudo sysctl -w net.ipv6.conf.default.accept_source_route=0 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: net.ipv6.conf.default.accept_source_route = 0	Source-routed packets allow the source of the packet to suggest routers forward the packet along a different path than configured on the router, which can be used to bypass network security measures. This requirement applies only to the forwarding of source-routerd traffic, such as when IPv6 forwarding is enabled and the system is functioning as a router. Accepting source-routed packets in the IPv6 protocol has few legitimate uses. It should be disabled unless it is absolutely required.
CCE-84131-2	Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces	To set the runtime status of the `net.ipv6.conf.all.accept_source_route` kernel parameter, run the following command: $ sudo sysctl -w net.ipv6.conf.all.accept_source_route=0 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: net.ipv6.conf.all.accept_source_route = 0	Source-routed packets allow the source of the packet to suggest routers forward the packet along a different path than configured on the router, which can be used to bypass network security measures. This requirement applies only to the forwarding of source-routerd traffic, such as when IPv6 forwarding is enabled and the system is functioning as a router. Accepting source-routed packets in the IPv6 protocol has few legitimate uses. It should be disabled unless it is absolutely required.
CCE-84133-8	Configure Auto Configuration on All IPv6 Interfaces By Default	To set the runtime status of the `net.ipv6.conf.default.autoconf` kernel parameter, run the following command: $ sudo sysctl -w net.ipv6.conf.default.autoconf=0 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: net.ipv6.conf.default.autoconf = 0	An illicit router advertisement message could result in a man-in-the-middle attack.
CCE-84134-6	Disable CAN Support	The Controller Area Network (CAN) is a serial communications protocol which was initially developed for automotive and is now also used in marine, industrial, and medical applications. To configure the system to prevent the `can` kernel module from being loaded, add the following line to the file `/etc/modprobe.d/can.conf`: install can /bin/false This entry will cause a non-zero return value during a `can` module installation and additionally convey the meaning of the entry to the user in form of an error message. If you would like to omit a non-zero return value and an error message, you may want to add a different line instead (both `/bin/true` and `/bin/false` are allowed by OVAL and will be accepted by the scan): install can /bin/true	Disabling CAN protects the system against exploitation of any flaws in its implementation.
CCE-84136-1	Disable DCCP Support	The Datagram Congestion Control Protocol (DCCP) is a relatively new transport layer protocol, designed to support streaming media and telephony. To configure the system to prevent the `dccp` kernel module from being loaded, add the following line to the file `/etc/modprobe.d/dccp.conf`: install dccp /bin/false This entry will cause a non-zero return value during a `dccp` module installation and additionally convey the meaning of the entry to the user in form of an error message. If you would like to omit a non-zero return value and an error message, you may want to add a different line instead (both `/bin/true` and `/bin/false` are allowed by OVAL and will be accepted by the scan): install dccp /bin/true	Disabling DCCP protects the system against exploitation of any flaws in its implementation.
CCE-84137-9	Disable ATM Support	The Asynchronous Transfer Mode (ATM) is a protocol operating on network, data link, and physical layers, based on virtual circuits and virtual paths. To configure the system to prevent the `atm` kernel module from being loaded, add the following line to the file `/etc/modprobe.d/atm.conf`: install atm /bin/false This entry will cause a non-zero return value during a `atm` module installation and additionally convey the meaning of the entry to the user in form of an error message. If you would like to omit a non-zero return value and an error message, you may want to add a different line instead (both `/bin/true` and `/bin/false` are allowed by OVAL and will be accepted by the scan): install atm /bin/true	Disabling ATM protects the system against exploitation of any flaws in its implementation.
CCE-84139-5	Disable SCTP Support	The Stream Control Transmission Protocol (SCTP) is a transport layer protocol, designed to support the idea of message-oriented communication, with several streams of messages within one connection. To configure the system to prevent the `sctp` kernel module from being loaded, add the following line to the file `/etc/modprobe.d/sctp.conf`: install sctp /bin/false This entry will cause a non-zero return value during a `sctp` module installation and additionally convey the meaning of the entry to the user in form of an error message. If you would like to omit a non-zero return value and an error message, you may want to add a different line instead (both `/bin/true` and `/bin/false` are allowed by OVAL and will be accepted by the scan): install sctp /bin/true	Disabling SCTP protects the system against exploitation of any flaws in its implementation.
CCE-84140-3	Ensure rsyncd service is disabled	The `rsyncd` service can be disabled with the following command: $ sudo systemctl mask --now rsyncd.service	The rsyncd service presents a security risk as it uses unencrypted protocols for communication.
CCE-84142-9	Uninstall rsh Package	The `rsh` package contains the client commands for the rsh services	These legacy clients contain numerous security exposures and have been replaced with the more secure SSH package. Even if the server is removed, it is best to ensure the clients are also removed to prevent users from inadvertently attempting to use these commands and therefore exposing their credentials. Note that removing the `rsh` package removes the clients for `rsh`,`rcp`, and `rlogin`.
CCE-84143-7	Uninstall rsh-server Package	The `rsh-server` package can be removed with the following command: $ sudo dnf remove rsh-server	The `rsh-server` service provides unencrypted remote access service which does not provide for the confidentiality and integrity of user passwords or the remote session and has very weak authentication. If a privileged user were to login using this service, the privileged user password could be compromised. The `rsh-server` package provides several obsolete and insecure network services. Removing it decreases the risk of those services' accidental (or intentional) activation.
CCE-84145-2	Remove Rsh Trust Files	The files `/etc/hosts.equiv` and `~/.rhosts` (in each user's home directory) list remote hosts and users that are trusted by the local system when using the rshd daemon. To remove these files, run the following command to delete them from any location: $ sudo rm /etc/hosts.equiv $ rm ~/.rhosts	This action is only meaningful if `.rhosts` support is permitted through PAM. Trust files are convenient, but when used in conjunction with the R-services, they can allow unauthenticated access to a system.
CCE-84146-0	Remove telnet Clients	The telnet client allows users to start connections to other systems via the telnet protocol.	The `telnet` protocol is insecure and unencrypted. The use of an unencrypted transmission medium could allow an unauthorized user to steal credentials. The `ssh` package provides an encrypted session and stronger security and is included in Red Hat Enterprise Linux 9.
CCE-84149-4	Uninstall telnet-server Package	The `telnet-server` package can be removed with the following command: $ sudo dnf remove telnet-server	It is detrimental for operating systems to provide, or install by default, functionality exceeding requirements or mission objectives. These unnecessary capabilities are often overlooked and therefore may remain insecure. They increase the risk to the platform by providing additional attack vectors. The telnet service provides an unencrypted remote access service which does not provide for the confidentiality and integrity of user passwords or the remote session. If a privileged user were to login using this service, the privileged user password could be compromised. Removing the `telnet-server` package decreases the risk of the telnet service's accidental (or intentional) activation.
CCE-84150-2	Disable telnet Service	Make sure that the activation of the `telnet` service on system boot is disabled. The `telnet` socket can be disabled with the following command: $ sudo systemctl mask --now telnet.socket	The telnet protocol uses unencrypted network communication, which means that data from the login session, including passwords and all other information transmitted during the session, can be stolen by eavesdroppers on the network. The telnet protocol is also subject to man-in-the-middle attacks.
CCE-84151-0	Remove NIS Client	The Network Information Service (NIS), formerly known as Yellow Pages, is a client-server directory service protocol used to distribute system configuration files. The NIS client (`ypbind`) was used to bind a system to an NIS server and receive the distributed configuration files.	The NIS service is inherently an insecure system that has been vulnerable to DOS attacks, buffer overflows and has poor authentication for querying NIS maps. NIS generally has been replaced by such protocols as Lightweight Directory Access Protocol (LDAP). It is recommended that the service be removed.
CCE-84152-8	Uninstall ypserv Package	The `ypserv` package can be removed with the following command: $ sudo dnf remove ypserv	The NIS service provides an unencrypted authentication service which does not provide for the confidentiality and integrity of user passwords or the remote session. Removing the `ypserv` package decreases the risk of the accidental (or intentional) activation of NIS or NIS+ services.
CCE-84153-6	Remove tftp Daemon	Trivial File Transfer Protocol (TFTP) is a simple file transfer protocol, typically used to automatically transfer configuration or boot files between systems. TFTP does not support authentication and can be easily hacked. The package `tftp` is a client program that allows for connections to a `tftp` server.	It is recommended that TFTP be removed, unless there is a specific need for TFTP (such as a boot server). In that case, use extreme caution when configuring the services.
CCE-84154-4	Uninstall tftp-server Package	The `tftp-server` package can be removed with the following command: $ sudo dnf remove tftp-server	Removing the `tftp-server` package decreases the risk of the accidental (or intentional) activation of tftp services. If TFTP is required for operational support (such as transmission of router configurations), its use must be documented with the Information Systems Security Manager (ISSM), restricted to only authorized personnel, and have access control rules established.
CCE-84155-1	Uninstall xinetd Package	The `xinetd` package can be removed with the following command: $ sudo dnf remove xinetd	Removing the `xinetd` package decreases the risk of the xinetd service's accidental (or intentional) activation.
CCE-84156-9	Disable xinetd Service	The `xinetd` service can be disabled with the following command: $ sudo systemctl mask --now xinetd.service	The xinetd service provides a dedicated listener service for some programs, which is no longer necessary for commonly-used network services. Disabling it ensures that these uncommon services are not running, and also prevents attacks against xinetd itself.
CCE-84157-7	Uninstall talk Package	The `talk` package contains the client program for the Internet talk protocol, which allows the user to chat with other users on different systems. Talk is a communication program which copies lines from one terminal to the terminal of another user. The `talk` package can be removed with the following command: $ sudo dnf remove talk	The talk software presents a security risk as it uses unencrypted protocols for communications. Removing the `talk` package decreases the risk of the accidental (or intentional) activation of talk client program.
CCE-84158-5	Uninstall talk-server Package	The `talk-server` package can be removed with the following command: $ sudo dnf remove talk-server	The talk software presents a security risk as it uses unencrypted protocols for communications. Removing the `talk-server` package decreases the risk of the accidental (or intentional) activation of talk services.
CCE-84159-3	Uninstall vsftpd Package	The `vsftpd` package can be removed with the following command: $ sudo dnf remove vsftpd	Removing the `vsftpd` package decreases the risk of its accidental activation.
CCE-84160-1	Disable vsftpd Service	The `vsftpd` service can be disabled with the following command: $ sudo systemctl mask --now vsftpd.service	Running FTP server software provides a network-based avenue of attack, and should be disabled if not needed. Furthermore, the FTP protocol is unencrypted and creates a risk of compromising sensitive information.
CCE-84163-5	Enable cron Service	The `crond` service is used to execute commands at preconfigured times. It is required by almost all systems to perform necessary maintenance tasks, such as notifying root of system activity. The `crond` service can be enabled with the following command: $ sudo systemctl enable crond.service	Due to its usage for maintenance and security-supporting tasks, enabling the cron daemon is essential.
CCE-84164-3	Disable At Service (atd)	The `at` and `batch` commands can be used to schedule tasks that are meant to be executed only once. This allows delayed execution in a manner similar to cron, except that it is not recurring. The daemon `atd` keeps track of tasks scheduled via `at` and `batch`, and executes them at the specified time. The `atd` service can be disabled with the following command: $ sudo systemctl mask --now atd.service	The `atd` service could be used by an unsophisticated insider to carry out activities outside of a normal login session, which could complicate accountability. Furthermore, the need to schedule tasks with `at` or `batch` is not common.
CCE-84167-6	Verify Owner on crontab	To properly set the owner of `/etc/crontab`, run the command: $ sudo chown root /etc/crontab	Service configuration files enable or disable features of their respective services that if configured incorrectly can lead to insecure and vulnerable configurations. Therefore, service configuration files should be owned by the correct user to prevent unauthorized changes.
CCE-84168-4	Verify Owner on cron.hourly	To properly set the owner of `/etc/cron.hourly`, run the command: $ sudo chown root /etc/cron.hourly	Service configuration files enable or disable features of their respective services that if configured incorrectly can lead to insecure and vulnerable configurations. Therefore, service configuration files should be owned by the correct user to prevent unauthorized changes.
CCE-84169-2	Verify Owner on cron.d	To properly set the owner of `/etc/cron.d`, run the command: $ sudo chown root /etc/cron.d	Service configuration files enable or disable features of their respective services that if configured incorrectly can lead to insecure and vulnerable configurations. Therefore, service configuration files should be owned by the correct user to prevent unauthorized changes.
CCE-84170-0	Verify Group Who Owns cron.daily	To properly set the group owner of `/etc/cron.daily`, run the command: $ sudo chgrp root /etc/cron.daily	Service configuration files enable or disable features of their respective services that if configured incorrectly can lead to insecure and vulnerable configurations. Therefore, service configuration files should be owned by the correct group to prevent unauthorized changes.
CCE-84171-8	Verify Group Who Owns Crontab	To properly set the group owner of `/etc/crontab`, run the command: $ sudo chgrp root /etc/crontab	Service configuration files enable or disable features of their respective services that if configured incorrectly can lead to insecure and vulnerable configurations. Therefore, service configuration files should be owned by the correct group to prevent unauthorized changes.
CCE-84173-4	Verify Permissions on cron.hourly	To properly set the permissions of `/etc/cron.hourly`, run the command: $ sudo chmod 0700 /etc/cron.hourly	Service configuration files enable or disable features of their respective services that if configured incorrectly can lead to insecure and vulnerable configurations. Therefore, service configuration files should have the correct access rights to prevent unauthorized changes.
CCE-84174-2	Verify Group Who Owns cron.weekly	To properly set the group owner of `/etc/cron.weekly`, run the command: $ sudo chgrp root /etc/cron.weekly	Service configuration files enable or disable features of their respective services that if configured incorrectly can lead to insecure and vulnerable configurations. Therefore, service configuration files should be owned by the correct group to prevent unauthorized changes.
CCE-84175-9	Verify Permissions on cron.daily	To properly set the permissions of `/etc/cron.daily`, run the command: $ sudo chmod 0700 /etc/cron.daily	Service configuration files enable or disable features of their respective services that if configured incorrectly can lead to insecure and vulnerable configurations. Therefore, service configuration files should have the correct access rights to prevent unauthorized changes.
CCE-84176-7	Verify Permissions on crontab	To properly set the permissions of `/etc/crontab`, run the command: $ sudo chmod 0600 /etc/crontab	Service configuration files enable or disable features of their respective services that if configured incorrectly can lead to insecure and vulnerable configurations. Therefore, service configuration files should have the correct access rights to prevent unauthorized changes.
CCE-84177-5	Verify Group Who Owns cron.d	To properly set the group owner of `/etc/cron.d`, run the command: $ sudo chgrp root /etc/cron.d	Service configuration files enable or disable features of their respective services that if configured incorrectly can lead to insecure and vulnerable configurations. Therefore, service configuration files should be owned by the correct group to prevent unauthorized changes.
CCE-84179-1	Verify Owner on cron.monthly	To properly set the owner of `/etc/cron.monthly`, run the command: $ sudo chown root /etc/cron.monthly	Service configuration files enable or disable features of their respective services that if configured incorrectly can lead to insecure and vulnerable configurations. Therefore, service configuration files should be owned by the correct user to prevent unauthorized changes.
CCE-84180-9	Ensure Red Hat GPG Key Installed	To ensure the system can cryptographically verify base software packages come from Red Hat (and to connect to the Red Hat Network to receive them), the Red Hat GPG key must properly be installed. To install the Red Hat GPG key, run: $ sudo subscription-manager register If the system is not connected to the Internet or an RHN Satellite, then install the Red Hat GPG key from trusted media such as the Red Hat installation CD-ROM or DVD. Assuming the disc is mounted in `/media/cdrom`, use the following command as the root user to import it into the keyring: $ sudo rpm --import /media/cdrom/RPM-GPG-KEY Alternatively, the key may be pre-loaded during the RHEL installation. In such cases, the key can be installed by running the following command: sudo rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release	Changes to software components can have significant effects on the overall security of the operating system. This requirement ensures the software has not been tampered with and that it has been provided by a trusted vendor. The Red Hat GPG key is necessary to cryptographically verify packages are from Red Hat.
CCE-84181-7	Verify Permissions on cron.monthly	To properly set the permissions of `/etc/cron.monthly`, run the command: $ sudo chmod 0700 /etc/cron.monthly	Service configuration files enable or disable features of their respective services that if configured incorrectly can lead to insecure and vulnerable configurations. Therefore, service configuration files should have the correct access rights to prevent unauthorized changes.
CCE-84183-3	Verify Permissions on cron.d	To properly set the permissions of `/etc/cron.d`, run the command: $ sudo chmod 0700 /etc/cron.d	Service configuration files enable or disable features of their respective services that if configured incorrectly can lead to insecure and vulnerable configurations. Therefore, service configuration files should have the correct access rights to prevent unauthorized changes.
CCE-84185-8	Ensure Software Patches Installed	If the system is joined to the Red Hat Network, a Red Hat Satellite Server, or a yum server, run the following command to install updates: $ sudo yum update If the system is not configured to use one of these sources, updates (in the form of RPM packages) can be manually downloaded from the Red Hat Network and installed using `rpm`. NOTE: U.S. Defense systems are required to be patched within 30 days or sooner as local policy dictates.	Installing software updates is a fundamental mitigation against the exploitation of publicly-known vulnerabilities. If the most recent security patches and updates are not installed, unauthorized users may take advantage of weaknesses in the unpatched software. The lack of prompt attention to patching could result in a system compromise.
CCE-84186-6	Verify Group Who Owns cron.hourly	To properly set the group owner of `/etc/cron.hourly`, run the command: $ sudo chgrp root /etc/cron.hourly	Service configuration files enable or disable features of their respective services that if configured incorrectly can lead to insecure and vulnerable configurations. Therefore, service configuration files should be owned by the correct group to prevent unauthorized changes.
CCE-84187-4	Verify Permissions on cron.weekly	To properly set the permissions of `/etc/cron.weekly`, run the command: $ sudo chmod 0700 /etc/cron.weekly	Service configuration files enable or disable features of their respective services that if configured incorrectly can lead to insecure and vulnerable configurations. Therefore, service configuration files should have the correct access rights to prevent unauthorized changes.
CCE-84188-2	Verify Owner on cron.daily	To properly set the owner of `/etc/cron.daily`, run the command: $ sudo chown root /etc/cron.daily	Service configuration files enable or disable features of their respective services that if configured incorrectly can lead to insecure and vulnerable configurations. Therefore, service configuration files should be owned by the correct user to prevent unauthorized changes.
CCE-84189-0	Verify Group Who Owns cron.monthly	To properly set the group owner of `/etc/cron.monthly`, run the command: $ sudo chgrp root /etc/cron.monthly	Service configuration files enable or disable features of their respective services that if configured incorrectly can lead to insecure and vulnerable configurations. Therefore, service configuration files should be owned by the correct group to prevent unauthorized changes.
CCE-84190-8	Verify Owner on cron.weekly	To properly set the owner of `/etc/cron.weekly`, run the command: $ sudo chown root /etc/cron.weekly	Service configuration files enable or disable features of their respective services that if configured incorrectly can lead to insecure and vulnerable configurations. Therefore, service configuration files should be owned by the correct user to prevent unauthorized changes.
CCE-84191-6	Uninstall quagga Package	The `quagga` package can be removed with the following command: $ sudo dnf remove quagga	Routing software is typically used on routers to exchange network topology information with other routers. If routing software is used when not required, system network information may be unnecessarily transmitted across the network. If there is no need to make the router software available, removing it provides a safeguard against its activation.
CCE-84194-0	Disable named Service	The `named` service can be disabled with the following command: $ sudo systemctl mask --now named.service	All network services involve some risk of compromise due to implementation flaws and should be disabled if possible.
CCE-84201-3	Disable Samba	The `smb` service can be disabled with the following command: $ sudo systemctl mask --now smb.service	Running a Samba server provides a network-based avenue of attack, and should be disabled if not needed.
CCE-84203-9	Install usbguard Package	The `usbguard` package can be installed with the following command: $ sudo dnf install usbguard	`usbguard` is a software framework that helps to protect against rogue USB devices by implementing basic whitelisting/blacklisting capabilities based on USB device attributes.
CCE-84205-4	Enable the USBGuard Service	The USBGuard service should be enabled. The `usbguard` service can be enabled with the following command: $ sudo systemctl enable usbguard.service	The `usbguard` service must be running in order to enforce the USB device authorization policy for all USB devices.
CCE-84206-2	Log USBGuard daemon audit events using Linux Audit	To configure USBGuard daemon to log via Linux Audit (as opposed directly to a file), `AuditBackend` option in `/etc/usbguard/usbguard-daemon.conf` needs to be set to `LinuxAudit`.	Using the Linux Audit logging allows for centralized trace of events.
CCE-84210-4	Authorize Human Interface Devices and USB hubs in USBGuard daemon	To allow authorization of USB devices combining human interface device and hub capabilities by USBGuard daemon, add the line `allow with-interface match-all { 03:: 09:00:* }` to `/etc/usbguard/rules.conf`.	Without allowing Human Interface Devices, it might not be possible to interact with the system. Without allowing hubs, it might not be possible to use any USB devices on the system.
CCE-84213-8	Disable httpd Service	The `httpd` service can be disabled with the following command: $ sudo systemctl mask --now httpd.service	Running web server software provides a network-based avenue of attack, and should be disabled if not needed.
CCE-84215-3	The Chrony package is installed	System time should be synchronized between all systems in an environment. This is typically done by establishing an authoritative time server or set of servers and having all systems synchronize their clocks to them. The `chrony` package can be installed with the following command: $ sudo dnf install chrony	Time synchronization is important to support time sensitive security mechanisms like Kerberos and also ensures log files have consistent time records across the enterprise, which aids in forensic investigations.
CCE-84217-9	The Chronyd service is enabled	chrony is a daemon which implements the Network Time Protocol (NTP) is designed to synchronize system clocks across a variety of systems and use a source that is highly accurate. More information on chrony can be found at https://chrony-project.org/. Chrony can be configured to be a client and/or a server. To enable Chronyd service, you can run: `# systemctl enable chronyd.service` This recommendation only applies if chrony is in use on the system.	If chrony is in use on the system proper configuration is vital to ensuring time synchronization is working properly.
CCE-84218-7	A remote time server for Chrony is configured	`Chrony` is a daemon which implements the Network Time Protocol (NTP). It is designed to synchronize system clocks across a variety of systems and use a source that is highly accurate. More information on `chrony` can be found at https://chrony-project.org/. `Chrony` can be configured to be a client and/or a server. Add or edit server or pool lines to `/etc/chrony.conf` as appropriate: server <remote-server> Alternatively, server or pool directives can be specified in files included via `sourcedir` or `confdir` directives in `/etc/chrony.conf`. When using `sourcedir`, create `.sources` files in the specified directory: # In /etc/chrony.conf: sourcedir /etc/chrony/sources.d # In /etc/chrony/sources.d/ntp.sources: server 0.pool.ntp.org When using `confdir`, create `.conf` files in the specified directory: # In /etc/chrony.conf: confdir /etc/chrony/conf.d # In /etc/chrony/conf.d/ntp-servers.conf: pool 1.pool.ntp.org Multiple servers may be configured.	If `chrony` is in use on the system proper configuration is vital to ensuring time synchronization is working properly.
CCE-84221-1	Disable Kerberos by removing host keytab	Kerberos may rely on key distribution functions unapproved by Common Criteria. To prevent using Kerberos by system daemons, remove the Kerberos keytab files, especially `/etc/krb5.keytab`.	Some key derivation functions (KDF) in Kerberos are not FIPS-compatible
CCE-84223-7	Enable the Hardware RNG Entropy Gatherer Service	The Hardware RNG Entropy Gatherer service should be enabled. The `rngd` service can be enabled with the following command: $ sudo systemctl enable rngd.service	The `rngd` service feeds random data from hardware device to kernel random device.
CCE-84224-5	Install fapolicyd Package	The `fapolicyd` package can be installed with the following command: $ sudo dnf install fapolicyd	`fapolicyd` (File Access Policy Daemon) implements application whitelisting to decide file access rights.
CCE-84227-8	Enable the File Access Policy Service	The File Access Policy service should be enabled. The `fapolicyd` service can be enabled with the following command: $ sudo systemctl enable fapolicyd.service	The `fapolicyd` service (File Access Policy Daemon) implements application whitelisting to decide file access rights.
CCE-84228-6	Uninstall Automatic Bug Reporting Tool (abrt)	The Automatic Bug Reporting Tool (`abrt`) collects and reports crash data when an application crash is detected. Using a variety of plugins, abrt can email crash reports to system administrators, log crash reports to files, or forward crash reports to a centralized issue tracking system such as RHTSupport. The `abrt` package can be removed with the following command: $ sudo dnf remove abrt	Mishandling crash data could expose sensitive information about vulnerabilities in software executing on the system, as well as sensitive information from within a process's address space or registers.
CCE-84229-4	Disable Odd Job Daemon (oddjobd)	The `oddjobd` service exists to provide an interface and access control mechanism through which specified privileged tasks can run tasks for unprivileged client applications. Communication with `oddjobd` through the system message bus. The `oddjobd` service can be disabled with the following command: $ sudo systemctl mask --now oddjobd.service	The `oddjobd` service may provide necessary functionality in some environments, and can be disabled if it is not needed. Execution of tasks by privileged programs, on behalf of unprivileged ones, has traditionally been a source of privilege escalation security issues.
CCE-84231-0	Disable Apache Qpid (qpidd)	The `qpidd` service provides high speed, secure, guaranteed delivery services. It is an implementation of the Advanced Message Queuing Protocol. By default the qpidd service will bind to port 5672 and listen for connection attempts. The `qpidd` service can be disabled with the following command: $ sudo systemctl mask --now qpidd.service	The qpidd service is automatically installed when the `base` package selection is selected during installation. The qpidd service listens for network connections, which increases the attack surface of the system. If the system is not intended to receive AMQP traffic, then the `qpidd` service is not needed and should be disabled or removed.
CCE-84232-8	Disable KDump Kernel Crash Analyzer (kdump)	The `kdump` service provides a kernel crash dump analyzer. It uses the `kexec` system call to boot a secondary kernel ("capture" kernel) following a system crash, which can load information from the crashed kernel for analysis. The `kdump` service can be disabled with the following command: $ sudo systemctl mask --now kdump.service	Kernel core dumps may contain the full contents of system memory at the time of the crash. Kernel core dumps consume a considerable amount of disk space and may result in denial of service by exhausting the available space on the target file system partition. Unless the system is used for kernel development or testing, there is little need to run the kdump service.
CCE-84234-4	Disable Automatic Bug Reporting Tool (abrtd)	The Automatic Bug Reporting Tool (`abrtd`) daemon collects and reports crash data when an application crash is detected. Using a variety of plugins, abrtd can email crash reports to system administrators, log crash reports to files, or forward crash reports to a centralized issue tracking system such as RHTSupport. The `abrtd` service can be disabled with the following command: $ sudo systemctl mask --now abrtd.service	Mishandling crash data could expose sensitive information about vulnerabilities in software executing on the system, as well as sensitive information from within a process's address space or registers.
CCE-84235-1	Disable Red Hat Network Service (rhnsd)	The Red Hat Network service automatically queries Red Hat Network servers to determine whether there are any actions that should be executed, such as package updates. This only occurs if the system was registered to an RHN server or satellite and managed as such. The `rhnsd` service can be disabled with the following command: $ sudo systemctl mask --now rhnsd.service	Although systems management and patching is extremely important to system security, management by a system outside the enterprise enclave is not desirable for some environments. However, if the system is being managed by RHN or RHN Satellite Server the `rhnsd` daemon can remain on.
CCE-84236-9	Disable ntpdate Service (ntpdate)	The `ntpdate` service sets the local hardware clock by polling NTP servers when the system boots. It synchronizes to the NTP servers listed in `/etc/ntp/step-tickers` or `/etc/ntp.conf` and then sets the local hardware clock to the newly synchronized system time. The `ntpdate` service can be disabled with the following command: $ sudo systemctl mask --now ntpdate.service	The `ntpdate` service may only be suitable for systems which are rebooted frequently enough that clock drift does not cause problems between reboots. In any event, the functionality of the ntpdate service is now available in the ntpd program and should be considered deprecated.
CCE-84237-7	Disable Network Router Discovery Daemon (rdisc)	The `rdisc` service implements the client side of the ICMP Internet Router Discovery Protocol (IRDP), which allows discovery of routers on the local subnet. If a router is discovered then the local routing table is updated with a corresponding default route. By default this daemon is disabled. The `rdisc` service can be disabled with the following command: $ sudo systemctl mask --now rdisc.service	General-purpose systems typically have their network and routing information configured statically by a system administrator. Workstations or some special-purpose systems often use DHCP (instead of IRDP) to retrieve dynamic network configuration information.
CCE-84238-5	Uninstall squid Package	The `squid` package can be removed with the following command: $ sudo dnf remove squid	If there is no need to make the proxy server software available, removing it provides a safeguard against its activation.
CCE-84239-3	Disable Squid	The `squid` service can be disabled with the following command: $ sudo systemctl mask --now squid.service	Running proxy server software provides a network-based avenue of attack, and should be removed if not needed.
CCE-84240-1	Uninstall DHCP Server Package	If the system does not need to act as a DHCP server, the dhcp package can be uninstalled. The `dhcp-server` package can be removed with the following command: $ sudo dnf remove dhcp-server	Removing the DHCP server ensures that it cannot be easily or accidentally reactivated and disrupt network operation.
CCE-84241-9	Disable DHCP Service	The `dhcpd` service should be disabled on any system that does not need to act as a DHCP server. The `dhcpd` service can be disabled with the following command: $ sudo systemctl mask --now dhcpd.service	Unmanaged or unintentionally activated DHCP servers may provide faulty information to clients, interfering with the operation of a legitimate site DHCP server if there is one.
CCE-84242-7	Disable Dovecot Service	The `dovecot` service can be disabled with the following command: $ sudo systemctl mask --now dovecot.service	Running an IMAP or POP3 server provides a network-based avenue of attack, and should be disabled if not needed.
CCE-84243-5	Uninstall nfs-utils Package	The `nfs-utils` package can be removed with the following command: $ sudo dnf remove nfs-utils	`nfs-utils` provides a daemon for the kernel NFS server and related tools. This package also contains the `showmount` program. `showmount` queries the mount daemon on a remote host for information about the Network File System (NFS) server on the remote host. For example, `showmount` can display the clients which are mounted on that host.
CCE-84245-0	Disable rpcbind Service	The rpcbind utility maps RPC services to the ports on which they listen. RPC processes notify rpcbind when they start, registering the ports they are listening on and the RPC program numbers they expect to serve. The rpcbind service redirects the client to the proper port number so it can communicate with the requested service. If the system does not require RPC (such as for NFS servers) then this service should be disabled. The `rpcbind` service can be disabled with the following command: $ sudo systemctl mask --now rpcbind.service	If the system does not require rpc based services, it is recommended that rpcbind be disabled to reduce the attack surface.
CCE-84246-8	Mount Remote Filesystems with noexec	Add the `noexec` option to the fourth column of `/etc/fstab` for the line which controls mounting of any NFS mounts.	The noexec mount option causes the system not to execute binary files. This option must be used for mounting any file system not containing approved binary files as they may be incompatible. Executing files from untrusted file systems increases the opportunity for unprivileged users to attain unauthorized administrative access.
CCE-84247-6	Mount Remote Filesystems with nosuid	Add the `nosuid` option to the fourth column of `/etc/fstab` for the line which controls mounting of any NFS mounts.	NFS mounts should not present suid binaries to users. Only vendor-supplied suid executables should be installed to their default location on the local filesystem.
CCE-84251-8	Uninstall setroubleshoot-plugins Package	The SETroubleshoot plugins are used to analyze SELinux AVC data. The service provides information around configuration errors, unauthorized intrusions, and other potential errors. The `setroubleshoot-plugins` package can be removed with the following command: $ sudo dnf remove setroubleshoot-plugins	The SETroubleshoot service is an unnecessary daemon to have running on a server.
CCE-84252-6	Uninstall setroubleshoot-server Package	The SETroubleshoot service notifies desktop users of SELinux denials. The service provides information around configuration errors, unauthorized intrusions, and other potential errors. The `setroubleshoot-server` package can be removed with the following command: $ sudo dnf remove setroubleshoot-server	The SETroubleshoot service is an unnecessary daemon to have running on a server.
CCE-85867-0	Configure kernel to zero out memory before allocation	To configure the kernel to zero out memory before allocating it, add the `init_on_alloc=1` argument to the default GRUB 2 command line. To ensure that `init_on_alloc=1` is added as a kernel command line argument to newly installed kernels, add `init_on_alloc=1` to the default Grub2 command line for Linux operating systems. Modify the line within `/etc/default/grub` as shown below: GRUB_CMDLINE_LINUX="... init_on_alloc=1 ..." Run the following command to update command line for already installed kernels: # grubby --update-kernel=ALL --args="init_on_alloc=1" If the system is distributed as a bootable container image, GRUB2 can't be configured using the method described above, but the following method needs to be used instead. The kernel arguments should be set in `/usr/lib/bootc/kargs.d` in a TOML file that has the following form: # /usr/lib/bootc/kargs.d/10-example.toml kargs = ["init_on_alloc=1"] For more details on configuring kernel arguments in bootable container images, please refer to Bootc documentation.	When the kernel configuration option `init_on_alloc` is enabled, all page allocator and slab allocator memory will be zeroed when allocated, eliminating many kinds of "uninitialized heap memory" flaws, effectively preventing data leaks.
CCE-85868-8	Configure kernel to zero out memory before allocation in zIPL	To ensure that the kernel is configured to zero out memory before allocation, check that all boot entries in `/boot/loader/entries/*.conf` have `init_on_alloc=1` included in its options. To ensure that new kernels and boot entries continue to zero out memory before allocation, add `init_on_alloc=1` to `/etc/kernel/cmdline`.	When the kernel configuration option `init_on_alloc` is enabled, all page allocator and slab allocator memory will be zeroed when allocated, eliminating many kinds of "uninitialized heap memory" flaws, effectively preventing data leaks.
CCE-85869-6	System Audit Directories Must Be Owned By Root	All audit directories must be owned by root user. By default, the path for audit log is /var/log/audit/ . To properly set the owner of `/var/log/audit`, run the command: $ sudo chown root /var/log/audit	Unauthorized disclosure of audit records can reveal system and configuration data to attackers, thus compromising its confidentiality.
CCE-85873-8	Ensure PAM password complexity module is enabled in system-auth	To enable PAM password complexity in system-auth file: Edit the `password` section in `/etc/pam.d/system-auth` to show `password requisite pam_pwquality.so`.	Enabling PAM password complexity permits to enforce strong passwords and consequently makes the system less prone to dictionary attacks.
CCE-85878-7	Ensure PAM password complexity module is enabled in password-auth	To enable PAM password complexity in password-auth file: Edit the `password` section in `/etc/pam.d/password-auth` to show `password requisite pam_pwquality.so`.	Enabling PAM password complexity permits to enforce strong passwords and consequently makes the system less prone to dictionary attacks.
CCE-85879-5	Enable randomization of the page allocator	To enable randomization of the page allocator in the kernel, add the `page_alloc.shuffle=1` argument to the default GRUB 2 command line. To ensure that `page_alloc.shuffle=1` is added as a kernel command line argument to newly installed kernels, add `page_alloc.shuffle=1` to the default Grub2 command line for Linux operating systems. Modify the line within `/etc/default/grub` as shown below: GRUB_CMDLINE_LINUX="... page_alloc.shuffle=1 ..." Run the following command to update command line for already installed kernels: # grubby --update-kernel=ALL --args="page_alloc.shuffle=1" If the system is distributed as a bootable container image, GRUB2 can't be configured using the method described above, but the following method needs to be used instead. The kernel arguments should be set in `/usr/lib/bootc/kargs.d` in a TOML file that has the following form: # /usr/lib/bootc/kargs.d/10-example.toml kargs = ["page_alloc.shuffle=1"] For more details on configuring kernel arguments in bootable container images, please refer to Bootc documentation.	The `CONFIG_SHUFFLE_PAGE_ALLOCATOR` config option is primarily focused on improving the average utilization of a direct-mapped memory-side-cache. Aside of this performance effect, it also reduces predictability of page allocations in situations when the bad actor can crash the system and somehow leverage knowledge of (page) allocation order right after a fresh reboot, or can control the timing between a hot-pluggable memory node (as in NUMA node) and applications allocating memory ouf of that node. The `page_alloc.shuffle=1` kernel command line parameter then forces this functionality irrespectively of memory cache architecture.
CCE-85880-3	Enable randomization of the page allocator in zIPL	To enable the randomization of the page allocator in the kernel, check that all boot entries in `/boot/loader/entries/*.conf` have `page_alloc.shuffle=1` included in its options. To enable randomization of the page allocator also for newly installed kernels, add `page_alloc.shuffle=1` to `/etc/kernel/cmdline`.	The `CONFIG_SHUFFLE_PAGE_ALLOCATOR` config option is primarily focused on improving the average utilization of a direct-mapped memory-side-cache. Aside of this performance effect, it also reduces predictability of page allocations in situations when the bad actor can crash the system and somehow leverage knowledge of (page) allocation order right after a fresh reboot, or can control the timing between a hot-pluggable memory node (as in NUMA node) and applications allocating memory ouf of that node. The `page_alloc.shuffle=1` kernel command line parameter then forces this functionality irrespectively of memory cache architecture.
CCE-85883-7	Add hidepid Option to /proc	The `hidepid` mount option is applicable to `/proc` and is used to control who can access the information in `/proc/[pid]` directories. The option can have one of the following values: 0: Everybody may access all /proc/[pid] directories. 1: Users may not access files and subdirectories inside any /proc/[pid] directories but their own. The /proc/[pid] directories themselves remain visible. 2: Same as for mode 1, but in addition the /proc/[pid] directories belonging to other users become invisible. For example, if you choose the value 2: Add the `hidepid=2` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/proc`.	Users should not be able to see and access directories within /proc, which are not related to their own processes in a system. Otherwise, sensitive information from other users could be seem.
CCE-85884-5	Enable Kernel Parameter to Enforce DAC on FIFOs	To set the runtime status of the `fs.protected_fifos` kernel parameter, run the following command: $ sudo sysctl -w fs.protected_fifos=2 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: fs.protected_fifos = 2	This parameter is available since Linux Kernel 4.19 and allows to prohibit opening FIFOs that are not owned by the user in world and group writeable sticky directories. It avoids unintentional writes to an attacker-controlled FIFO where a program expects to create the regular file.
CCE-85885-2	Enable Kernel Parameter to Enforce DAC on Regular files	To set the runtime status of the `fs.protected_regular` kernel parameter, run the following command: $ sudo sysctl -w fs.protected_regular=2 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: fs.protected_regular = 2	This parameter is available since Linux Kernel 4.19 and allows to prohibit opening "regular" files that are not owned by the user in world and group writeable sticky directories. It avoids writes to an attacker-controlled regular file, for example, when a program expects to create the regular file.
CCE-85893-6	Perform general configuration of Audit for OSPP (AArch64)	Configure some basic `Audit` parameters specific for OSPP profile. In particular, configure `Audit` to watch for direct modification of files storing system user and group information, and usage of applications with special rights which can change system configuration. Further audited events include access to audit log it self, attempts to Alter Process and Session Initiation Information, and attempts to modify MAC controls. The following rules configure audit as described above: ## The purpose of these rules is to meet the requirements for Operating ## System Protection Profile (OSPP)v4.2. These rules depends on having ## the following rule files copied to /etc/audit/rules.d: ## ## 10-base-config.rules, 11-loginuid.rules, ## 30-ospp-v42-1-create-failed.rules, 30-ospp-v42-1-create-success.rules, ## 30-ospp-v42-2-modify-failed.rules, 30-ospp-v42-2-modify-success.rules, ## 30-ospp-v42-3-access-failed.rules, 30-ospp-v42-3-access-success.rules, ## 30-ospp-v42-4-delete-failed.rules, 30-ospp-v42-4-delete-success.rules, ## 30-ospp-v42-5-perm-change-failed.rules, ## 30-ospp-v42-5-perm-change-success.rules, ## 30-ospp-v42-6-owner-change-failed.rules, ## 30-ospp-v42-6-owner-change-success.rules ## ## original copies may be found in /usr/share/audit/sample-rules/ ## User add delete modify. This is covered by pam. However, someone could ## open a file and directly create or modify a user, so we'll watch passwd and ## shadow for writes -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=user-modify -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=user-modify -a always,exit -F arch=b32 -S open -F a1&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=user-modify -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify -a always,exit -F arch=b32 -S open -F a1&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify ## User enable and disable. This is entirely handled by pam. ## Group add delete modify. This is covered by pam. However, someone could ## open a file and directly create or modify a user, so we'll watch group and ## gshadow for writes -a always,exit -F arch=b32 -F path=/etc/passwd -F perm=wa -F auid>=1000 -F auid!=unset -F key=user-modify -a always,exit -F arch=b64 -F path=/etc/passwd -F perm=wa -F auid>=1000 -F auid!=unset -F key=user-modify -a always,exit -F arch=b32 -F path=/etc/shadow -F perm=wa -F auid>=1000 -F auid!=unset -F key=user-modify -a always,exit -F arch=b64 -F path=/etc/shadow -F perm=wa -F auid>=1000 -F auid!=unset -F key=user-modify -a always,exit -F arch=b32 -F path=/etc/group -F perm=wa -F auid>=1000 -F auid!=unset -F key=group-modify -a always,exit -F arch=b64 -F path=/etc/group -F perm=wa -F auid>=1000 -F auid!=unset -F key=group-modify -a always,exit -F arch=b32 -F path=/etc/gshadow -F perm=wa -F auid>=1000 -F auid!=unset -F key=group-modify -a always,exit -F arch=b64 -F path=/etc/gshadow -F perm=wa -F auid>=1000 -F auid!=unset -F key=group-modify ## Use of special rights for config changes. This would be use of setuid ## programs that relate to user accts. This is not all setuid apps because ## requirements are only for ones that affect system configuration. -a always,exit -F arch=b32 -F path=/usr/sbin/unix_chkpwd -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F arch=b64 -F path=/usr/sbin/unix_chkpwd -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F arch=b32 -F path=/usr/sbin/usernetctl -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F arch=b64 -F path=/usr/sbin/usernetctl -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F arch=b32 -F path=/usr/sbin/userhelper -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F arch=b64 -F path=/usr/sbin/userhelper -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F arch=b32 -F path=/usr/sbin/seunshare -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F arch=b64 -F path=/usr/sbin/seunshare -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F arch=b32 -F path=/usr/bin/mount -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F arch=b64 -F path=/usr/bin/mount -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F arch=b32 -F path=/usr/bin/newgrp -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F arch=b64 -F path=/usr/bin/newgrp -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F arch=b32 -F path=/usr/bin/newuidmap -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F arch=b64 -F path=/usr/bin/newuidmap -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F arch=b32 -F path=/usr/bin/gpasswd -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F arch=b64 -F path=/usr/bin/gpasswd -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F arch=b32 -F path=/usr/bin/newgidmap -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F arch=b64 -F path=/usr/bin/newgidmap -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F arch=b32 -F path=/usr/bin/umount -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F arch=b64 -F path=/usr/bin/umount -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F arch=b32 -F path=/usr/bin/passwd -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F arch=b64 -F path=/usr/bin/passwd -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F arch=b32 -F path=/usr/bin/crontab -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F arch=b64 -F path=/usr/bin/crontab -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F arch=b32 -F path=/usr/bin/at -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F arch=b64 -F path=/usr/bin/at -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F arch=b32 -F path=/usr/sbin/grub2-set-bootflag -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F arch=b64 -F path=/usr/sbin/grub2-set-bootflag -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes ## Privilege escalation via su or sudo. This is entirely handled by pam. ## Special case for systemd-run. It is not audit aware, specifically watch it -a always,exit -F arch=b32 -F path=/usr/bin/systemd-run -F perm=x -F auid!=unset -F key=maybe-escalation -a always,exit -F arch=b64 -F path=/usr/bin/systemd-run -F perm=x -F auid!=unset -F key=maybe-escalation ## Special case for pkexec. It is not audit aware, specifically watch it -a always,exit -F arch=b32 -F path=/usr/bin/pkexec -F perm=x -F key=maybe-escalation -a always,exit -F arch=b64 -F path=/usr/bin/pkexec -F perm=x -F key=maybe-escalation ## Watch for configuration changes to privilege escalation. -a always,exit -F arch=b32 -F path=/etc/sudoers -F perm=wa -F key=special-config-changes -a always,exit -F arch=b64 -F path=/etc/sudoers -F perm=wa -F key=special-config-changes -a always,exit -F arch=b32 -F dir=/etc/sudoers.d/ -F perm=wa -F key=special-config-changes -a always,exit -F arch=b64 -F dir=/etc/sudoers.d/ -F perm=wa -F key=special-config-changes ## Audit log access -a always,exit -F arch=b32 -F dir=/var/log/audit/ -F perm=r -F auid>=1000 -F auid!=unset -F key=access-audit-trail -a always,exit -F arch=b64 -F dir=/var/log/audit/ -F perm=r -F auid>=1000 -F auid!=unset -F key=access-audit-trail ## Attempts to Alter Process and Session Initiation Information -a always,exit -F arch=b32 -F path=/var/run/utmp -F perm=wa -F auid>=1000 -F auid!=unset -F key=session -a always,exit -F arch=b64 -F path=/var/run/utmp -F perm=wa -F auid>=1000 -F auid!=unset -F key=session -a always,exit -F arch=b32 -F path=/var/log/btmp -F perm=wa -F auid>=1000 -F auid!=unset -F key=session -a always,exit -F arch=b64 -F path=/var/log/btmp -F perm=wa -F auid>=1000 -F auid!=unset -F key=session -a always,exit -F arch=b32 -F path=/var/log/wtmp -F perm=wa -F auid>=1000 -F auid!=unset -F key=session -a always,exit -F arch=b64 -F path=/var/log/wtmp -F perm=wa -F auid>=1000 -F auid!=unset -F key=session ## Attempts to modify MAC controls -a always,exit -F arch=b32 -F dir=/etc/selinux/ -F perm=wa -F auid>=1000 -F auid!=unset -F key=MAC-policy -a always,exit -F arch=b64 -F dir=/etc/selinux/ -F perm=wa -F auid>=1000 -F auid!=unset -F key=MAC-policy ## Software updates. This is entirely handled by rpm. ## System start and shutdown. This is entirely handled by systemd ## Kernel Module loading. This is handled in 43-module-load.rules ## Application invocation. The requirements list an optional requirement ## FPT_SRP_EXT.1 Software Restriction Policies. This event is intended to ## state results from that policy. This would be handled entirely by ## that daemon. Load new Audit rules into kernel by running: augenrules --load Note: This rule uses a special set of Audit rules to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are aligned with your needs.	Auditing of events listed in the description provides data for monitoring and investigation of potentially malicious events e.g. tampering with `Audit` logs, malicious access to files storing information about system users and groups etc.
CCE-85898-5	Configure auditing of unsuccessful file creations (AArch64)	Ensure that unsuccessful attempts to create a file are audited. The following rules configure audit as described above: ## Unsuccessful file creation (open with O_CREAT) -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-create -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-create -a always,exit -F arch=b32 -S open -F a1&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-create -a always,exit -F arch=b32 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-create -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-create -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-create -a always,exit -F arch=b32 -S open -F a1&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-create -a always,exit -F arch=b32 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-create Load new Audit rules into kernel by running: augenrules --load Note: This rule uses a special set of Audit rules to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are aligned with your needs.	Unsuccessful file creations might be a sign of a malicious action being performed on the system. Keeping log of such events helps in monitoring and investigation of such actions.
CCE-85903-3	Disable Geolocation in GNOME3	`GNOME` allows the clock and applications to track and access location information. This setting should be disabled as applications should not track system location. To configure the system to disable location tracking, add or set `enabled` to `false` in `/etc/dconf/db/local.d/00-security-settings`. For example: [org/gnome/system/location] enabled=false To configure the clock to disable location tracking, add or set `geolocation` to `false` in `/etc/dconf/db/local.d/00-security-settings`. For example: [org/gnome/clocks] geolocation=false Once the settings have been added, add a lock to `/etc/dconf/db/local.d/locks/00-security-settings-lock` to prevent user modification. For example: /org/gnome/system/location/enabled /org/gnome/clocks/geolocation After the settings have been set, run `dconf update`.	Power settings should not be enabled on systems that are not mobile devices. Enabling power settings on non-mobile devices could have unintended processing consequences on standard systems.
CCE-85905-8	Configure auditing of successful file creations (AArch64)	Ensure that successful attempts to create a file are audited. The following rules configure audit as described above: ## Successful file creation (open with O_CREAT) -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&0100 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-create -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&0100 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-create -a always,exit -F arch=b32 -S open -F a1&0100 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-create -a always,exit -F arch=b32 -S creat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-create Load new Audit rules into kernel by running: augenrules --load Note: This rule uses a special set of Audit rules to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are aligned with your needs.	Auditing of successful attempts to create a file helps in investigation of actions which happened on the system.
CCE-85907-4	Configure auditing of unsuccessful file modifications (AARch64)	Ensure that unsuccessful attempts to modify a file are audited. The following rules configure audit as described above: ## Unsuccessful file modifications (open for write or truncate) -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification -a always,exit -F arch=b32 -S open -F a1&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification -a always,exit -F arch=b32 -S truncate,ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification -a always,exit -F arch=b64 -S truncate,ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification -a always,exit -F arch=b32 -S open -F a1&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification -a always,exit -F arch=b32 -S truncate,ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification -a always,exit -F arch=b64 -S truncate,ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification Load new Audit rules into kernel by running: augenrules --load Note: This rule uses a special set of Audit rules to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are aligned with your needs.	Unsuccessful file modifications might be a sign of a malicious action being performed on the system. Auditing of such events helps in detection and investigation of such actions.
CCE-85909-0	Configure auditing of successful file modifications (AArch64)	Ensure that successful attempts to modify a file are audited. The following rules configure audit as described above: ## Successful file modifications (open for write or truncate) -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&01003 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-modification -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&01003 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-modification -a always,exit -F arch=b32 -S open -F a1&01003 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-modification -a always,exit -F arch=b32 -S truncate,ftruncate -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-modification -a always,exit -F arch=b64 -S truncate,ftruncate -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-modification Load new Audit rules into kernel by running: augenrules --load Note: This rule uses a special set of Audit rules to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are aligned with your needs.	Auditing of successful attempts to modify a file helps in investigation of actions which happened on the system.
CCE-85917-3	Record Unsuccessful Delete Attempts to Files - unlink	The audit system should collect unsuccessful file deletion attempts for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`. If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file. -a always,exit -F arch=b32 -S unlink -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete -a always,exit -F arch=b32 -S unlink -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete If the system is 64 bit then also add the following lines: -a always,exit -F arch=b64 -S unlink -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete -a always,exit -F arch=b64 -S unlink -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete	Unsuccessful attempts to delete files could be an indicator of malicious activity on a system. Auditing these events could serve as evidence of potential system compromise.
CCE-85920-7	Ensure No Device Files are Unlabeled by SELinux	Device files, which are used for communication with important system resources, should be labeled with proper SELinux types. If any device files carry the SELinux type `device_t` or `unlabeled_t`, report the bug so that policy can be corrected. Supply information about what the device is and what programs use it. To check for incorrectly labeled device files, run following commands: $ sudo find /dev -context :device_t: $ -type c -o -type b $ -printf "%p %Z\n" $ sudo find /dev -context :unlabeled_t: $ -type c -o -type b $ -printf "%p %Z\n" It should produce no output in a well-configured system.	If a device file carries the SELinux type `device_t` or `unlabeled_t`, then SELinux cannot properly restrict access to the device file.
CCE-85922-3	Configure auditing of unsuccessful file accesses (AArch64)	Ensure that unsuccessful attempts to access a file are audited. The following rules configure audit as described above: ## Unsuccessful file access (any other opens) This has to go last. -a always,exit -F arch=b32 -S open,openat,openat2,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-access -a always,exit -F arch=b64 -S openat,openat2,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-access -a always,exit -F arch=b32 -S open,openat,openat2,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-access -a always,exit -F arch=b64 -S openat,openat2,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-access Load new Audit rules into kernel by running: augenrules --load Note: This rule uses a special set of Audit rules to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are aligned with your needs.	Unsuccessful attempts to access a file might be signs of malicious activity happening within the system. Auditing of such activities helps in their monitoring and investigation.
CCE-85924-9	Configure auditing of successful file accesses (AArch64)	Ensure that successful attempts to access a file are audited. The following rules configure audit as described above: ## Successful file access (any other opens) This has to go last. ## These next two are likely to result in a whole lot of events -a always,exit -F arch=b32 -S open,openat,openat2,open_by_handle_at -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-access -a always,exit -F arch=b64 -S openat,openat2,open_by_handle_at -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-access Load new Audit rules into kernel by running: augenrules --load Note: This rule uses a special set of Audit rules to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are aligned with your needs.	Auditing of successful attempts to access a file helps in investigation of activities performed on the system.
CCE-85925-6	Verify the UEFI Boot Loader grub.cfg Permissions	File permissions for `/boot/grub2/grub.cfg` should be set to 700. To properly set the permissions of `/boot/grub2/grub.cfg`, run the command: $ sudo chmod 700 /boot/grub2/grub.cfg	Proper permissions ensure that only the root user can modify important boot parameters.
CCE-85931-4	Ensure journald is configured to compress large log files	The journald system can compress large log files to avoid fill the system disk.	Log files that are not properly compressed run the risk of growing so large that they fill up the log partition. Valuable logging information could be lost if the log partition becomes full.
CCE-85937-1	Configure auditing of unsuccessful file deletions (AArch64)	Ensure that unsuccessful attempts to delete a file are audited. The following rules configure audit as described above: ## Unsuccessful file delete -a always,exit -F arch=b32 -S unlink,unlinkat,rename,renameat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete -a always,exit -F arch=b64 -S unlinkat,renameat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete -a always,exit -F arch=b32 -S unlink,unlinkat,rename,renameat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete -a always,exit -F arch=b64 -S unlinkat,renameat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete Load new Audit rules into kernel by running: augenrules --load Note: This rule uses a special set of Audit rules to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are aligned with your needs.	Unsuccessful attempts to delete a file might be signs of malicious activities. Auditing of such events help in monitoring and investigating of such activities.
CCE-85939-7	Configure auditing of successful file deletions (AArch64)	Ensure that successful attempts to delete a file are audited. The following rules configure audit as described above: ## Successful file delete -a always,exit -F arch=b32 -S unlink,unlinkat,rename,renameat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-delete -a always,exit -F arch=b64 -S unlinkat,renameat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-delete Load new Audit rules into kernel by running: augenrules --load Note: This rule uses a special set of Audit rules to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are aligned with your needs.	Auditing of successful attempts to delete a file may help in monitoring and investigation of activities performed on the system.
CCE-85941-3	Enable systemd-journald Service	The `systemd-journald` service is an essential component of systemd. The `systemd-journald` service can be enabled with the following command: $ sudo systemctl enable systemd-journald.service	In the event of a system failure, Red Hat Enterprise Linux 9 must preserve any information necessary to determine cause of failure and any information necessary to return to operations with least disruption to system processes.
CCE-85942-1	Configure auditing of unsuccessful ownership changes (AArch64)	Ensure that unsuccessful attempts to change an ownership of files or directories are audited. The following rules configure audit as described above: ## Unsuccessful ownership change -a always,exit -F arch=b32 -S lchown,fchown,chown,fchownat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-owner-change -a always,exit -F arch=b64 -S fchown,fchownat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-owner-change -a always,exit -F arch=b32 -S lchown,fchown,chown,fchownat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-owner-change -a always,exit -F arch=b64 -S fchown,fchownat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-owner-change Load new Audit rules into kernel by running: augenrules --load Note: This rule uses a special set of Audit rules to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are aligned with your needs.	Unsuccessful attempts to change an ownership of files or directories might be signs of a malicious activity. Having such events audited helps in monitoring and investigation of such activities.
CCE-85946-2	Set PAM Password Hashing Algorithm - password-auth	The PAM system service can be configured to only store encrypted representations of passwords. In `/etc/pam.d/password-auth`, the `password` section of the file controls which PAM modules to execute during a password change. Set the `pam_unix.so` module in the `password` section to include the option `sha512` and no other hashing algorithms as shown below: password sufficient pam_unix.so `sha512` other arguments... This will help ensure that new passwords for local users will be stored using the `sha512` algorithm.	Passwords need to be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. Passwords that are encrypted with a weak algorithm are no more protected than if they are kept in plain text. This setting ensures user and group account administration utilities are configured to store only encrypted representations of passwords. Additionally, the `crypt_style` configuration option in `/etc/libuser.conf` ensures the use of a strong hashing algorithm that makes password cracking attacks more difficult.
CCE-85948-8	Configure auditing of successful ownership changes (AArch64)	Ensure that successful attempts to change an ownership of files or directories are audited. The following rules configure audit as described above: ## Successful ownership change -a always,exit -F arch=b32 -S lchown,fchown,chown,fchownat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-owner-change -a always,exit -F arch=b64 -S fchown,fchownat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-owner-change Load new Audit rules into kernel by running: augenrules --load Note: This rule uses a special set of Audit rules to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are aligned with your needs.	Auditing of successful ownership changes of files or directories helps in monitoring or investigating of activities performed on the system.
CCE-85950-4	Configure auditing of unsuccessful permission changes (AArch64)	Ensure that unsuccessful attempts to change file or directory permissions are audited. The following rules configure audit as described above: ## Unsuccessful permission change -a always,exit -F arch=b32 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-perm-change -a always,exit -F arch=b64 -S fchmod,fchmodat,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-perm-change -a always,exit -F arch=b32 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-perm-change -a always,exit -F arch=b64 -S fchmod,fchmodat,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-perm-change Load new Audit rules into kernel by running: augenrules --load Note: This rule uses a special set of Audit rules to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are aligned with your needs.	Unsuccessful attempts to change permissions of files or directories might be signs of malicious activity. Having such events audited helps in monitoring and investigation of such activities.
CCE-85952-0	Configure auditing of successful permission changes (AArch64)	Ensure that successful attempts to modify permissions of files or directories are audited. The following rules configure audit as described above: ## Successful permission change -a always,exit -F arch=b32 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change -a always,exit -F arch=b64 -S fchmod,fchmodat,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change Load new Audit rules into kernel by running: augenrules --load Note: This rule uses a special set of Audit rules to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are aligned with your needs.	Auditing successful file or directory permission changes helps in monitoring and investigating of activities performed on the system.
CCE-85956-1	Ensure auditd Collects Information on the Use of Privileged Commands - init	At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -a always,exit -F path=/usr/sbin/init -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`: -a always,exit -F path=/usr/sbin/init -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged	Misuse of the init command may cause availability issues for the system.
CCE-85957-9	Ensure auditd Collects Information on the Use of Privileged Commands - poweroff	At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -a always,exit -F path=/usr/sbin/poweroff -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`: -a always,exit -F path=/usr/sbin/poweroff -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged	Misuse of the poweroff command may cause availability issues for the system.
CCE-85958-7	Ensure auditd Collects Information on the Use of Privileged Commands - reboot	At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -a always,exit -F path=/usr/sbin/reboot -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`: -a always,exit -F path=/usr/sbin/reboot -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged	Misuse of the reboot command may cause availability issues for the system.
CCE-85959-5	Ensure auditd Collects Information on the Use of Privileged Commands - shutdown	At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -a always,exit -F path=/usr/sbin/shutdown -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`: -a always,exit -F path=/usr/sbin/shutdown -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged	Misuse of the shutdown command may cause availability issues for the system.
CCE-85960-3	Verify ip6tables Enabled if Using IPv6	The `ip6tables` service can be enabled with the following command: $ sudo systemctl enable ip6tables.service	The `ip6tables` service provides the system's host-based firewalling capability for IPv6 and ICMPv6.
CCE-85962-9	Verify iptables Enabled	The `iptables` service can be enabled with the following command: $ sudo systemctl enable iptables.service	The `iptables` service provides the system's host-based firewalling capability for IPv4 and ICMP.
CCE-85966-0	Set Default ip6tables Policy for Incoming Packets	To set the default policy to DROP (instead of ACCEPT) for the built-in INPUT chain which processes incoming packets, add or correct the following line in `/etc/sysconfig/ip6tables`: :INPUT DROP [0:0] If changes were required, reload the ip6tables rules: $ sudo service ip6tables reload	In `ip6tables`, the default policy is applied only after all the applicable rules in the table are examined for a match. Setting the default policy to `DROP` implements proper design for a firewall, i.e. any packets which are not explicitly permitted should not be accepted.
CCE-85967-8	Disallow Configuration to Bypass Password Requirements for Privilege Escalation	Verify the operating system is not configured to bypass password requirements for privilege escalation. Check the configuration of the "/etc/pam.d/sudo" file with the following command: $ sudo grep pam_succeed_if /etc/pam.d/sudo If any occurrences of "pam_succeed_if" is returned from the command, this is a finding.	Without re-authentication, users may access resources or perform tasks for which they do not have authorization. When operating systems provide the capability to escalate a functional capability, it is critical the user re-authenticate.
CCE-85969-4	Set Default iptables Policy for Incoming Packets	To set the default policy to DROP (instead of ACCEPT) for the built-in INPUT chain which processes incoming packets, add or correct the following line in `/etc/sysconfig/iptables`: :INPUT DROP [0:0]	In `iptables` the default policy is applied only after all the applicable rules in the table are examined for a match. Setting the default policy to `DROP` implements proper design for a firewall, i.e. any packets which are not explicitly permitted should not be accepted.
CCE-85971-0	Ensure Users Cannot Change GNOME3 Session Idle Settings	If not already configured, ensure that users cannot change GNOME3 session idle settings by adding `/org/gnome/desktop/session/idle-delay` to `/etc/dconf/db/local.d/locks/00-security-settings-lock` to prevent user modification. For example: /org/gnome/desktop/session/idle-delay After the settings have been set, run `dconf update`.	A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not logout because of the temporary nature of the absence. Rather than relying on the user to manually lock their operating system session prior to vacating the vicinity, GNOME desktops can be configured to identify when a user's session has idled and take action to initiate the session lock. As such, users should not be allowed to change session settings.
CCE-85972-8	Ensure There Are No Accounts With Blank or Null Passwords	Check the "/etc/shadow" file for blank passwords with the following command: $ sudo awk -F: '!$2 {print $1}' /etc/shadow If the command returns any results, this is a finding. Configure all accounts on the system to have a password or lock the account with the following commands: Perform a password reset: $ sudo passwd [username] Lock an account: $ sudo passwd -l [username]	If an account has an empty password, anyone could log in and run commands with the privileges of that account. Accounts with empty passwords should never be used in operational environments.
CCE-85974-4	Uninstall httpd Package	The `httpd` package can be removed with the following command: $ sudo dnf remove httpd	If there is no need to make the web server software available, removing it provides a safeguard against its activation.
CCE-85977-7	Uninstall dovecot Package	The `dovecot` package can be removed with the following command: $ sudo dnf remove dovecot	If there is no need to make the Dovecot software available, removing it provides a safeguard against its activation.
CCE-85979-3	Uninstall Samba Package	The `samba` package can be removed with the following command: $ sudo dnf remove samba	If there is no need to make the Samba software available, removing it provides a safeguard against its activation.
CCE-85981-9	Uninstall net-snmp Package	The `net-snmp` package provides the snmpd service. The `net-snmp` package can be removed with the following command: $ sudo dnf remove net-snmp	If there is no need to run SNMP server software, removing the package provides a safeguard against its activation.
CCE-85984-3	The Postfix package is installed	A mail server is required for sending emails. The `postfix` package can be installed with the following command: $ sudo dnf install postfix	Emails can be used to notify designated personnel about important system events such as failures or warnings.
CCE-85985-0	Configure auditing of successful file creations (ppc64le)	Ensure that successful attempts to create a file are audited. The following rules configure audit as described above: ## Successful file creation (open with O_CREAT) -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&0100 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-create -a always,exit -F arch=b64 -S open -F a1&0100 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-create -a always,exit -F arch=b64 -S creat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-create Load new Audit rules into kernel by running: augenrules --load Note: This rule uses a special set of Audit rules to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are aligned with your needs.	Auditing of successful attempts to create a file helps in investigation of actions which happened on the system.
CCE-85986-8	Disable Recovery Booting	Red Hat Enterprise Linux 9 systems support an "recovery boot" option that can be used to prevent services from being started. The `GRUB_DISABLE_RECOVERY` configuration option in `/etc/default/grub` should be set to `true` to disable the generation of recovery mode menu entries. It is also required to change the runtime configuration, run: $ sudo grubby --update-kernel=ALL	Using recovery boot, the console user could disable auditing, firewalls, or other services, weakening system security.
CCE-85988-4	Configure auditing of unsuccessful ownership changes (ppc64le)	Ensure that unsuccessful attempts to change an ownership of files or directories are audited. The following rules configure audit as described above: ## Unsuccessful ownership change -a always,exit -F arch=b64 -S lchown,fchown,chown,fchownat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-owner-change -a always,exit -F arch=b64 -S lchown,fchown,chown,fchownat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-owner-change Load new Audit rules into kernel by running: augenrules --load Note: This rule uses a special set of Audit rules to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are aligned with your needs.	Unsuccessful attempts to change an ownership of files or directories might be signs of a malicious activity. Having such events audited helps in monitoring and investigation of such activities.
CCE-85990-0	Authorize Human Interface Devices in USBGuard daemon	To allow authorization of Human Interface Devices (keyboard, mouse) by USBGuard daemon, add the line `allow with-interface match-all { 03:: }` to `/etc/usbguard/rules.conf`.	Without allowing Human Interface Devices, it might not be possible to interact with the system.
CCE-85991-8	Configure audit according to OSPP requirements	Configure audit to meet requirements for Operating System Protection Profile (OSPP) v4.2.1. Audit defines groups of rules in `/usr/share/doc/audit/rules` to satisfy specific policies. To fulfill requirements for compliance with OSPP v4.2.1, the following files are necessary: /usr/share/doc/audit/rules/10-base-config.rules /usr/share/doc/audit/rules/11-loginuid.rules /usr/share/doc/audit/rules/30-ospp-v42.rules /usr/share/doc/audit/rules/43-module-load.rules Copy the files from `/usr/share/doc/audit/rules` to `/etc/audit/rules.d`: cp /usr/share/doc/audit*/rules/{10-base-config,11-loginuid,30-ospp-v42,43-module-load}.rules /etc/audit/rules.d/	The audit rules defined in `/usr/share/doc/audit/rules` are the recommended way to meet compliance with OSPP v4.2.1.
CCE-85996-7	Ensure journald is configured to send logs to rsyslog	Data from journald may be stored in volatile memory or persisted locally. Utilities exist to accept remote export of journald logs.	Storing log data on a remote host protects log integrity from local attacks. If an attacker gains root access on the local system, they could tamper with or remove log data that is stored on the local system.
CCE-85997-5	Configure auditing of unsuccessful file creations (ppc64le)	Ensure that unsuccessful attempts to create a file are audited. The following rules configure audit as described above: ## Unsuccessful file creation (open with O_CREAT) -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-create -a always,exit -F arch=b64 -S open -F a1&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-create -a always,exit -F arch=b64 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-create -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-create -a always,exit -F arch=b64 -S open -F a1&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-create -a always,exit -F arch=b64 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-create Load new Audit rules into kernel by running: augenrules --load Note: This rule uses a special set of Audit rules to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are aligned with your needs.	Unsuccessful file creations might be a sign of a malicious action being performed on the system. Keeping log of such events helps in monitoring and investigation of such actions.
CCE-85998-3	Configure auditing of successful ownership changes (ppc64le)	Ensure that successful attempts to change an ownership of files or directories are audited. The following rules configure audit as described above: ## Successful ownership change -a always,exit -F arch=b64 -S lchown,fchown,chown,fchownat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-owner-change Load new Audit rules into kernel by running: augenrules --load Note: This rule uses a special set of Audit rules to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are aligned with your needs.	Auditing of successful ownership changes of files or directories helps in monitoring or investigating of activities performed on the system.
CCE-85999-1	Configure auditing of successful file accesses (ppc64le)	Ensure that successful attempts to access a file are audited. The following rules configure audit as described above: ## Successful file access (any other opens) This has to go last. ## These next two are likely to result in a whole lot of events -a always,exit -F arch=b64 -S open,openat,openat2,open_by_handle_at -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-access Load new Audit rules into kernel by running: augenrules --load Note: This rule uses a special set of Audit rules to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are aligned with your needs.	Auditing of successful attempts to access a file helps in investigation of activities performed on the system.
CCE-86000-7	Configure auditing of unsuccessful permission changes (ppc64le)	Ensure that unsuccessful attempts to change file or directory permissions are audited. The following rules configure audit as described above: ## Unsuccessful permission change -a always,exit -F arch=b64 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-perm-change -a always,exit -F arch=b64 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-perm-change Load new Audit rules into kernel by running: augenrules --load Note: This rule uses a special set of Audit rules to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are aligned with your needs.	Unsuccessful attempts to change permissions of files or directories might be signs of malicious activity. Having such events audited helps in monitoring and investigation of such activities.
CCE-86001-5	Configure auditing of unsuccessful file accesses (ppc64le)	Ensure that unsuccessful attempts to access a file are audited. The following rules configure audit as described above: ## Unsuccessful file access (any other opens) This has to go last. -a always,exit -F arch=b64 -S open,openat,openat2,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-access -a always,exit -F arch=b64 -S open,openat,openat2,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-access Load new Audit rules into kernel by running: augenrules --load Note: This rule uses a special set of Audit rules to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are aligned with your needs.	Unsuccessful attempts to access a file might be signs of malicious activity happening within the system. Auditing of such activities helps in their monitoring and investigation.
CCE-86002-3	Configure auditing of successful permission changes (ppc64le)	Ensure that successful attempts to modify permissions of files or directories are audited. The following rules configure audit as described above: ## Successful permission change -a always,exit -F arch=b64 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change Load new Audit rules into kernel by running: augenrules --load Note: This rule uses a special set of Audit rules to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are aligned with your needs.	Auditing successful file or directory permission changes helps in monitoring and investigating of activities performed on the system.
CCE-86003-1	Configure file name of core dumps	To set the runtime status of the `kernel.core_uses_pid` kernel parameter, run the following command: $ sudo sysctl -w kernel.core_uses_pid=0 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: kernel.core_uses_pid = 0	The default coredump filename is `core`. By setting `core_uses_pid` to `1`, the coredump filename becomes `core.PID`. If `core_pattern` does not include `%p` (default does not) and `core_uses_pid` is set, then `.PID` will be appended to the filename. When combined with `kernel.core_pattern = ""` configuration, it is ensured that no core dumps are generated and also no confusing error messages are printed by a shell.
CCE-86005-6	Disable storing core dumps	The `kernel.core_pattern` option specifies the core dumpfile pattern name. It can be set to an empty string. In this case, the kernel behaves differently based on another related option. If `kernel.core_uses_pid` is set to `1`, then a file named as `.PID` (where `PID` is process ID of the crashed process) is created in the working directory. If `kernel.core_uses_pid` is set to `0`, no coredump is saved. To set the runtime status of the `kernel.core_pattern` kernel parameter, run the following command: $ sudo sysctl -w kernel.core_pattern= To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: kernel.core_pattern =	A core dump includes a memory image taken at the time the operating system terminates an application. The memory image could contain sensitive data and is generally useful only for developers trying to debug problems.
CCE-86010-6	Verify /boot/grub2/user.cfg Group Ownership	The file `/boot/grub2/user.cfg` should be group-owned by the `root` group to prevent reading or modification of the file. To properly set the group owner of `/boot/grub2/user.cfg`, run the command: $ sudo chgrp root /boot/grub2/user.cfg	The `root` group is a highly-privileged group. Furthermore, the group-owner of this file should not have any access privileges anyway. Non-root users who read the boot parameters may be able to identify weaknesses in security upon boot and be able to exploit them.
CCE-86013-0	Verify /boot/grub2/user.cfg Group Ownership	The file `/boot/grub2/user.cfg` should be group-owned by the `root` group to prevent reading or modification of the file. To properly set the group owner of `/boot/grub2/user.cfg`, run the command: $ sudo chgrp root /boot/grub2/user.cfg	The `root` group is a highly-privileged group. Furthermore, the group-owner of this file should not have any access privileges anyway. Non-root users who read the boot parameters may be able to identify weaknesses in security upon boot and be able to exploit them.
CCE-86016-3	Verify /boot/grub2/user.cfg User Ownership	The file `/boot/grub2/user.cfg` should be owned by the `root` user to prevent reading or modification of the file. To properly set the owner of `/boot/grub2/user.cfg`, run the command: $ sudo chown root /boot/grub2/user.cfg	Only root should be able to modify important boot parameters. Also, non-root users who read the boot parameters may be able to identify weaknesses in security upon boot and be able to exploit them.
CCE-86018-9	fapolicyd Must be Configured to Limit Access to Users Home Folders	fapolicyd needs be configured so that users cannot give access to their home folders to other users.	Users' home directories/folders may contain information of a sensitive nature. Non-privileged users should coordinate any sharing of information with a System Administrator (SA) through shared resources. fapolicyd can confine users to their home directory, not allowing them to make any changes outside of their own home directories. Confining users to their home directory will minimize the risk of sharing information.
CCE-86022-1	Verify /boot/grub2/user.cfg User Ownership	The file `/boot/grub2/user.cfg` should be owned by the `root` user to prevent reading or modification of the file. To properly set the owner of `/boot/grub2/user.cfg`, run the command: $ sudo chown root /boot/grub2/user.cfg	Only root should be able to modify important boot parameters. Also, non-root users who read the boot parameters may be able to identify weaknesses in security upon boot and be able to exploit them.
CCE-86025-4	Verify /boot/grub2/user.cfg Permissions	File permissions for `/boot/grub2/user.cfg` should be set to 600. To properly set the permissions of `/boot/grub2/user.cfg`, run the command: $ sudo chmod 600 /boot/grub2/user.cfg	Proper permissions ensure that only the root user can read or modify important boot parameters.
CCE-86029-6	Verify /boot/grub2/user.cfg Permissions	File permissions for `/boot/grub2/user.cfg` should be set to 600. To properly set the permissions of `/boot/grub2/user.cfg`, run the command: $ sudo chmod 600 /boot/grub2/user.cfg	Proper permissions ensure that only the root user can read or modify important boot parameters.
CCE-86031-2	Set Existing Passwords Maximum Age	Configure non-compliant accounts to enforce a `60`-day maximum password lifetime restriction by running the following command: $ sudo chage -M `60` USER	Any password, no matter how complex, can eventually be cracked. Therefore, passwords need to be changed periodically. If the operating system does not limit the lifetime of passwords and force users to change their passwords, there is the risk that the operating system passwords could be compromised.
CCE-86033-8	Disable XDMCP in GDM	XDMCP is an unencrypted protocol, and therefore, presents a security risk, see e.g. XDMCP Gnome docs. To disable XDMCP support in Gnome, set `Enable` to `false` under the `[xdmcp]` configuration section in `/etc/gdm/custom.conf`. For example: [xdmcp] Enable=false	XDMCP provides unencrypted remote access through the Gnome Display Manager (GDM) which does not provide for the confidentiality and integrity of user passwords or the remote session. If a privileged user were to login using XDMCP, the privileged user password could be compromised due to typed XEvents and keystrokes will traversing over the network in clear text.
CCE-86036-1	Add usrquota Option to /home	The `usrquota` mount option allows for the filesystem to have disk quotas configured. Add the `usrquota` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/home`.	To ensure the availability of disk space on /home, it is important to limit the impact a single user or group can cause for other users (or the wider system) by intentionally or accidentally filling up the partition. Quotas can also be applied to inodes for filesystems where inode exhaustion is a concern.
CCE-86040-3	Add nosuid Option to /boot/efi	The `nosuid` mount option can be used to prevent execution of setuid programs in `/boot/efi`. The SUID and SGID permissions should not be required on the boot partition. Add the `nosuid` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/boot/efi`.	The presence of SUID and SGID executables should be tightly controlled. Users should not be able to execute SUID or SGID binaries from boot partitions.
CCE-86041-1	Configure the Firewalld Ports	Configure the `firewalld` ports to allow approved services to have access to the system. To configure `firewalld` to open ports, run the following command: firewall-cmd --permanent --add-port=port_number/tcp To configure `firewalld` to allow access for pre-defined services, run the following command: firewall-cmd --permanent --add-service=service_name	In order to prevent unauthorized connection of devices, unauthorized transfer of information, or unauthorized tunneling (i.e., embedding of data types within data types), organizations must disable or restrict unused or unnecessary physical and logical ports/protocols on information systems. Operating systems are capable of providing a wide variety of functions and services. Some of the functions and services provided by default may not be necessary to support essential organizational operations. Additionally, it is sometimes convenient to provide multiple services from a single component (e.g., VPN and IPS); however, doing so increases risk over limiting the services provided by one component. To support the requirements and principles of least functionality, the operating system must support the organizational requirements, providing only essential capabilities and limiting the use of ports, protocols, and/or services to only those required, authorized, and approved to conduct official business.
CCE-86042-9	Add grpquota Option to /home	The `grpquota` mount option allows for the filesystem to have disk quotas configured. Add the `grpquota` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/home`.	To ensure the availability of disk space on /home, it is important to limit the impact a single user or group can cause for other users (or the wider system) by intentionally or accidentally filling up the partition. Quotas can also be applied to inodes for filesystems where inode exhaustion is a concern.
CCE-86043-7	Ensure All Groups on the System Have Unique Group ID	Change the group name or delete groups, so each has a unique id.	To assure accountability and prevent unauthenticated access, groups must be identified uniquely to prevent potential misuse and compromise of the system.
CCE-86046-0	Ensure journald is configured to write log files to persistent disk	The journald system may store log files in volatile memory or locally on disk. If the logs are only stored in volatile memory they will be lost upon reboot.	Log files contain valuable data and need to be persistent to aid in possible investigations.
CCE-86048-6	Verify permissions on System Login Banner for Remote Connections	To properly set the permissions of `/etc/issue.net`, run the command: $ sudo chmod 0644 /etc/issue.net	Display of a standardized and approved use notification before granting access to the operating system ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. Proper permissions will ensure that only root user can modify the banner.
CCE-86049-4	Firewalld Must Employ a Deny-all, Allow-by-exception Policy for Allowing Connections to Other Systems	Red Hat Enterprise Linux 9 incorporates the "firewalld" daemon, which allows for many different configurations. One of these configurations is zones. Zones can be utilized to a deny-all, allow-by-exception approach. The default "drop" zone will drop all incoming network packets unless it is explicitly allowed by the configuration file or is related to an outgoing network connection.	Failure to restrict network connectivity only to authorized systems permits inbound connections from malicious systems. It also permits outbound connections that may facilitate exfiltration of data.
CCE-86052-8	Verify Group Ownership of System Login Banner for Remote Connections	To properly set the group owner of `/etc/issue.net`, run the command: $ sudo chgrp root /etc/issue.net	Display of a standardized and approved use notification before granting access to the operating system ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. Proper group ownership will ensure that only root user can modify the banner.
CCE-86057-7	Verify ownership of System Login Banner for Remote Connections	To properly set the owner of `/etc/issue.net`, run the command: $ sudo chown root /etc/issue.net	Display of a standardized and approved use notification before granting access to the operating system ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. Proper ownership will ensure that only root user can modify the banner.
CCE-86063-5	Uninstall dnsmasq Package	dnsmasq is a lightweight tool that provides DNS caching, DNS forwarding and DHCP (Dynamic Host Configuration Protocol) services. The `dnsmasq` package can be removed with the following command: $ sudo dnf remove dnsmasq	Unless a system is specifically designated to act as a DNS caching, DNS forwarding and/or DHCP server, it is recommended that the package be removed to reduce the potential attack surface.
CCE-86065-0	Enforce Usage of pam_wheel with Group Parameter for su Authentication	To ensure that only users who are members of the group set in the `group` option of `pam_wheel.so` module can run commands with altered privileges through the `su` command, make sure that the following line exists in the file `/etc/pam.d/su`: auth required pam_wheel.so use_uid group=`sugroup`	The `su` program allows to run commands with a substitute user and group ID. It is commonly used to run commands as the root user. Limiting access to such command is considered a good security practice.
CCE-86068-4	Lock Accounts Must Persist	This rule ensures that the system lock out accounts using `pam_faillock.so` persist after system reboot. From "pam_faillock" man pages: Note that the default directory that "pam_faillock" uses is usually cleared on system boot so the access will be re-enabled after system reboot. If that is undesirable, a different tally directory must be set with the "dir" option. pam_faillock.so module requires multiple entries in pam files. These entries must be carefully defined to work as expected. In order to avoid errors when manually editing these files, it is recommended to use the appropriate tools, such as `authselect` or `authconfig`, depending on the OS version. The chosen profile expects the directory to be `/var/log/faillock`. To configure the tally directory, add the following line to `/etc/security/faillock.conf`: dir = `/var/log/faillock`	Locking out user accounts after a number of incorrect attempts prevents direct password guessing attacks. In combination with the `silent` option, user enumeration attacks are also mitigated.
CCE-86072-6	Ensure the Group Used by pam_wheel.so Module Exists on System and is Empty	Ensure that the group `sugroup` referenced by `var_pam_wheel_group_for_su` variable and used as value for the `pam_wheel.so` `group` option exists and has no members. This empty group used by `pam_wheel.so` in `/etc/pam.d/su` ensures that no user can run commands with altered privileges through the `su` command.	The `su` program allows to run commands with a substitute user and group ID. It is commonly used to run commands as the root user. Limiting access to such command is considered a good security practice.
CCE-86073-4	Support session locking with tmux (not enforcing)	The `tmux` terminal multiplexer is used to implement automatic session locking. It should be started from `/etc/bashrc` or drop-in files within `/etc/profile.d/`.	Unlike `bash` itself, the `tmux` terminal multiplexer provides a mechanism to lock sessions after period of inactivity. A session lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not want to log out because of the temporary nature of the absence.
CCE-86075-9	Remove ftp Package	FTP (File Transfer Protocol) is a traditional and widely used standard tool for transferring files between a server and clients over a network, especially where no authentication is necessary (permits anonymous users to connect to a server). The `ftp` package can be removed with the following command: $ sudo dnf remove ftp	FTP does not protect the confidentiality of data or authentication credentials. It is recommended SFTP be used if file transfer is required. Unless there is a need to run the system as a FTP server (for example, to allow anonymous downloads), it is recommended that the package be removed to reduce the potential attack surface.
CCE-86080-9	Account Lockouts Must Persist	By setting a `dir` in the faillock configuration account lockouts will persist across reboots.	Having lockouts persist across reboots ensures that account is only unlocked by an administrator. If the lockouts did not persist across reboots an attack could simply reboot the system to continue brute force attacks against the accounts on the system.
CCE-86081-7	Configure SSSD LDAP Backend Client to Demand a Valid Certificate from the Server	Configure SSSD to demand a valid certificate from the server to protect the integrity of LDAP remote access sessions by setting the ldap_tls_reqcert option in /etc/sssd/sssd.conf to `demand`.	Without a valid certificate presented to the LDAP client backend, the identity of a server can be forged compromising LDAP remote access sessions.
CCE-86082-5	Configure SSSD LDAP Backend to Use TLS For All Transactions	The LDAP client should be configured to implement TLS for the integrity of all remote LDAP authentication sessions. If the `id_provider` is set to `ldap` or `ipa` in `/etc/sssd/sssd.conf` or any of the `/etc/sssd/sssd.conf.d` configuration files, `ldap_id_use_start_tls` must be set to `true`. To check if LDAP is configured to use TLS when `id_provider` is set to `ldap` or `ipa`, use the following command: $ sudo grep -i ldap_id_use_start_tls /etc/sssd/sssd.conf /etc/sssd/conf.d/*.conf	Without cryptographic integrity protections, information can be altered by unauthorized users without detection. The ssl directive specifies whether to use TLS or not. If not specified it will default to no. It should be set to start_tls rather than doing LDAP over SSL.
CCE-86083-3	Install the SSSD Package	The `sssd` package should be installed. The `sssd` package can be installed with the following command: $ sudo dnf install sssd
CCE-86087-4	Configure PAM in SSSD Services	SSSD should be configured to run SSSD `pam` services. To configure SSSD to known SSH hosts, add `pam` to `services` under the `[sssd]` section in `/etc/sssd/sssd.conf`. For example: [sssd] services = sudo, autofs, pam	Using an authentication device, such as a CAC or token that is separate from the information system, ensures that even if the information system is compromised, that compromise will not affect credentials stored on the authentication device.
CCE-86088-2	Enable the SSSD Service	The SSSD service should be enabled. The `sssd` service can be enabled with the following command: $ sudo systemctl enable sssd.service
CCE-86089-0	Ensure SMEP is not disabled during boot	The SMEP is used to prevent the supervisor mode from executing user space code, it is enabled by default since Linux kernel 3.0. But it could be disabled through kernel boot parameters. Ensure that Supervisor Mode Execution Prevention (SMEP) is not disabled by the `nosmep` boot parameter option. Check that the line GRUB_CMDLINE_LINUX="..." within `/etc/default/grub` doesn't contain the argument `nosmep`. Run the following command to update command line for already installed kernels: # grubby --update-kernel=ALL --remove-args="nosmep" If the system is distributed as a bootable container image, GRUB2 can't be configured using the method described above, but the kernel arguments should be configured using TOML files located in the `/usr/lib/bootc/kargs.d` directory. Remove all occurences of `nosmep` from all files in `/usr/lib/bootc/kargs.d`. For more details on configuring kernel arguments in bootable container images, please refer to Bootc documentation.	Disabling SMEP can facilitate exploitation of certain vulnerabilities because it allows the kernel to unintentionally execute code in less privileged memory space.
CCE-86092-4	Do not allow usercopy whitelist violations to fallback to object size	This is a temporary option that allows missing usercopy whitelists to be discovered via a WARN() to the kernel log, instead of rejecting the copy, falling back to non-whitelisted hardened usercopy that checks the slab allocation size instead of the whitelist size. This configuration is available from kernel 4.16. The configuration that was used to build kernel is available at `/boot/config-`. To check the configuration value for `CONFIG_HARDENED_USERCOPY_FALLBACK`, run the following command: `grep CONFIG_HARDENED_USERCOPY_FALLBACK /boot/config-` Configs with value 'n' are not explicitly set in the file, so either commented lines or no lines should be returned.	This config prevents entire classes of heap overflow exploits and similar kernel memory exposures.
CCE-86096-5	Enable support for BUG()	Disabling this option eliminates support for BUG and WARN, reducing the size of your kernel image and potentially quietly ignoring numerous fatal conditions. You should only consider disabling this option for embedded systems with no facilities for reporting errors. The configuration that was used to build kernel is available at `/boot/config-`. To check the configuration value for `CONFIG_BUG`, run the following command: `grep CONFIG_BUG /boot/config-` For each kernel installed, a line with value "y" should be returned.	Not setting this variable may hide a number of critical errors.
CCE-86100-5	Account Lockouts Must Be Logged	PAM faillock locks an account due to excessive password failures, this event must be logged.	Without auditing of these events it may be harder or impossible to identify what an attacker did after an attack.
CCE-86101-3	Ensure a dedicated group owns sudo	Restrict the execution of privilege escalated commands to a dedicated group of users. Ensure the group owner of /usr/bin/sudo is `root`.	Restricting the set of users able to execute commands as privileged user reduces the attack surface.
CCE-86108-8	Account Lockouts Must Be Logged	PAM faillock locks an account due to excessive password failures, this event must be logged.	Without auditing of these events it may be harder or impossible to identify what an attacker did after an attack.
CCE-86113-8	Ensure that System Accounts Are Locked	Some accounts are not associated with a human user of the system, and exist to perform some administrative functions. An attacker should not be able to log into these accounts. System accounts are those user accounts with a user ID less than `1000`. If any system account other than `root`, `halt`, `sync`, `shutdown` and `nfsnobody` has an unlocked password, disable it with the command: $ sudo usermod -L account	Disabling authentication for default system accounts makes it more difficult for attackers to make use of them to compromise a system.
CCE-86116-1	Configure Firewalld to Trust Loopback Traffic	Assign loopback interface to the `firewalld` `trusted` zone in order to explicitly allow the loopback traffic in the system. To configure `firewalld` to trust loopback traffic, run the following command: sudo firewall-cmd --permanent --zone=trusted --add-interface=lo To ensure `firewalld` settings are applied in runtime, run the following command: firewall-cmd --reload	Loopback traffic is generated between processes on machine and is typically critical to operation of the system. The loopback interface is the only place that loopback network traffic should be seen, all other interfaces should ignore traffic on this network as an anti-spoofing measure.
CCE-86119-5	Verify Ownership on SSH Server Private *_key Key Files	SSH server private keys, files that match the `/etc/ssh/*_key` glob, must be owned by `root` user.	If an unauthorized user obtains the private SSH host key file, the host could be impersonated.
CCE-86122-9	Disable ypserv Service	The `ypserv` service, which allows the system to act as a client in a NIS or NIS+ domain, should be disabled. The `ypserv` service can be disabled with the following command: $ sudo systemctl mask --now ypserv.service	Disabling the `ypserv` service ensures the system is not acting as a client in a NIS or NIS+ domain. This service should be disabled unless in use.
CCE-86127-8	Verify Group Ownership on SSH Server Private *_key Key Files	SSH server private keys, files that match the `/etc/ssh/*_key` glob, must be group-owned by `ssh_keys` group.	If an unauthorized user obtains the private SSH host key file, the host could be impersonated.
CCE-86130-2	Verify Ownership on SSH Server Public *.pub Key Files	SSH server public keys, files that match the `/etc/ssh/*.pub` glob, must be owned by `root` user.	If a public host key file is modified by an unauthorized user, the SSH service may be compromised.
CCE-86136-9	Verify Group Ownership on SSH Server Public *.pub Key Files	SSH server public keys, files that match the `/etc/ssh/*.pub` glob, must be group-owned by `root` group.	If a public host key file is modified by an unauthorized user, the SSH service may be compromised.
CCE-86137-7	Configure Firewalld to Restrict Loopback Traffic	Configure `firewalld` to restrict loopback traffic to the `lo` interface. The loopback traffic must be trusted by assigning the `lo` interface to the `firewalld` `trusted` zone. However, the loopback traffic must be restricted to the loopback interface as an anti-spoofing measure. To configure `firewalld` to restrict loopback traffic to the `lo` interface, run the following commands: sudo firewall-cmd --permanent --zone=trusted --add-rich-rule='rule family=ipv4 source address="127.0.0.1" destination not address="127.0.0.1" drop' sudo firewall-cmd --permanent --zone=trusted --add-rich-rule='rule family=ipv6 source address="::1" destination not address="::1" drop' To ensure `firewalld` settings are applied in runtime, run the following command: firewall-cmd --reload	Loopback traffic is generated between processes on machine and is typically critical to operation of the system. The loopback interface is the only place that loopback network traffic should be seen, all other interfaces should ignore traffic on this network as an anti-spoofing measure.
CCE-86138-5	Enable Public Key Authentication	Enable SSH login with public keys. The default SSH configuration enables authentication based on public keys. The appropriate configuration is used if no value is set for `PubkeyAuthentication`. To explicitly enable Public Key Authentication, add or correct the following `/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf`: PubkeyAuthentication yes	Without the use of multifactor authentication, the ease of access to privileged functions is greatly increased. Multifactor authentication requires using two or more factors to achieve authentication. A privileged account is defined as an information system account with authorizations of a privileged user. Smart cards or hardware tokens paired with digital certificates are common examples of multifactor implementations.
CCE-86141-9	Ensure Message Of The Day Is Configured Properly	To configure the system message of the day banner edit the `/etc/motd` file. Replace the default text with a message compliant with the local site policy. The message should not contain information about operating system version, release, kernel version or patch level. The recommended banner text can be tailored in the XCCDF Value `xccdf_org.ssgproject.content_value_cis_banner_text`: `Authorized users only. All activity may be monitored and reported.`	Warning messages inform users who are attempting to login to the system of their legal status regarding the system and must include the name of the organization that owns the system and any monitoring policies that are in place. Displaying OS and patch level information in login banners also has the side effect of providing detailed system information to attackers attempting to target specific exploits of a system. Authorized users can easily get this information by running the `uname -a` command once they have logged in.
CCE-86142-7	Ensure Local Login Warning Banner Is Configured Properly	To configure the system local login warning banner edit the `/etc/issue` file. The contents of this file is displayed to users prior to login to local terminals. Replace the default text with a message compliant with the local site policy. The message should not contain information about operating system version, release, kernel version or patch level. The recommended banner text can be tailored in the XCCDF Value `xccdf_org.ssgproject.content_value_cis_banner_text`: `Authorized users only. All activity may be monitored and reported.`	Warning messages inform users who are attempting to login to the system of their legal status regarding the system and must include the name of the organization that owns the system and any monitoring policies that are in place. Displaying OS and patch level information in login banners also has the side effect of providing detailed system information to attackers attempting to target specific exploits of a system. Authorized users can easily get this information by running the `uname -a` command once they have logged in.
CCE-86143-5	Ensure Remote Login Warning Banner Is Configured Properly	To configure the system remote login warning banner edit the `/etc/issue.net` file. The contents of this file is displayed to users prior to login from remote connections. Replace the default text with a message compliant with the local site policy. The message should not contain information about operating system version, release, kernel version or patch level. The recommended banner text can be tailored in the XCCDF Value `xccdf_org.ssgproject.content_value_cis_banner_text`: `Authorized users only. All activity may be monitored and reported.`	Warning messages inform users who are attempting to login to the system of their legal status regarding the system and must include the name of the organization that owns the system and any monitoring policies that are in place. Displaying OS and patch level information in login banners also has the side effect of providing detailed system information to attackers attempting to target specific exploits of a system. Authorized users can easily get this information by running the `uname -a` command once they have logged in.
CCE-86148-4	Modify the System Login Banner for Remote Connections	To configure the system login banner edit `/etc/issue.net`. Replace the default text with a message compliant with the local site policy or a legal disclaimer. The DoD required text is either: You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests -- not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details. OR: `I've read & consent to terms in IS user agreem't.`	Display of a standardized and approved use notification before granting access to the operating system ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. System use notifications are required only for access via login interfaces with human users and are not required when such human interfaces do not exist.
CCE-86149-2	Configure the tmux lock session key binding	To set a key binding for the screen locking in `tmux` terminal multiplexer, the `session-lock` command must be bound to a key. Add the following line to `/etc/tmux.conf`: bind X lock-session . The console can now be locked with the following key combination: Ctrl+b Shift+x	The `tmux` package allows for a session lock to be implemented and configured. However, the session lock is implemented by an external command. The `tmux` default configuration does not contain an effective session lock.
CCE-86152-6	Ensure SELinux is Not Disabled	The SELinux state should be set to `enforcing` or `permissive` at system boot time. In the file `/etc/selinux/config`, add or correct the following line to configure the system to boot into enforcing or permissive mode: SELINUX=enforcing OR SELINUX=permissive Ensure that all files have correct SELinux labels by running: fixfiles onboot Then reboot the system.	Running SELinux in disabled mode is strongly discouraged. It prevents enforcing the SELinux controls without a system reboot. It also avoids labeling any persistent objects such as files, making it difficult to enable SELinux in the future.
CCE-86155-9	Ensure logrotate is Installed	logrotate is installed by default. The `logrotate` package can be installed with the following command: $ sudo dnf install logrotate	The logrotate package provides the logrotate services.
CCE-86158-3	Enable logrotate Timer	The `logrotate` timer can be enabled with the following command: $ sudo systemctl enable logrotate.timer	Log files that are not properly rotated run the risk of growing so large that they fill up the /var/log partition. Valuable logging information could be lost if the /var/log partition becomes full.
CCE-86163-3	Ensure a Table Exists for Nftables	Tables in nftables hold chains. Each table only has one address family and only applies to packets of this family. Tables can have one of six families. Red Hat Enterprise Linux 9 uses `firewalld` for firewall management. When `nftables` is the firewall backend used by `firewalld`, an `inet` family table called `filter` is used. To verify that the `nftables` table used by `firewalld` exists, run the following command: $ sudo nft list tables table `inet` `filter` This table is automatically created by `firewalld` when it is started.	Nftables doesn't have any default tables. Without a table being built, nftables will not filter network traffic.
CCE-86170-8	Install the cron service	The Cron service should be installed.	The cron service allow periodic job execution, needed for almost all administrative tasks and services (software update, log rotating, etc.). Access to cron service should be restricted to administrative accounts only.
CCE-86173-2	Record Unsuccessful Creation Attempts to Files - open O_CREAT	The audit system should collect unauthorized file accesses for all users and root. The `open` syscall can be used to create new files when O_CREAT flag is specified. The following auidt rules will assure that unsuccessful attempts to create a file via `open` syscall are collected. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the rules below to a file with suffix `.rules` in the directory `/etc/audit/rules.d`. If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the rules below to `/etc/audit/audit.rules` file. -a always,exit -F arch=b32 -S open -F a1&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create -a always,exit -F arch=b32 -S open -F a1&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-create If the system is 64 bit then also add the following lines: -a always,exit -F arch=b64 -S open -F a1&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create -a always,exit -F arch=b64 -S open -F a1&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-create	Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing these events could serve as evidence of potential system compromise.
CCE-86177-3	Kernel panic oops	Enable the kernel to panic when it oopses. This has the same effect as setting oops=panic on the kernel command line. The configuration that was used to build kernel is available at `/boot/config-`. To check the configuration value for `CONFIG_PANIC_ON_OOPS`, run the following command: `grep CONFIG_PANIC_ON_OOPS /boot/config-` For each kernel installed, a line with value "y" should be returned.	This feature ensures that the kernel does not do anything erroneous after an oops which could result in data corruption or other issues.
CCE-86179-9	Verify Group Who Owns SSH Server Configuration Files	To properly set the group owner of `/etc/ssh/sshd_config.d`, run the command: $ sudo chgrp root /etc/ssh/sshd_config.d	Service configuration files enable or disable features of their respective services that if configured incorrectly can lead to insecure and vulnerable configurations. Therefore, service configuration files should be owned by the correct group to prevent unauthorized changes.
CCE-86180-7	Verify Owner on SSH Server Configuration Files	To properly set the owner of `/etc/ssh/sshd_config.d`, run the command: $ sudo chown root /etc/ssh/sshd_config.d	Service configuration files enable or disable features of their respective services that if configured incorrectly can lead to insecure and vulnerable configurations. Therefore, service configuration files should be owned by the correct group to prevent unauthorized changes.
CCE-86185-6	Ensure that /etc/cron.allow exists	The file `/etc/cron.allow` should exist and should be used instead of `/etc/cron.deny`.	Access to `crontab` should be restricted. It is easier to manage an allow list than a deny list. Therefore, `/etc/cron.allow` needs to be created and used instead of `/etc/cron.deny`. Regardless of the existence of any of these files, the root administrative user is always allowed to setup a crontab.
CCE-86186-4	Verify Permissions on SSH Server Config File	To properly set the permissions of `/etc/ssh/sshd_config.d`, run the command: $ sudo chmod 0700 /etc/ssh/sshd_config.d	Service configuration files enable or disable features of their respective services that if configured incorrectly can lead to insecure and vulnerable configurations. Therefore, service configuration files should be owned by the correct group to prevent unauthorized changes.
CCE-86194-8	OpenSSH Service Must Use Passcode for Their Private Keys	Verify the SSH private key files have a passcode. For each private key stored on the system, use the following command: $ sudo ssh-keygen -y -f /path/to/file If the contents of the key are displayed, without asking a passphrase this is a finding.	If an unauthorized user obtains access to a private key without a passcode, that user would have unauthorized access to any system where the associated public key has been installed.
CCE-86198-9	Record Attempts to Alter Process and Session Initiation Information btmp	The audit system already collects process information for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -w /var/log/btmp -p wa -k session If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules`: -w /var/log/btmp -p wa -k session	Manual editing of these files may indicate nefarious activity, such as an attacker attempting to remove evidence of an intrusion.
CCE-86202-9	Record Attempts to Alter Process and Session Initiation Information utmp	The audit system already collects process information for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -w /var/run/utmp -p wa -k session If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules`: -w /var/run/utmp -p wa -k session	Manual editing of these files may indicate nefarious activity, such as an attacker attempting to remove evidence of an intrusion.
CCE-86203-7	Record Attempts to Alter Process and Session Initiation Information wtmp	The audit system already collects process information for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -w /var/log/wtmp -p wa -k session If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules`: -w /var/log/wtmp -p wa -k session	Manual editing of these files may indicate nefarious activity, such as an attacker attempting to remove evidence of an intrusion.
CCE-86208-6	Configure SSH Client to Use FIPS 140-2 Validated MACs: openssh.config	Crypto Policies provide a centralized control over crypto algorithms usage of many packages. OpenSSH is supported by system crypto policy, but the OpenSSH configuration may be set up incorrectly. To check that Crypto Policies settings are configured correctly, ensure that `/etc/crypto-policies/back-ends/openssh.config` contains the following line and is not commented out: `MACs hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com`	Overriding the system crypto policy makes the behavior of the OpenSSH client violate expectations, and makes system configuration more fragmented.
CCE-86209-4	Disable the use of user namespaces	To set the runtime status of the `user.max_user_namespaces` kernel parameter, run the following command: $ sudo sysctl -w user.max_user_namespaces=0 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: user.max_user_namespaces = 0 When containers are deployed on the machine, the value should be set to large non-zero value.	It is detrimental for operating systems to provide, or install by default, functionality exceeding requirements or system objectives. These unnecessary capabilities or services are often overlooked and therefore may remain unsecured. They increase the risk to the platform by providing additional attack vectors. User namespaces are used primarily for Linux containers. The value 0 disallows the use of user namespaces.
CCE-86211-0	Record Events that Modify User/Group Information - /etc/pam.d/	If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -w /etc/pam.d/ -p wa -k audit_rules_usergroup_modification If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules`: -w /etc/pam.d/ -p wa -k audit_rules_usergroup_modification	The PAM configuration files in /etc/pam.d define the authentication mechanism used by PAM-aware applications. Any unexpected changes to PAM configuration should be investigated.
CCE-86212-8	Record Events that Modify User/Group Information - /etc/pam.conf	If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -w /etc/pam.conf -p wa -k audit_rules_usergroup_modification If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules`: -w /etc/pam.conf -p wa -k audit_rules_usergroup_modification	The PAM configuration file defines the authentication mechanism used by PAM-aware applications. Any unexpected changes to PAM configuration should be investigated.
CCE-86213-6	Record Events that Modify User/Group Information - /etc/nsswitch.conf	If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -w /etc/nsswitch.conf -p wa -k audit_rules_usergroup_modification If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules`: -w /etc/nsswitch.conf -p wa -k audit_rules_usergroup_modification	The nsswitch file defines how the system uses various databases and name resolution mechanisms. Any unexpected changes to nsswitch configuration should be investigated.
CCE-86215-1	Disable IPv6 Addressing on All IPv6 Interfaces	To disable support for (`ipv6`) addressing on all interface add the following line to `/etc/sysctl.d/ipv6.conf` (or another file in `/etc/sysctl.d`): net.ipv6.conf.all.disable_ipv6 = 1 This disables IPv6 on all network interfaces as other services and system functionality require the IPv6 stack loaded to work.	Any unnecessary network stacks - including IPv6 - should be disabled, to reduce the vulnerability to exploitation.
CCE-86216-9	Verify Permissions on SSH Server Config File	To properly set the permissions of files in `/etc/ssh/sshd_config.d`, run the command: find -H /etc/ssh/sshd_config.d -type d -exec chown 0600 {} \;	Service configuration files enable or disable features of their respective services that if configured incorrectly can lead to insecure and vulnerable configurations. Therefore, service configuration files should be owned by the correct group to prevent unauthorized changes.
CCE-86217-7	Verify Owner on SSH Server Configuration Files	To properly set the owner of files in `/etc/ssh/sshd_config.d`, run the command: find -H /etc/ssh/sshd_config.d -type d -exec chown -L root {} \;	Service configuration files enable or disable features of their respective services that if configured incorrectly can lead to insecure and vulnerable configurations. Therefore, service configuration files should be owned by the correct group to prevent unauthorized changes.
CCE-86226-8	Install pam_pwquality Package	The `libpwquality` package can be installed with the following command: $ sudo dnf install libpwquality	Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. "pwquality" enforces complex password construction configuration and has the ability to limit brute-force attacks on the system.
CCE-86228-4	Audit Tools Must Have a Mode of 0755 or Less Permissive	Red Hat Enterprise Linux 9 systems providing tools to interface with audit information will leverage user permissions and roles identifying the user accessing the tools, and the corresponding rights the user enjoys, to make access decisions regarding the access to audit tools. Audit tools include, but are not limited to, vendor-provided and open source audit tools needed to successfully view and manipulate audit information system activity and records. Audit tools include custom queries and report generators. Audit tools must have a mode of 0755 or less permissive.	Protecting audit information also includes identifying and protecting the tools used to view and manipulate log data. Therefore, protecting audit tools is necessary to prevent unauthorized operations on audit information.
CCE-86230-0	Harden SSH client Crypto Policy	Crypto Policies are means of enforcing certain cryptographic settings for selected applications including OpenSSH client. To override the system wide crypto policy for Openssh client, place a file in the `/etc/ssh/ssh_config.d/` so that it is loaded before the `05-redhat.conf`. In this case it is file named `02-ospp.conf` containing parameters which need to be changed with respect to the crypto policy. This rule checks if the file exists and if it contains required parameters and values which modify the Crypto Policy. During the parsing process, as soon as Openssh client parses some configuration option and its value, it remembers it and ignores any subsequent overrides. The customization mechanism provided by crypto policies appends eventual customizations at the end of the system wide crypto policy. Therefore, if the crypto policy customization overrides some parameter which is already configured in the system wide crypto policy, the SSH client will not honor that customized parameter.	The Common Criteria requirements specify how certain parameters for OpenSSH Client are configured. Particular parameters are RekeyLimit, GSSAPIAuthentication, Ciphers, PubkeyAcceptedKeyTypes, MACs and KexAlgorithms. Currently particular requirements specified by CC are stricter compared to any existing Crypto Policy.
CCE-86236-7	Install McAfee Endpoint Security for Linux (ENSL)	Install McAfee Endpoint Security for Linux antivirus software which is provided for systems and uses signatures to search for the presence of viruses on the filesystem. The `McAfeeTP` package can be installed with the following command: $ sudo dnf install McAfeeTP	Virus scanning software can be used to detect if a system has been compromised by computer viruses, as well as to limit their spread to other systems.
CCE-86238-3	Record Unsuccessful Creation Attempts to Files - openat O_CREAT	The audit system should collect unauthorized file accesses for all users and root. The `openat` syscall can be used to create new files when O_CREAT flag is specified. The following auidt rules will assure that unsuccessful attempts to create a file via `openat` syscall are collected. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the rules below to a file with suffix `.rules` in the directory `/etc/audit/rules.d`. If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the rules below to `/etc/audit/audit.rules` file. -a always,exit -F arch=b32 -S openat -F a2&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create -a always,exit -F arch=b32 -S openat -F a2&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-create If the system is 64 bit then also add the following lines: -a always,exit -F arch=b64 -S openat -F a2&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create -a always,exit -F arch=b64 -S openat -F a2&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-create	Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing these events could serve as evidence of potential system compromise.
CCE-86240-9	Audit Tools Must Be Group-owned by Root	Red Hat Enterprise Linux 9 systems providing tools to interface with audit information will leverage user permissions and roles identifying the user accessing the tools, and the corresponding rights the user enjoys, to make access decisions regarding the access to audit tools. Audit tools include, but are not limited to, vendor-provided and open source audit tools needed to successfully view and manipulate audit information system activity and records. Audit tools include custom queries and report generators. Audit tools must have the correct group owner.	Protecting audit information also includes identifying and protecting the tools used to view and manipulate log data. Therefore, protecting audit tools is necessary to prevent unauthorized operations on audit information.
CCE-86246-6	Install the pcsc-lite-ccid package	The `pcsc-lite-ccid` package can be installed with the following command: $ sudo dnf install pcsc-lite-ccid	The pcsc-lite-ccid package must be installed if it is to be available for multifactor authentication using smartcards.
CCE-86249-0	An SELinux Context must be configured for the pam_faillock.so records directory	The `dir` configuration option in PAM pam_faillock.so module defines where the lockout records is stored. The configured directory must have the correct SELinux context.	Not having the correct SELinux context on the pam_faillock.so records directory may lead to unauthorized access to the directory.
CCE-86252-4	User a virtually-mapped stack	Enable this to use virtually-mapped kernel stacks with guard pages. This configuration is available from kernel 4.9. The configuration that was used to build kernel is available at `/boot/config-`. To check the configuration value for `CONFIG_VMAP_STACK`, run the following command: `grep CONFIG_VMAP_STACK /boot/config-` For each kernel installed, a line with value "y" should be returned.	This causes kernel stack overflows to be caught immediately rather than causing difficult-to-diagnose corruption.
CCE-86253-2	Verify Group Who Owns SSH Server Configuration Files	To properly set the group owner of files in `/etc/ssh/sshd_config.d`, run the command: find -H /etc/ssh/sshd_config.d -type d -exec chgrp -L root {} \;	Service configuration files enable or disable features of their respective services that if configured incorrectly can lead to insecure and vulnerable configurations. Therefore, service configuration files should be owned by the correct group to prevent unauthorized changes.
CCE-86263-1	Audit Tools Must Be Owned by Root	Red Hat Enterprise Linux 9 systems providing tools to interface with audit information will leverage user permissions and roles identifying the user accessing the tools, and the corresponding rights the user enjoys, to make access decisions regarding the access to audit tools. Audit tools include, but are not limited to, vendor-provided and open source audit tools needed to successfully view and manipulate audit information system activity and records. Audit tools include custom queries and report generators. Audit tools must have the correct owner.	Protecting audit information also includes identifying and protecting the tools used to view and manipulate log data. Therefore, protecting audit tools is necessary to prevent unauthorized operations on audit information.
CCE-86271-4	Verify User Who Owns /etc/selinux Directory	To properly set the owner of `/etc/selinux`, run the command: $ sudo chown root /etc/selinux	The ownership of the /etc/selinux directory by the root user is important because this directory hosts SELinux configuration. Protection of this directory is critical for system security. Assigning the ownership to root ensures exclusive control of the SELinux configuration.
CCE-86274-8	Verify Group Who Owns /etc/selinux Directory	To properly set the group owner of `/etc/selinux`, run the command: $ sudo chgrp root /etc/selinux	The ownership of the /etc/selinux directory by the root group is important because this directory hosts SELinux configuration. Protection of this directory is critical for system security. Assigning the ownership to root ensures exclusive control of the SELinux configuration.
CCE-86279-7	Verify Permissions On /etc/selinux Directory	To properly set the permissions of `/etc/selinux`, run the command: $ sudo chmod 0755 /etc/selinux	Setting correct permissions on the /etc/selinux directory is important because this directory hosts SELinux configuration. Protection of this directory is critical for system security. Restricting the permissions ensures exclusive control of the SELinux configuration.
CCE-86280-5	Install the pcsc-lite package	The `pcsc-lite` package can be installed with the following command: $ sudo dnf install pcsc-lite	The pcsc-lite package must be installed if it is to be available for multifactor authentication using smartcards.
CCE-86283-9	Ensure /dev/shm is configured	The `/dev/shm` is a traditional shared memory concept. One program will create a memory portion, which other processes (if permitted) can access. If `/dev/shm` is not configured, tmpfs will be mounted to /dev/shm by systemd.	Any user can upload and execute files inside the `/dev/shm` similar to the `/tmp` partition. Configuring `/dev/shm` allows an administrator to set the noexec option on the mount, making /dev/shm useless for an attacker to install executable code. It would also prevent an attacker from establishing a hardlink to a system setuid program and wait for it to be updated. Once the program was updated, the hardlink would be broken and the attacker would have his own copy of the program. If the program happened to have a security vulnerability, the attacker could continue to exploit the known flaw.
CCE-86286-2	Verify User Who Owns /etc/sestatus.conf File	To properly set the owner of `/etc/sestatus.conf`, run the command: $ sudo chown root /etc/sestatus.conf	The ownership of the /etc/sestatus.conf file by the root user is important because this file hosts SELinux configuration. Protection of this file is critical for system security. Assigning the ownership to root ensures exclusive control of the SELinux configuration.
CCE-86289-6	Verify Group Who Owns /etc/sestatus.conf File	To properly set the group owner of `/etc/sestatus.conf`, run the command: $ sudo chgrp root /etc/sestatus.conf	The ownership of the /etc/sestatus.conf file by the root group is important because this file hosts SELinux configuration. Protection of this file is critical for system security. Assigning the ownership to root ensures exclusive control of the SELinux configuration.
CCE-86292-0	Ensure debug-shell service is not enabled during boot	systemd's `debug-shell` service is intended to diagnose systemd related boot issues with various `systemctl` commands. Once enabled and following a system reboot, the root shell will be available on `tty9` which is access by pressing `CTRL-ALT-F9`. The `debug-shell` service should only be used for systemd related issues and should otherwise be disabled. By default, the `debug-shell` systemd service is already disabled. Ensure the debug-shell is not enabled by the `systemd.debug-shel=1` boot parameter option. Check that the line GRUB_CMDLINE_LINUX="..." within `/etc/default/grub` doesn't contain the argument `systemd.debug-shell`. Run the following command to update command line for already installed kernels: # grubby --update-kernel=ALL --remove-args="systemd.debug-shell" If the system is distributed as a bootable container image, GRUB2 can't be configured using the method described above, but the kernel arguments should be configured using TOML files located in the `/usr/lib/bootc/kargs.d` directory. Remove all occurences of `systemd.debug-shell` from all files in `/usr/lib/bootc/kargs.d`. For more details on configuring kernel arguments in bootable container images, please refer to Bootc documentation.	This prevents attackers with physical access from trivially bypassing security on the machine through valid troubleshooting configurations and gaining root access when the system is rebooted.
CCE-86293-8	Verify Permissions On /etc/sestatus.conf File	To properly set the permissions of `/etc/sestatus.conf`, run the command: $ sudo chmod 0644 /etc/sestatus.conf	Setting correct permissions on the /etc/sestatus.conf file is important because this file hosts SELinux configuration. Protection of this file is critical for system security. Restricting the permissions ensures exclusive control of the SELinux configuration.
CCE-86298-7	Verify Root Has A Primary GID 0	The `root` user should have a primary group of 0.	To help ensure that root-owned files are not inadvertently exposed to other users.
CCE-86300-1	Uninstall CUPS Package	The `cups` package can be removed with the following command: $ sudo dnf remove cups	If the system does not need to print jobs or accept print jobs from other systems, it is recommended that CUPS be removed to reduce the potential attack surface.
CCE-86303-5	Verify User Who Owns /etc/ipsec.d Directory	To properly set the owner of `/etc/ipsec.d`, run the command: $ sudo chown root /etc/ipsec.d	The ownership of the /etc/ipsec.d directory by the root user is important because this directory hosts Libreswan configuration. Protection of this file is critical for system security. Assigning the ownership to root ensures exclusive control of the Libreswan configuration.
CCE-86306-8	Verify Permissions On /etc/ipsec.d Directory	To properly set the permissions of `/etc/ipsec.d`, run the command: $ sudo chmod 0700 /etc/ipsec.d	Setting correct permissions on the /etc/ipsec.d directory is important because this directory hosts Libreswan configuration. Protection of this directory is critical for system security. Restricting the permissions ensures exclusive control of the Libreswan configuration.
CCE-86309-2	Verify Group Who Owns /etc/nftables Directory	To properly set the group owner of `/etc/nftables`, run the command: $ sudo chgrp root /etc/nftables	The ownership of the /etc/nftables directory by the root group is important because this directory hosts nftables configuration. Protection of this directory is critical for system security. Assigning the ownership to root ensures exclusive control of the nftables configuration.
CCE-86313-4	Verify User Who Owns /etc/nftables Directory	To properly set the owner of `/etc/nftables`, run the command: $ sudo chown root /etc/nftables	The ownership of the /etc/nftables directory by the root user is important because this directory hosts nftables configuration. Protection of this directory is critical for system security. Assigning the ownership to root ensures exclusive control of the nftables configuration.
CCE-86315-9	Disable the GNOME3 Login Restart and Shutdown Buttons	In the default graphical environment, users logging directly into the system are greeted with a login screen that allows any user, known or unknown, the ability the ability to shutdown or restart the system. This functionality should be disabled by setting `disable-restart-buttons` to `true`. To disable, add or edit `disable-restart-buttons` to `/etc/dconf/db/distro.d/00-security-settings`. For example: [org/gnome/login-screen] disable-restart-buttons=true Once the setting has been added, add a lock to `/etc/dconf/db/distro.d/locks/00-security-settings-lock` to prevent user modification. For example: /org/gnome/login-screen/disable-restart-buttons After the settings have been set, run `dconf update`.	A user who is at the console can reboot the system at the login screen. If restart or shutdown buttons are pressed at the login screen, this can create the risk of short-term loss of availability of systems due to reboot.
CCE-86320-9	Verify Permissions On /etc/nftables Directory	To properly set the permissions of `/etc/nftables`, run the command: $ sudo chmod 0700 /etc/nftables	Setting correct permissions on the /etc/nftables directory is important because this directory hosts nftables configuration. Protection of this directory is critical for system security. Restricting the permissions ensures exclusive control of the nftables configuration.
CCE-86321-7	SSSD Has a Correct Trust Anchor	SSSD must have acceptable trust anchor present.	Without path validation, an informed trust decision by the relying party cannot be made when presented with any certificate not already explicitly trusted. A trust anchor is an authoritative entity represented via a public key and associated data. It is used in the context of public key infrastructures, X.509 digital certificates, and DNSSEC. When there is a chain of trust, usually the top entity to be trusted becomes the trust anchor; it can be, for example, a Certification Authority (CA). A certification path starts with the subject certificate and proceeds through a number of intermediate certificates up to a trusted root certificate, typically issued by a trusted CA. This requirement verifies that a certification path to an accepted trust anchor is used for certificate validation and that the path includes status information. Path validation is necessary for a relying party to make an informed trust decision when presented with any certificate not already explicitly trusted. Status information for certification paths includes certificate revocation lists or online certificate status protocol responses. Validation of the certificate status information is out of scope for this requirement.
CCE-86325-8	Verify Group Who Owns /etc/sysctl.d Directory	To properly set the group owner of `/etc/sysctl.d`, run the command: $ sudo chgrp root /etc/sysctl.d	The ownership of the /etc/sysctl.d directory by the root group is important because this directory hosts kernel configuration. Protection of this directory is critical for system security. Assigning the ownership to root ensures exclusive control of the kernel configuration.
CCE-86330-8	Verify User Who Owns /etc/sysctl.d Directory	To properly set the owner of `/etc/sysctl.d`, run the command: $ sudo chown root /etc/sysctl.d	The ownership of the /etc/sysctl.d directory by the root user is important because this directory hosts kernel configuration. Protection of this directory is critical for system security. Assigning the ownership to root ensures exclusive control of the kernel configuration.
CCE-86336-5	Uninstall rsync Package	The rsyncd service can be used to synchronize files between systems over network links. The `rsync-daemon` package can be removed with the following command: $ sudo dnf remove rsync-daemon	The rsyncd service presents a security risk as it uses unencrypted protocols for communication.
CCE-86337-3	Verify Permissions On /etc/sysctl.d Directory	To properly set the permissions of `/etc/sysctl.d`, run the command: $ sudo chmod 0755 /etc/sysctl.d	Setting correct permissions on the /etc/sysctl.d directory is important because this directory hosts kernel configuration. Protection of this directory is critical for system security. Restricting the permissions ensures exclusive control of the kernel configuration.
CCE-86343-1	Record Events that Modify the System's Mandatory Access Controls in usr/share	If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -w /usr/share/selinux/ -p wa -k MAC-policy If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules`: -w /usr/share/selinux/ -p wa -k MAC-policy	The system's mandatory access policy (SELinux) should not be arbitrarily changed by anything other than administrator action. All changes to MAC policy should be audited.
CCE-86346-4	Verify User Who Owns /etc/at.allow file	If `/etc/at.allow` exists, it must be owned by `root`. To properly set the owner of `/etc/at.allow`, run the command: $ sudo chown root /etc/at.allow	If the owner of the at.allow file is not set to root, the possibility exists for an unauthorized user to view or edit sensitive information.
CCE-86350-6	Kernel panic timeout	Set the timeout value (in seconds) until a reboot occurs when the kernel panics. A timeout of 0 configures the system to wait forever. With a timeout value greater than 0, the system will wait the specified amount of seconds before rebooting. While a timeout value less than 0 makes the system reboot immediately. The configuration that was used to build kernel is available at `/boot/config-`. To check the configuration value for `CONFIG_PANIC_TIMEOUT`, run the following command: `grep CONFIG_PANIC_TIMEOUT /boot/config-` For each kernel installed, a line with value "`0`" should be returned.	This is required to enable protection against Spectre v2.
CCE-86351-4	Verify Group Who Owns /etc/sudoers.d Directory	To properly set the group owner of `/etc/sudoers.d`, run the command: $ sudo chgrp root /etc/sudoers.d	The ownership of the /etc/sudoers.d directory by the root group is important because this directory hosts sudo configuration. Protection of this directory is critical for system security. Assigning the ownership to root ensures exclusive control of the sudo configuration.
CCE-86354-8	Limit Password Reuse: password-auth	Do not allow users to reuse recent passwords. This can be accomplished by using the `remember` option for the `pam_pwhistory` PAM module. On systems with newer versions of `authselect`, the `pam_pwhistory` PAM module can be enabled via authselect feature: authselect enable-feature with-pwhistory Otherwise, it should be enabled using an authselect custom profile. Newer systems also have the `/etc/security/pwhistory.conf` file for setting `pam_pwhistory` module options. This file should be used whenever available. Otherwise, the `pam_pwhistory` module options can be set in PAM files. The value for `remember` option must be equal or greater than `5`	Preventing reuse of previous passwords helps ensure that a compromised password is not reused by a user.
CCE-86356-3	Ensure PAM Enforces Password Requirements - Enforce for root User	The pam_pwquality module's `enforce_for_root` parameter controls requirements for enforcing password complexity for the root user. Enable the `enforce_for_root` setting in `/etc/security/pwquality.conf` to require the `root` user to use complex passwords.	Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised.
CCE-86357-1	Verify User Who Owns /etc/sudoers.d Directory	To properly set the owner of `/etc/sudoers.d`, run the command: $ sudo chown root /etc/sudoers.d	The ownership of the /etc/sudoers.d directory by the root user is important because this directory hosts sudo configuration. Protection of this directory is critical for system security. Assigning the ownership to root ensures exclusive control of the sudo configuration.
CCE-86360-5	Verify Permissions On /etc/sudoers.d Directory	To properly set the permissions of `/etc/sudoers.d`, run the command: $ sudo chmod 0750 /etc/sudoers.d	Setting correct permissions on the /etc/sudoers.d directory is important because this directory hosts sudo configuration. Protection of this directory is critical for system security. Restricting the permissions ensures exclusive control of the sudo configuration.
CCE-86363-9	Verify Group Who Owns /etc/crypttab File	To properly set the group owner of `/etc/crypttab`, run the command: $ sudo chgrp root /etc/crypttab	The ownership of the /etc/crypttab file by the root group is important because this file hosts encrypted block devices configuration. Protection of this file is critical for system security. Assigning the ownership to root ensures exclusive control of the encrypted block devices configuration.
CCE-86366-2	Verify User Who Owns /etc/crypttab File	To properly set the owner of `/etc/crypttab`, run the command: $ sudo chown root /etc/crypttab	The ownership of the /etc/crypttab file by the root user is important because this file hosts encrypted block devices configuration. Protection of this file is critical for system security. Assigning the ownership to root ensures exclusive control of the encrypted block devices configuration.
CCE-86368-8	Record Events When Executables Are Run As Another User	Verify the system generates an audit record when actions are run as another user. sudo provides users with temporary elevated privileges to perform operations, either as the superuser or another user. If audit is using the "auditctl" tool to load the rules, run the following command: $ sudo grep execve /etc/audit/audit.rules If audit is using the "augenrules" tool to load the rules, run the following command: $ sudo grep -r execve /etc/audit/rules.d -a always,exit -F arch=b32 -S execve -C euid!=uid -F auid!=unset -k user_emulation -a always,exit -F arch=b64 S execve -C euid!=uid -F auid!=unset -k user_emulation If both the "b32" and "b64" audit rules for "SUID" files are not defined, this is a finding.	Creating an audit log of users with temporary elevated privileges and the operation(s) they performed is essential to reporting. Administrators will want to correlate the events written to the audit trail with the records written to sudo's logfile to verify if unauthorized commands have been executed. Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised information system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider threats and the advanced persistent threat.
CCE-86370-4	Verify Permissions On /etc/crypttab File	To properly set the permissions of `/etc/crypttab`, run the command: $ sudo chmod 0600 /etc/crypttab	Setting correct permissions on the /etc/crypttab file is important because this file hosts encrypted block devices configuration. Protection of this file is critical for system security. Assigning the ownership to root ensures exclusive control of the encrypted block devices configuration.
CCE-86374-6	Verify Group Who Owns /etc/chrony.keys File	To properly set the group owner of `/etc/chrony.keys`, run the command: $ sudo chgrp chrony /etc/chrony.keys	The ownership of the /etc/chrony.keys file by the chrony group is important because this file hosts chrony cryptographic keys. Protection of this file is critical for system security. Assigning the ownership to chrony ensures exclusive control of the chrony cryptography keys.
CCE-86378-7	Install nftables Package	nftables provides a new in-kernel packet classification framework that is based on a network-specific Virtual Machine (VM) and a new nft userspace command line tool. nftables reuses the existing Netfilter subsystems such as the existing hook infrastructure, the connection tracking system, NAT, userspace queuing and logging subsystem. The `nftables` package can be installed with the following command: $ sudo dnf install nftables	`nftables` is a subsystem of the Linux kernel that can protect against threats originating from within a corporate network to include malicious mobile code and poorly configured software on a host.
CCE-86380-3	Verify User Who Owns /etc/chrony.keys File	To properly set the owner of `/etc/chrony.keys`, run the command: $ sudo chown root /etc/chrony.keys	The ownership of the /etc/chrony.keys file by the chrony user is important because this file hosts chrony cryptographic keys. Protection of this file is critical for system security. Assigning the ownership to chrony ensures exclusive control of the chrony cryptographic keys.
CCE-86384-5	Verify Permissions On /etc/chrony.keys File	To properly set the permissions of `/etc/chrony.keys`, run the command: $ sudo chmod 0640 /etc/chrony.keys	Setting correct permissions on the /etc/chrony.keys file is important because this file hosts chrony cryptographic keys. Protection of this file is critical for system security. Assigning the correct mode ensures exclusive control of the chrony cryptographic keys.
CCE-86387-8	Verify Group Who Owns /etc/ipsec.conf File	To properly set the group owner of `/etc/ipsec.conf`, run the command: $ sudo chgrp root /etc/ipsec.conf	The ownership of the /etc/ipsec.conf file by the root group is important because this file hosts Libreswan configuration. Protection of this file is critical for system security. Assigning the ownership to root ensures exclusive control of the Libreswan configuration.
CCE-86391-0	Verify User Who Owns /etc/ipsec.conf File	To properly set the owner of `/etc/ipsec.conf`, run the command: $ sudo chown root /etc/ipsec.conf	The ownership of the /etc/ipsec.conf file by the root user is important because this file hosts Libreswan configuration. Protection of this file is critical for system security. Assigning the ownership to root ensures exclusive control of the Libreswan configuration.
CCE-86394-4	Configure Kernel to Rate Limit Sending of Duplicate TCP Acknowledgments	Make sure that the system is configured to limit the maximal rate for sending duplicate acknowledgments in response to incoming TCP packets that are for an existing connection but that are invalid due to any of these reasons: (a) out-of-window sequence number, (b) out-of-window acknowledgment number, or (c) PAWS (Protection Against Wrapped Sequence numbers) check failure This measure protects against or limits effects of DoS attacks against the system. Set the system to implement rate-limiting measures by adding the following line to `/etc/sysctl.conf` or a configuration file in the `/etc/sysctl.d/` directory (or modify the line to have the required value): net.ipv4.tcp_invalid_ratelimit = `500` Issue the following command to make the changes take effect: # sysctl --system	Denial of Service (DoS) is a condition when a resource is not available for legitimate users. When this occurs, the organization either cannot accomplish its mission or must operate at degraded capacity. This can help mitigate simple “ack loop” DoS attacks, wherein a buggy or malicious middlebox or man-in-the-middle can rewrite TCP header fields in manner that causes each endpoint to think that the other is sending invalid TCP segments, thus causing each side to send an unterminating stream of duplicate acknowledgments for invalid segments.
CCE-86395-1	Verify Permissions On /etc/ipsec.conf File	To properly set the permissions of `/etc/ipsec.conf`, run the command: $ sudo chmod 0644 /etc/ipsec.conf	Setting correct permissions on the /etc/ipsec.conf file is important because this file hosts Libreswan configuration. Protection of this file is critical for system security. Restricting the permissions ensures exclusive control of the Libreswan configuration.
CCE-86398-5	Verify Group Who Owns /etc/ipsec.secrets File	To properly set the group owner of `/etc/ipsec.secrets`, run the command: $ sudo chgrp root /etc/ipsec.secrets	The ownership of the /etc/ipsec.secrets file by the root group is important because this file hosts Libreswan configuration. Protection of this file is critical for system security. Assigning the ownership to root ensures exclusive control of the Libreswan configuration.
CCE-86401-7	Verify User Who Owns /etc/ipsec.secrets File	To properly set the owner of `/etc/ipsec.secrets`, run the command: $ sudo chown root /etc/ipsec.secrets	The ownership of the /etc/ipsec.secrets file by the root user is important because this file hosts Libreswan configuration. Protection of this file is critical for system security. Assigning the ownership to root ensures exclusive control of the Libreswan configuration.
CCE-86402-5	Record Events When Privileged Executables Are Run	Verify the system generates an audit record when privileged functions are executed. If audit is using the "auditctl" tool to load the rules, run the following command: $ sudo grep execve /etc/audit/audit.rules If audit is using the "augenrules" tool to load the rules, run the following command: $ sudo grep -r execve /etc/audit/rules.d -a always,exit -F arch=b32 -S execve -C uid!=euid -F euid=0 -k setuid -a always,exit -F arch=b64 -S execve -C uid!=euid -F euid=0 -k setuid -a always,exit -F arch=b32 -S execve -C gid!=egid -F egid=0 -k setgid -a always,exit -F arch=b64 -S execve -C gid!=egid -F egid=0 -k setgid If both the "b32" and "b64" audit rules for "SUID" files are not defined, this is a finding. If both the "b32" and "b64" audit rules for "SGID" files are not defined, this is a finding.	Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised information system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider threats and the advanced persistent threat.
CCE-86409-0	Disable WIFI Network Connection Creation in GNOME3	`GNOME` allows users to create ad-hoc wireless connections through the `NetworkManager` applet. Wireless connections should be disabled by adding or setting `disable-wifi-create` to `true` in `/etc/dconf/db/local.d/00-security-settings`. For example: [org/gnome/nm-applet] disable-wifi-create=true Once the settings have been added, add a lock to `/etc/dconf/db/local.d/locks/00-security-settings-lock` to prevent user modification. For example: /org/gnome/nm-applet/disable-wifi-create After the settings have been set, run `dconf update`.	Wireless network connections should not be allowed to be configured by general users on a given system as it could open the system to backdoor attacks.
CCE-86411-6	Verify Permissions On /etc/ipsec.secrets File	To properly set the permissions of `/etc/ipsec.secrets`, run the command: $ sudo chmod 0644 /etc/ipsec.secrets	Setting correct permissions on the /etc/ipsec.secrets file is important because this file hosts Libreswan configuration. Protection of this file is critical for system security. Restricting the permissions ensures exclusive control of the Libreswan configuration.
CCE-86414-0	Verify Group Who Owns /etc/sudoers File	To properly set the group owner of `/etc/sudoers`, run the command: $ sudo chgrp root /etc/sudoers	The ownership of the /etc/sudoers file by the root group is important because this file hosts sudo configuration. Protection of this file is critical for system security. Assigning the ownership to root ensures exclusive control of the sudo configuration.
CCE-86417-3	Verify User Who Owns /etc/sudoers File	To properly set the owner of `/etc/sudoers`, run the command: $ sudo chown root /etc/sudoers	The ownership of the /etc/sudoers file by the root user is important because this file hosts sudo configuration. Protection of this file is critical for system security. Assigning the ownership to root ensures exclusive control of the sudo configuration.
CCE-86420-7	Ensure debug-shell service is not enabled in zIPL	systemd's `debug-shell` service is intended to diagnose systemd related boot issues with various `systemctl` commands. Once enabled and following a system reboot, the root shell will be available on `tty9` which is access by pressing `CTRL-ALT-F9`. The `debug-shell` service should only be used for systemd related issues and should otherwise be disabled. By default, the `debug-shell` systemd service is already disabled. Ensure the debug-shell is not enabled by the `systemd.debug-shel=1` boot parameter option. Check that not boot entries in `/boot/loader/entries/*.conf` have `systemd.debug-shell=1` included in its options. To ensure that new kernels and boot entries don't enable the debug-shell, check that `systemd.debug-shell=1` is not present in `/etc/kernel/cmdline`.	This prevents attackers with physical access from trivially bypassing security on the machine through valid troubleshooting configurations and gaining root access when the system is rebooted.
CCE-86423-1	Perform full reference count validation	Enabling this switches the refcounting infrastructure from a fast unchecked atomic_t implementation to a fully state checked implementation, which can have a slight impact in performance. This configuration is available from kernel 4.13, but may be available if backported by distros. The configuration that was used to build kernel is available at `/boot/config-`. To check the configuration value for `CONFIG_REFCOUNT_FULL`, run the following command: `grep CONFIG_REFCOUNT_FULL /boot/config-` For each kernel installed, a line with value "y" should be returned.	Refcounting provides protections against various use-after-free conditions that can be used in security flaw exploits.
CCE-86424-9	Verify Permissions On /etc/sudoers File	To properly set the permissions of `/etc/sudoers`, run the command: $ sudo chmod 0440 /etc/sudoers	Setting correct permissions on the /etc/sudoers file is important because this file hosts sudo configuration. Protection of this file is critical for system security. Restricting the permissions ensures exclusive control of the sudo configuration.
CCE-86427-2	Verify Group Who Owns /etc/iptables Directory	To properly set the group owner of `/etc/iptables`, run the command: $ sudo chgrp root /etc/iptables	The ownership of the /etc/iptables directory by the root group is important because this directory hosts iptables configuration. Protection of this file is critical for system security. Assigning the ownership to root ensures exclusive control of the iptables configuration.
CCE-86430-6	Verify User Who Owns /etc/iptables Directory	To properly set the owner of `/etc/iptables`, run the command: $ sudo chown root /etc/iptables	The ownership of the /etc/iptables directory by the root user is important because this directory hosts iptables configuration. Protection of this file is critical for system security. Assigning the ownership to root ensures exclusive control of the iptables configuration.
CCE-86433-0	Record Attempts to perform maintenance activities	The Red Hat Enterprise Linux 9 operating system must generate audit records for privileged activities, nonlocal maintenance, diagnostic sessions and other system-level access. Verify the operating system audits activities performed during nonlocal maintenance and diagnostic sessions. Run the following command: $ sudo auditctl -l \| grep sudo.log -w /var/log/sudo.log -p wa -k maintenance If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -w /var/log/sudo.log -p wa -k maintenance If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules`: -w /var/log/sudo.log -p wa -k maintenance	If events associated with nonlocal administrative access or diagnostic sessions are not logged, a major tool for assessing and investigating attacks would not be available. This requirement addresses auditing-related issues associated with maintenance tools used specifically for diagnostic and repair actions on organizational information systems. Nonlocal maintenance and diagnostic activities are those activities conducted by individuals communicating through a network, either an external network (e.g., the internet) or an internal network. Local maintenance and diagnostic activities are those activities carried out by individuals physically present at the information system or information system component and not communicating across a network connection. This requirement applies to hardware/software diagnostic test equipment or tools. This requirement does not cover hardware/software components that may support information system maintenance, yet are a part of the system, for example, the software implementing "ping," "ls," "ipconfig," or the hardware and software implementing the monitoring port of an Ethernet switch.
CCE-86436-3	Verify Permissions On /etc/iptables Directory	To properly set the permissions of `/etc/iptables`, run the command: $ sudo chmod 0700 /etc/iptables	Setting correct permissions on the /etc/iptables directory is important because this directory hosts iptables configuration. Protection of this directory is critical for system security. Restricting the permissions ensures exclusive control of the iptables configuration.
CCE-86439-7	Verify Group Who Owns /etc/ipsec.d Directory	To properly set the group owner of `/etc/ipsec.d`, run the command: $ sudo chgrp root /etc/ipsec.d	The ownership of the /etc/ipsec.d directory by the root group is important because this directory hosts Libreswan configuration. Protection of this file is critical for system security. Assigning the ownership to root ensures exclusive control of the Libreswan configuration.
CCE-86444-7	Limit the maximum number of sequential characters in passwords	The `pwquality maxsequence` setting defines the maximum allowable length for consecutive character sequences in a new password. Such sequences can be, e.g., 123 or abc. If the value is set to 0, this check will be turned off. Note: Passwords that consist mainly of such sequences are unlikely to meet the simplicity criteria unless the sequence constitutes only a small portion of the overall password.	Use of a strong password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password complexity is one important factor that determines the duration required to crack it. A more intricate password results in a larger number of potential combinations that must be tested before successfully compromising the password.
CCE-86445-4	Audit Configuration Files Must Be Owned By Root	All audit configuration files must be owned by root user. To properly set the owner of `/etc/audit/`, run the command: $ sudo chown root /etc/audit/ To properly set the owner of `/etc/audit/rules.d/`, run the command: $ sudo chown root /etc/audit/rules.d/	Without the capability to restrict which roles and individuals can select which events are audited, unauthorized personnel may be able to prevent the auditing of critical events. Misconfigured audits may degrade the system's performance by overwhelming the audit log. Misconfigured audits may also make it more difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.
CCE-86446-2	Audit Configuration Files Must Be Owned By Group root	All audit configuration files must be owned by group root. chown :root /etc/audit/audit.{rules,conf} /etc/audit/rules.d/	Without the capability to restrict which roles and individuals can select which events are audited, unauthorized personnel may be able to prevent the auditing of critical events. Misconfigured audits may degrade the system's performance by overwhelming the audit log. Misconfigured audits may also make it more difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.
CCE-86448-8	Verify that audit tools Have Mode 0755 or less	The Red Hat Enterprise Linux 9 operating system audit tools must have the proper permissions configured to protected against unauthorized access. Verify it by running the following command: $ stat -c "%n %a" /sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/autrace /sbin/auditd /sbin/augenrules /sbin/audisp-syslog /sbin/auditctl 755 /sbin/aureport 755 /sbin/ausearch 755 /sbin/autrace 755 /sbin/auditd 755 /sbin/augenrules 755 /sbin/audisp-syslog 755 Audit tools needed to successfully view and manipulate audit information system activity and records. Audit tools include custom queries and report generators	Protecting audit information also includes identifying and protecting the tools used to view and manipulate log data. Therefore, protecting audit tools is necessary to prevent unauthorized operation on audit information. Operating systems providing tools to interface with audit information will leverage user permissions and roles identifying the user accessing the tools and the corresponding rights the user enjoys to make access decisions regarding the access to audit tools.
CCE-86451-2	Enable seccomp to safely compute untrusted bytecode	This kernel feature is useful for number crunching applications that may need to compute untrusted bytecode during their execution. By using pipes or other transports made available to the process as file descriptors supporting the read/write syscalls, it's possible to isolate those applications in their own address space using seccomp. The configuration that was used to build kernel is available at `/boot/config-`. To check the configuration value for `CONFIG_SECCOMP`, run the following command: `grep CONFIG_SECCOMP /boot/config-` For each kernel installed, a line with value "y" should be returned.	`seccomp` enables the ability to filter system calls made by an application, effectively isolating the system's resources from it.
CCE-86452-0	Enable the GNOME3 Screen Locking On Smartcard Removal	In the default graphical environment, screen locking on smartcard removal can be enabled by setting `removal-action` to `'lock-screen'`. To enable, add or edit `removal-action` to `/etc/dconf/db/local.d/00-security-settings`. For example: [org/gnome/settings-daemon/peripherals/smartcard] removal-action='lock-screen' Once the setting has been added, add a lock to `/etc/dconf/db/local.d/locks/00-security-settings-lock` to prevent user modification. For example: /org/gnome/settings-daemon/peripherals/smartcard/removal-action After the settings have been set, run `dconf update`.	Locking the screen automatically when removing the smartcard can prevent undesired access to system.
CCE-86454-6	Verify that audit tools are owned by root	The Red Hat Enterprise Linux 9 operating system audit tools must have the proper ownership configured to protected against unauthorized access. Verify it by running the following command: $ stat -c "%n %U" /sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/autrace /sbin/auditd /sbin/augenrules /sbin/audisp-syslog /sbin/auditctl root /sbin/aureport root /sbin/ausearch root /sbin/autrace root /sbin/auditd root /sbin/augenrules root /sbin/audisp-syslog root Audit tools needed to successfully view and manipulate audit information system activity and records. Audit tools include custom queries and report generators	Protecting audit information also includes identifying and protecting the tools used to view and manipulate log data. Therefore, protecting audit tools is necessary to prevent unauthorized operation on audit information. Operating systems providing tools to interface with audit information will leverage user permissions and roles identifying the user accessing the tools and the corresponding rights the user enjoys to make access decisions regarding the access to audit tools.
CCE-86457-9	Verify that audit tools are owned by group root	The Red Hat Enterprise Linux 9 operating system audit tools must have the proper ownership configured to protected against unauthorized access. Verify it by running the following command: $ stat -c "%n %G" /sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/autrace /sbin/auditd /sbin/augenrules /sbin/audisp-syslog /sbin/auditctl root /sbin/aureport root /sbin/ausearch root /sbin/autrace root /sbin/auditd root /sbin/augenrules root /sbin/audisp-syslog root Audit tools needed to successfully view and manipulate audit information system activity and records. Audit tools include custom queries and report generators	Protecting audit information also includes identifying and protecting the tools used to view and manipulate log data. Therefore, protecting audit tools is necessary to prevent unauthorized operation on audit information. Operating systems providing tools to interface with audit information will leverage user permissions and roles identifying the user accessing the tools and the corresponding rights the user enjoys to make access decisions regarding the access to audit tools.
CCE-86470-2	Ensure that All Root's Path Directories Are Owned by Root	For each element in root's path, run: # ls -ld DIR and ensure that the directory is owned by the root user.	Directories in root's path that are not owned by root could allow unprivileged users to manipulate the execution environment of root, potentially leading to privilege escalation or execution of malicious code.
CCE-86472-8	Ensure that All Entries in The Path of Root Are Directories	For each element in root's path, run: # ls -ld DIR and ensure that the entry is a directory.	Locations in root's path that are not directories could cause unexpected behavior, such as executing scripts from unintended locations. Ensuring that all locations in root's path are directories helps maintain a secure environment for root.
CCE-86474-4	Ensure rootfiles tmpfile.d is Configured Correctly	To set the mode of the root user initialization file `/root/.bash_profile`, ensure the following lines are is included in a file ending in `.conf` under `/etc/tmpfiles.d/`. C /root/.bash_logout 600 root root - /usr/share/rootfiles/.bash_logout C /root/.bash_profile 600 root root - /usr/share/rootfiles/.bash_profile C /root/.bashrc 600 root root - /usr/share/rootfiles/.bashrc C /root/.cshrc 600 root root - /usr/share/rootfiles/.cshrc C /root/.tcshrc 600 root root - /usr/share/rootfiles/.tcshrc	Local initialization files are used to configure the user's shell environment upon logon. Malicious modification of these files could compromise accounts upon logon.
CCE-86477-7	Ensure sudo only includes the default configuration directory	Administrators can configure authorized `sudo` users via drop-in files, and it is possible to include other directories and configuration files from the file currently being parsed. Make sure that `/etc/sudoers` only includes drop-in configuration files from `/etc/sudoers.d`, or that no drop-in file is included. Either the `/etc/sudoers` should contain only one `#includedir` directive pointing to `/etc/sudoers.d`, and no file in `/etc/sudoers.d/` should include other files or directories; Or the `/etc/sudoers` should not contain any `#include`, `@include`, `#includedir` or `@includedir` directives. Note that the '#' character doesn't denote a comment in the configuration file.	Some `sudo` configuration options allow users to run programs without re-authenticating. Use of these configuration options makes it easier for one compromised account to be used to compromise other accounts.
CCE-86479-3	Configure Fapolicy Module to Employ a Deny-all, Permit-by-exception Policy to Allow the Execution of Authorized Software Programs.	The Fapolicy module must be configured to employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs and to prevent unauthorized software from running.	Utilizing a whitelist provides a configuration management method for allowing the execution of only authorized software. Using only authorized software decreases risk by limiting the number of potential vulnerabilities. Verification of whitelisted software occurs prior to execution or at system startup. Proceed with caution with enforcing the use of this daemon. Improper configuration may render the system non-functional. The "fapolicyd" API is not namespace aware and can cause issues when launching or running containers.
CCE-86481-9	Record Events that Modify the System's Network Environment - /etc/NetworkManager/	If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -w /etc/NetworkManager -p wa -k audit_rules_networkconfig_modification_networkmanager If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules`: -w /etc/NetworkManager -p wa -k audit_rules_networkconfig_modification_networkmanager	The network environment should not be modified by anything other than administrator action. Any change to network parameters should be audited.
CCE-86491-8	Enable use of Berkeley Packet Filter with seccomp	Enable tasks to build secure computing environments defined in terms of Berkeley Packet Filter programs which implement task-defined system call filtering polices. The configuration that was used to build kernel is available at `/boot/config-`. To check the configuration value for `CONFIG_SECCOMP_FILTER`, run the following command: `grep CONFIG_SECCOMP_FILTER /boot/config-` For each kernel installed, a line with value "y" should be returned.	Use of BPF filters allows for expressive filtering of system calls using a filter program language with a long history of being exposed to userland.
CCE-86502-2	Ensure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session in /etc/security/pwquality.conf	To configure the number of retry prompts that are permitted per-session: Edit the `/etc/security/pwquality.conf` to include `retry=3`, or a lower value if site policy is more restrictive. The profile requirement is a maximum of `retry=3` prompts per session.	Setting the password retry prompts that are permitted on a per-session basis to a low value requires some software, such as SSH, to re-connect. This can slow down and draw additional attention to some types of password-guessing attacks. Note that this is different from account lockout, which is provided by the pam_faillock module.
CCE-86505-5	Uninstall bind Package	The `named` service is provided by the `bind` package. The `bind` package can be removed with the following command: $ sudo dnf remove bind On Red Hat Enterprise Linux 9.6 and newer, the `bind` command is also provided by the `bind9.18` package. The `bind9.18` package can be removed with the following command: $ sudo dnf remove bind9.18	If there is no need to make DNS server software available, removing it provides a safeguard against its activation.
CCE-86507-1	Configure Firewalld to Use the Nftables Backend	Firewalld can be configured with many backends, such as nftables.	Nftables is modern kernel module for controlling network connections coming into a system. Utilizing the limit statement in "nftables" can help to mitigate DoS attacks.
CCE-86510-5	Set GNOME3 Screensaver Inactivity Timeout	The idle time-out value for inactivity in the GNOME3 desktop is configured via the `idle-delay` setting must be set under an appropriate configuration file(s) in the `/etc/dconf/db/local.d` directory and locked in `/etc/dconf/db/local.d/locks` directory to prevent user modification. For example, to configure the system for a 15 minute delay, add the following to `/etc/dconf/db/local.d/00-security-settings`: [org/gnome/desktop/session] idle-delay=uint32 900	A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not logout because of the temporary nature of the absence. Rather than relying on the user to manually lock their operating system session prior to vacating the vicinity, GNOME3 can be configured to identify when a user's session has idled and take action to initiate a session lock.
CCE-86513-9	Uninstall avahi Server Package	If the system does not need to have an Avahi server which implements the DNS Service Discovery and Multicast DNS protocols, the avahi-autoipd and avahi packages can be uninstalled.	Automatic discovery of network services is not normally required for system functionality. It is recommended to remove this package to reduce the potential attack surface.
CCE-86516-2	Uninstall avahi-autoipd Server Package	If the system does not need to have an Avahi server which implements the DNS Service Discovery and Multicast DNS protocols, the avahi-autoipd and avahi packages can be uninstalled.	Automatic discovery of network services is not normally required for system functionality. It is recommended to remove this package to reduce the potential attack surface.
CCE-86526-1	Ensure all users last password change date is in the past	All users should have a password change date in the past.	If a user recorded password change date is in the future then they could bypass any set password expiration.
CCE-86529-5	Set the GNOME3 Login Warning Banner Text	In the default graphical environment, configuring the login warning banner text in the GNOME Display Manager's login screen can be configured on the login screen by setting `banner-message-text` to `'APPROVED_BANNER'` where APPROVED_BANNER is the approved banner for your environment. To enable, add or edit `banner-message-text` to `/etc/dconf/db/distro.d/00-security-settings`. For example: [org/gnome/login-screen] banner-message-text='APPROVED_BANNER' Once the setting has been added, add a lock to `/etc/dconf/db/distro.d/locks/00-security-settings-lock` to prevent user modification. For example: /org/gnome/login-screen/banner-message-text After the settings have been set, run `dconf update`. When entering a warning banner that spans several lines, remember to begin and end the string with `'` and use `\n` for new lines.	An appropriate warning message reinforces policy awareness during the logon process and facilitates possible legal action against attackers.
CCE-86532-9	Remove User Host-Based Authentication Files	The `~/.shosts` (in each user's home directory) files list remote hosts and users that are trusted by the local system. To remove these files, run the following command to delete them from any location: $ sudo find / -name '.shosts' -type f -delete	The .shosts files are used to configure host-based authentication for individual users or the system via SSH. Host-based authentication is not sufficient for preventing unauthorized access to the system, as it does not require interactive identification and authentication of a connection request, or for the use of two-factor authentication.
CCE-86537-8	Verify Group Who Owns cron.deny	To properly set the group owner of `/etc/cron.deny`, run the command: $ sudo chgrp root /etc/cron.deny	Service configuration files enable or disable features of their respective services that if configured incorrectly can lead to insecure and vulnerable configurations. Therefore, service configuration files should be owned by the correct group to prevent unauthorized changes.
CCE-86538-6	FIPS Must Use a Supported Subpolicy	Sub-policies can be used to modify existing crypto policies. Some sub-policies such as `NO-ENFORCE-EMS` reduce the security of the system and should not be used. Other such as `AD-SUPPORT` should only be enabled if operationally required. The `OSPP`, `NO-SHA1`, `NO-CAMELLIA`, and `ECDHE-ONLY` are allowed by this rule.	Sub-policies can cause insecure ciphers to be used.
CCE-86546-9	Harden common str/mem functions against buffer overflows	Detect overflows of buffers in common string and memory functions where the compiler can determine and validate the buffer sizes. This configuration is available from kernel 4.13, but may be available if backported by distros. The configuration that was used to build kernel is available at `/boot/config-`. To check the configuration value for `CONFIG_FORTIFY_SOURCE`, run the following command: `grep CONFIG_FORTIFY_SOURCE /boot/config-` For each kernel installed, a line with value "y" should be returned.	This features helps reduce likelihood of memory corruption of kernel structures.
CCE-86547-7	Enable Dracut FIPS Module	Red Hat Enterprise Linux 9 has an installation-time kernel flag that can enable FIPS mode. The installer must be booted with `fips=1` for the system to have FIPS mode enabled. Enabling FIPS mode on a preexisting system is not supported. If this rule fails on an installed system, then this is a permanent finding and cannot be fixed. To enable FIPS, the system requires that the `fips` module is added in `dracut` configuration. Check if `/etc/dracut.conf.d/40-fips.conf` contain `add_dracutmodules+=" fips "`	Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. The operating system must implement cryptographic modules adhering to the higher standards approved by the federal government since this provides assurance they have been tested and validated.
CCE-86552-7	Ensure SSH LoginGraceTime is configured	The `LoginGraceTime` parameter to the SSH server specifies the time allowed for successful authentication to the SSH server. The longer the Grace period is the more open unauthenticated connections can exist. Like other session controls in this session the Grace Period should be limited to appropriate limits to ensure the service is available for needed access.	Setting the `LoginGraceTime` parameter to a low number will minimize the risk of successful brute force attacks to the SSH server. It will also limit the number of concurrent unauthenticated connections.
CCE-86553-5	Verify the SSH Private Key Files Have a Passcode	When creating SSH key pairs, always use a passcode. You can create such keys with the following command: $ sudo ssh-keygen -n [passphrase] Red Hat Enterprise Linux 9, for certificate-based authentication, must enforce authorized access to the corresponding private key.	If an unauthorized user obtains access to a private key without a passcode, that user would have unauthorized access to any system where the associated public key has been installed.
CCE-86556-8	Install Virus Scanning Software	Virus scanning software can be used to protect a system from penetration from computer viruses and to limit their spread through intermediate systems. The virus scanning software should be configured to perform scans dynamically on accessed files. If this capability is not available, the system must be configured to scan, at a minimum, all altered files on the system on a daily basis. If the system processes inbound SMTP mail, the virus scanner must be configured to scan all received mail.	Virus scanning software can be used to detect if a system has been compromised by computer viruses, as well as to limit their spread to other systems.
CCE-86567-5	Verify Only Group Root Has GID 0	If any group other than root has a GID of 0, this misconfiguration should be investigated and the groups other than root should be removed or have their GID changed.	Ensuring that only the `root` group has a GID of 0 helps prevent root group owned files from becoming accidentally accessible to non-privileged users.
CCE-86570-9	Implement STIG Sub Crypto Policy	Create a custom cryptographic policy to follow the guidance from DISA.	To follow STIG policy.
CCE-86573-3	Enable different security models	This allows you to choose different security modules to be configured into your kernel. The configuration that was used to build kernel is available at `/boot/config-`. To check the configuration value for `CONFIG_SECURITY`, run the following command: `grep CONFIG_SECURITY /boot/config-` For each kernel installed, a line with value "y" should be returned.	This is enables kernel security primitives required by the LSM framework.
CCE-86574-1	Record Access Events to Audit Log Directory	The audit system should collect access events to read audit log directory. The following audit rule will assure that access to audit log directory are collected. Set ARCH to either b32 for 32-bit system, or have two lines for both b32 and b64 in case your system is 64-bit. -a always,exit -F arch=ARCH -F dir=/var/log/audit/ -F perm=r -F auid>=1000 -F auid!=unset -F key=access-audit-trail If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the rule to a file with suffix `.rules` in the directory `/etc/audit/rules.d`. If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the rule to `/etc/audit/audit.rules` file.	Attempts to read the logs should be recorded, suspicious access to audit log files could be an indicator of malicious activity on a system. Auditing these events could serve as evidence of potential system compromise.'
CCE-86576-6	Elevate The SELinux Context When An Administrator Calls The Sudo Command	Configure the operating system to elevate the SELinux context when an administrator calls the sudo command. Edit a file in the /etc/sudoers.d directory with the following command: sudo visudo -f /etc/sudoers.d/CUSTOM_FILE Use the following example to build the CUSTOM_FILE in the /etc/sudoers.d directory to allow any administrator belonging to a designated sudoers admin group to elevate their SELinux context with the use of the sudo command: %wheel ALL=(ALL) TYPE=sysadm_t ROLE=sysadm_r ALL	Preventing non-privileged users from executing privileged functions mitigates the risk that unauthorized individuals or processes may gain unnecessary access to information or privileges. Privileged functions include, for example, establishing accounts, performing system integrity checks, or administering cryptographic key management activities. Non-privileged users are individuals who do not possess appropriate authorizations. Circumventing intrusion detection and prevention mechanisms or malicious code protection mechanisms are examples of privileged functions that require protection from non-privileged users.
CCE-86580-8	Enable the GNOME3 Login Smartcard Authentication	In the default graphical environment, smart card authentication can be enabled on the login screen by setting `enable-smartcard-authentication` to `true`. To enable, add or edit `enable-smartcard-authentication` to `/etc/dconf/db/distro.d/00-security-settings`. For example: [org/gnome/login-screen] enable-smartcard-authentication=true Once the setting has been added, add a lock to `/etc/dconf/db/distro.d/locks/00-security-settings-lock` to prevent user modification. For example: /org/gnome/login-screen/enable-smartcard-authentication After the settings have been set, run `dconf update`.	Smart card login provides two-factor authentication stronger than that provided by a username and password combination. Smart cards leverage PKI (public key infrastructure) in order to provide and verify credentials.
CCE-86581-6	Verify Permissions on System.map Files	The System.map files are symbol map files generated during the compilation of the Linux kernel. They contain the mapping between kernel symbols and their corresponding memory addresses. In general, there is no need for non-root users to read these files. To properly set the permissions of `/boot/System.map`, run the command: $ sudo chmod 0600 /boot/System.map	The purpose of `System.map` files is primarily for debugging and profiling the kernel. Unrestricted access to these files might disclose information useful to attackers and malicious software leading to more sophisticated exploitation.
CCE-86584-0	Verify Group Who Owns System.map Files	The System.map files are symbol map files generated during the compilation of the Linux kernel. They contain the mapping between kernel symbols and their corresponding memory addresses. These files must be group-owned by root. To properly set the group owner of `/boot/System.map`, run the command: $ sudo chgrp root /boot/System.map	The purpose of `System.map` files is primarily for debugging and profiling the kernel. Unrestricted access to these files might disclose information useful to attackers and malicious software leading to more sophisticated exploitation.
CCE-86587-3	Verify User Who Owns System.map Files	The System.map files are symbol map files generated during the compilation of the Linux kernel. They contain the mapping between kernel symbols and their corresponding memory addresses. These files must be owned by root. To properly set the owner of `/boot/System.map`, run the command: $ sudo chown root /boot/System.map	The purpose of `System.map` files is primarily for debugging and profiling the kernel. Unrestricted access to these files might disclose information useful to attackers and malicious software leading to more sophisticated exploitation.
CCE-86603-8	Record Events that Modify the System's Network Environment - /etc/hostname	If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -w /etc/hostname -p wa -k audit_rules_networkconfig_modification_hostname_file If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules`: -w /etc/hostname -p wa -k audit_rules_networkconfig_modification_hostname_file	The network environment should not be modified by anything other than administrator action. Any change to network parameters should be audited.
CCE-86608-7	The s-nail Package Is Installed	A mail server is required for sending emails. The `s-nail` package can be installed with the following command: $ sudo dnf install s-nail	Emails can be used to notify designated personnel about important system events such as failures or warnings.
CCE-86612-9	Install cryptsetup Package	The `cryptsetup` package can be installed with the following command: $ sudo dnf install cryptsetup	LUKS is the upcoming standard for Linux hard disk encryption. By providing a standard on-disk format, it does not only facilitate compatibility among distributions, but also provide secure management of multiple user passwords. In contrast to existing solution, LUKS stores all necessary setup information in the partition header, enabling the user to transport or migrate their data seamlessly. LUKS for dm-crypt is implemented in `cryptsetup`.
CCE-86613-7	Ensure auditd Collects Changes to Cron Jobs - /etc/cron.d/	At a minimum, the audit system should collect administrator actions for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -w /etc/cron.d/ -p wa -k cronjobs If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules`: -w /etc/cron.d/ -p wa -k cronjobs	The actions taken by system administrators should be audited to keep a record of what was executed on the system, as well as, for accountability purposes. Editing the sudoers file may be sign of an attacker trying to establish persistent methods to a system, auditing the editing of the sudoers files mitigates this risk.
CCE-86621-0	Encrypt Audit Records Sent With audispd Plugin	Configure the operating system to encrypt the transfer of off-loaded audit records onto a different system or media from the system being audited. Uncomment the `enable_krb5` option in /etc/audit/audisp-remote.conf , and set it with the following line: enable_krb5 = yes	Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Off-loading is a common process in information systems with limited audit storage capacity.
CCE-86636-8	Ensure auditd Collects Changes to Cron Jobs - /var/spool/cron	If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -w /var/spool/cron -p wa -k cronjobs If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules`: -w /var/spool/cron -p wa -k cronjobs	In addition to auditing new user and group accounts, these watches will alert the system administrator(s) to any modifications. Any unexpected users, groups, or modifications should be investigated for legitimacy.
CCE-86646-7	Uninstall rpcbind Package	The rpcbind utility maps RPC services to the ports on which they listen. RPC processes notify rpcbind when they start, registering the ports they are listening on and the RPC program numbers they expect to serve. The rpcbind service redirects the client to the proper port number so it can communicate with the requested service. If the system does not require RPC (such as for NFS servers) then this service should be disabled. The `rpcbind` package can be removed with the following command: $ sudo dnf remove rpcbind	If the system does not require rpc based services, it is recommended that rpcbind be disabled to reduce the attack surface.
CCE-86657-4	Enable checks on credential management	Enable this to turn on some debug checking for credential management. The additional code keeps track of the number of pointers from task_structs to any given cred struct, and checks to see that this number never exceeds the usage count of the cred struct. Furthermore, if SELinux is enabled, this also checks that the security pointer in the cred struct is never seen to be invalid. The configuration that was used to build kernel is available at `/boot/config-`. To check the configuration value for `CONFIG_DEBUG_CREDENTIALS`, run the following command: `grep CONFIG_DEBUG_CREDENTIALS /boot/config-` For each kernel installed, a line with value "y" should be returned.	This adds sanity checks and validations to credential data structures.
CCE-86667-3	Disable Ctrl-Alt-Del Reboot Activation	By default, `SystemD` will reboot the system if the `Ctrl-Alt-Del` key sequence is pressed. To configure the system to ignore the `Ctrl-Alt-Del` key sequence from the command line instead of rebooting the system, do either of the following: ln -sf /dev/null /etc/systemd/system/ctrl-alt-del.target or systemctl mask ctrl-alt-del.target Do not simply delete the `/usr/lib/systemd/system/ctrl-alt-del.service` file, as this file may be restored during future system updates.	A locally logged-in user who presses Ctrl-Alt-Del, when at the console, can reboot the system. If accidentally pressed, as could happen in the case of mixed OS environment, this can create the risk of short-term loss of availability of systems due to unintentional reboot.
CCE-86695-4	Verify the UEFI Boot Loader grub.cfg User Ownership	The file `/boot/grub2/grub.cfg` should be owned by the `root` user to prevent destruction or modification of the file. To properly set the owner of `/boot/grub2/grub.cfg`, run the command: $ sudo chown root /boot/grub2/grub.cfg	Only root should be able to modify important boot parameters.
CCE-86696-2	Verify the UEFI Boot Loader grub.cfg Group Ownership	The file `/boot/grub2/grub.cfg` should be group-owned by the `root` group to prevent destruction or modification of the file. To properly set the group owner of `/boot/grub2/grub.cfg`, run the command: $ sudo chgrp root /boot/grub2/grub.cfg	The `root` group is a highly-privileged group. Furthermore, the group-owner of this file should not have any access privileges anyway.
CCE-86697-0	Verify Group Ownership of Message of the Day Banner	To properly set the group owner of `/etc/motd`, run the command: $ sudo chgrp root /etc/motd	Display of a standardized and approved use notification before granting access to the operating system ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. Proper group ownership will ensure that only root user can modify the banner.
CCE-86698-8	Verify ownership of Message of the Day Banner	To properly set the owner of `/etc/motd`, run the command: $ sudo chown root /etc/motd	Display of a standardized and approved use notification before granting access to the operating system ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. Proper ownership will ensure that only root user can modify the banner.
CCE-86699-6	Verify Group Ownership of System Login Banner	To properly set the group owner of `/etc/issue`, run the command: $ sudo chgrp root /etc/issue	Display of a standardized and approved use notification before granting access to the operating system ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. Proper group ownership will ensure that only root user can modify the banner.
CCE-86700-2	Verify ownership of System Login Banner	To properly set the owner of `/etc/issue`, run the command: $ sudo chown root /etc/issue	Display of a standardized and approved use notification before granting access to the operating system ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. Proper ownership will ensure that only root user can modify the banner.
CCE-86717-6	Enable Yama support	This enables support for LSM module Yama, which extends DAC support with additional system-wide security settings beyond regular Linux discretionary access controls. The module will limit the use of the system call `ptrace()`. The configuration that was used to build kernel is available at `/boot/config-`. To check the configuration value for `CONFIG_SECURITY_YAMA`, run the following command: `grep CONFIG_SECURITY_YAMA /boot/config-` For each kernel installed, a line with value "y" should be returned.	Unrestricted usage of ptrace allows compromised binaries to run ptrace on another processes of the user.
CCE-86722-6	Enable PAM	UsePAM Enables the Pluggable Authentication Module interface. If set to “yes” this will enable PAM authentication using ChallengeResponseAuthentication and PasswordAuthentication in addition to PAM account and session module processing for all authentication types. To enable PAM authentication, add or correct the following line in `/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf`: UsePAM yes	When UsePAM is set to yes, PAM runs through account and session types properly. This is important if you want to restrict access to services based off of IP, time or other factors of the account. Additionally, you can make sure users inherit certain environment variables on login or disallow access to the server.
CCE-86742-4	Ensure Password History Is Enforced for the Root User	The `enforce_for_root` option enforces password history for the root user. Enable the `enforce_for_root` setting in `/etc/security/pwhistory.conf` to require the `root` user to use a password that has not been used recently.	Requiring users not to reuse their passwords make it less likely that an attacker will be able to guess the password or use a compromised password.
CCE-86746-5	Verify Non-Interactive Accounts Are Locked	Accounts meant for non-interactive purposes should be locked to prevent unauthorized access. Accounts with non-standard shells (those not defined in `/etc/shells`) should be locked using `usermod -L`.	Locking non-interactive accounts improves security by preventing potential misuse. While many systems configure these accounts with invalid strings, setting the shell field to `nologin` is also suggested
CCE-86756-4	Verify No .forward Files Exist	The `.forward` file specifies an email address to forward the user's mail to.	Use of the `.forward` file poses a security risk in that sensitive data may be inadvertently transferred outside the organization. The .forward file also poses a risk as it can be used to execute commands that may perform unintended actions.
CCE-86759-8	Set existing passwords a period of inactivity before they been locked	Configure user accounts that have been inactive for over a given period of time to be automatically disabled by running the following command: $ sudo chage --inactive 30 USER	Inactive accounts pose a threat to system security since the users are not logging in to notice failed login attempts or other anomalies.
CCE-86760-6	Install systemd-journal-remote Package	Journald (via systemd-journal-remote ) supports the ability to send log events it gathers to a remote log host or to receive messages from remote hosts, thus enabling centralised log management.	Storing log data on a remote host protects log integrity from local attacks. If an attacker gains root access on the local system, they could tamper with or remove log data that is stored on the local system.
CCE-86761-4	Disable Bluetooth Service	The `bluetooth` service can be disabled with the following command: $ sudo systemctl mask --now bluetooth.service $ sudo service bluetooth stop	Disabling the `bluetooth` service prevents the system from attempting connections to Bluetooth devices, which entails some security risk. Nevertheless, variation in this risk decision may be expected due to the utility of Bluetooth connectivity and its limited range.
CCE-86762-2	Verify Permissions and Ownership of Old Passwords File	To properly set the owner of `/etc/security/opasswd`, run the command: $ sudo chown root /etc/security/opasswd To properly set the group owner of `/etc/security/opasswd`, run the command: $ sudo chgrp root /etc/security/opasswd To properly set the permissions of `/etc/security/opasswd`, run the command: $ sudo chmod 0600 /etc/security/opasswd	The `/etc/security/opasswd` file stores old passwords to prevent password reuse. Protection of this file is critical for system security.
CCE-86763-0	Disable Mounting of freevxfs	To configure the system to prevent the `freevxfs` kernel module from being loaded, add the following line to the file `/etc/modprobe.d/freevxfs.conf`: install freevxfs /bin/false This entry will cause a non-zero return value during a `freevxfs` module installation and additionally convey the meaning of the entry to the user in form of an error message. If you would like to omit a non-zero return value and an error message, you may want to add a different line instead (both `/bin/true` and `/bin/false` are allowed by OVAL and will be accepted by the scan): install freevxfs /bin/true This effectively prevents usage of this uncommon filesystem.	Linux kernel modules which implement filesystems that are not needed by the local system should be disabled.
CCE-86764-8	Disable Mounting of hfs	To configure the system to prevent the `hfs` kernel module from being loaded, add the following line to the file `/etc/modprobe.d/hfs.conf`: install hfs /bin/false This entry will cause a non-zero return value during a `hfs` module installation and additionally convey the meaning of the entry to the user in form of an error message. If you would like to omit a non-zero return value and an error message, you may want to add a different line instead (both `/bin/true` and `/bin/false` are allowed by OVAL and will be accepted by the scan): install hfs /bin/true This effectively prevents usage of this uncommon filesystem.	Linux kernel modules which implement filesystems that are not needed by the local system should be disabled.
CCE-86765-5	Disable Mounting of hfsplus	To configure the system to prevent the `hfsplus` kernel module from being loaded, add the following line to the file `/etc/modprobe.d/hfsplus.conf`: install hfsplus /bin/false This entry will cause a non-zero return value during a `hfsplus` module installation and additionally convey the meaning of the entry to the user in form of an error message. If you would like to omit a non-zero return value and an error message, you may want to add a different line instead (both `/bin/true` and `/bin/false` are allowed by OVAL and will be accepted by the scan): install hfsplus /bin/true This effectively prevents usage of this uncommon filesystem.	Linux kernel modules which implement filesystems that are not needed by the local system should be disabled.
CCE-86766-3	Disable Mounting of jffs2	To configure the system to prevent the `jffs2` kernel module from being loaded, add the following line to the file `/etc/modprobe.d/jffs2.conf`: install jffs2 /bin/false This entry will cause a non-zero return value during a `jffs2` module installation and additionally convey the meaning of the entry to the user in form of an error message. If you would like to omit a non-zero return value and an error message, you may want to add a different line instead (both `/bin/true` and `/bin/false` are allowed by OVAL and will be accepted by the scan): install jffs2 /bin/true This effectively prevents usage of this uncommon filesystem.	Linux kernel modules which implement filesystems that are not needed by the local system should be disabled.
CCE-86767-1	Use Only FIPS 140-2 Validated Ciphers	Limit the ciphers to those algorithms which are FIPS-approved. Counter (CTR) mode is also preferred over cipher-block chaining (CBC) mode. The following line in `/etc/ssh/sshd_config` demonstrates use of FIPS-approved ciphers: Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc The man page `sshd_config(5)` contains a list of supported ciphers. The rule is parametrized to use the following ciphers: `aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc,rijndael-cbc@lysator.liu.se`.	Unapproved mechanisms that are used for authentication to the cryptographic module are not verified and therefore cannot be relied upon to provide confidentiality or integrity, and system data may be compromised. Operating systems utilizing encryption are required to use FIPS-compliant mechanisms for authenticating to cryptographic modules. FIPS 140-2 is the current standard for validating that mechanisms used to access cryptographic modules utilize authentication that meets industry and government requirements. For government systems, this allows Security Levels 1, 2, 3, or 4 for use on Red Hat Enterprise Linux 9.
CCE-86768-9	Use Only Strong Key Exchange algorithms	Limit the Key Exchange to strong algorithms. The following line in `/etc/ssh/sshd_config` demonstrates use of those: KexAlgorithms `ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256`	Key exchange is any method in cryptography by which cryptographic keys are exchanged between two parties, allowing use of a cryptographic algorithm. If the sender and receiver wish to exchange encrypted messages, each must be equipped to encrypt messages to be sent and decrypt messages received
CCE-86769-7	Use Only Strong MACs	Limit the MACs to strong hash algorithms. The following line in `/etc/ssh/sshd_config` demonstrates use of those MACs: MACs `hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-ripemd160`	MD5 and 96-bit MAC algorithms are considered weak and have been shown to increase exploitability in SSH downgrade attacks. Weak algorithms continue to have a great deal of attention as a weak spot that can be exploited with expanded computing power. An attacker that breaks the algorithm could take advantage of a MiTM position to decrypt the SSH tunnel and capture credentials and information
CCE-86772-1	Ensure the audit-libs package as a part of audit Subsystem is Installed	The audit-libs package should be installed.	The auditd service is an access monitoring and accounting daemon, watching system calls to audit any access, in comparison with potential local access control policy such as SELinux policy.
CCE-86779-6	Do not allow ACPI methods to be inserted/replaced at run time	This debug facility allows ACPI AML methods to be inserted and/or replaced without rebooting the system. This configuration is available from kernel 3.0. The configuration that was used to build kernel is available at `/boot/config-`. To check the configuration value for `CONFIG_ACPI_CUSTOM_METHOD`, run the following command: `grep CONFIG_ACPI_CUSTOM_METHOD /boot/config-` Configs with value 'n' are not explicitly set in the file, so either commented lines or no lines should be returned.	Enabling this feature allows arbitrary kernel memory to be written to by root (uid=0) users, allowing them to bypass certain security measures
CCE-86782-0	Ensure Rsyslog Encrypts Off-Loaded Audit Records	Rsyslogd is a system utility providing support for message logging. Support for both internet and UNIX domain sockets enables this utility to support both local and remote logging. Couple this utility with `gnutls` (which is a secure communications library implementing the SSL, TLS and DTLS protocols), and you have a method to securely encrypt and off-load auditing. When using `rsyslogd` to off-load logs off an encryption system must be used. Set the following configuration option in /etc/rsyslog.conf or in a file in /etc/rsyslog.d (using legacy syntax): $DefaultNetstreamDriver gtls Alternatively, use the RainerScript syntax: global(DefaultNetstreamDriver="gtls")	The audit records generated by Rsyslog contain valuable information regarding system configuration, user authentication, and other such information. Audit records should be protected from unauthorized access.
CCE-86805-9	NetworkManager DNS Mode Must Be Must Configured	The DNS processing mode in NetworkManager describes how DNS is processed on the system. Depending the mode some changes the system's DNS may not be respected.	To ensure that DNS resolver settings are respected, a DNS mode in NetworkManager must be configured.
CCE-86815-8	Enable checks on notifier call chains	Enable this to turn on sanity checking for notifier call chains. This is most useful for kernel developers to make sure that modules properly unregister themselves from notifier chains. The configuration that was used to build kernel is available at `/boot/config-`. To check the configuration value for `CONFIG_DEBUG_NOTIFIERS`, run the following command: `grep CONFIG_DEBUG_NOTIFIERS /boot/config-` For each kernel installed, a line with value "y" should be returned.	This provides validation of notifier chains, it checks whether the notifiers are from the kernel or a module that is still loaded prior to being invoked.
CCE-86817-4	Limit Users' SSH Access	By default, the SSH configuration allows any user with an account to access the system. There are several options available to limit which users and group can access the system via SSH. It is recommended that at least one of the following options be leveraged: - AllowUsers variable gives the system administrator the option of allowing specific users to ssh into the system. The list consists of space separated user names. Numeric user IDs are not recognized with this variable. If a system administrator wants to restrict user access further by specifically allowing a user's access only from a particular host, the entry can be specified in the form of user@host. - AllowGroups variable gives the system administrator the option of allowing specific groups of users to ssh into the system. The list consists of space separated group names. Numeric group IDs are not recognized with this variable. - DenyUsers variable gives the system administrator the option of denying specific users to ssh into the system. The list consists of space separated user names. Numeric user IDs are not recognized with this variable. If a system administrator wants to restrict user access further by specifically denying a user's access from a particular host, the entry can be specified in the form of user@host. - DenyGroups variable gives the system administrator the option of denying specific groups of users to ssh into the system. The list consists of space separated group names. Numeric group IDs are not recognized with this variable.	Specifying which accounts are allowed SSH access into the system reduces the possibility of unauthorized access to the system.
CCE-86819-0	Ensure Users Cannot Change GNOME3 Screensaver Idle Activation	If not already configured, ensure that users cannot change GNOME3 screensaver lock settings by adding /org/gnome/desktop/screensaver/idle-activation-enabled to `/etc/dconf/db/local.d/00-security-settings`. For example: /org/gnome/desktop/screensaver/idle-activation-enabled After the settings have been set, run `dconf update`.	A session lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not want to logout because of the temporary nature of the absence.
CCE-86830-7	Verify Group Who Owns /etc/cron.allow file	If `/etc/cron.allow` exists, it must be group-owned by `root`. To properly set the group owner of `/etc/cron.allow`, run the command: $ sudo chgrp root /etc/cron.allow	If the owner of the cron.allow file is not set to root, the possibility exists for an unauthorized user to view or edit sensitive information.
CCE-86844-8	Verify User Who Owns /etc/cron.allow file	If `/etc/cron.allow` exists, it must be owned by `root`. To properly set the owner of `/etc/cron.allow`, run the command: $ sudo chown root /etc/cron.allow	If the owner of the cron.allow file is not set to root, the possibility exists for an unauthorized user to view or edit sensitive information.
CCE-86845-5	Ensure EPEL Repository is Disabled	The system must not have the EPEL (Extra Packages for Enterprise Linux) repository enabled. EPEL provides additional packages that are not part of the official RHEL distribution and may not meet enterprise security requirements. Check if any repository files in `/etc/yum.repos.d/` contain enabled EPEL repositories by running: $ grep -r "^\[.epel.\]" /etc/yum.repos.d/ If EPEL repositories are found, ensure they are disabled by setting `enabled=0` in the repository configuration file.	The EPEL repository is not officially supported by Red Hat and may contain packages that have not been vetted for security in an enterprise environment. Using unsupported repositories can introduce vulnerabilities, compatibility issues, or packages that do not meet DoD security requirements. Only packages from authorized repositories should be installed to maintain system integrity and security.
CCE-86850-5	Ensure that /etc/cron.deny does not exist	The file `/etc/cron.deny` should not exist. Use `/etc/cron.allow` instead.	Access to `cron` should be restricted. It is easier to manage an allow list than a deny list.
CCE-86856-2	Ensure that /etc/at.allow exists	The file `/etc/at.allow` should exist and should be used instead of `/etc/at.deny`.	Using the at.allow file to control who can run at jobs enforces this who can schedule jobs. It is easier to manage an allow list than a deny list.
CCE-86858-8	Configure Multiple DNS Servers in /etc/resolv.conf	Determine whether the system is using local or DNS name resolution with the following command: $ sudo grep hosts /etc/nsswitch.conf hosts: files dns If the DNS entry is missing from the host's line in the "/etc/nsswitch.conf" file, the "/etc/resolv.conf" file must be empty. Verify the "/etc/resolv.conf" file is empty with the following command: $ sudo ls -al /etc/resolv.conf -rw-r--r-- 1 root root 0 Aug 19 08:31 resolv.conf If the DNS entry is found on the host's line of the "/etc/nsswitch.conf" file, then verify the following: Multiple Domain Name System (DNS) Servers should be configured in `/etc/resolv.conf`. This provides redundant name resolution services in the event that a domain server crashes. To configure the system to contain as least `2` DNS servers, add a corresponding `nameserver ip_address` entry in `/etc/resolv.conf` for each DNS server where ip_address is the IP address of a valid DNS server. For example: search example.com nameserver 192.168.0.1 nameserver 192.168.0.2	To provide availability for name resolution services, multiple redundant name servers are mandated. A failure in name resolution could lead to the failure of security functions requiring name resolution, which may include time synchronization, centralized authentication, and remote system logging.
CCE-86860-4	Configure GnuTLS library to use DoD-approved TLS Encryption	Crypto Policies provide a centralized control over crypto algorithms usage of many packages. GnuTLS is supported by system crypto policy, but the GnuTLS configuration may be set up to ignore it. To check that Crypto Policies settings are configured correctly, ensure that `/etc/crypto-policies/back-ends/gnutls.config` contains the following line and is not commented out: `+VERS-ALL:-VERS-DTLS0.9:-VERS-TLS1.1:-VERS-TLS1.0:-VERS-SSL3.0:-VERS-DTLS1.0` These keywords are order-independent, so the line can be in any order. GnuTLS will then prefer the highest version.	Overriding the system crypto policy makes the behavior of the GnuTLS library violate expectations, and makes system configuration more fragmented.
CCE-86871-1	Ensure Rsyslog Authenticates Off-Loaded Audit Records	Rsyslogd is a system utility providing support for message logging. Support for both internet and UNIX domain sockets enables this utility to support both local and remote logging. Couple this utility with `gnutls` (which is a secure communications library implementing the SSL, TLS and DTLS protocols), and you have a method to securely encrypt and off-load auditing. When using `rsyslogd` to off-load logs the remote system must be authenticated. Set the following configuration option in /etc/rsyslog.conf or in a file in /etc/rsyslog.d (using legacy syntax): $ActionSendStreamDriverAuthMode x509/name Alternatively, use the RainerScript syntax: action(type="omfwd" Target="some.example.com" StreamDriverAuthMode="x509/name")	The audit records generated by Rsyslog contain valuable information regarding system configuration, user authentication, and other such information. Audit records should be protected from unauthorized access.
CCE-86877-8	Verify Permissions on /etc/cron.allow file	If `/etc/cron.allow` exists, it must have permissions `0640` or more restrictive. To properly set the permissions of `/etc/cron.allow`, run the command: $ sudo chmod 0640 /etc/cron.allow	If the permissions of the cron.allow file are not set to 0640 or more restrictive, the possibility exists for an unauthorized user to view or edit sensitive information.
CCE-86885-1	Disable mutable hooks	Ensure kernel structures associated with LSMs are always mapped as read-only after system boot. The configuration that was used to build kernel is available at `/boot/config-`. To check the configuration value for `CONFIG_SECURITY_WRITABLE_HOOKS`, run the following command: `grep CONFIG_SECURITY_WRITABLE_HOOKS /boot/config-` Configs with value 'n' are not explicitly set in the file, so either commented lines or no lines should be returned.	If CONFIG_SECURITY_WRITABLE_HOOKS is enabled, then hooks can be loaded at runtime and being able to manipulate hooks is a way to bypass all LSMs.
CCE-86887-7	Verify Owner on cron.deny	To properly set the owner of `/etc/cron.deny`, run the command: $ sudo chown root /etc/cron.deny	Service configuration files enable or disable features of their respective services that if configured incorrectly can lead to insecure and vulnerable configurations. Therefore, service configuration files should be owned by the correct user to prevent unauthorized changes.
CCE-86891-9	Ensure tmp.mount Unit Is Enabled	The `/tmp` directory is a world-writable directory used for temporary file storage. This directory is managed by `systemd-tmpfiles`. Ensure that the `tmp.mount` systemd unit is enabled.	The `/tmp` directory is used as temporary storage by many programs. Placing `/tmp` in a tmpfs filesystem enables the setting of more restrictive mount options, which can help protect programs which use it. The `tmp.mount` unit configures the tmpfs filesystem and ensures the `/tmp` directory is wiped during reboot.
CCE-86899-2	Record Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT	The audit system should collect unauthorized file accesses for all users and root. The `open_by_handle_at` syscall can be used to create new files when O_CREAT flag is specified. The following auidt rules will assure that unsuccessful attempts to create a file via `open_by_handle_at` syscall are collected. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the rules below to a file with suffix `.rules` in the directory `/etc/audit/rules.d`. If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the rules below to `/etc/audit/audit.rules` file. -a always,exit -F arch=b32 -S open_by_handle_at -F a2&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create -a always,exit -F arch=b32 -S open_by_handle_at -F a2&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-create If the system is 64 bit then also add the following lines: -a always,exit -F arch=b64 -S open_by_handle_at -F a2&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create -a always,exit -F arch=b64 -S open_by_handle_at -F a2&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-create	Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing these events could serve as evidence of potential system compromise.
CCE-86904-0	Verify Permissions on /etc/at.allow file	If `/etc/at.allow` exists, it must have permissions `0640` or more restrictive. To properly set the permissions of `/etc/at.allow`, run the command: $ sudo chmod 0640 /etc/at.allow	If the permissions of the at.allow file are not set to 0640 or more restrictive, the possibility exists for an unauthorized user to view or edit sensitive information.
CCE-86915-6	Set Existing Passwords Warning Age	To configure how many days prior to password expiration that a warning will be issued to users, run the command: $ sudo chage --warndays `7` USER This profile requirement is `7`.	Providing an advance warning that a password will be expiring gives users time to think of a secure password. Users caught unaware may choose a simple password or write it down where it may be discovered.
CCE-86917-2	Configure the Use of the pam_faillock.so Module in the /etc/pam.d/system-auth File.	The pam_faillock.so module must be loaded in preauth in /etc/pam.d/system-auth.	If the pam_faillock.so module is not loaded the system will not correctly lockout accounts to prevent password guessing attacks.
CCE-86923-0	Set SSH Daemon LogLevel to VERBOSE	The `VERBOSE` parameter configures the SSH daemon to record login and logout activity. To specify the log level in SSH, add or correct the following line in `/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf`: LogLevel VERBOSE	SSH provides several logging levels with varying amounts of verbosity. `DEBUG` is specifically not recommended other than strictly for debugging SSH communications since it provides so much data that it is difficult to identify important security information. `INFO` or `VERBOSE` level is the basic level that only records login activity of SSH users. In many situations, such as Incident Response, it is important to determine when a particular user was active on a system. The logout record can eliminate those users who disconnected, which helps narrow the field.
CCE-86932-1	Configure the Use of the pam_faillock.so Module in the /etc/pam.d/password-auth File.	The pam_faillock.so module must be loaded in preauth in /etc/pam.d/password-auth.	If the pam_faillock.so module is not loaded the system will not correctly lockout accounts to prevent password guessing attacks.
CCE-86940-4	Record Events that Modify the System's Network Environment - /etc/sysconfig/network-scripts	If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -w /etc/sysconfig/network-scripts -p wa -k audit_rules_networkconfig_modification_network_scripts If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules`: -w /etc/sysconfig/network-scripts -p wa -k audit_rules_networkconfig_modification_network_scripts	The network environment should not be modified by anything other than administrator action. Any change to network parameters should be audited.
CCE-86946-1	Ensure that /etc/at.deny does not exist	The file `/etc/at.deny` should not exist. Use `/etc/at.allow` instead.	Access to `at` should be restricted. It is easier to manage an allow list than a deny list.
CCE-86948-7	Disable /dev/kmem virtual device support	Disable support for the /dev/kmem device. The configuration that was used to build kernel is available at `/boot/config-`. To check the configuration value for `CONFIG_DEVKMEM`, run the following command: `grep CONFIG_DEVKMEM /boot/config-` Configs with value 'n' are not explicitly set in the file, so either commented lines or no lines should be returned.	The /dev/kmem device is rarely used, but can be used for certain kind of kernel debugging operations.
CCE-86951-1	Ensure That the sudo Binary Has the Correct Permissions	To properly set the permissions of `/usr/bin/sudo`, run the command: $ sudo chmod 4110 /usr/bin/sudo In order to use this rule, the group owner for /usr/bin/sudo needs to be changed to a group other than root to effectively limit access to sudo.	The sudoers program should only be usable by people who have the correct permissions.
CCE-86954-5	Set GNOME3 Screensaver Lock Delay After Activation Period	To activate the locking delay of the screensaver in the GNOME3 desktop when the screensaver is activated, add or set `lock-delay` to `uint32 0` in `/etc/dconf/db/local.d/00-security-settings`. For example: [org/gnome/desktop/screensaver] lock-delay=uint32 `0` After the settings have been set, run `dconf update`.	A session lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not want to logout because of the temporary nature of the absence.
CCE-86961-0	Disable the uvcvideo module	If the device contains a camera it should be covered or disabled when not in use.	Failing to disconnect from collaborative computing devices (i.e., cameras) can result in subsequent compromises of organizational information. Providing easy methods to physically disconnect from such devices after a collaborative computing session helps to ensure participants actually carry out the disconnect activity without having to go through complex and tedious procedures.
CCE-86966-9	Ensure All Groups on the System Have Unique Group Names	Change the group name or delete groups, so each has a unique name.	To assure accountability and prevent unauthenticated access, groups must be identified uniquely to prevent potential misuse and compromise of the system.
CCE-86987-5	Enable checks on linked list manipulation	Enable this to turn on extended checks in the linked-list walking routines. The configuration that was used to build kernel is available at `/boot/config-`. To check the configuration value for `CONFIG_DEBUG_LIST`, run the following command: `grep CONFIG_DEBUG_LIST /boot/config-` For each kernel installed, a line with value "y" should be returned.	This add sanity checks to manipulation of linked lists structures in the kernel and may prevent exploits such as CVE-2017-1661, where a race condition and simultaneous operations caused a list to corrupt.
CCE-86993-3	Make the kernel text and rodata read-only	When set, kernel text and rodata memory will be made read-only, and non-text memory will be made non-executable. This configuration is available from kernel 4.11. The configuration that was used to build kernel is available at `/boot/config-`. To check the configuration value for `CONFIG_STRICT_KERNEL_RWX`, run the following command: `grep CONFIG_STRICT_KERNEL_RWX /boot/config-` For each kernel installed, a line with value "y" should be returned.	This provides protection against certain security exploits (e.g. executing the heap or modifying text)
CCE-87025-3	Verify that system commands directories have root as a group owner	System commands are stored in the following directories: by default: /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin All these directories should have `root` user as a group owner. If any system command directory is not group owned by a user other than root correct its ownership with the following command: $ sudo chgrp root DIR	If the operating system were to allow any user to make changes to software libraries, then those changes might be implemented without undergoing the appropriate testing and approvals that are part of a robust change management process. This requirement applies to operating systems with software libraries that are accessible and configurable, as in the case of interpreted languages. Software libraries also include privileged programs which execute with escalated privileges. Only qualified and authorized individuals must be allowed to obtain access to information system components for purposes of initiating changes, including upgrades and modifications.
CCE-87029-5	Verify that system commands directories have root ownership	System commands are stored in the following directories by default: /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin All these directories should be owned by the `root` user. If any system command directory is not owned by a user other than root correct its ownership with the following command: $ sudo chown root DIR	If the operating system were to allow any user to make changes to software libraries, then those changes might be implemented without undergoing the appropriate testing and approvals that are part of a robust change management process. This requirement applies to operating systems with software libraries that are accessible and configurable, as in the case of interpreted languages. Software libraries also include privileged programs which execute with escalated privileges. Only qualified and authorized individuals must be allowed to obtain access to information system components for purposes of initiating changes, including upgrades and modifications.
CCE-87035-2	Generate some entropy during boot and runtime	Instrument some kernel code to extract some entropy from both original and artificially created program state. This will help especially embedded systems where there is little 'natural' source of entropy normally. This configuration is available from kernel 4.9, but may be available if backported by distros. The configuration that was used to build kernel is available at `/boot/config-`. To check the configuration value for `CONFIG_GCC_PLUGIN_LATENT_ENTROPY`, run the following command: `grep CONFIG_GCC_PLUGIN_LATENT_ENTROPY /boot/config-` For each kernel installed, a line with value "y" should be returned.	This helps generate entropy during startup and is particularly relevant for devices with inappropriate entropy sources.
CCE-87037-8	User Initialization Files Must Be Group-Owned By The Primary Group	Change the group owner of interactive users files to the group found in /etc/passwd for the user. To change the group owner of a local interactive user home directory, use the following command: $ sudo chgrp USER_GROUP /home/USER/.INIT_FILE This rule ensures every initialization file related to an interactive user is group-owned by an interactive user.	Local initialization files for interactive users are used to configure the user's shell environment upon logon. Malicious modification of these files could compromise accounts upon logon.
CCE-87038-6	User Initialization Files Must Be Owned By the Primary User	Set the owner of the user initialization files for interactive users to the primary owner with the following command: $ sudo chown USER /home/USER/.* This rule ensures every initialization file related to an interactive user is owned by an interactive user.	Local initialization files are used to configure the user's shell environment upon logon. Malicious modification of these files could compromise accounts upon logon.
CCE-87039-4	All User Files and Directories In The Home Directory Must Be Group-Owned By The Primary Group	Change the group of a local interactive users files and directories to a group that the interactive user is a member of. To change the group owner of a local interactive users files and directories, use the following command: $ sudo chgrp USER_GROUP /home/USER/FILE_DIR This rule ensures every file or directory under the home directory related to an interactive user is group-owned by an interactive user.	If a local interactive users files are group-owned by a group of which the user is not a member, unintended users may be able to access them.
CCE-87041-0	All User Files and Directories In The Home Directory Must Have a Valid Owner	Either remove all files and directories from the system that do not have a valid user, or assign a valid user to all unowned files and directories. To assign a valid owner to a local interactive user's files and directories, use the following command: $ sudo chown -R USER /home/USER This rule ensures every file or directory under the home directory related to an interactive user is owned by an interactive user.	If local interactive users do not own the files in their directories, unauthorized users may be able to access them. Additionally, if files are not owned by the user, this could be an indication of system compromise.
CCE-87042-8	All User Files and Directories In The Home Directory Must Have Mode 0750 Or Less Permissive	Set the mode on files and directories in the local interactive user home directory with the following command: $ sudo chmod 0750 /home/USER/FILE_DIR Files that begin with a "." are excluded from this requirement.	If a local interactive user files have excessive permissions, unintended users may be able to access or modify them.
CCE-87047-7	Force initialization of variables containing userspace addresses	While the kernel is built with warnings enabled for any missed stack variable initializations, this warning is silenced for anything passed by reference to another function, under the occasionally misguided assumption that the function will do the initialization. As this regularly leads to exploitable flaws, this plugin is available to identify and zero-initialize such variables, depending on the chosen level of coverage. This configuration is available from kernel 4.11, but may be available if backported by distros. The configuration that was used to build kernel is available at `/boot/config-`. To check the configuration value for `CONFIG_GCC_PLUGIN_STRUCTLEAK`, run the following command: `grep CONFIG_GCC_PLUGIN_STRUCTLEAK /boot/config-` For each kernel installed, a line with value "y" should be returned.	Initializing structures from userspace can prevent some classes of information exposure.
CCE-87077-4	Ensure Chrony is only configured with the server directive	Check that Chrony only has time sources configured with the `server` directive.	Depending on the infrastructure being used the `pool` directive may not be supported. Using the `server` directive allows for better control of where the system gets time data from.
CCE-87086-5	Disable Kernel mac80211 Module	To configure the system to prevent the `mac80211` kernel module from being loaded, add the following line to the file `/etc/modprobe.d/mac80211.conf`: install mac80211 /bin/false This entry will cause a non-zero return value during a `mac80211` module installation and additionally convey the meaning of the entry to the user in form of an error message. If you would like to omit a non-zero return value and an error message, you may want to add a different line instead (both `/bin/true` and `/bin/false` are allowed by OVAL and will be accepted by the scan): install mac80211 /bin/true	If Wireless functionality must be disabled, preventing the kernel from loading the kernel module provides an additional safeguard against its activation.
CCE-87087-3	Ensure All User Initialization Files Have Mode 0740 Or Less Permissive	Set the mode of the user initialization files, including the `root` user, to `0740` with the following commands: $ sudo chmod 0740 /root/.INIT_FILE $ sudo chmod 0740 /home/USER/.INIT_FILE	Local initialization files are used to configure the user's shell environment upon logon. Malicious modification of these files could compromise accounts upon logon.
CCE-87088-1	Certificate status checking in SSSD	Multifactor solutions that require devices separate from information systems gaining access include, for example, hardware tokens providing time-based or challenge-response authenticators and smart cards. Configuring `certificate_verification` to `ocsp_dgst=sha1` ensures that certificates for multifactor solutions are checked via Online Certificate Status Protocol (OCSP).	Ensuring that multifactor solutions certificates are checked via Online Certificate Status Protocol (OCSP) ensures the security of the system.
CCE-87090-7	zero-init everything passed by reference	Zero-initialize any stack variables that may be passed by reference and had not already been explicitly initialized. This configuration is available from kernel 4.14, but may be available if backported by distros. The configuration that was used to build kernel is available at `/boot/config-`. To check the configuration value for `CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL`, run the following command: `grep CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL /boot/config-` For each kernel installed, a line with value "y" should be returned.	This eliminates all classes of uninitialized stack variable exploits and information exposures.
CCE-87097-2	Do Not Show System Messages When Unsuccessful Logon Attempts Occur	This rule ensures the system prevents informative messages from being presented to the user pertaining to logon information after a number of incorrect login attempts using `pam_faillock.so`. pam_faillock.so module requires multiple entries in pam files. These entries must be carefully defined to work as expected. In order to avoid errors when manually editing these files, it is recommended to use the appropriate tools, such as `authselect` or `authconfig`, depending on the OS version.	The pam_faillock module without the silent option will leak information about the existence or non-existence of a user account in the system because the failures are not recorded for unknown users. The message about the user account being locked is never displayed for non-existing user accounts allowing the adversary to infer that a particular account exists or not on the system.
CCE-87101-2	Ensure Authentication Required for Single User Mode	Single user mode is used for recovery when the system detects an issue during boot or by manual selection from the bootloader.	Requiring authentication in single user mode prevents an unauthorized user from rebooting the system into single user to gain root privileges without credentials.
CCE-87103-8	Verify Group Who Owns /etc/at.allow file	If `/etc/at.allow` exists, it must be group-owned by `root`. To properly set the group owner of `/etc/at.allow`, run the command: $ sudo chgrp root /etc/at.allow	If the owner of the at.allow file is not set to root, the possibility exists for an unauthorized user to view or edit sensitive information.
CCE-87106-1	Disable support for /proc/kkcore	Provides a virtual ELF core file of the live kernel. The configuration that was used to build kernel is available at `/boot/config-`. To check the configuration value for `CONFIG_PROC_KCORE`, run the following command: `grep CONFIG_PROC_KCORE /boot/config-` Configs with value 'n' are not explicitly set in the file, so either commented lines or no lines should be returned.	This feature exposes the memory to the userspace and can assist an attacker in discovering attack vectors.
CCE-87108-7	Verify the system-wide library files in directories "/lib", "/lib64", "/usr/lib/" and "/usr/lib64" are group-owned by root.	System-wide library files are stored in the following directories by default: /lib /lib64 /usr/lib /usr/lib64 All system-wide shared library files should be protected from unauthorised access. If any of these files is not group-owned by root, correct its group-owner with the following command: $ sudo chgrp root FILE	If the operating system were to allow any user to make changes to software libraries, then those changes might be implemented without undergoing the appropriate testing and approvals that are part of a robust change management process. This requirement applies to operating systems with software libraries that are accessible and configurable, as in the case of interpreted languages. Software libraries also include privileged programs which execute with escalated privileges. Only qualified and authorized individuals must be allowed to obtain access to information system components for purposes of initiating changes, including upgrades and modifications.
CCE-87109-5	Randomize layout of sensitive kernel structures	Randomize at compile-time the layouts of structures that are entirely function pointers (and have not been manually annotated with __no_randomize_layout), or structures that have been explicitly marked with __randomize_layout. This configuration is available from kernel 4.13, but may be available if backported by distros. The configuration that was used to build kernel is available at `/boot/config-`. To check the configuration value for `CONFIG_GCC_PLUGIN_RANDSTRUCT`, run the following command: `grep CONFIG_GCC_PLUGIN_RANDSTRUCT /boot/config-` For each kernel installed, a line with value "y" should be returned.	Randomizing the layout of kernel data structures make it more difficult for an attacker to know the location of sensitive data.
CCE-87114-5	Verify that Interactive Boot is Disabled	Red Hat Enterprise Linux 9 systems support an "interactive boot" option that can be used to prevent services from being started. On a Red Hat Enterprise Linux 9 system, interactive boot can be enabled by providing a `1`, `yes`, `true`, or `on` value to the `systemd.confirm_spawn` kernel argument in `/etc/default/grub`. Remove any instance of systemd.confirm_spawn=(1\|yes\|true\|on) from the kernel arguments in that file to disable interactive boot. Recovery booting must also be disabled. Confirm that `GRUB_DISABLE_RECOVERY=true` is set in `/etc/default/grub`. It is also required to change the runtime configuration, run: /sbin/grubby --update-kernel=ALL --remove-args="systemd.confirm_spawn" grub2-mkconfig -o /boot/grub2/grub.cfg	Using interactive or recovery boot, the console user could disable auditing, firewalls, or other services, weakening system security.
CCE-87128-5	Poison kernel stack before returning from syscalls	This option makes the kernel erase the kernel stack before returning from system calls. This has the effect of leaving the stack initialized to the poison value, which both reduces the lifetime of any sensitive stack contents and reduces potential for uninitialized stack variable exploits or information exposures (it does not cover functions reaching the same stack depth as prior functions during the same syscall). This configuration is available from kernel 4.20, but may be available if backported by distros. The configuration that was used to build kernel is available at `/boot/config-`. To check the configuration value for `CONFIG_GCC_PLUGIN_STACKLEAK`, run the following command: `grep CONFIG_GCC_PLUGIN_STACKLEAK /boot/config-` For each kernel installed, a line with value "y" should be returned.	This blocks most uninitialized stack variable attacks, with the performance impact being driven by the depth of the stack usage, rather than the function calling complexity.
CCE-87149-1	Enable checks on scatter-gather (SG) table operations	Scatter-gather tables are mechanism used for high performance I/O on DMA devices. Enable this to turn on checks on scatter-gather tables. The configuration that was used to build kernel is available at `/boot/config-`. To check the configuration value for `CONFIG_DEBUG_SG`, run the following command: `grep CONFIG_DEBUG_SG /boot/config-` For each kernel installed, a line with value "y" should be returned.	This can help find problems with drivers that do not properly initialize their SG tables.
CCE-87181-4	Disable Kernel Parameter for IPv4 Forwarding on all IPv4 Interfaces	To set the runtime status of the `net.ipv4.conf.all.forwarding` kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.all.forwarding=0 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: net.ipv4.conf.all.forwarding = 0	IP forwarding permits the kernel to forward packets from one network interface to another. The ability to forward packets between two networks is only appropriate for systems acting as routers.
CCE-87212-7	Ensure auditd Collects Information on the Use of Privileged Commands - usermod	At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -a always,exit -F path=/usr/sbin/usermod -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`: -a always,exit -F path=/usr/sbin/usermod -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged	Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider and advanced persistent threats. Privileged programs are subject to escalation-of-privilege attacks, which attempt to subvert their normal role of providing some necessary but limited capability. As such, motivation exists to monitor these programs for unusual activity.
CCE-87226-7	Disable the IPv6 protocol	Disable support for IP version 6 (IPv6). The configuration that was used to build kernel is available at `/boot/config-`. To check the configuration value for `CONFIG_IPV6`, run the following command: `grep CONFIG_IPV6 /boot/config-` Configs with value 'n' are not explicitly set in the file, so either commented lines or no lines should be returned.	Any unnecessary network stacks, including IPv6, should be disabled to reduce the vulnerability to exploitation.
CCE-87232-5	Prevent Unrestricted Mail Relaying	Modify the /etc/postfix/main.cf file to restrict client connections to the local network with the following command: $ sudo postconf -e 'smtpd_client_restrictions = permit_mynetworks,reject'	If unrestricted mail relaying is permitted, unauthorized senders could use this host as a mail relay for the purpose of sending spam or other unauthorized activity.
CCE-87257-2	Disable the 32-bit vDSO	Certain buggy versions of glibc (2.3.3) will crash if they are presented with a 32-bit vDSO that is not mapped at the address indicated in its segment table. Setting `CONFIG_COMPAT_VDSO` to `y` turns off the 32-bit VDSO and works around the glibc bug. The configuration that was used to build kernel is available at `/boot/config-`. To check the configuration value for `CONFIG_COMPAT_VDSO`, run the following command: `grep CONFIG_COMPAT_VDSO /boot/config-` Configs with value 'n' are not explicitly set in the file, so either commented lines or no lines should be returned.	Enabling VDSO compatibility hurts performance and disables ASLR.
CCE-87263-0	Disable LDAP Server (slapd)	The Lightweight Directory Access Protocol (LDAP) is a service that provides a method for looking up information from a central database.	If the system will not need to act as an LDAP server, it is recommended that the software be disabled to reduce the potential attack surface.
CCE-87293-7	Configure SNMP Service to Use Only SNMPv3 or Newer	Edit `/etc/snmp/snmpd.conf`, removing any references to `rocommunity`, `rwcommunity`, or `com2sec`. Upon doing that, restart the SNMP service: $ sudo systemctl restart snmpd	Earlier versions of SNMP are considered insecure, as they potentially allow unauthorized access to detailed system management information.
CCE-87295-2	Make sure that the dconf databases are up-to-date with regards to respective keyfiles	By default, DConf uses a binary database as a data backend. The system-level database is compiled from keyfiles in the /etc/dconf/db/ directory by the dconf update command. More specifically, content present in the following directories: /etc/dconf/db/distro.d /etc/dconf/db/local.d	Unlike text-based keyfiles, the binary database is impossible to check by OVAL. Therefore, in order to evaluate dconf configuration, both have to be true at the same time - configuration files have to be compliant, and the database needs to be more recent than those keyfiles, which gives confidence that it reflects them.
CCE-87305-9	Trigger a kernel BUG when data corruption is detected	This option makes the kernel BUG when it encounters data corruption in kernel memory structures when they get checked for validity. This configuration is available from kernel 4.10. The configuration that was used to build kernel is available at `/boot/config-`. To check the configuration value for `CONFIG_BUG_ON_DATA_CORRUPTION`, run the following command: `grep CONFIG_BUG_ON_DATA_CORRUPTION /boot/config-` For each kernel installed, a line with value "y" should be returned.	This helps detect data corruptions early and stop with a BUG() error message.
CCE-87331-5	Enable TCP/IP syncookie support	Normal TCP/IP networking is open to an attack known as SYN flooding. It is denial-of-service attack that prevents legitimate remote users from being able to connect to your computer during an ongoing attack. When enabled the TCP/IP stack will use a cryptographic challenge protocol known as SYN cookies to enable legitimate users to continue to connect, even when your machine is under attack. The configuration that was used to build kernel is available at `/boot/config-`. To check the configuration value for `CONFIG_SYN_COOKIES`, run the following command: `grep CONFIG_SYN_COOKIES /boot/config-` For each kernel installed, a line with value "y" should be returned.	SYN cookies provide protection against SYN flooding attacks.
CCE-87332-3	Configure SSH Server to Use FIPS 140-2 Validated Ciphers: opensshserver.config	Crypto Policies provide a centralized control over crypto algorithms usage of many packages. OpenSSH is supported by system crypto policy, but the OpenSSH configuration may be set up incorrectly. To check that Crypto Policies settings for ciphers are configured correctly, ensure that `/etc/crypto-policies/back-ends/opensshserver.config` contains the following text and is not commented out: -oCiphers=`aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc,rijndael-cbc@lysator.liu.se`	Overriding the system crypto policy makes the behavior of the OpenSSH server violate expectations, and makes system configuration more fragmented. By specifying a cipher list with the order of ciphers being in a “strongest to weakest” orientation, the system will automatically attempt to use the strongest cipher for securing SSH connections.
CCE-87338-0	Disable Power Settings in GNOME3	By default, `GNOME` enables a power profile designed for mobile devices with battery usage. While useful for mobile devices, this setting should be disabled for all other systems. To configure the system to disable the power setting, add or set `active` to `false` in `/etc/dconf/db/local.d/00-security-settings`. For example: [org/gnome/settings-daemon/plugins/power] active=false Once the settings have been added, add a lock to `/etc/dconf/db/local.d/locks/00-security-settings-lock` to prevent user modification. For example: /org/gnome/settings-daemon/plugins/power After the settings have been set, run `dconf update`.	Power settings should not be enabled on systems that are not mobile devices. Enabling power settings on non-mobile devices could have unintended processing consequences on standard systems.
CCE-87340-6	Restrict unprivileged access to the kernel syslog	Enforce restrictions on unprivileged users reading the kernel syslog via dmesg(8). The configuration that was used to build kernel is available at `/boot/config-`. To check the configuration value for `CONFIG_SECURITY_DMESG_RESTRICT`, run the following command: `grep CONFIG_SECURITY_DMESG_RESTRICT /boot/config-` For each kernel installed, a line with value "y" should be returned.	Prevents unprivileged users from retrieving kernel addresses with dmesg.
CCE-87370-3	Set the Boot Loader Admin Username to a Non-Default Value	The grub2 boot loader should have a superuser account and password protection enabled to protect boot-time settings. To maximize the protection, select a password-protected superuser account with unique name, and modify the `/etc/grub.d/01_users` configuration file to reflect the account name change. Do not to use common administrator account names like root, admin, or administrator for the grub2 superuser account. Change the superuser to a different username (The default is 'root'). $ sed -i 's/$set superusers=$.*/\1"<unique user ID>"/g' /etc/grub.d/01_users The line mentioned above must be followed by the line export superusers so that the `superusers` is honored. Once the superuser account has been added, update the `grub.cfg` file by running: grub2-mkconfig -o /boot/grub2/grub.cfg	Having a non-default grub superuser username makes password-guessing attacks less effective.
CCE-87414-9	Configure auditd space_left on Low Disk Space	The `auditd` service can be configured to take an action when disk space is running low but prior to running out of space completely. Edit the file `/etc/audit/auditd.conf`. Add or modify the following line, substituting SIZE_in_MB appropriately: space_left = SIZE_in_MB Set this value to the appropriate size in Megabytes cause the system to notify the user of an issue.	Notifying administrators of an impending disk space problem may allow them to take corrective action prior to any disruption.
CCE-87416-4	Mount Remote Filesystems with Kerberos Security	Add the `sec=krb5:krb5i:krb5p` option to the fourth column of `/etc/fstab` for the line which controls mounting of any NFS mounts.	When an NFS server is configured to use AUTH_SYS a selected userid and groupid are used to handle requests from the remote user. The userid and groupid could mistakenly or maliciously be set incorrectly. The AUTH_GSS method of authentication uses certificates on the server and client systems to more securely authenticate the remote mount request.
CCE-87451-1	User Initialization Files Must Not Run World-Writable Programs	Set the mode on files being executed by the user initialization files with the following command: $ sudo chmod o-w FILE	If user start-up files execute world-writable programs, especially in unprotected directories, they could be maliciously modified to destroy user files or otherwise compromise the system at the user level. If the system is compromised at the user level, it is easier to elevate privileges to eventually compromise the system at the root and network level.
CCE-87468-5	Disable Full User Name on Splash Shield	By default when the screen is locked, the splash shield will show the user's full name. This should be disabled to prevent casual observers from seeing who has access to the system. This can be disabled by adding or setting `show-full-name-in-top-bar` to `false` in `/etc/dconf/db/local.d/00-security-settings`. For example: [org/gnome/desktop/screensaver] show-full-name-in-top-bar=false Once the settings have been added, add a lock to `/etc/dconf/db/local.d/locks/00-security-settings-lock` to prevent user modification. For example: /org/gnome/desktop/screensaver/show-full-name-in-top-bar After the settings have been set, run `dconf update`.	Setting the splash screen to not reveal the logged in user's name conceals who has access to the system from passersby.
CCE-87483-4	The system must booted with init_on_free=1	Setting `init_on_free=1` on boot guarantees that pages and heap objects are initialized right after they're freed, so it won't be possible to access stale data by using a dangling pointer.	`init_on_free` is a Linux kernel boot parameter that enhances security by initializing memory regions when they are freed, preventing data leakage. This process ensures that stale data in freed memory cannot be accessed by malicious programs.
CCE-87487-5	Ensure that Users Path Contains Only Local Directories	Ensure that all interactive user initialization files executable search path statements do not contain statements that will reference a working directory other than the users home directory.	The executable search path (typically the PATH environment variable) contains a list of directories for the shell to search to find executables. If this path includes the current working directory (other than the users home directory), executables in these directories may be executed instead of system commands. This variable is formatted as a colon-separated list of directories. If there is an empty entry, such as a leading or trailing colon or two consecutive colons, this is interpreted as the current working directory. If deviations from the default system search path for the local interactive user are required, they must be documented with the Information System Security Officer (ISSO).
CCE-87489-1	Disable kexec system call	`kexec` is a system call that implements the ability to shutdown your current kernel, and to start another kernel. It is like a reboot but it is independent of the system firmware. And like a reboot you can start any kernel with it, not just Linux. The configuration that was used to build kernel is available at `/boot/config-`. To check the configuration value for `CONFIG_KEXEC`, run the following command: `grep CONFIG_KEXEC /boot/config-` Configs with value 'n' are not explicitly set in the file, so either commented lines or no lines should be returned.	Prohibits the execution of a new kernel image after reboot.
CCE-87491-7	Ensure Users Cannot Change GNOME3 Screensaver Settings	If not already configured, ensure that users cannot change GNOME3 screensaver lock settings by adding `/org/gnome/desktop/screensaver/lock-delay` to `/etc/dconf/db/local.d/locks/00-security-settings-lock` to prevent user modification. For example: /org/gnome/desktop/screensaver/lock-delay After the settings have been set, run `dconf update`.	A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not logout because of the temporary nature of the absence. Rather than relying on the user to manually lock their operating system session prior to vacating the vicinity, GNOME desktops can be configured to identify when a user's session has idled and take action to initiate the session lock. As such, users should not be allowed to change session settings.
CCE-87495-8	Avoid speculative indirect branches in kernel	Compile kernel with the retpoline compiler options to guard against kernel-to-user data leaks by avoiding speculative indirect branches. Requires a compiler with -mindirect-branch=thunk-extern support for full protection. The kernel may run slower. The configuration that was used to build kernel is available at `/boot/config-`. To check the configuration value for `CONFIG_RETPOLINE`, run the following command: `grep CONFIG_RETPOLINE /boot/config-` For each kernel installed, a line with value "y" should be returned.	This is required to enable protection against Spectre v2.
CCE-87522-9	Configure session renegotiation for SSH client	The `RekeyLimit` parameter specifies how often the session key is renegotiated, both in terms of amount of data that may be transmitted and the time elapsed. To decrease the default limits, put line `RekeyLimit 512M 1h` to file `/etc/ssh/ssh_config.d/02-rekey-limit.conf`. Make sure that there is no other `RekeyLimit` configuration preceding the `include` directive in the main config file `/etc/ssh/ssh_config`. Check also other files in `/etc/ssh/ssh_config.d` directory. Files are processed according to lexicographical order of file names. Make sure that there is no file processed before `02-rekey-limit.conf` containing definition of `RekeyLimit`.	By decreasing the limit based on the amount of data and enabling time-based limit, effects of potential attacks against encryption keys are limited.
CCE-87524-5	Require Credential Prompting for Remote Access in GNOME3	By default, `GNOME` does not require credentials when using `Vino` for remote access. To configure the system to require remote credentials, add or set `authentication-methods` to `['vnc']` in `/etc/dconf/db/local.d/00-security-settings`. For example: [org/gnome/Vino] authentication-methods=['vnc'] Once the settings have been added, add a lock to `/etc/dconf/db/local.d/locks/00-security-settings-lock` to prevent user modification. For example: /org/gnome/Vino/authentication-methods After the settings have been set, run `dconf update`.	Username and password prompting is required for remote access. Otherwise, non-authorized and nefarious users can access the system freely.
CCE-87543-5	Disable chrony daemon from acting as server	The `port` option in `/etc/chrony.conf` can be set to `0` to make chrony daemon to never open any listening port for server operation and to operate strictly in a client-only mode.	In order to prevent unauthorized connection of devices, unauthorized transfer of information, or unauthorized tunneling (i.e., embedding of data types within data types), organizations must disable or restrict unused or unnecessary physical and logical ports/protocols on information systems. Operating systems are capable of providing a wide variety of functions and services. Some of the functions and services provided by default may not be necessary to support essential organizational operations. Additionally, it is sometimes convenient to provide multiple services from a single component (e.g., VPN and IPS); however, doing so increases risk over limiting the services provided by any one component. To support the requirements and principles of least functionality, the operating system must support the organizational requirements, providing only essential capabilities and limiting the use of ports, protocols, and/or services to only those required, authorized, and approved to conduct official business or to address authorized quality of life issues.
CCE-87567-4	Configure SSH Server to Use FIPS 140-2 Validated MACs: opensshserver.config	Crypto Policies provide a centralized control over crypto algorithms usage of many packages. OpenSSH is supported by system crypto policy, but the OpenSSH configuration may be set up incorrectly. To check that Crypto Policies settings are configured correctly, ensure that `/etc/crypto-policies/back-ends/opensshserver.config` contains the following text and is not commented out: `-oMACS=hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com`	Overriding the system crypto policy makes the behavior of the OpenSSH server violate expectations, and makes system configuration more fragmented.
CCE-87574-0	Disable vsyscall mapping	This config disables the vsyscall mapping at all. Attempts to use the vsyscalls will be reported to dmesg, so that either old or malicious userspace programs can be identified. This configuration is available from kernel 4.4. The configuration that was used to build kernel is available at `/boot/config-`. To check the configuration value for `CONFIG_LEGACY_VSYSCALL_NONE`, run the following command: `grep CONFIG_LEGACY_VSYSCALL_NONE /boot/config-` For each kernel installed, a line with value "y" should be returned.	This will eliminate any risk of ASLR bypass due to the vsyscall fixed address mapping.
CCE-87599-7	Enable GNOME3 Login Warning Banner	In the default graphical environment, displaying a login warning banner in the GNOME Display Manager's login screen can be enabled on the login screen by setting `banner-message-enable` to `true`. To enable, add or edit `banner-message-enable` to `/etc/dconf/db/distro.d/00-security-settings`. For example: [org/gnome/login-screen] banner-message-enable=true Once the setting has been added, add a lock to `/etc/dconf/db/distro.d/locks/00-security-settings-lock` to prevent user modification. For example: /org/gnome/login-screen/banner-message-enable After the settings have been set, run `dconf update`. The banner text must also be set.	Display of a standardized and approved use notification before granting access to the operating system ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. For U.S. Government systems, system use notifications are required only for access via login interfaces with human users and are not required when such human interfaces do not exist.
CCE-87606-0	Disable systemd-journal-remote Socket	Journald supports the ability to receive messages from remote hosts, thus acting as a log server. Clients should not receive data from other hosts. NOTE: The same package, systemd-journal-remote , is used for both sending logs to remote hosts and receiving incoming logs. With regards to receiving logs, there are two Systemd unit files; systemd-journal-remote.socket and systemd-journal-remote.service.	If a client is configured to also receive data, thus turning it into a server, the client system is acting outside it's operational boundary.
CCE-87609-4	Disable hibernation	Enable the suspend to disk (STD) functionality, which is usually called "hibernation" in user interfaces. STD checkpoints the system and powers it off; and restores that checkpoint on reboot. The configuration that was used to build kernel is available at `/boot/config-`. To check the configuration value for `CONFIG_HIBERNATION`, run the following command: `grep CONFIG_HIBERNATION /boot/config-` Configs with value 'n' are not explicitly set in the file, so either commented lines or no lines should be returned.	Suspending to disk allows one to replace the running kernel.
CCE-87615-1	Disable Kernel cfg80211 Module	To configure the system to prevent the `cfg80211` kernel module from being loaded, add the following line to the file `/etc/modprobe.d/cfg80211.conf`: install cfg80211 /bin/false This entry will cause a non-zero return value during a `cfg80211` module installation and additionally convey the meaning of the entry to the user in form of an error message. If you would like to omit a non-zero return value and an error message, you may want to add a different line instead (both `/bin/true` and `/bin/false` are allowed by OVAL and will be accepted by the scan): install cfg80211 /bin/true	If Wireless functionality must be disabled, preventing the kernel from loading the kernel module provides an additional safeguard against its activation.
CCE-87628-4	Ensure Unnecessary Services and Ports Are Not Accepted	Services and ports can be accepted or explicitly rejected or dropped by a zone. For every zone, a default behavior can be set that handles incoming traffic that is not further specified. Such behavior is defined by setting the target of the zone. The possible options are: - `ACCEPT` - accepts all incoming packets except those disabled by a specific rule. - `REJECT` - disables all incoming packets except those that have been allowed in specific rules and the source machine is informed about the rejection. - `DROP` - disables all incoming packets except those that have been allowed in specific rules and no information sent to the source machine.	To reduce the attack surface of a system, all services and ports should be blocked unless required.
CCE-87638-3	Set the GNOME3 Login Number of Failures	In the default graphical environment, the GNOME3 login screen and be configured to restart the authentication process after a configured number of attempts. This can be configured by setting `allowed-failures` to `3` or less. To enable, add or edit `allowed-failures` to `/etc/dconf/db/distro.d/00-security-settings`. For example: [org/gnome/login-screen] allowed-failures=3 Once the setting has been added, add a lock to `/etc/dconf/db/distro.d/locks/00-security-settings-lock` to prevent user modification. For example: /org/gnome/login-screen/allowed-failures After the settings have been set, run `dconf update`.	Setting the password retry prompts that are permitted on a per-session basis to a low value requires some software, such as SSH, to re-connect. This can slow down and draw additional attention to some types of password-guessing attacks.
CCE-87650-8	Disable vsyscall emulation	The kernel traps and emulates calls into the fixed vsyscall address mapping. This configuration is available from kernel 5.3, but may be available if backported by distros. The configuration that was used to build kernel is available at `/boot/config-`. To check the configuration value for `CONFIG_LEGACY_VSYSCALL_EMULATE`, run the following command: `grep CONFIG_LEGACY_VSYSCALL_EMULATE /boot/config-` Configs with value 'n' are not explicitly set in the file, so either commented lines or no lines should be returned.	The mapping is non-executable, but it still contains known contents, which could be used in certain rare security vulnerability exploits.
CCE-87668-0	Set Root Account Password Maximum Age	Configure the root account to enforce a `99999`-day maximum password lifetime restriction by running the following command: $ sudo chage -M `99999` root	Any password, no matter how complex, can eventually be cracked. Therefore, passwords need to be changed periodically. If the operating system does not limit the lifetime of passwords and force users to change their passwords, there is the risk that the operating system passwords could be compromised.
CCE-87670-6	Record Unsuccessful Delete Attempts to Files - renameat	The audit system should collect unsuccessful file deletion attempts for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`. If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file. -a always,exit -F arch=b32 -S renameat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete -a always,exit -F arch=b32 -S renameat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete If the system is 64 bit then also add the following lines: -a always,exit -F arch=b64 -S renameat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete -a always,exit -F arch=b64 -S renameat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete	Unsuccessful attempts to delete files could be an indicator of malicious activity on a system. Auditing these events could serve as evidence of potential system compromise.
CCE-87681-3	Distribute the SSH Server configuration to multiple files in a config directory.	Make sure to have the `Include /etc/ssh/sshd_config.d/*.conf` line in the `/etc/ssh/sshd_config` file. Ideally, don't have any active configuration directives in that file, and distribute the service configuration to several files in the `/etc/ssh/sshd_config.d` directory.	This form of distributed configuration is considered as a good practice, and as other sshd rules assume that directives in files in the `/etc/ssh/sshd_config.d` config directory are effective, there has to be a rule that ensures this. Aside from that, having multiple configuration files makes the SSH Server configuration changes easier to partition according to the reason that they were introduced, and therefore it should help to perform merges of hardening updates.
CCE-87685-4	Record Any Attempts to Run chacl	At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -a always,exit -F path=/usr/bin/chacl -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`: -a always,exit -F path=/usr/bin/chacl -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged	Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter).
CCE-87712-6	Disable Access to Network bpf() Syscall From Unprivileged Processes	To prevent unprivileged processes from using the `bpf()` syscall the `kernel.unprivileged_bpf_disabled` kernel parameter must be set to `1` or `2`. Writing `1` to this entry will disable unprivileged calls to `bpf()`; once disabled, calling `bpf()` without `CAP_SYS_ADMIN` or `CAP_BPF` will return `-EPERM`. Once set to `1`, this can't be cleared from the running kernel anymore. To set the runtime status of the `kernel.unprivileged_bpf_disabled` kernel parameter, run the following command: $ sudo sysctl -w kernel.unprivileged_bpf_disabled=1 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: kernel.unprivileged_bpf_disabled = 1 Writing `2` to this entry will also disable unprivileged calls to `bpf()`, however, an admin can still change this setting later on, if needed, by writing `0` or `1` to this entry. To set the runtime status of the `kernel.unprivileged_bpf_disabled` kernel parameter, run the following command: $ sudo sysctl -w kernel.unprivileged_bpf_disabled=2 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: kernel.unprivileged_bpf_disabled = 2	Loading and accessing the packet filters programs and maps using the bpf() syscall has the potential of revealing sensitive information about the kernel state.
CCE-87721-7	Ensure the Default C Shell Umask is Set Correctly	To ensure the default umask for users of the C shell is set properly, add or correct the `umask` setting in `/etc/csh.cshrc` to read as follows: umask `027`	The umask value influences the permissions assigned to files when they are created. A misconfigured umask value could result in files with excessive permissions that can be read or written to by unauthorized users.
CCE-87726-6	Randomize slab freelist	Randomizes the freelist order used on creating new pages. This configuration is available from kernel 5.9, but may be available if backported by distros. The configuration that was used to build kernel is available at `/boot/config-`. To check the configuration value for `CONFIG_SLAB_FREELIST_RANDOM`, run the following command: `grep CONFIG_SLAB_FREELIST_RANDOM /boot/config-` For each kernel installed, a line with value "y" should be returned.	This security feature reduces the predictability of the kernel slab allocator against heap overflows.
CCE-87734-0	Disable GNOME3 Automounting	The system's default desktop environment, GNOME3, will mount devices and removable media (such as DVDs, CDs and USB flash drives) whenever they are inserted into the system. To disable automount within GNOME3, add or set `automount` to `false` in `/etc/dconf/db/local.d/00-security-settings`. For example: [org/gnome/desktop/media-handling] automount=false Once the settings have been added, add a lock to `/etc/dconf/db/local.d/locks/00-security-settings-lock` to prevent user modification. For example: /org/gnome/desktop/media-handling/automount After the settings have been set, run `dconf update`.	Disabling automatic mounting in GNOME3 can prevent the introduction of malware via removable media. It will, however, also prevent desktop users from legitimate use of removable media.
CCE-87746-4	Configure auditd space_left on Low Disk Space	The `auditd` service can be configured to take an action when disk space is running low but prior to running out of space completely. Edit the file `/etc/audit/auditd.conf`. Add or modify the following line, substituting PERCENTAGE appropriately: space_left = PERCENTAGE% Set this value to at least 25 to cause the system to notify the user of an issue.	Notifying administrators of an impending disk space problem may allow them to take corrective action prior to any disruption.
CCE-87755-5	Enable GNOME3 Screensaver Idle Activation	To activate the screensaver in the GNOME3 desktop after a period of inactivity, add or set `idle-activation-enabled` to `true` in `/etc/dconf/db/local.d/00-security-settings`. For example: [org/gnome/desktop/screensaver] idle-activation-enabled=true Once the setting has been added, add a lock to `/etc/dconf/db/local.d/locks/00-security-settings-lock` to prevent user modification. For example: /org/gnome/desktop/screensaver/idle-activation-enabled After the settings have been set, run `dconf update`.	A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not logout because of the temporary nature of the absence. Rather than relying on the user to manually lock their operating system session prior to vacating the vicinity, GNOME desktops can be configured to identify when a user's session has idled and take action to initiate the session lock. Enabling idle activation of the screensaver ensures the screensaver will be activated after the idle delay. Applications requiring continuous, real-time screen display (such as network management products) require the login session does not have administrator rights and the display station is located in a controlled-access area.
CCE-87757-1	Configure AIDE to Verify the Audit Tools	The operating system file integrity tool must be configured to protect the integrity of the audit tools.	Protecting the integrity of the tools used for auditing purposes is a critical step toward ensuring the integrity of audit information. Audit information includes all information (e.g., audit records, audit settings, and audit reports) needed to successfully audit information system activity. Audit tools include but are not limited to vendor-provided and open-source audit tools needed to successfully view and manipulate audit information system activity and records. Audit tools include custom queries and report generators. It is not uncommon for attackers to replace the audit tools or inject code into the existing tools to provide the capability to hide or erase system activity from the audit logs. To address this risk, audit tools must be cryptographically signed to provide the capability to identify when the audit tools have been modified, manipulated, or replaced. An example is a checksum hash of the file or files.
CCE-87767-0	Disable kernel support for MISC binaries	Enabling `CONFIG_BINFMT_MISC` makes it possible to plug wrapper-driven binary formats into the kernel. This is specially useful for programs that need an interpreter to run like Java, Python and DOS emulators. Once you have registered such a binary class with the kernel, you can start one of those programs simply by typing in its name at a shell prompt. The configuration that was used to build kernel is available at `/boot/config-`. To check the configuration value for `CONFIG_BINFMT_MISC`, run the following command: `grep CONFIG_BINFMT_MISC /boot/config-` Configs with value 'n' are not explicitly set in the file, so either commented lines or no lines should be returned.	This disables arbitrary binary format support and helps reduce attack surface.
CCE-87770-4	Disable merging of slabs with similar size	The kernel may merge similar slabs together to reduce overhead and increase cache hotness of objects. Disabling merging of slabs keeps the slabs separate and reduces the risk of kernel heap overflows overwriting objects in merged caches. To disable merging of slabs in the Kernel add the argument `slab_nomerge=yes` to the default GRUB 2 command line for the Linux operating system. To ensure that `slab_nomerge=yes` is added as a kernel command line argument to newly installed kernels, add `slab_nomerge=yes` to the default Grub2 command line for Linux operating systems. Modify the line within `/etc/default/grub` as shown below: GRUB_CMDLINE_LINUX="... slab_nomerge=yes ..." Run the following command to update command line for already installed kernels: # grubby --update-kernel=ALL --args="slab_nomerge=yes" If the system is distributed as a bootable container image, GRUB2 can't be configured using the method described above, but the following method needs to be used instead. The kernel arguments should be set in `/usr/lib/bootc/kargs.d` in a TOML file that has the following form: # /usr/lib/bootc/kargs.d/10-example.toml kargs = ["slab_nomerge=yes"] For more details on configuring kernel arguments in bootable container images, please refer to Bootc documentation.	Disabling the merge of slabs of similar sizes prevents the kernel from merging a seemingly useless but vulnerable slab with a useful and valuable slab. This increase the risk that a heap overflow could overwrite objects from merged caches, with unmerged caches the heap overflow would only affect the objects in the same cache. Overall, this reduces the kernel attack surface area by isolating slabs from each other.
CCE-87805-8	Disable vsyscall emulate execution only	The kernel traps and emulates calls into the fixed vsyscall address mapping and does not allow reads. This configuration is available from kernel 5.3. The configuration that was used to build kernel is available at `/boot/config-`. To check the configuration value for `CONFIG_LEGACY_VSYSCALL_XONLY`, run the following command: `grep CONFIG_LEGACY_VSYSCALL_XONLY /boot/config-` Configs with value 'n' are not explicitly set in the file, so either commented lines or no lines should be returned.	Disabling this mitigates certain uses of the vsyscall area as an ASLR-bypassing buffer.
CCE-87836-3	Disable SSH Support for Rhosts RSA Authentication	SSH can allow authentication through the obsolete rsh command through the use of the authenticating user's SSH keys. This should be disabled. To ensure this behavior is disabled, add or correct the following line in `/etc/ssh/sshd_config`: RhostsRSAAuthentication no	Configuring this setting for the SSH daemon provides additional assurance that remote login via SSH will require a password, even in the event of misconfiguration elsewhere.
CCE-87863-7	Enable the NTP Daemon	The `ntpd` service can be enabled with the following command: $ sudo systemctl enable ntpd.service	Enabling the `ntpd` service ensures that the `ntpd` service will be running and that the system will synchronize its time to any servers specified. This is important whether the system is configured to be a client (and synchronize only its own clock) or it is also acting as an NTP server to other systems. Synchronizing time is essential for authentication services such as Kerberos, but it is also important for maintaining accurate logs and auditing possible security breaches. The NTP daemon offers all of the functionality of `ntpdate`, which is now deprecated.
CCE-87872-8	Ensure SSH MaxStartups is configured	The MaxStartups parameter specifies the maximum number of concurrent unauthenticated connections to the SSH daemon. Additional connections will be dropped until authentication succeeds or the LoginGraceTime expires for a connection. To configure MaxStartups, you should add or edit the following line in the `/etc/ssh/sshd_config` file: MaxStartups `10:30:100`	To protect a system from denial of service due to a large number of pending authentication connection attempts, use the rate limiting function of MaxStartups to protect availability of sshd logins and prevent overwhelming the daemon.
CCE-87884-3	Disable x86 vsyscall emulation	Disabling it is roughly equivalent to booting with vsyscall=none, except that it will also disable the helpful warning if a program tries to use a vsyscall. With this option set to N, offending programs will just segfault, citing addresses of the form 0xffffffffff600?00. This configuration is available from kernel 3.19. The configuration that was used to build kernel is available at `/boot/config-`. To check the configuration value for `CONFIG_X86_VSYSCALL_EMULATION`, run the following command: `grep CONFIG_X86_VSYSCALL_EMULATION /boot/config-` Configs with value 'n' are not explicitly set in the file, so either commented lines or no lines should be returned.	The vsyscall table is no longer required and is a potential source of ROP gadgets.
CCE-87894-2	Disable WIFI Network Notification in GNOME3	By default, `GNOME` disables WIFI notification. This should be permanently set so that users do not connect to a wireless network when the system finds one. While useful for mobile devices, this setting should be disabled for all other systems. To configure the system to disable the WIFI notification, add or set `suppress-wireless-networks-available` to `true` in `/etc/dconf/db/local.d/00-security-settings`. For example: [org/gnome/nm-applet] suppress-wireless-networks-available=true Once the settings have been added, add a lock to `/etc/dconf/db/local.d/locks/00-security-settings-lock` to prevent user modification. For example: /org/gnome/nm-applet/suppress-wireless-networks-available After the settings have been set, run `dconf update`.	Wireless network connections should not be allowed to be configured by general users on a given system as it could open the system to backdoor attacks.
CCE-87901-5	Appropriate Action Must be Setup When the Internal Audit Event Queue is Full	The audit system should have an action setup in the event the internal event queue becomes full. To setup an overflow action edit `/etc/audit/auditd.conf`. Set `overflow_action` to one of the following values: `syslog`, `single`, `halt`.	The audit system should have an action setup in the event the internal event queue becomes full so that no data is lost.
CCE-87907-2	Enable the pcscd Service	The `pcscd` service can be enabled with the following command: $ sudo systemctl enable pcscd.service	Using an authentication device, such as a CAC or token that is separate from the information system, ensures that even if the information system is compromised, that compromise will not affect credentials stored on the authentication device. Multifactor solutions that require devices separate from information systems gaining access include, for example, hardware tokens providing time-based or challenge-response authenticators and smart cards or similar secure authentication devices issued by an organization or identity provider.
CCE-87913-0	Disable Booting from USB Devices in Boot Firmware	Configure the system boot firmware (historically called BIOS on PC systems) to disallow booting from USB drives.	Booting a system from a USB device would allow an attacker to circumvent any security measures provided by the operating system. Attackers could mount partitions and modify the configuration of the OS.
CCE-87917-1	All Interactive User Home Directories Must Be Owned By The Primary User	Change the owner of interactive users home directories to that correct owner. To change the owner of a interactive users home directory, use the following command: $ sudo chown USER /home/USER This rule ensures every home directory related to an interactive user is owned by an interactive user. It also ensures that interactive users are owners of one and only one home directory.	If a local interactive user does not own their home directory, unauthorized users could access or modify the user's files, and the users may not be able to access their own files.
CCE-87926-2	Disable legacy (BSD) PTY support	Disable the Linux traditional BSD-like terminal names /dev/ptyxx for masters and /dev/ttyxx for slaves of pseudo terminals, and use only the modern ptys (devpts) interface. The configuration that was used to build kernel is available at `/boot/config-`. To check the configuration value for `CONFIG_LEGACY_PTYS`, run the following command: `grep CONFIG_LEGACY_PTYS /boot/config-` Configs with value 'n' are not explicitly set in the file, so either commented lines or no lines should be returned.	The legacy scheme has a number of security problems.
CCE-87960-1	Ensure remote access methods are monitored in Rsyslog	Logging of remote access methods must be implemented to help identify cyber attacks and ensure ongoing compliance with remote access policies are being audited and upheld. An examples of a remote access method is the use of the Remote Desktop Protocol (RDP) from an external, non-organization controlled network. The `/etc/rsyslog.conf` or `/etc/rsyslog.d/.conf` file should contain a match for the following selectors: `auth.`, `authpriv.`, and `daemon.`. If not, use the following as an example configuration: `auth.;authpriv. /var/log/secure daemon.* /var/log/messages`	Logging remote access methods can be used to trace the decrease the risks associated with remote user access management. It can also be used to spot cyber attacks and ensure ongoing compliance with organizational policies surrounding the use of remote access methods.
CCE-87963-5	Harden slab freelist metadata	This feature protects integrity of the allocator's metadata. This configuration is available from kernel 4.14. The configuration that was used to build kernel is available at `/boot/config-`. To check the configuration value for `CONFIG_SLAB_FREELIST_HARDENED`, run the following command: `grep CONFIG_SLAB_FREELIST_HARDENED /boot/config-` For each kernel installed, a line with value "y" should be returned.	Many kernel heap attacks try to target slab cache metadata and other infrastructure. This options makes minor performance sacrifices to harden the kernel slab allocator against common freelist exploit methods.
CCE-87979-1	Enable SSH Warning Banner	To enable the warning banner and ensure it is consistent across the system, add or correct the following line in `/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf`: Banner /etc/issue.net Another section contains information on how to create an appropriate system-wide warning banner.	The warning message reinforces policy awareness during the logon process and facilitates possible legal action against attackers. Alternatively, systems whose ownership should not be obvious should ensure usage of a banner that does not provide easy attribution.
CCE-87996-5	Configure SSSD to Expire Offline Credentials	SSSD should be configured to expire offline credentials after 1 day. Check if SSSD allows cached authentications with the following command: $ sudo grep cache_credentials /etc/sssd/sssd.conf cache_credentials = true If "cache_credentials" is set to "false" or is missing no further checks are required. To configure SSSD to expire offline credentials, set `offline_credentials_expiration` to `1` under the `[pam]` section in `/etc/sssd/sssd.conf`. For example: [pam] offline_credentials_expiration = 1	If cached authentication information is out-of-date, the validity of the authentication information may be questionable.
CCE-88002-1	Audit Configuration Files Permissions are 640 or More Restrictive	All audit configuration files permissions must be 640 or more restrictive. chmod 0640 /etc/audit/audit.{rules,conf} /etc/audit/rules.d/	Without the capability to restrict which roles and individuals can select which events are audited, unauthorized personnel may be able to prevent the auditing of critical events. Misconfigured audits may degrade the system's performance by overwhelming the audit log. Misconfigured audits may also make it more difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.
CCE-88011-2	Record Unsuccessful Delete Attempts to Files - rename	The audit system should collect unsuccessful file deletion attempts for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`. If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file. -a always,exit -F arch=b32 -S rename -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete -a always,exit -F arch=b32 -S rename -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete If the system is 64 bit then also add the following lines: -a always,exit -F arch=b64 -S rename -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete -a always,exit -F arch=b64 -S rename -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete	Unsuccessful attempts to delete files could be an indicator of malicious activity on a system. Auditing these events could serve as evidence of potential system compromise.
CCE-88032-8	Warn on W+X mappings found at boot	Generate a warning if any W+X mappings are found at boot. This configuration is available from kernel 5.8. The configuration that was used to build kernel is available at `/boot/config-`. To check the configuration value for `CONFIG_DEBUG_WX`, run the following command: `grep CONFIG_DEBUG_WX /boot/config-` For each kernel installed, a line with value "y" should be returned.	This is useful for discovering cases where the kernel is leaving W+X mappings after applying NX, as such mappings are a security risk. Note that even if the check fails, your kernel is possibly still fine, as W+X mappings are not a security hole in themselves, what they do is that they make the exploitation of other unfixed kernel bugs easier.
CCE-88035-1	Uninstall nginx Package	The `nginx` package can be removed with the following command: $ sudo dnf remove nginx	If there is no need to make the web server software available, removing it provides a safeguard against its activation.
CCE-88048-4	Only Authorized Local User Accounts Exist on Operating System	Enterprise Application tends to use the server or virtual machine exclusively. Besides the default operating system user, there should be only authorized local users required by the installed software groups and applications that exist on the operating system. The authorized user list can be customized in the refine value variable `var_accounts_authorized_local_users_regex`. OVAL regular expression is used for the user list. Configure the system so all accounts on the system are assigned to an active system, application, or user account. Remove accounts that do not support approved system activities or that allow for a normal user to perform administrative-level actions. To remove unauthorized system accounts, use the following command: $ sudo userdel unauthorized_user	Accounts providing no operational purpose provide additional opportunities for system compromise. Unnecessary accounts include user accounts for individuals not requiring access to the system and application accounts for applications not installed on the system.
CCE-88059-1	Ensure that Root's Path Does Not Include Relative Paths or Null Directories	Ensure that none of the directories in root's path is equal to a single `.` character, or that it contains any instances that lead to relative path traversal, such as `..` or beginning a path without the slash (`/`) character. Also ensure that there are no "empty" elements in the path, such as in these examples: PATH=:/bin PATH=/bin: PATH=/bin::/sbin These empty elements have the same effect as a single `.` character.	Including these entries increases the risk that root could execute code from an untrusted location.
CCE-88098-9	Force kernel panic on uncorrected MCEs	A Machine Check Exception is an error generated by the CPU itdetects an error in itself, memory or I/O devices. These errors may be corrected and generate a check log entry, if an error cannot be corrected the kernel may panic or SIGBUS. To force the kernel to panic on any uncorrected error reported by Machine Check set the MCE tolerance to zero by adding `mce=0` to the default GRUB 2 command line for the Linux operating system. To ensure that `mce=0` is added as a kernel command line argument to newly installed kernels, add `mce=0` to the default Grub2 command line for Linux operating systems. Modify the line within `/etc/default/grub` as shown below: GRUB_CMDLINE_LINUX="... mce=0 ..." Run the following command to update command line for already installed kernels: # grubby --update-kernel=ALL --args="mce=0" If the system is distributed as a bootable container image, GRUB2 can't be configured using the method described above, but the following method needs to be used instead. The kernel arguments should be set in `/usr/lib/bootc/kargs.d` in a TOML file that has the following form: # /usr/lib/bootc/kargs.d/10-example.toml kargs = ["mce=0"] For more details on configuring kernel arguments in bootable container images, please refer to Bootc documentation.	Allowing uncorrected errors to result on a SIGBUS may allow an attacker to continue trying to exploit a vulnerability such as Rowhammer.
CCE-88104-5	Disable rexec Service	The `rexec` service, which is available with the `rsh-server` package and runs as a service through xinetd or separately as a systemd socket, should be disabled. If using xinetd, set `disable` to `yes` in `/etc/xinetd.d/rexec`. The `rexec` socket can be disabled with the following command: $ sudo systemctl mask --now rexec.socket	The rexec service uses unencrypted network communications, which means that data from the login session, including passwords and all other information transmitted during the session, can be stolen by eavesdroppers on the network.
CCE-88120-1	Uninstall cyrus-imapd Package	The `cyrus-imapd` package can be removed with the following command: $ sudo dnf remove cyrus-imapd	If there is no need to make the cyrus-imapd software available, removing it provides a safeguard against its activation.
CCE-88121-9	Disallow merge of slab caches	For reduced kernel memory fragmentation, slab caches can be merged when they share the same size and other characteristics. This carries a risk of kernel heap overflows being able to overwrite objects from merged caches (and more easily control cache layout), which makes such heap attacks easier to exploit by attackers. This configuration is available from kernel 4.13. The configuration that was used to build kernel is available at `/boot/config-`. To check the configuration value for `CONFIG_SLAB_MERGE_DEFAULT`, run the following command: `grep CONFIG_SLAB_MERGE_DEFAULT /boot/config-` Configs with value 'n' are not explicitly set in the file, so either commented lines or no lines should be returned.	Disabling the merge of slabs of similar sizes prevents the kernel from merging a seemingly useless but vulnerable slab with a useful and valuable slab. This increase the risk that a heap overflow could overwrite objects from merged caches, with unmerged caches the heap overflow would only affect the objects in the same cache. Overall, this reduces the kernel attack surface area by isolating slabs from each other.
CCE-88161-5	Configure Low Address Space To Protect From User Allocation	This is the portion of low virtual memory which should be protected from userspace allocation. This configuration is available from kernel 3.14, but may be available if backported by distros. The configuration that was used to build kernel is available at `/boot/config-`. To check the configuration value for `CONFIG_DEFAULT_MMAP_MIN_ADDR`, run the following command: `grep CONFIG_DEFAULT_MMAP_MIN_ADDR /boot/config-` For each kernel installed, a line with value should be returned. If the system architecture is x86_64, the value should be 65536. If the system architecture is aarch64, the value should be 32768.	Keeping a user from writing to low pages can help reduce the impact of kernel NULL pointer bugs.
CCE-88165-6	SSH server uses strong entropy to seed	To set up SSH server to use entropy from a high-quality source, edit the `/etc/sysconfig/sshd` file. The `SSH_USE_STRONG_RNG` configuration value determines how many bytes of entropy to use, so make sure that the file contains line SSH_USE_STRONG_RNG=32	SSH implementation in Red Hat Enterprise Linux 9 uses the openssl library, which doesn't use high-entropy sources by default. Randomness is needed to generate data-encryption keys, and as plaintext padding and initialization vectors in encryption algorithms, and high-quality entropy eliminates the possibility that the output of the random number generator used by SSH would be known to potential attackers.
CCE-88173-0	Configure a Sufficiently Large Partition for Audit Logs	The Red Hat Enterprise Linux 9 operating system must allocate audit record storage capacity to store at least one weeks worth of audit records when audit records are not immediately sent to a central audit record storage facility. The partition size needed to capture a week's worth of audit records is based on the activity level of the system and the total storage capacity available. In normal circumstances, 10.0 GB of storage space for audit records will be sufficient. Determine which partition the audit records are being written to with the following command: $ sudo grep log_file /etc/audit/auditd.conf log_file = /var/log/audit/audit.log Check the size of the partition that audit records are written to with the following command: $ sudo df -h /var/log/audit/ /dev/sda2 24G 10.4G 13.6G 43% /var/log/audit	Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Off-loading is a common process in information systems with limited audit storage capacity.
CCE-88185-4	Disable User Administration in GNOME3	By default, `GNOME` will allow all users to have some administratrion capability. This should be disabled so that non-administrative users are not making configuration changes. To configure the system to disable user administration capability in the Graphical User Interface (GUI), add or set `user-administration-disabled` to `true` in `/etc/dconf/db/local.d/00-security-settings`. For example: [org/gnome/desktop/lockdown] user-administration-disabled=true Once the settings have been added, add a lock to `/etc/dconf/db/local.d/locks/00-security-settings-lock` to prevent user modification. For example: /org/gnome/desktop/lockdown/user-administration-disabled After the settings have been set, run `dconf update`.	Allowing all users to have some administratrive capabilities to the system through the Graphical User Interface (GUI) when they would not have them otherwise could allow unintended configuration changes as well as a nefarious user the capability to make system changes such as adding new accounts, etc.
CCE-88194-6	Disable SSH root Login with a Password (Insecure)	To disable password-based root logins over SSH, add or correct the following line in `/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf`: PermitRootLogin prohibit-password	Even though the communications channel may be encrypted, an additional layer of security is gained by preventing use of a password. This also helps to minimize direct attack attempts on root's password.
CCE-88276-1	Enable SLUB debugging support	SLUB has extensive debug support features and this allows the allocator validation checking to be enabled. The configuration that was used to build kernel is available at `/boot/config-`. To check the configuration value for `CONFIG_SLUB_DEBUG`, run the following command: `grep CONFIG_SLUB_DEBUG /boot/config-` For each kernel installed, a line with value "y" should be returned.	This activates the checking of the memory allocator structures and resets to zero the zones allocated when they are released.
CCE-88285-2	Disable the GNOME3 Login User List	In the default graphical environment, users logging directly into the system are greeted with a login screen that displays all known users. This functionality should be disabled by setting `disable-user-list` to `true`. To disable, add or edit `disable-user-list` to `/etc/dconf/db/distro.d/00-security-settings`. For example: [org/gnome/login-screen] disable-user-list=true Once the setting has been added, add a lock to `/etc/dconf/db/distro.d/locks/00-security-settings-lock` to prevent user modification. For example: /org/gnome/login-screen/disable-user-list After the settings have been set, run `dconf update`.	Leaving the user list enabled is a security risk since it allows anyone with physical access to the system to quickly enumerate known user accounts without logging in.
CCE-88303-3	Configure auditd Disk Error Action on Disk Error	The `auditd` service can be configured to take an action when there is a disk error. Edit the file `/etc/audit/auditd.conf`. Add or modify the following line, substituting ACTION appropriately: disk_error_action = ACTION Set this value to `single` to cause the system to switch to single-user mode for corrective action. Acceptable values also include `syslog`, `exec`, `single`, and `halt`. For certain systems, the need for availability outweighs the need to log all actions, and a different setting should be determined. Details regarding all possible values for ACTION are described in the `auditd.conf` man page.	Taking appropriate action in case of disk errors will minimize the possibility of losing audit records.
CCE-88319-9	Randomize the address of the kernel image (KASLR)	In support of Kernel Address Space Layout Randomization (KASLR), this randomizes the physical address at which the kernel image is decompressed and the virtual address where the kernel image is mapped. The configuration that was used to build kernel is available at `/boot/config-`. To check the configuration value for `CONFIG_RANDOMIZE_BASE`, run the following command: `grep CONFIG_RANDOMIZE_BASE /boot/config-` For each kernel installed, a line with value "y" should be returned.	An unpredictable kernel address makes it more difficult to succeed with exploits that rely on knowledge of the location of kernel code internals.
CCE-88322-3	Ensure rsyslog Default File Permissions Configured	rsyslog will create logfiles that do not already exist on the system. This settings controls what permissions will be applied to these newly created files.	It is important to ensure that log files have the correct permissions to ensure that sensitive data is archived and protected.
CCE-88336-3	Configure auditd Disk Full Action when Disk Space Is Full	The `auditd` service can be configured to take an action when disk space is running low but prior to running out of space completely. Edit the file `/etc/audit/auditd.conf`. Add or modify the following line, substituting ACTION appropriately: disk_full_action = ACTION Set this value to `single` to cause the system to switch to single-user mode for corrective action. Acceptable values also include `syslog`, `single`, and `halt`. For certain systems, the need for availability outweighs the need to log all actions, and a different setting should be determined. Details regarding all possible values for ACTION are described in the `auditd.conf` man page.	Taking appropriate action in case of a filled audit storage volume will minimize the possibility of losing audit records.
CCE-88345-4	Ensure SMAP is not disabled during boot	The SMAP is used to prevent the supervisor mode from unintentionally reading/writing into memory pages in the user space, it is enabled by default since Linux kernel 3.7. But it could be disabled through kernel boot parameters. Ensure that Supervisor Mode Access Prevention (SMAP) is not disabled by the `nosmap` boot parameter option. Check that the line GRUB_CMDLINE_LINUX="..." within `/etc/default/grub` doesn't contain the argument `nosmap`. Run the following command to update command line for already installed kernels: # grubby --update-kernel=ALL --remove-args="nosmap" If the system is distributed as a bootable container image, GRUB2 can't be configured using the method described above, but the kernel arguments should be configured using TOML files located in the `/usr/lib/bootc/kargs.d` directory. Remove all occurences of `nosmap` from all files in `/usr/lib/bootc/kargs.d`. For more details on configuring kernel arguments in bootable container images, please refer to Bootc documentation.	Disabling SMAP can facilitate exploitation of vulnerabilities caused by unintended access and manipulation of data in the user space.
CCE-88395-9	Disable rlogin Service	The `rlogin` service, which is available with the `rsh-server` package and runs as a service through xinetd or separately as a systemd socket, should be disabled. If using xinetd, set `disable` to `yes` in `/etc/xinetd.d/rlogin`. The `rlogin` socket can be disabled with the following command: $ sudo systemctl mask --now rlogin.socket	The rlogin service uses unencrypted network communications, which means that data from the login session, including passwords and all other information transmitted during the session, can be stolen by eavesdroppers on the network.
CCE-88396-7	Configure auditd max_log_file_action Upon Reaching Maximum Log Size	The default action to take when the logs reach their maximum size is to rotate the log files, discarding the oldest one. To configure the action taken by `auditd`, add or correct the line in `/etc/audit/auditd.conf`: max_log_file_action = ACTION Possible values for ACTION are described in the `auditd.conf` man page. These include: `ignore` `syslog` `suspend` `rotate` `keep_logs` Set the `ACTION` to `rotate` to ensure log rotation occurs. This is the default. The setting is case-insensitive.	Automatically rotating logs (by setting this to `rotate`) minimizes the chances of the system unexpectedly running out of disk space by being overwhelmed with log data. However, for systems that must never discard log data, or which use external processes to transfer it and reclaim space, `keep_logs` can be employed.
CCE-88413-0	Ensure PAM Enforces Password Requirements - Prevent the Use of Dictionary Words	The pam_pwquality module's `dictcheck` check if passwords contains dictionary words. When `dictcheck` is set to `1` passwords will be checked for dictionary words.	Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised. Passwords with dictionary words may be more vulnerable to password-guessing attacks.
CCE-88427-0	Enable poison of pages after freeing	Fill the pages with poison patterns after free_pages() and verify the patterns before alloc_pages. This does have a potential performance impact if enabled with the "page_poison=1" kernel boot option. This configuration is available from kernel 4.6. The configuration that was used to build kernel is available at `/boot/config-`. To check the configuration value for `CONFIG_PAGE_POISONING`, run the following command: `grep CONFIG_PAGE_POISONING /boot/config-` For each kernel installed, a line with value "y" should be returned.	The filling of the memory helps reduce the risk of information leaks from freed data.
CCE-88429-6	Verify nftables Service is Disabled	nftables is a subsystem of the Linux kernel providing filtering and classification of network packets/datagrams/frames and is the successor to iptables. The `nftables` service can be disabled with the following command: systemctl disable nftables	Running both `firewalld` and `nftables` may lead to conflict. `nftables` is actually one of the backends for `firewalld` management tools.
CCE-88436-1	Ensure auditd Collects Information on Kernel Module Unloading - create_module	To capture kernel module loading and unloading events, use the following line, setting ARCH to either b32 for 32-bit system, or having two lines for both b32 and b64 in case your system is 64-bit: -a always,exit -F arch=ARCH -S create_module -F auid>=1000 -F auid!=unset -F key=modules Place to add the line depends on a way `auditd` daemon is configured. If it is configured to use the `augenrules` program (the default), add the line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`. If the `auditd` daemon is configured to use the `auditctl` utility, add the line to file `/etc/audit/audit.rules`.	The removal of kernel modules can be used to alter the behavior of the kernel and potentially introduce malicious code into kernel space. It is important to have an audit trail of modules that have been introduced into the kernel.
CCE-88441-1	Randomize the kernel memory sections	Randomizes the base virtual address of kernel memory sections (physical memory mapping, vmalloc & vmemmap). This configuration is available from kernel 4.8, but may be available if backported by distros. The configuration that was used to build kernel is available at `/boot/config-`. To check the configuration value for `CONFIG_RANDOMIZE_MEMORY`, run the following command: `grep CONFIG_RANDOMIZE_MEMORY /boot/config-` For each kernel installed, a line with value "y" should be returned.	This security feature makes exploits relying on predictable memory locations less reliable.
CCE-88477-5	Configure audispd's Plugin disk_full_action When Disk Is Full	Configure the action the operating system takes if the disk the audit records are written to becomes full. Edit the file `/etc/audit/audisp-remote.conf`. Add or modify the following line, substituting ACTION appropriately: disk_full_action = ACTION Set this value to `single` to cause the system to switch to single user mode for corrective action. Acceptable values also include `syslog` and `halt`. For certain systems, the need for availability outweighs the need to log all actions, and a different setting should be determined.	Taking appropriate action in case of a filled audit storage volume will minimize the possibility of losing audit records.
CCE-88493-2	Ensure All Accounts on the System Have Unique User IDs	Change user IDs (UIDs), or delete accounts, so each has a unique name.	To assure accountability and prevent unauthenticated access, interactive users must be identified and authenticated to prevent potential misuse and compromise of the system.
CCE-88499-9	Ensure Mail Transfer Agent is not Listening on any non-loopback Address	Mail Transfer Agents (MTA), such as sendmail and Postfix, are used to listen for incoming mail and transfer the messages to the appropriate user or mail server. If the system is not intended to be a mail server, it is recommended that the MTA be configured to only process local mail.	The software for all Mail Transfer Agents is complex and most have a long history of security issues. While it is important to ensure that the system can process local mail messages, it is not necessary to have the MTA's daemon listening on a port unless the server is intended to be a mail server that receives and processes mail from other systems.
CCE-88504-6	Install an Endpoint Security Solution	Verify that an Endpoint Security Solution has been deployed on the operating system. If there is not an Endpoint Security Solution deployed, this is a finding.	Without the use of automated mechanisms to scan for security flaws on a continuous and/or periodic basis, the operating system or other system components may remain vulnerable to the exploits presented by undetected software flaws. To support this requirement, the operating system may have an integrated solution incorporating continuous scanning and periodic scanning using other tools, as specified in the requirement.
CCE-88512-9	Ensure auditd Collects Information on the Use of Privileged Commands - pt_chown	At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -a always,exit -F path=/usr/libexec/pt_chown -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`: -a always,exit -F path=/usr/libexec/pt_chown -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged	Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider and advanced persistent threats. Privileged programs are subject to escalation-of-privilege attacks, which attempt to subvert their normal role of providing some necessary but limited capability. As such, motivation exists to monitor these programs for unusual activity.
CCE-88570-7	Record Events that Modify the System's Discretionary Access Controls - umount2	At a minimum, the audit system should collect file system umount2 changes. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -a always,exit -F arch=b32 -S umount2 -F auid>=1000 -F auid!=unset -F key=perm_mod If the system is 64 bit then also add the following line: -a always,exit -F arch=b64 -S umount2 -F auid>=1000 -F auid!=unset -F key=perm_mod If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following line to `/etc/audit/audit.rules` file: -a always,exit -F arch=b32 -S umount2 -F auid>=1000 -F auid!=unset -F key=perm_mod If the system is 64 bit then also add the following line: -a always,exit -F arch=b64 -S umount2 -F auid>=1000 -F auid!=unset -F key=perm_mod	The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications can facilitate the identification of patterns of abuse among both authorized and unauthorized users.
CCE-88575-6	Enable poison without sanity check	Skip the sanity checking on alloc, only fill the pages with poison on free. This reduces some of the overhead of the poisoning feature. This configuration is available from kernel 4.6. The configuration that was used to build kernel is available at `/boot/config-`. To check the configuration value for `CONFIG_PAGE_POISONING_NO_SANITY`, run the following command: `grep CONFIG_PAGE_POISONING_NO_SANITY /boot/config-` For each kernel installed, a line with value "y" should be returned.	This configuration helps alleviates the performance impact of poisonining.
CCE-88577-2	Enable NX or XD Support in the BIOS	Reboot the system and enter the BIOS or Setup configuration menu. Navigate the BIOS configuration menu and make sure that the option is enabled. The setting may be located under a Security section. Look for Execute Disable (XD) on Intel-based systems and No Execute (NX) on AMD-based systems.	Computers with the ability to prevent this type of code execution frequently put an option in the BIOS that will allow users to turn the feature on or off at will.
CCE-88592-1	Remove the kernel mapping in user mode	This feature reduces the number of hardware side channels by ensuring that the majority of kernel addresses are not mapped into userspace. This configuration is available from kernel 4.15, but may be available if backported by distros. The configuration that was used to build kernel is available at `/boot/config-`. To check the configuration value for `CONFIG_PAGE_TABLE_ISOLATION`, run the following command: `grep CONFIG_PAGE_TABLE_ISOLATION /boot/config-` For each kernel installed, a line with value "y" should be returned.	This is a countermeasure to the Meltdown attack.
CCE-88599-6	The File /etc/ssh/sshd_config.d/50-redhat.conf Must Exist	The `/etc/ssh/sshd_config.d/50-redhat.conf` file must exist as it contains important settings to secure SSH.	The file must exist to configure SSH correctly.
CCE-88648-1	Configure Time Service Maxpoll Interval	The `maxpoll` should be configured to `10` in `/etc/ntp.conf` or `/etc/chrony.conf` (or `/etc/chrony.d/`) to continuously poll time servers. To configure `maxpoll` in `/etc/ntp.conf` or `/etc/chrony.conf` (or `/etc/chrony.d/`) add the following after each `server`, `pool` or `peer` entry: maxpoll `10` to `server` directives. If using chrony, any `pool` directives should be configured too.	Inaccurate time stamps make it more difficult to correlate events and can lead to an inaccurate analysis. Determining the correct time a particular event occurred on a system is critical when conducting forensic analysis and investigating system events. Sources outside the configured acceptable allowance (drift) may be inaccurate. Synchronizing internal information system clocks provides uniformity of time stamps for information systems with multiple system clocks and systems connected over a network. Organizations should consider endpoints that may not have regular access to the authoritative time server (e.g., mobile, teleworking, and tactical endpoints).
CCE-88653-1	Disable Ctrl-Alt-Del Reboot Key Sequence in GNOME3	By default, `GNOME` will reboot the system if the `Ctrl-Alt-Del` key sequence is pressed. To configure the system to ignore the `Ctrl-Alt-Del` key sequence from the Graphical User Interface (GUI) instead of rebooting the system, add or set `logout` to `['']` in `/etc/dconf/db/local.d/00-security-settings`. For example: [org/gnome/settings-daemon/plugins/media-keys] logout=[''] Once the settings have been added, add a lock to `/etc/dconf/db/local.d/locks/00-security-settings-lock` to prevent user modification. For example: /org/gnome/settings-daemon/plugins/media-keys/logout After the settings have been set, run `dconf update`.	A locally logged-in user who presses Ctrl-Alt-Del, when at the console, can reboot the system. If accidentally pressed, as could happen in the case of mixed OS environment, this can create the risk of short-term loss of availability of systems due to unintentional reboot.
CCE-88654-9	Set the UEFI Boot Loader Password	The grub2 boot loader should have a superuser account and password protection enabled to protect boot-time settings. Since plaintext passwords are a security risk, generate a hash for the password by running the following command: # grub2-setpassword When prompted, enter the password that was selected.	Password protection on the boot loader configuration ensures users with physical access cannot trivially alter important bootloader settings. These include which kernel to use, and whether to enter single-user mode.
CCE-88666-3	Kernel panic on oops	To set the runtime status of the `kernel.panic_on_oops` kernel parameter, run the following command: $ sudo sysctl -w kernel.panic_on_oops=1 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: kernel.panic_on_oops = 1	An attacker trying to exploit the kernel may trigger kernel OOPSes, panicking the system will impede them from continuing.
CCE-88693-7	Verify that Shared Library Directories Have Restrictive Permissions	System-wide shared library directories, which contain are linked to executables during process load time or run time, are stored in the following directories by default: /lib /lib64 /usr/lib /usr/lib64 Kernel modules, which can be added to the kernel during runtime, are stored in `/lib/modules`. All sub-directories in these directories should not be group-writable or world-writable. If any file in these directories is found to be group-writable or world-writable, correct its permission with the following command: $ sudo chmod go-w DIR	If the operating system were to allow any user to make changes to software libraries, then those changes might be implemented without undergoing the appropriate testing and approvals that are part of a robust change management process. This requirement applies to operating systems with software libraries that are accessible and configurable, as in the case of interpreted languages. Software libraries also include privileged programs which execute with escalated privileges. Only qualified and authorized individuals must be allowed to obtain access to information system components for purposes of initiating changes, including upgrades and modifications.
CCE-88714-1	Disable All GNOME3 Thumbnailers	The system's default desktop environment, GNOME3, uses a number of different thumbnailer programs to generate thumbnails for any new or modified content in an opened folder. To disable the execution of these thumbnail applications, add or set `disable-all` to `true` in `/etc/dconf/db/local.d/00-security-settings`. For example: [org/gnome/desktop/thumbnailers] disable-all=true Once the settings have been added, add a lock to `/etc/dconf/db/local.d/locks/00-security-settings-lock` to prevent user modification. For example: /org/gnome/desktop/thumbnailers/disable-all After the settings have been set, run `dconf update`. This effectively prevents an attacker from gaining access to a system through a flaw in GNOME3's Nautilus thumbnail creators.	An attacker with knowledge of a flaw in a GNOME3 thumbnailer application could craft a malicious file to exploit this flaw. Assuming the attacker could place the malicious file on the local filesystem (via a web upload for example) and assuming a user browses the same location using Nautilus, the malicious file would exploit the thumbnailer with the potential for malicious code execution. It is best to disable these thumbnailer applications unless they are explicitly required.
CCE-88733-1	Implement Blank Screensaver	To set the screensaver mode in the GNOME3 desktop to a blank screen, add or set `picture-uri` to `string ''` in `/etc/dconf/db/local.d/00-security-settings`. For example: [org/gnome/desktop/screensaver] picture-uri=string '' Once the settings have been added, add a lock to `/etc/dconf/db/local.d/locks/00-security-settings-lock` to prevent user modification. For example: /org/gnome/desktop/screensaver/picture-uri After the settings have been set, run `dconf update`.	Setting the screensaver mode to blank-only conceals the contents of the display from passersby.
CCE-88742-2	Enable FIPS Mode	Red Hat Enterprise Linux 9 has an installation-time kernel flag that can enable FIPS mode. The installer must be booted with `fips=1` for the system to have FIPS mode enabled. Enabling FIPS mode on a preexisting system is not supported. If this rule fails on an installed system, then this is a permanent finding and cannot be fixed. To enable FIPS mode at bootable container build time configure `fips=1` kernel argument in `/usr/lib/bootc/kargs.d/01-fips.toml`: kargs = ["fips=1"] Then set the cryptographic policy to `DEFAULT`: update-crypto-policies --no-reload --set `DEFAULT`	Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. The operating system must implement cryptographic modules adhering to the higher standards approved by the federal government since this provides assurance they have been tested and validated.
CCE-88747-1	Disable IA32 emulation	Disables support for legacy 32-bit programs under a 64-bit kernel. The configuration that was used to build kernel is available at `/boot/config-`. To check the configuration value for `CONFIG_IA32_EMULATION`, run the following command: `grep CONFIG_IA32_EMULATION /boot/config-` Configs with value 'n' are not explicitly set in the file, so either commented lines or no lines should be returned.	Disabling 32-bit backwards compatibility helps reduce the attack surface.
CCE-88749-7	Ensure auditd Collects Information on Kernel Module Loading and Unloading - query_module	To capture kernel module loading and unloading events, use the following line, setting ARCH to either b32 for 32-bit system, or having two lines for both b32 and b64 in case your system is 64-bit: -a always,exit -F arch=ARCH -S query_module -F auid>=1000 -F auid!=unset -F key=modules Place to add the line depends on a way `auditd` daemon is configured. If it is configured to use the `augenrules` program (the default), add the line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`. If the `auditd` daemon is configured to use the `auditctl` utility, add the line to file `/etc/audit/audit.rules`.	The addition/removal of kernel modules can be used to alter the behavior of the kernel and potentially introduce malicious code into kernel space. It is important to have an audit trail of modules that have been introduced into the kernel.
CCE-88756-2	Require Encryption for Remote Access in GNOME3	By default, `GNOME` requires encryption when using `Vino` for remote access. To prevent remote access encryption from being disabled, add or set `require-encryption` to `true` in `/etc/dconf/db/local.d/00-security-settings`. For example: [org/gnome/Vino] require-encryption=true Once the settings have been added, add a lock to `/etc/dconf/db/local.d/locks/00-security-settings-lock` to prevent user modification. For example: /org/gnome/Vino/require-encryption After the settings have been set, run `dconf update`.	Open X displays allow an attacker to capture keystrokes and to execute commands remotely.
CCE-88767-9	Configure GNOME3 DConf User Profile	By default, DConf provides a standard user profile. This profile contains a list of DConf configuration databases. The user profile and database always take the highest priority. As such the DConf User profile should always exist and be configured correctly. To make sure that the user profile is configured correctly, the `/etc/dconf/profile/user` should be set as follows: user-db:user system-db:local system-db:site system-db:distro	Failure to have a functional DConf profile prevents GNOME3 configuration settings from being enforced for all users and allows various security risks.
CCE-88770-3	Ensure /opt Located On Separate Partition	It is recommended that the `/opt` directory resides on a separate partition.	The `/opt` partition contains additional software, usually installed outside the packaging system. Putting this directory on a separate partition makes it easier to apply restrictions e.g. through the `nosuid` mount option.
CCE-88806-5	Ensure McAfee Endpoint Security for Linux (ENSL) is running	Install McAfee Endpoint Security for Linux antivirus software which is provided for systems and uses signatures to search for the presence of viruses on the filesystem.	Virus scanning software can be used to detect if a system has been compromised by computer viruses, as well as to limit their spread to other systems.
CCE-88809-9	Use zero for poisoning instead of debugging value	Instead of using the existing poison value, fill the pages with zeros. This makes it harder to detect when errors are occurring due to sanitization but the zeroing at free means that it is no longer necessary to write zeros when GFP_ZERO is used on allocation. This configuration is available from kernel 4.19. The configuration that was used to build kernel is available at `/boot/config-`. To check the configuration value for `CONFIG_PAGE_POISONING_ZERO`, run the following command: `grep CONFIG_PAGE_POISONING_ZERO /boot/config-` For each kernel installed, a line with value "y" should be returned.	This configuration helps alleviates the performance impact of poisonining.
CCE-88816-4	Configure auditd admin_space_left on Low Disk Space	The `auditd` service can be configured to take an action when disk space is running low but prior to running out of space completely. Edit the file `/etc/audit/auditd.conf`. Add or modify the following line, substituting PERCENTAGE appropriately: admin_space_left = PERCENTAGE% Set this value to `5` to cause the system to perform an action.	Notifying administrators of an impending disk space problem may allow them to take corrective action prior to any disruption.
CCE-88822-2	Enable Use of Privilege Separation	When enabled, SSH will create an unprivileged child process that has the privilege of the authenticated user. To enable privilege separation in SSH, add or correct the following line in the `/etc/ssh/sshd_config` file: UsePrivilegeSeparation `sandbox`	SSH daemon privilege separation causes the SSH process to drop root privileges when not needed which would decrease the impact of software vulnerabilities in the unprivileged section.
CCE-88828-9	Disable the LDT (local descriptor table)	Linux can allow user programs to install a per-process x86 Local Descriptor Table (LDT) using the modify_ldt(2) system call. This is required to run 16-bit or segmented code such as DOSEMU or some Wine programs. It is also used by some very old threading libraries. This configuration is available from kernel 4.3, but may be available if backported by distros. Disable LDT if 16-bit program emulation is not necessary. The configuration that was used to build kernel is available at `/boot/config-`. To check the configuration value for `CONFIG_MODIFY_LDT_SYSCALL`, run the following command: `grep CONFIG_MODIFY_LDT_SYSCALL /boot/config-` Configs with value 'n' are not explicitly set in the file, so either commented lines or no lines should be returned.	Disabling support for unnecessary code reduces attack surface.
CCE-88837-0	Install Intrusion Detection Software	The base Red Hat Enterprise Linux 9 platform already includes a sophisticated auditing system that can detect intruder activity, as well as SELinux, which provides host-based intrusion prevention capabilities by confining privileged programs and user sessions which may become compromised.	Host-based intrusion detection tools provide a system-level defense when an intruder gains access to a system or network.
CCE-88865-1	Set Password Hashing Algorithm in /etc/libuser.conf	In `/etc/libuser.conf`, add or correct the following line in its `[defaults]` section to ensure the system will use the `sha512` algorithm for password hashing: crypt_style = `sha512`	Passwords need to be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. Passwords that are encrypted with a weak algorithm are no more protected than if they are kept in plain text. This setting ensures user and group account administration utilities are configured to store only encrypted representations of passwords. Additionally, the `crypt_style` configuration option in `/etc/libuser.conf` ensures the use of a strong hashing algorithm that makes password cracking attacks more difficult.
CCE-88876-8	Disable network management of chrony daemon	The `cmdport` option in `/etc/chrony.conf` can be set to `0` to stop chrony daemon from listening on the UDP port 323 for management connections made by chronyc.	Minimizing the exposure of the server functionality of the chrony daemon diminishes the attack surface.
CCE-88882-6	Generate USBGuard Policy	By default USBGuard when enabled prevents access to all USB devices and this lead to inaccessible system if they use USB mouse/keyboard. To prevent this scenario, the initial policy configuration must be generated based on current connected USB devices.	The `usbguard` must be configured to allow connected USB devices to work properly, avoiding the system to become inaccessible.
CCE-88900-6	Implement Custom Crypto Policy Modules for CIS Benchmark	Create a custom crypto policy module to enforce the use of strong ciphers and MACs in SSHD, disable CBC mode ciphers in SSHD and disable the use of weak MACs globally. Add the following line to the file `/etc/crypto-policies/policies/modules/NO-SSHCBC.pmod`: cipher@SSH = --CBC Add the following line to the file `/etc/crypto-policies/policies/modules/NO-SSHWEAKCIPHERS.pmod`: cipher@SSH = -3DES-CBC -AES-128-CBC -AES-192-CBC -AES-256-CBC -CHACHA20-POLY1305 Add the following line to the file `/etc/crypto-policies/policies/modules/NO-SSHWEAKMACS.pmod`: mac@SSH = -HMAC-MD5 -UMAC-64* -UMAC-128* Add the following line to the file `/etc/crypto-policies/policies/modules/NO-WEAKMAC.pmod`: mac = --128 Then, set the system wide crypto policy to use the custom policy. $ sudo update-crypto-policies --set DEFAULT:NO-SHA1:NO-SSHCBC:NO-SSHWEAKCIPHERS:NO-SSHWEAKMACS:NO-WEAKMAC	CBC mode ciphers are vulnerable to certain attacks, such as the BEAST attack. Disabling CBC mode ciphers helps protect against these attacks and ensures that only strong, proven cryptographic algorithms are used to protect SSH communications. Weak ciphers that are used for authentication to the cryptographic module cannot be relied upon to provide confidentiality or integrity, and system data may be compromised. Message Authentication Codes (MACs) are cryptographic mechanisms used to verify the integrity and authenticity of data transmitted over SSH connections. Weak MACs that are used for authentication to the cryptographic module cannot be relied upon to provide integrity, and system data may be compromised. Implementing a custom crypto policy that disables weak MAC algorithms helps ensure that only strong, proven cryptographic algorithms are used to protect SSH communications.
CCE-88939-4	Configure AIDE to Use FIPS 140-2 for Validating Hashes	By default, the `sha512` option is added to the `NORMAL` ruleset in AIDE. If using a custom ruleset or the `sha512` option is missing, add `sha512` to the appropriate ruleset. For example, add `sha512` to the following line in `/etc/aide.conf`: NORMAL = FIPSR+sha512 AIDE rules can be configured in multiple ways; this is merely one example that is already configured by default.	File integrity tools use cryptographic hashes for verifying file contents and directories have not been altered. These hashes must be FIPS 140-2 approved cryptographic hashes.
CCE-88963-4	Disable compatibility with brk()	Enabling compatiliby with `brk()` allows legacy binaries to run (i.e. those linked against libc5). But this compatibility comes at the cost of not being able to randomize the heap placement (ASLR). Unless legacy binaries need to run on the system, set `CONFIG_COMPAT_BRK` to `"n"`. The configuration that was used to build kernel is available at `/boot/config-`. To check the configuration value for `CONFIG_COMPAT_BRK`, run the following command: `grep CONFIG_COMPAT_BRK /boot/config-` Configs with value 'n' are not explicitly set in the file, so either commented lines or no lines should be returned.	Enabling compatibility with brk() disables support for ASLR.
CCE-88964-2	All Interactive Users Must Have A Home Directory Defined	Assign home directories to all interactive users that currently do not have a home directory assigned. This rule checks if the home directory is properly defined in a folder which has at least one parent folder, like "user" in "/home/user" or "/remote/users/user". Therefore, this rule will report a finding for home directories like `/users`, `/tmp` or `/`.	If local interactive users are not assigned a valid home directory, there is no place for the storage and control of files they should own.
CCE-88983-2	Ensure Home Directories are Created for New Users	All local interactive user accounts, upon creation, should be assigned a home directory. Configure the operating system to assign home directories to all new local interactive users by setting the `CREATE_HOME` parameter in `/etc/login.defs` to `yes` as follows: CREATE_HOME yes	If local interactive users are not assigned a valid home directory, there is no place for the storage and control of files they should own.
CCE-89001-2	Drop Gratuitous ARP frames on All IPv4 Interfaces	To set the runtime status of the `net.ipv4.conf.all.drop_gratuitous_arp` kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.all.drop_gratuitous_arp=1 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: net.ipv4.conf.all.drop_gratuitous_arp = 1	Drop Gratuitous ARP frames to prevent ARP poisoning.
CCE-89013-7	Only Allow specific PKI-established CAs	The operating system must only allow the use of trusted PKI-established certificate authorities for verification of the establishment of protected sessions.	Untrusted Certificate Authorities (CA) can issue certificates, but they may be issued by organizations or individuals that seek to compromise systems or by organizations with insufficient security controls. If the CA used for verifying the certificate is not a approved CA, trust of this CA has not been established. The Environment shall only accept PKI-certificates obtained from a approved internal or external certificate authority. Reliance on CAs for the establishment of secure sessions includes, for example, the use of SSL/TLS certificates.
CCE-89022-8	Verify that Shared Library Directories Have Root Ownership	System-wide shared library files, which are linked to executables during process load time or run time, are stored in the following directories by default: /lib /lib64 /usr/lib /usr/lib64 Kernel modules, which can be added to the kernel during runtime, are also stored in `/lib/modules`. All files in these directories should be owned by the `root` user. If the directories, is found to be owned by a user other than root correct its ownership with the following command: $ sudo chown root DIR	Files from shared library directories are loaded into the address space of processes (including privileged ones) or of the kernel itself at runtime. Proper ownership of library directories is necessary to protect the integrity of the system.
CCE-89023-6	Prevent Routing External Traffic to Local Loopback on All IPv4 Interfaces	To set the runtime status of the `net.ipv4.conf.all.route_localnet` kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.all.route_localnet=0 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: net.ipv4.conf.all.route_localnet = 0	Refuse the routing of packets whose source or destination address is the local loopback. This prohibits the use of network 127/8 for local routing purposes. Enabling `route_localnet` can expose applications listening on localhost to external traffic.
CCE-89033-5	Disable kernel debugfs	`debugfs` is a virtual file system that kernel developers use to put debugging files into. Enable this option to be able to read and write to these files. The configuration that was used to build kernel is available at `/boot/config-`. To check the configuration value for `CONFIG_DEBUG_FS`, run the following command: `grep CONFIG_DEBUG_FS /boot/config-` Configs with value 'n' are not explicitly set in the file, so either commented lines or no lines should be returned.	To reduce the attack surface, this file system should be disabled if not in use.
CCE-89036-8	Strong Stack Protector	This features adds canary logic protection to more kinds of vulnerable functions than CONFIG_STACKPROTECTOR, but not to all functions so that performance is not severily impacted. This configuration is available from kernel 4.18. This config requires gcc version 4.9 or above, or a distribution gcc with the feature backported ("-fstack-protector-strong"). The configuration that was used to build kernel is available at `/boot/config-`. To check the configuration value for `CONFIG_STACKPROTECTOR_STRONG`, run the following command: `grep CONFIG_STACKPROTECTOR_STRONG /boot/config-` For each kernel installed, a line with value "y" should be returned.	This provides a mechanism that protects more vulnerable functions than CONFIG_STACKPROTECTOR, balancing between security and performance.
CCE-89041-8	Detect stack corruption on calls to schedule()	This option checks for a stack overrun on calls to schedule(). If the stack end location is found to be overwritten always panic as the content of the corrupted region can no longer be trusted. This configuration is available from kernel 3.18. The configuration that was used to build kernel is available at `/boot/config-`. To check the configuration value for `CONFIG_SCHED_STACK_END_CHECK`, run the following command: `grep CONFIG_SCHED_STACK_END_CHECK /boot/config-` For each kernel installed, a line with value "y" should be returned.	This ensures no erroneous behaviour occurs which could result in data corruption or a sporadic crash at a later stage once the region is examined.
CCE-89055-8	Stack Protector buffer overflow detection	This feature puts, at the beginning of functions, a canary value on the stack just before the return address, and validates the value just before actually returning. This configuration is available from kernel 4.18. The configuration that was used to build kernel is available at `/boot/config-`. To check the configuration value for `CONFIG_STACKPROTECTOR`, run the following command: `grep CONFIG_STACKPROTECTOR /boot/config-` For each kernel installed, a line with value "y" should be returned.	This halts the program when a stack overflow is detected, potentially reducing the impact of exploits.
CCE-89060-8	Emulate Privileged Access Never (PAN)	Enabling this option prevents the kernel from accessing user-space memory directly by pointing TTBR0_EL1 to a reserved zeroed area and reserved ASID. The user access routines restore the valid TTBR0_EL1 temporarily. This configuration is available from kernel 4.10, but may be available if backported by distros. The configuration that was used to build kernel is available at `/boot/config-`. To check the configuration value for `CONFIG_ARM64_SW_TTBR0_PAN`, run the following command: `grep CONFIG_ARM64_SW_TTBR0_PAN /boot/config-` For each kernel installed, a line with value "y" should be returned.	The Privileged Access Never (PAN) is the ARM equivalent of the x86 Supervisor Mode Access Prevention (SMAP), and it prevents privileged access to user data unless explicitly enabled.
CCE-89064-0	Configure System to Forward All Mail From Postmaster to The Root Account	Verify the administrators are notified in the event of an audit processing failure. Check that the "/etc/aliases" file has a defined value for "root". $ sudo grep "postmaster:\s*root$" /etc/aliases postmaster: root	It is critical for the appropriate personnel to be aware if a system is at risk of failing to process audit logs as required. Without this notification, the security personnel may be unaware of an impending failure of the audit capability, and system operation may be adversely affected. Audit processing failures include software/hardware errors, failures in the audit capturing mechanisms, and audit storage capacity being reached or exceeded.
CCE-89069-9	Set Existing Passwords Minimum Age	Configure non-compliant accounts to enforce a 24 hours/1 day minimum password lifetime by running the following command: $ sudo chage -m 1 USER	Enforcing a minimum password lifetime helps to prevent repeated password changes to defeat the password reuse or history enforcement requirement. If users are allowed to immediately and continually change their password, the password could be repeatedly changed in a short period of time to defeat the organization's policy regarding password reuse.
CCE-89105-1	Prevent remote hosts from connecting to the proxy display	The SSH daemon should prevent remote hosts from connecting to the proxy display. The default SSH configuration for `X11UseLocalhost` is `yes`, which prevents remote hosts from connecting to the proxy display. To explicitly prevent remote connections to the proxy display, add or correct the following line in `/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf`: `X11UseLocalhost yes`	When X11 forwarding is enabled, there may be additional exposure to the server and client displays if the sshd proxy display is configured to listen on the wildcard address. By default, sshd binds the forwarding server to the loopback address and sets the hostname part of the `DISPLAY` environment variable to localhost. This prevents remote hosts from connecting to the proxy display.
CCE-89122-6	Configure opensc Smart Card Drivers	The OpenSC smart card tool can auto-detect smart card drivers; however, setting the smart card drivers in use by your organization helps to prevent users from using unauthorized smart cards. The default smart card driver for this profile is `default`. To configure the OpenSC driver, edit the `/etc/opensc.conf` and add the following line into the file in the `app default` block, so it will look like: app default { ... card_drivers = `default`; }	Smart card login provides two-factor authentication stronger than that provided by a username and password combination. Smart cards leverage PKI (public key infrastructure) in order to provide and verify credentials. Configuring the smart card driver in use by your organization helps to prevent users from using unauthorized smart cards.
CCE-89123-4	Configure L1 Terminal Fault mitigations	L1 Terminal Fault (L1TF) is a hardware vulnerability which allows unprivileged speculative access to data which is available in the Level 1 Data Cache when the page table entry isn't present. Select the appropriate mitigation by adding the argument `l1tf=flush` to the default GRUB 2 command line for the Linux operating system. To ensure that `l1tf=flush` is added as a kernel command line argument to newly installed kernels, add `l1tf=flush` to the default Grub2 command line for Linux operating systems. Modify the line within `/etc/default/grub` as shown below: GRUB_CMDLINE_LINUX="... l1tf=`flush` ..." Run the following command to update command line for already installed kernels: # grubby --update-kernel=ALL --args="l1tf=`flush`" If the system is distributed as a bootable container image, GRUB2 can't be configured using the method described above, but the following method needs to be used instead. The kernel arguments should be set in `/usr/lib/bootc/kargs.d` in a TOML file that has the following form: # /usr/lib/bootc/kargs.d/10-example.toml kargs = ["l1tf=`flush`"] For more details on configuring kernel arguments in bootable container images, please refer to Bootc documentation. Since Linux Kernel 4.19 you can check the L1TF vulnerability state with the following command: `cat /sys/devices/system/cpu/vulnerabilities/l1tf`	The L1TF vulnerability allows an attacker to bypass memory access security controls imposed by the system or hypervisor. The L1TF vulnerability allows read access to any physical memory location that is cached in the L1 Data Cache.
CCE-89151-5	Force opensc To Use Defined Smart Card Driver	The OpenSC smart card middleware can auto-detect smart card drivers; however by forcing the smart card driver in use by your organization, opensc will no longer autodetect or use other drivers unless specified. This helps to prevent users from using unauthorized smart cards. The default smart card driver for this profile is `default`. To force the OpenSC driver, edit the `/etc/opensc.conf`. Look for a line similar to: # force_card_driver = customcos; and change it to: force_card_driver = `default`;	Smart card login provides two-factor authentication stronger than that provided by a username and password combination. Smart cards leverage PKI (public key infrastructure) in order to provide and verify credentials. Forcing the smart card driver in use by your organization helps to prevent users from using unauthorized smart cards.
CCE-89155-6	Enable Smartcards in SSSD	SSSD should be configured to authenticate access to the system using smart cards. To enable smart cards in SSSD, set `pam_cert_auth` to `True` under the `[pam]` section in `/etc/sssd/sssd.conf`. For example: [pam] pam_cert_auth = True Add or update "pam_sss.so" line in auth section of "/etc/pam.d/system-auth" file to include "try_cert_auth" or "require_cert_auth" option, like in the following example: /etc/pam.d/system-auth:auth [success=done authinfo_unavail=ignore ignore=ignore default=die] pam_sss.so try_cert_auth Also add or update "pam_sss.so" line in auth section of "/etc/pam.d/smartcard-auth" file to include the "allow_missing_name" option, like in the following example: /etc/pam.d/smartcard-auth:auth sufficient pam_sss.so allow_missing_name	Using an authentication device, such as a CAC or token that is separate from the information system, ensures that even if the information system is compromised, that compromise will not affect credentials stored on the authentication device. Multi-Factor Authentication (MFA) solutions that require devices separate from information systems gaining access include, for example, hardware tokens providing time-based or challenge-response authenticators and smart cards or similar secure authentication devices issued by an organization or identity provider.
CCE-89175-4	Enable SSH Server firewalld Firewall Exception	If the SSH server is in use, inbound connections to SSH's port should be allowed to permit remote access through SSH. In more restrictive firewalld settings, the SSH port should be added to the proper firewalld zone in order to allow SSH remote access. To configure `firewalld` to allow `ssh` access, run the following command(s): firewall-cmd --permanent --add-service=ssh Then run the following command to load the newly created rule(s): firewall-cmd --reload	If inbound SSH connections are expected, adding the SSH port to the proper firewalld zone will allow remote access through the SSH port.
CCE-89176-2	Limit Password Reuse: system-auth	Do not allow users to reuse recent passwords. This can be accomplished by using the `remember` option for the `pam_pwhistory` PAM module. On systems with newer versions of `authselect`, the `pam_pwhistory` PAM module can be enabled via authselect feature: authselect enable-feature with-pwhistory Otherwise, it should be enabled using an authselect custom profile. Newer systems also have the `/etc/security/pwhistory.conf` file for setting `pam_pwhistory` module options. This file should be used whenever available. Otherwise, the `pam_pwhistory` module options can be set in PAM files. The value for `remember` option must be equal or greater than `5`	Preventing reuse of previous passwords helps ensure that a compromised password is not reused by a user.
CCE-89180-4	Unmap kernel when running in userspace (aka KAISER)	Speculation attacks against some high-performance processors can be used to bypass MMU permission checks and leak kernel data to userspace. This can be defended against by unmapping the kernel when running in userspace, mapping it back in on exception entry via a trampoline page in the vector table. This configuration is available from kernel 4.16, but may be available if backported by distros. The configuration that was used to build kernel is available at `/boot/config-`. To check the configuration value for `CONFIG_UNMAP_KERNEL_AT_EL0`, run the following command: `grep CONFIG_UNMAP_KERNEL_AT_EL0 /boot/config-` For each kernel installed, a line with value "y" should be returned.	This is a countermeasure to the Meltdown attack.
CCE-89228-1	Make the module text and rodata read-only	When set, module text and rodata memory will be made read-only, and non-text memory will be made non-executable. This configuration is available from kernel 4.11. The configuration that was used to build kernel is available at `/boot/config-`. To check the configuration value for `CONFIG_STRICT_MODULE_RWX`, run the following command: `grep CONFIG_STRICT_MODULE_RWX /boot/config-` For each kernel installed, a line with value "y" should be returned.	This provides protection against certain security exploits (e.g. executing the heap or modifying text)
CCE-89240-6	Disable Kernel iwlwifi Module	To configure the system to prevent the `iwlwifi` kernel module from being loaded, add the following line to the file `/etc/modprobe.d/iwlwifi.conf`: install iwlwifi /bin/false This entry will cause a non-zero return value during a `iwlwifi` module installation and additionally convey the meaning of the entry to the user in form of an error message. If you would like to omit a non-zero return value and an error message, you may want to add a different line instead (both `/bin/true` and `/bin/false` are allowed by OVAL and will be accepted by the scan): install iwlwifi /bin/true	If Wireless functionality must be disabled, preventing the kernel from loading the kernel module provides an additional safeguard against its activation.
CCE-89272-9	Record Events that Modify the System's Discretionary Access Controls - umount	At a minimum, the audit system should collect file system umount changes. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -a always,exit -F arch=b32 -S umount -F auid>=1000 -F auid!=unset -F key=perm_mod If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following line to `/etc/audit/audit.rules` file: -a always,exit -F arch=b32 -S umount -F auid>=1000 -F auid!=unset -F key=perm_mod	The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications can facilitate the identification of patterns of abuse among both authorized and unauthorized users.
CCE-89284-4	Verify Permissions on /etc/audit/auditd.conf	To properly set the permissions of `/etc/audit/auditd.conf`, run the command: $ sudo chmod 0640 /etc/audit/auditd.conf	Without the capability to restrict the roles and individuals that can select which events are audited, unauthorized personnel may be able to prevent the auditing of critical events. Misconfigured audits may degrade the system's performance by overwhelming the audit log. Misconfigured audits may also make it more difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.
CCE-89299-2	Harden memory copies between kernel and userspace	This option checks for obviously wrong memory regions when copying memory to/from the kernel (via copy_to_user() and copy_from_user() functions) by rejecting memory ranges that are larger than the specified heap object, span multiple separately allocated pages, are not on the process stack, or are part of the kernel text. This configuration is available from kernel 4.8, and may be available if backported by distros. The configuration that was used to build kernel is available at `/boot/config-`. To check the configuration value for `CONFIG_HARDENED_USERCOPY`, run the following command: `grep CONFIG_HARDENED_USERCOPY /boot/config-` For each kernel installed, a line with value "y" should be returned.	This config prevents entire classes of heap overflow exploits and similar kernel memory exposures.
CCE-89302-4	Enable GNOME3 Screensaver Lock After Idle Period	To activate locking of the screensaver in the GNOME3 desktop when it is activated, add or set `lock-enabled` to `true` in `/etc/dconf/db/local.d/00-security-settings`. For example: [org/gnome/desktop/screensaver] lock-enabled=true Once the settings have been added, add a lock to `/etc/dconf/db/local.d/locks/00-security-settings-lock` to prevent user modification. For example: /org/gnome/desktop/screensaver/lock-enabled After the settings have been set, run `dconf update`.	A session lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not want to logout because of the temporary nature of the absence.
CCE-89333-9	Configure Sending and Accepting Shared Media Redirects for All IPv4 Interfaces	To set the runtime status of the `net.ipv4.conf.all.shared_media` kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.all.shared_media=`0` To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: net.ipv4.conf.all.shared_media = `0`	This setting should be aligned with `net.ipv4.conf.all.secure_redirects` because it overrides it. If `shared_media` is enabled for an interface `secure_redirects` will be enabled too.
CCE-89379-2	Enable module signature verification	Check modules for valid signatures upon load. Note that this option adds the OpenSSL development packages as a kernel build dependency so that the signing tool can use its crypto library. The configuration that was used to build kernel is available at `/boot/config-`. To check the configuration value for `CONFIG_MODULE_SIG`, run the following command: `grep CONFIG_MODULE_SIG /boot/config-` For each kernel installed, a line with value "y" should be returned.	Loaded modules must be signed.
CCE-89427-9	Set the UEFI Boot Loader Admin Username to a Non-Default Value	The grub2 boot loader should have a superuser account and password protection enabled to protect boot-time settings. To maximize the protection, select a password-protected superuser account with unique name, and modify the `/etc/grub.d/01_users` configuration file to reflect the account name change. It is highly suggested not to use common administrator account names like root, admin, or administrator for the grub2 superuser account. Change the superuser to a different username (The default is 'root'). $ sed -i 's/$set superusers=$.*/\1"<unique user ID>"/g' /etc/grub.d/01_users The line mentioned above must be followed by the line export superusers so that the `superusers` is honored. Once the superuser account has been added, update the `grub.cfg` file by running: grub2-mkconfig -o /boot/grub2/grub.cfg	Having a non-default grub superuser username makes password-guessing attacks less effective.
CCE-89442-8	Verify that system commands files are group owned by root or a system account	System commands files are stored in the following directories by default: /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin All files in these directories should be owned by the `root` group, or a system account. If the directory, or any file in these directories, is found to be owned by a group other than root or a a system account correct its ownership with the following command: $ sudo chgrp root FILE	If the operating system allows any user to make changes to software libraries, then those changes might be implemented without undergoing the appropriate testing and approvals that are part of a robust change management process. This requirement applies to operating systems with software libraries that are accessible and configurable, as in the case of interpreted languages. Software libraries also include privileged programs which execute with escalated privileges. Only qualified and authorized individuals must be allowed to obtain access to information system components for purposes of initiating changes, including upgrades and modifications.
CCE-89444-4	Configure Sending and Accepting Shared Media Redirects by Default	To set the runtime status of the `net.ipv4.conf.default.shared_media` kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.default.shared_media=`0` To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: net.ipv4.conf.default.shared_media = `0`	This setting should be aligned with `net.ipv4.conf.default.secure_redirects` because it overrides it. If `shared_media` is enabled for an interface `secure_redirects` will be enabled too.
CCE-89457-6	Ensure the default plugins for the audit dispatcher are Installed	The audit-audispd-plugins package should be installed.	Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Off-loading is a common process in information systems with limited audit storage capacity.
CCE-89460-0	Require modules to be validly signed	Reject unsigned modules or signed modules with an unknown key. The configuration that was used to build kernel is available at `/boot/config-`. To check the configuration value for `CONFIG_MODULE_SIG_FORCE`, run the following command: `grep CONFIG_MODULE_SIG_FORCE /boot/config-` For each kernel installed, a line with value "y" should be returned.	Prevent loading modules that are unsigned or signed with an unknown key.
CCE-89466-7	Install the Host Intrusion Prevention System (HIPS) Module	Install the McAfee Host Intrusion Prevention System (HIPS) Module if it is absolutely necessary. If SELinux is enabled, do not install or enable this module.	Without a host-based intrusion detection tool, there is no system-level defense when an intruder gains access to a system or network. Additionally, a host-based intrusion prevention tool can provide methods to immediately lock out detected intrusion attempts.
CCE-89481-6	Ensure auditd Collects Information on the Use of Privileged Commands - unix_update	At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -a always,exit -F path=/usr/sbin/unix_update -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`: -a always,exit -F path=/usr/sbin/unix_update -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged	Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider and advanced persistent threats. Privileged programs are subject to escalation-of-privilege attacks, which attempt to subvert their normal role of providing some necessary but limited capability. As such, motivation exists to monitor these programs for unusual activity.
CCE-89488-1	Record Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE	The audit system should collect detailed unauthorized file accesses for all users and root. The `openat` syscall can be used to modify files if called for write operation of with O_TRUNC_WRITE flag. The following auidt rules will assure that unsuccessful attempts to modify a file via `openat` syscall are collected. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the rules below to a file with suffix `.rules` in the directory `/etc/audit/rules.d`. If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the rules below to `/etc/audit/audit.rules` file. -a always,exit -F arch=b32 -S openat -F a2&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification -a always,exit -F arch=b32 -S openat -F a2&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification If the system is 64 bit then also add the following lines: -a always,exit -F arch=b64 -S openat -F a2&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification -a always,exit -F arch=b64 -S openat -F a2&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification	Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing these events could serve as evidence of potential system compromise.
CCE-89498-0	Ensure auditd Collects System Administrator Actions - /etc/sudoers.d/	At a minimum, the audit system should collect administrator actions for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -w /etc/sudoers.d/ -p wa -k actions If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules`: -w /etc/sudoers.d/ -p wa -k actions	The actions taken by system administrators should be audited to keep a record of what was executed on the system, as well as, for accountability purposes. Editing the sudoers file may be sign of an attacker trying to establish persistent methods to a system, auditing the editing of the sudoers files mitigates this risk.
CCE-89538-3	Prevent user from disabling the screen lock	The `tmux` terminal multiplexer is used to implement automatic session locking. It should not be listed in `/etc/shells`.	Not listing `tmux` among permitted shells prevents malicious program running as user from lowering security by disabling the screen lock.
CCE-89555-7	Configure ARP filtering for All IPv4 Interfaces	To set the runtime status of the `net.ipv4.conf.all.arp_filter` kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.all.arp_filter=`0` To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: net.ipv4.conf.all.arp_filter = `0`	Prevents the Linux Kernel from handling the ARP table globally. By default, the kernel may respond to an ARP request from a certain interface with information from another interface.
CCE-89564-9	Ensure auditd Collects Information on the Use of Privileged Commands - mount	At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -a always,exit -F path=/usr/bin/mount -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`: -a always,exit -F path=/usr/bin/mount -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged	Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider and advanced persistent threats. Privileged programs are subject to escalation-of-privilege attacks, which attempt to subvert their normal role of providing some necessary but limited capability. As such, motivation exists to monitor these programs for unusual activity.
CCE-89568-0	Disable Kernel Support for USB via Bootloader Configuration	All USB support can be disabled by adding the `nousb` argument to the kernel's boot loader configuration. To do so, add the argument `nousb` to the default GRUB 2 command line for the Linux operating system. To ensure that `nousb` is added as a kernel command line argument to newly installed kernels, add `nousb` to the default Grub2 command line for Linux operating systems. Modify the line within `/etc/default/grub` as shown below: GRUB_CMDLINE_LINUX="... nousb ..." Run the following command to update command line for already installed kernels: # grubby --update-kernel=ALL --args="nousb" If the system is distributed as a bootable container image, GRUB2 can't be configured using the method described above, but the following method needs to be used instead. The kernel arguments should be set in `/usr/lib/bootc/kargs.d` in a TOML file that has the following form: # /usr/lib/bootc/kargs.d/10-example.toml kargs = ["nousb"] For more details on configuring kernel arguments in bootable container images, please refer to Bootc documentation.	Disabling the USB subsystem within the Linux kernel at system boot will protect against potentially malicious USB devices, although it is only practical in specialized systems.
CCE-89603-5	System Audit Logs Must Be Group Owned By Root	All audit logs must be group owned by root user. The path for audit log can be configured via `log_file` parameter in /etc/audit/auditd.conf or, by default, the path for audit log is /var/log/audit/ . To properly set the group owner of `/var/log/audit/`, run the command: $ sudo chgrp root /var/log/audit/ If `log_group` in `/etc/audit/auditd.conf` is set to a group other than the `root` group account, change the group ownership of the audit logs to this specific group.	Unauthorized disclosure of audit records can reveal system and configuration data to attackers, thus compromising its confidentiality.
CCE-89616-7	Enable automatic signing of all modules	Sign all modules during make modules_install. Without this option, modules must be signed manually, using the scripts/sign-file tool. The configuration that was used to build kernel is available at `/boot/config-`. To check the configuration value for `CONFIG_MODULE_SIG_ALL`, run the following command: `grep CONFIG_MODULE_SIG_ALL /boot/config-` For each kernel installed, a line with value "y" should be returned.	This ensures the modules are signed during install process.
CCE-89663-9	Disable GDM Automatic Login	The GNOME Display Manager (GDM) can allow users to automatically login without user interaction or credentials. User should always be required to authenticate themselves to the system that they are authorized to use. To disable user ability to automatically login to the system, set the `AutomaticLoginEnable` to `false` in the `[daemon]` section in `/etc/gdm/custom.conf`. For example: [daemon] AutomaticLoginEnable=false	Failure to restrict system access to authenticated users negatively impacts operating system security.
CCE-89691-0	Sign kernel modules with SHA-512	This configures the kernel to build and sign modules using SHA512 as the hash function. The configuration that was used to build kernel is available at `/boot/config-`. To check the configuration value for `CONFIG_MODULE_SIG_SHA512`, run the following command: `grep CONFIG_MODULE_SIG_SHA512 /boot/config-` For each kernel installed, a line with value "y" should be returned.	Use of strong hash function is important to secure the module against counterfeit signatures.
CCE-89696-9	Enable Encrypted X11 Forwarding	By default, remote X11 connections are not encrypted when initiated by users. SSH has the capability to encrypt remote X11 connections when SSH's `X11Forwarding` option is enabled. To enable X11 Forwarding, add or correct the following line in `/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf`: X11Forwarding yes	Non-encrypted X displays allow an attacker to capture keystrokes and to execute commands remotely.
CCE-89706-6	Ensure nss-tools is installed	The `nss-tools` package can be installed with the following command: $ sudo dnf install nss-tools	Network Security Services (NSS) is a set of libraries designed to support cross-platform development of security-enabled client and server applications. Install the `nss-tools` package to install command-line tools to manipulate the NSS certificate and key database.
CCE-89708-2	Set Password Hashing Rounds in /etc/login.defs	In `/etc/login.defs`, ensure `SHA_CRYPT_MIN_ROUNDS` and `SHA_CRYPT_MAX_ROUNDS` has the minimum value of `5000`. For example: SHA_CRYPT_MIN_ROUNDS `5000` SHA_CRYPT_MAX_ROUNDS `5000` Notice that if neither are set, they already have the default value of 5000. If either is set, they must have the minimum value of `5000`.	Passwords need to be protected at all times, and hashing is the standard method for protecting passwords. If passwords are not hashed, they can be plainly read (i.e., clear text) and easily compromised. Passwords that are hashed with a weak algorithm are no more protected than if they are kept in plain text. Using more hashing rounds makes password cracking attacks more difficult.
CCE-89732-2	Enable authselect	Configure user authentication setup to use the `authselect` tool. If authselect profile is selected, the rule will enable the `minimal` profile.	Authselect is a successor to authconfig. It is a tool to select system authentication and identity sources from a list of supported profiles instead of letting the administrator manually build the PAM stack. That way, it avoids potential breakage of configuration, as it ships several tested profiles that are well tested and supported to solve different use-cases.
CCE-89737-1	Enable Certmap in SSSD	SSSD should be configured to verify the certificate of the user or group. To set this up ensure that section like `certmap/testing.test/rule_name` is setup in `/etc/sssd/sssd.conf`. For example [certmap/testing.test/rule_name] matchrule =<SAN>.*EDIPI@mil maprule = (userCertificate;binary={cert!bin}) domains = testing.test	Without mapping the certificate used to authenticate to the user account, the ability to determine the identity of the individual user or group will not be available for forensic analysis.
CCE-89777-7	Ensure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly	The audit system should collect detailed unauthorized file accesses for all users and root. To correctly identify unsuccessful creation, unsuccessful modification and unsuccessful access of files via `open` syscall the audit rules collecting these events need to be in certain order. The more specific rules need to come before the less specific rules. The reason for that is that more specific rules cover a subset of events covered in the less specific rules, thus, they need to come before to not be overshadowed by less specific rules, which match a bigger set of events. Make sure that rules for unsuccessful calls of `open` syscall are in the order shown below. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), check the order of rules below in a file with suffix `.rules` in the directory `/etc/audit/rules.d`. If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, check the order of rules below in `/etc/audit/audit.rules` file. -a always,exit -F arch=b32 -S open -F a1&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create -a always,exit -F arch=b32 -S open -F a1&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-create -a always,exit -F arch=b32 -S open -F a1&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification -a always,exit -F arch=b32 -S open -F a1&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification -a always,exit -F arch=b32 -S open -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-access -a always,exit -F arch=b32 -S open -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-access If the system is 64 bit then also add the following lines: -a always,exit -F arch=b64 -S open -F a1&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create -a always,exit -F arch=b64 -S open -F a1&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-create -a always,exit -F arch=b64 -S open -F a1&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification -a always,exit -F arch=b64 -S open -F a1&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification -a always,exit -F arch=b64 -S open -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-access -a always,exit -F arch=b64 -S open -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-access	The more specific rules cover a subset of events covered by the less specific rules. By ordering them from more specific to less specific, it is assured that the less specific rule will not catch events better recorded by the more specific rule.
CCE-89789-2	Disable Accepting Packets Routed Between Local Interfaces	To set the runtime status of the `net.ipv4.conf.all.accept_local` kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.all.accept_local=0 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: net.ipv4.conf.all.accept_local = 0	Configure `net.ipv4.conf.all.accept_local=0` to consider as invalid the packets received from outside whose source is the 127.0.0.0/8 address block. In combination with suitable routing, this can be used to direct packets between two local interfaces over the wire and have them accepted properly.
CCE-89844-5	Specify the hash to use when signing modules	This configures the kernel to build and sign modules using `sha512` as the hash function. The configuration that was used to build kernel is available at `/boot/config-`. To check the configuration value for `CONFIG_MODULE_SIG_HASH`, run the following command: `grep CONFIG_MODULE_SIG_HASH /boot/config-` For each kernel installed, a line with value "`sha512`" should be returned.	Use of strong hash function is important to secure the module against counterfeit signatures.
CCE-89858-5	Verify that Shared Library Directories Have Root Group Ownership	System-wide shared library files, which are linked to executables during process load time or run time, are stored in the following directories by default: /lib /lib64 /usr/lib /usr/lib64 Kernel modules, which can be added to the kernel during runtime, are also stored in `/lib/modules`. All files in these directories should be group-owned by the `root` user. If the directories, is found to be owned by a user other than root correct its ownership with the following command: $ sudo chgrp root DIR	Files from shared library directories are loaded into the address space of processes (including privileged ones) or of the kernel itself at runtime. Proper ownership of library directories is necessary to protect the integrity of the system.
CCE-89876-7	Configure tmux to lock session after inactivity	To enable console screen locking in `tmux` terminal multiplexer after a period of inactivity, the `lock-after-time` option has to be set to a value greater than 0 and less than or equal to 900 in `/etc/tmux.conf`.	Locking the session after a period of inactivity limits the potential exposure if the session is left unattended.
CCE-89889-0	Configure Response Mode of ARP Requests for All IPv4 Interfaces	To set the runtime status of the `net.ipv4.conf.all.arp_ignore` kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.all.arp_ignore=`0` To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: net.ipv4.conf.all.arp_ignore = `0`	Avoids ARP Flux on system that have more than one interface on the same subnet.
CCE-89900-5	Configure audispd Plugin To Send Logs To Remote Server	Configure the audispd plugin to off-load audit records onto a different system or media from the system being audited. Set the `remote_server` option in /etc/audit/audisp-remote.conf with an IP address or hostname of the system that the audispd plugin should send audit records to. For example remote_server = `logcollector`	Information stored in one location is vulnerable to accidental or incidental deletion or alteration.Off-loading is a common process in information systems with limited audit storage capacity.
CCE-89909-6	Disable WiFi or Bluetooth in BIOS	Some machines that include built-in wireless support offer the ability to disable the device through the BIOS. This is hardware-specific; consult your hardware manual or explore the BIOS setup during boot.	Disabling wireless support in the BIOS prevents easy activation of the wireless interface, generally requiring administrators to reboot the system first.
CCE-89947-6	Use Kerberos Security on All Exports	Using Kerberos on all exported mounts prevents a malicious client or user from impersonating a system user. To cryptography authenticate users to the NFS server, add `sec=krb5:krb5i:krb5p` to each export in `/etc/exports`.	When an NFS server is configured to use AUTH_SYS a selected userid and groupid are used to handle requests from the remote user. The userid and groupid could mistakenly or maliciously be set incorrectly. The AUTH_GSS method of authentication uses certificates on the server and client systems to more securely authenticate the remote mount request.
CCE-89952-6	System Audit Logs Must Be Owned By Root	All audit logs must be owned by root user. The path for audit log can be configured via `log_file` parameter in /etc/audit/auditd.conf or by default, the path for audit log is /var/log/audit/ . To properly set the owner of `/var/log/audit/`, run the command: $ sudo chown root /var/log/audit/	Unauthorized disclosure of audit records can reveal system and configuration data to attackers, thus compromising its confidentiality.
CCE-89970-8	Ensure nonessential services are removed or masked	A network port is identified by its number, the associated IP address, and the type of the communication protocol such as TCP or UDP. A listening port is a network port on which an application or process listens on, acting as a communication endpoint. Each listening port can be open or closed (filtered) using a firewall. In general terms, an open port is a network port that accepts incoming packets from remote locations.	Services listening on the system pose a potential risk as an attack vector. These services should be reviewed, and if not required, the service should be stopped, and the package containing the service should be removed. If required packages have a dependency, the service should be stopped and masked to reduce the attack surface of the system.
CCE-89977-3	Verify Permissions on /etc/audit/rules.d/*.rules	To properly set the permissions of `/etc/audit/rules.d/.rules`, run the command: $ sudo chmod 0600 /etc/audit/rules.d/.rules	Without the capability to restrict the roles and individuals that can select which events are audited, unauthorized personnel may be able to prevent the auditing of critical events. Misconfigured audits may degrade the system's performance by overwhelming the audit log. Misconfigured audits may also make it more difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.
CCE-89983-1	Verify All Account Password Hashes are Shadowed with SHA512	Verify the operating system requires the shadow password suite configuration be set to encrypt interactive user passwords using a strong cryptographic hash. Check that the interactive user account passwords are using a strong password hash with the following command: $ sudo cut -d: -f2 /etc/shadow $6$kcOnRq/5$NUEYPuyL.wghQwWssXRcLRFiiru7f5JPV6GaJhNC2aK5F3PZpE/BCCtwrxRc/AInKMNX3CdMw11m9STiql12f/ Password hashes `!` or `*` indicate inactive accounts not available for logon and are not evaluated. If any interactive user password hash does not begin with `$6`, this is a finding.	Passwords need to be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised.
CCE-89998-9	Ensure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly	The audit system should collect detailed unauthorized file accesses for all users and root. To correctly identify unsuccessful creation, unsuccessful modification and unsuccessful access of files via `open_by_handle_at` syscall the audit rules collecting these events need to be in certain order. The more specific rules need to come before the less specific rules. The reason for that is that more specific rules cover a subset of events covered in the less specific rules, thus, they need to come before to not be overshadowed by less specific rules, which match a bigger set of events. Make sure that rules for unsuccessful calls of `open_by_handle_at` syscall are in the order shown below. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), check the order of rules below in a file with suffix `.rules` in the directory `/etc/audit/rules.d`. If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, check the order of rules below in `/etc/audit/audit.rules` file. -a always,exit -F arch=b32 -S open_by_handle_at -F a2&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create -a always,exit -F arch=b32 -S open_by_handle_at -F a2&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-create -a always,exit -F arch=b32 -S open_by_handle_at -F a2&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification -a always,exit -F arch=b32 -S open_by_handle_at -F a2&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification -a always,exit -F arch=b32 -S open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-access -a always,exit -F arch=b32 -S open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-access If the system is 64 bit then also add the following lines: -a always,exit -F arch=b64 -S open_by_handle_at -F a2&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create -a always,exit -F arch=b64 -S open_by_handle_at -F a2&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-create -a always,exit -F arch=b64 -S open_by_handle_at -F a2&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification -a always,exit -F arch=b64 -S open_by_handle_at -F a2&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification -a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-access -a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-access	The more specific rules cover a subset of events covered by the less specific rules. By ordering them from more specific to less specific, it is assured that the less specific rule will not catch events better recorded by the more specific rule.
CCE-89999-7	Specify module signing key to use	Setting this option to something other than its default of `certs/signing_key.pem` will disable the autogeneration of signing keys and allow the kernel modules to be signed with a key of your choosing. The string provided should identify a file containing both a private key and its corresponding X.509 certificate in PEM form, or — on systems where the OpenSSL ENGINE_pkcs11 is functional — a PKCS#11 URI as defined by RFC7512. In the latter case, the PKCS#11 URI should reference both a certificate and a private key. The configuration that was used to build kernel is available at `/boot/config-`. To check the configuration value for `CONFIG_MODULE_SIG_KEY`, run the following command: `grep CONFIG_MODULE_SIG_KEY /boot/config-` For each kernel installed, a line with value "`certs/signing_key.pem`" should be returned.	A key and certificate is required to sign the built modules.
CCE-90029-0	Require Re-Authentication When Using the sudo Command	The sudo `timestamp_timeout` tag sets the amount of time sudo password prompt waits. The default `timestamp_timeout` value is 5 minutes. The timestamp_timeout should be configured by making sure that the `timestamp_timeout` tag exists in `/etc/sudoers` configuration file or any sudo configuration snippets in `/etc/sudoers.d/`. If the value is set to an integer less than 0, the user's time stamp will not expire and the user will not have to re-authenticate for privileged actions until the user's session is terminated.	Without re-authentication, users may access resources or perform tasks for which they do not have authorization. When operating systems provide the capability to escalate a functional capability, it is critical that the user re-authenticate.
CCE-90061-3	Prevent non-Privileged Users from Modifying Network Interfaces using nmcli	By default, non-privileged users are given permissions to modify networking interfaces and configurations using the `nmcli` command. Non-privileged users should not be making configuration changes to network configurations. To ensure that non-privileged users do not have permissions to make changes to the network configuration using `nmcli`, create the following configuration in `/etc/polkit-1/localauthority/20-org.d/10-nm-harden-access.pkla`: [Disable General User Access to NetworkManager] Identity=default Action=org.freedesktop.NetworkManager.* ResultAny=no ResultInactive=no ResultActive=auth_admin	Allowing non-privileged users to make changes to network settings can allow untrusted access, prevent system availability, and/or can lead to a compromise or attack.
CCE-90085-2	Enforce usage of pam_wheel for su authentication	To ensure that only users who are members of the `wheel` group can run commands with altered privileges through the `su` command, make sure that the following line exists in the file `/etc/pam.d/su`: auth required pam_wheel.so use_uid	The `su` program allows to run commands with a substitute user and group ID. It is commonly used to run commands as the root user. Limiting access to such command is considered a good security practice.
CCE-90096-9	Assign Expiration Date to Temporary Accounts	Temporary accounts are established as part of normal account activation procedures when there is a need for short-term accounts. In the event temporary accounts are required, configure the system to terminate them after a documented time period. For every temporary account, run the following command to set an expiration date on it, substituting `USER` and `YYYY-MM-DD` appropriately: $ sudo chage -E YYYY-MM-DD USER `YYYY-MM-DD` indicates the documented expiration date for the account. For U.S. Government systems, the operating system must be configured to automatically terminate these types of accounts after a period of 72 hours.	If temporary user accounts remain active when no longer needed or for an excessive period, these accounts may be used to gain unauthorized access. To mitigate this risk, automated termination of all temporary accounts must be set upon account creation.
CCE-90125-6	Configure SSH Client to Use FIPS 140 Validated Ciphers: openssh.config	Crypto Policies provide a centralized control over crypto algorithms usage of many packages. OpenSSH is supported by system crypto policy, but the OpenSSH configuration may be set up incorrectly. To check that Crypto Policies settings for ciphers are configured correctly, ensure that `/etc/crypto-policies/back-ends/openssh.config` contains the following line and is not commented out: Ciphers `aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc,rijndael-cbc@lysator.liu.se`	Overriding the system crypto policy makes the behavior of the OpenSSH client violate expectations, and makes system configuration more fragmented. By specifying a cipher list with the order of ciphers being in a “strongest to weakest” orientation, the system will automatically attempt to use the strongest cipher for securing SSH connections.
CCE-90128-0	Disable GNOME3 Automount Opening	The system's default desktop environment, GNOME3, will mount devices and removable media (such as DVDs, CDs and USB flash drives) whenever they are inserted into the system. To disable automount-open within GNOME3, add or set `automount-open` to `false` in `/etc/dconf/db/local.d/00-security-settings`. For example: [org/gnome/desktop/media-handling] automount-open=false Once the settings have been added, add a lock to `/etc/dconf/db/local.d/locks/00-security-settings-lock` to prevent user modification. For example: /org/gnome/desktop/media-handling/automount-open After the settings have been set, run `dconf update`.	Automatically mounting file systems permits easy introduction of unknown devices, thereby facilitating malicious activity. Disabling automatic mounting in GNOME3 can prevent the introduction of malware via removable media. It will, however, also prevent desktop users from legitimate use of removable media.
CCE-90137-1	Ensure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly	The audit system should collect detailed unauthorized file accesses for all users and root. To correctly identify unsuccessful creation, unsuccessful modification and unsuccessful access of files via `openat` syscall the audit rules collecting these events need to be in certain order. The more specific rules need to come before the less specific rules. The reason for that is that more specific rules cover a subset of events covered in the less specific rules, thus, they need to come before to not be overshadowed by less specific rules, which match a bigger set of events. Make sure that rules for unsuccessful calls of `openat` syscall are in the order shown below. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), check the order of rules below in a file with suffix `.rules` in the directory `/etc/audit/rules.d`. If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, check the order of rules below in `/etc/audit/audit.rules` file. -a always,exit -F arch=b32 -S openat -F a2&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create -a always,exit -F arch=b32 -S openat -F a2&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-create -a always,exit -F arch=b32 -S openat -F a2&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification -a always,exit -F arch=b32 -S openat -F a2&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification -a always,exit -F arch=b32 -S openat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-access -a always,exit -F arch=b32 -S openat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-access If the system is 64 bit then also add the following lines: -a always,exit -F arch=b64 -S openat -F a2&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create -a always,exit -F arch=b64 -S openat -F a2&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-create -a always,exit -F arch=b64 -S openat -F a2&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification -a always,exit -F arch=b64 -S openat -F a2&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification -a always,exit -F arch=b64 -S openat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-access -a always,exit -F arch=b64 -S openat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-access	The more specific rules cover a subset of events covered by the less specific rules. By ordering them from more specific to less specific, it is assured that the less specific rule will not catch events better recorded by the more specific rule.
CCE-90144-7	Ensure /usr Located On Separate Partition	It is recommended that the `/usr` directory resides on a separate partition.	The `/usr` partition contains system software, utilities and files. Putting it on a separate partition allows limiting its size and applying restrictions through mount options.
CCE-90150-4	Ensure Users Cannot Change GNOME3 Screensaver Lock After Idle Period	If not already configured, ensure that users cannot change GNOME3 screensaver lock settings by adding /org/gnome/desktop/screensaver/lock-enabled to `/etc/dconf/db/local.d/locks/00-security-settings`. For example: /org/gnome/desktop/screensaver/lock-enabled After the settings have been set, run `dconf update`.	A session lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not want to logout because of the temporary nature of the absence.
CCE-90171-0	Configure the tmux Lock Command	To enable console screen locking in `tmux` terminal multiplexer, the `vlock` command must be configured to be used as a locking mechanism. Add the following line to `/etc/tmux.conf`: set -g lock-command vlock . The console can now be locked with the following key combination: ctrl+b :lock-session	The `tmux` package allows for a session lock to be implemented and configured. However, the session lock is implemented by an external command. The `tmux` default configuration does not contain an effective session lock.
CCE-90176-9	Ensure auditd Collects System Administrator Actions - /etc/sudoers	At a minimum, the audit system should collect administrator actions for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -w /etc/sudoers -p wa -k actions If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules`: -w /etc/sudoers -p wa -k actions	The actions taken by system administrators should be audited to keep a record of what was executed on the system, as well as, for accountability purposes. Editing the sudoers file may be sign of an attacker trying to establish persistent methods to a system, auditing the editing of the sudoers files mitigates this risk.
CCE-90187-6	Configure audispd's Plugin network_failure_action On Network Failure	Configure the action the operating system takes if there is an error sending audit records to a remote system. Edit the file `/etc/audit/audisp-remote.conf`. Add or modify the following line, substituting ACTION appropriately: network_failure_action = ACTION Set this value to `single` to cause the system to switch to single user mode for corrective action. Acceptable values also include `syslog` and `halt`. For certain systems, the need for availability outweighs the need to log all actions, and a different setting should be determined. This profile configures the action to be `single`.	Taking appropriate action when there is an error sending audit records to a remote system will minimize the possibility of losing audit records.
CCE-90191-8	Ensure Rsyslog Encrypts Off-Loaded Audit Records	Rsyslogd is a system utility providing support for message logging. Support for both internet and UNIX domain sockets enables this utility to support both local and remote logging. Couple this utility with `gnutls` (which is a secure communications library implementing the SSL, TLS and DTLS protocols), and you have a method to securely encrypt and off-load auditing. When using `rsyslogd` to off-load logs off a encryption system must be used. Set the following configuration option in /etc/rsyslog.conf or in a file in /etc/rsyslog.d (using legacy syntax): $ActionSendStreamDriverMode 1 Alternatively, use the RainerScript syntax: action(type="omfwd" ... StreamDriverMode="1")	The audit records generated by Rsyslog contain valuable information regarding system configuration, user authentication, and other such information. Audit records should be protected from unauthorized access.
CCE-90197-5	Disable SSH Forwarding	The DisableForwarding parameter disables all forwarding features, including X11, ssh-agent(1), TCP and StreamLocal. This option overrides all other forwarding-related options and may simplify restricted configurations. To explicitly disable SSHD forwarding, add or correct the following line in `/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf`: DisableForwarding yes	Disable ssh forwarding unless there is an operational requirement to use it. Leaving port forwarding enabled can expose the organization to security risks.
CCE-90208-0	Remove Host-Based Authentication Files	The `shosts.equiv` file lists remote hosts and users that are trusted by the local system. To remove these files, run the following command to delete them from any location: $ sudo rm /[path]/[to]/[file]/shosts.equiv	The shosts.equiv files are used to configure host-based authentication for the system via SSH. Host-based authentication is not sufficient for preventing unauthorized access to the system, as it does not require interactive identification and authentication of a connection request, or for the use of two-factor authentication.
CCE-90234-6	Configure Speculative Store Bypass Mitigation	Certain CPUs are vulnerable to an exploit against a common wide industry wide performance optimization known as Speculative Store Bypass (SSB). In such cases, recent stores to the same memory location cannot always be observed by later loads during speculative execution. However, such stores are unlikely and thus they can be detected prior to instruction retirement at the end of a particular speculation execution window. Since Linux Kernel 4.17 you can check the SSB mitigation state with the following command: `cat /sys/devices/system/cpu/vulnerabilities/spec_store_bypass` Select the appropriate SSB state by adding the argument `spec_store_bypass_disable=prctl` to the default GRUB 2 command line for the Linux operating system. To ensure that `spec_store_bypass_disable=prctl` is added as a kernel command line argument to newly installed kernels, add `spec_store_bypass_disable=prctl` to the default Grub2 command line for Linux operating systems. Modify the line within `/etc/default/grub` as shown below: GRUB_CMDLINE_LINUX="... spec_store_bypass_disable=`prctl` ..." Run the following command to update command line for already installed kernels: # grubby --update-kernel=ALL --args="spec_store_bypass_disable=`prctl`" If the system is distributed as a bootable container image, GRUB2 can't be configured using the method described above, but the following method needs to be used instead. The kernel arguments should be set in `/usr/lib/bootc/kargs.d` in a TOML file that has the following form: # /usr/lib/bootc/kargs.d/10-example.toml kargs = ["spec_store_bypass_disable=`prctl`"] For more details on configuring kernel arguments in bootable container images, please refer to Bootc documentation.	In vulnerable processors, the speculatively forwarded store can be used in a cache side channel attack. An example of this is reading memory to which the attacker does not directly have access, for example inside the sandboxed code.
CCE-90257-7	Disable GNOME3 Automount running	The system's default desktop environment, GNOME3, will mount devices and removable media (such as DVDs, CDs and USB flash drives) whenever they are inserted into the system. To disable autorun-never within GNOME3, add or set `autorun-never` to `true` in `/etc/dconf/db/local.d/00-security-settings`. For example: [org/gnome/desktop/media-handling] autorun-never=true Once the settings have been added, add a lock to `/etc/dconf/db/local.d/locks/00-security-settings-lock` to prevent user modification. For example: /org/gnome/desktop/media-handling/autorun-never After the settings have been set, run `dconf update`.	Automatically mounting file systems permits easy introduction of unknown devices, thereby facilitating malicious activity. Disabling automatic mount running in GNOME3 can prevent the introduction of malware via removable media. It will, however, also prevent desktop users from legitimate use of removable media.
CCE-90262-7	Ensure auditd Collects Information on the Use of Privileged Commands - kmod	At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -a always,exit -F path=/usr/bin/kmod -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`: -a always,exit -F path=/usr/bin/kmod -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged	Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter).
CCE-90271-8	Set SSH Client Alive Count Max to zero	The SSH server sends at most `ClientAliveCountMax` messages during a SSH session and waits for a response from the SSH client. The option `ClientAliveInterval` configures timeout after each `ClientAliveCountMax` message. If the SSH server does not receive a response from the client, then the connection is considered unresponsive and terminated. To ensure the SSH timeout occurs precisely when the `ClientAliveInterval` is set, set the `ClientAliveCountMax` to value of `0` in `/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf`:	This ensures a user login will be terminated as soon as the `ClientAliveInterval` is reached.
CCE-90286-6	Record Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE	The audit system should collect detailed unauthorized file accesses for all users and root. The `open_by_handle_at` syscall can be used to modify files if called for write operation of with O_TRUNC_WRITE flag. The following auidt rules will assure that unsuccessful attempts to modify a file via `open_by_handle_at` syscall are collected. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the rules below to a file with suffix `.rules` in the directory `/etc/audit/rules.d`. If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the rules below to `/etc/audit/audit.rules` file. -a always,exit -F arch=b32 -S open_by_handle_at -F a2&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification -a always,exit -F arch=b32 -S open_by_handle_at -F a2&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification If the system is 64 bit then also add the following lines: -a always,exit -F arch=b64 -S open_by_handle_at -F a2&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification -a always,exit -F arch=b64 -S open_by_handle_at -F a2&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification	Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing these events could serve as evidence of potential system compromise.
CCE-90308-8	Disable Ctrl-Alt-Del Burst Action	By default, `SystemD` will reboot the system if the `Ctrl-Alt-Del` key sequence is pressed Ctrl-Alt-Delete more than 7 times in 2 seconds. To configure the system to ignore the `CtrlAltDelBurstAction` setting, add or modify the following to `/etc/systemd/system.conf`: CtrlAltDelBurstAction=none	A locally logged-in user who presses Ctrl-Alt-Del, when at the console, can reboot the system. If accidentally pressed, as could happen in the case of mixed OS environment, this can create the risk of short-term loss of availability of systems due to unintentional reboot.
CCE-90319-5	Verify Any Configured IPSec Tunnel Connections	Libreswan provides an implementation of IPsec and IKE, which permits the creation of secure tunnels over untrusted networks. As such, IPsec can be used to circumvent certain network requirements such as filtering. Verify that if any IPsec connection (`conn`) configured in `/etc/ipsec.conf` and `/etc/ipsec.d` exists is an approved organizational connection.	IP tunneling mechanisms can be used to bypass network filtering.
CCE-90345-0	Enforce Spectre v2 mitigation	Spectre V2 is an indirect branch poisoning attack that can lead to data leakage. An exploit for Spectre V2 tricks the indirect branch predictor into executing code from a future indirect branch chosen by the attacker, even if the privilege level is different. Since Linux Kernel 4.15 you can check the Spectre V2 mitigation state with the following command: `cat /sys/devices/system/cpu/vulnerabilities/spectre_v2` Enforce the Spectre V2 mitigation by adding the argument `spectre_v2=on` to the default GRUB 2 command line for the Linux operating system. To ensure that `spectre_v2=on` is added as a kernel command line argument to newly installed kernels, add `spectre_v2=on` to the default Grub2 command line for Linux operating systems. Modify the line within `/etc/default/grub` as shown below: GRUB_CMDLINE_LINUX="... spectre_v2=on ..." Run the following command to update command line for already installed kernels: # grubby --update-kernel=ALL --args="spectre_v2=on" If the system is distributed as a bootable container image, GRUB2 can't be configured using the method described above, but the following method needs to be used instead. The kernel arguments should be set in `/usr/lib/bootc/kargs.d` in a TOML file that has the following form: # /usr/lib/bootc/kargs.d/10-example.toml kargs = ["spectre_v2=on"] For more details on configuring kernel arguments in bootable container images, please refer to Bootc documentation.	The Spectre V2 vulnerability allows an attacker to read memory that he should not have access to.
CCE-90365-8	Ensure the Default Umask is Set Correctly For Interactive Users	Remove the `UMASK` environment variable from all interactive users initialization files.	The umask controls the default access mode assigned to newly created files. A umask of 077 limits new files to mode 700 or less permissive. Although umask can be represented as a four-digit number, the first digit representing special access modes is typically ignored or required to be 0. This requirement applies to the globally configured system defaults and the local interactive user defaults for each account on the system.
CCE-90388-0	Record Any Attempts to Run ssh-agent	At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -a always,exit -F path=/usr/bin/ssh-agent -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`: -a always,exit -F path=/usr/bin/ssh-agent -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged	Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter).
CCE-90432-6	Verify Permissions on /etc/shells File	To properly set the permissions of `/etc/shells`, run the command: $ sudo chmod 0644 /etc/shells	The `/etc/shells` file contains the list of full pathnames to shells on the system. Since this file is used by many system programs this file should be protected.
CCE-90434-2	Verify Group Who Owns /etc/shells File	To properly set the group owner of `/etc/shells`, run the command: $ sudo chgrp root /etc/shells	The `/etc/shells` file contains the list of full pathnames to shells on the system. Since this file is used by many system programs this file should be protected.
CCE-90435-9	Verify Who Owns /etc/shells File	To properly set the owner of `/etc/shells`, run the command: $ sudo chown root /etc/shells	The `/etc/shells` file contains the list of full pathnames to shells on the system. Since this file is used by many system programs this file should be protected.
CCE-90456-5	Configure Microarchitectural Data Sampling mitigation	Microarchitectural Data Sampling (MDS) is a hardware vulnerability which allows unprivileged speculative access to data which is available in various CPU internal buffers. When performing store, load, L1 refill operations, processors write data into temporary microarchitectural structures (buffers), and the data in the buffer can be forwarded to load operations as an optimization. Under certain conditions, data unrelated to the load operations can be speculatively forwarded from the buffers to a disclosure gadget which allows in turn to infer the value via a cache side channel attack. Select the appropriate mitigation by adding the argument `mds=full` to the default GRUB 2 command line for the Linux operating system. To ensure that `mds=full` is added as a kernel command line argument to newly installed kernels, add `mds=full` to the default Grub2 command line for Linux operating systems. Modify the line within `/etc/default/grub` as shown below: GRUB_CMDLINE_LINUX="... mds=`full` ..." Run the following command to update command line for already installed kernels: # grubby --update-kernel=ALL --args="mds=`full`" If the system is distributed as a bootable container image, GRUB2 can't be configured using the method described above, but the following method needs to be used instead. The kernel arguments should be set in `/usr/lib/bootc/kargs.d` in a TOML file that has the following form: # /usr/lib/bootc/kargs.d/10-example.toml kargs = ["mds=`full`"] For more details on configuring kernel arguments in bootable container images, please refer to Bootc documentation. Not all processors are affected by all variants of MDS, but the mitigation mechanism is identical for all of them. Since Linux Kernel 5.2 you can check whether the system is vulnerable or mitigated with the following command: `cat /sys/devices/system/cpu/vulnerabilities/mds`	The MDS vulnerability allows an attacker to sample data from internal CPU buffers.
CCE-90482-1	Record Any Attempts to Run setfacl	At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -a always,exit -F path=/usr/bin/setfacl -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`: -a always,exit -F path=/usr/bin/setfacl -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged	Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter).
CCE-90516-6	System Audit Directories Must Be Group Owned By Root	All audit directories must be group owned by root user. By default, the path for audit log is /var/log/audit/ . To properly set the group owner of `/var/log/audit`, run the command: $ sudo chgrp root /var/log/audit If `log_group` in `/etc/audit/auditd.conf` is set to a group other than the `root` group account, change the group ownership of the audit directories to this specific group.	Unauthorized disclosure of audit records can reveal system and configuration data to attackers, thus compromising its confidentiality.
CCE-90560-4	Assign Expiration Date to Emergency Accounts	Emergency accounts are privileged accounts established in response to crisis situations where the need for rapid account activation is required. In the event emergency accounts are required, configure the system to terminate them after a documented time period. For every emergency account, run the following command to set an expiration date on it, substituting `ACCOUNT_NAME` and `YYYY-MM-DD` appropriately: $ sudo chage -E YYYY-MM-DD ACCOUNT_NAME `YYYY-MM-DD` indicates the documented expiration date for the account. For U.S. Government systems, the operating system must be configured to automatically terminate these types of accounts after a period of 72 hours.	If emergency user accounts remain active when no longer needed or for an excessive period, these accounts may be used to gain unauthorized access. To mitigate this risk, automated termination of all emergency accounts must be set upon account creation.
CCE-90566-1	SSHD Must Include System Crypto Policy Config File	SSHD should follow the system cryptographic policy. In order to accomplish this the SSHD configuration should include the configuration file provided by the system crypto policy. The following line should be present in `/etc/ssh/sshd_config` or in a file included by this file (a file within the `/etc/ssh/sshd_config.d` directory): Include /etc/crypto-policies/back-ends/opensshserver.config	Without cryptographic integrity protections, information can be altered by unauthorized users without detection.
CCE-90567-9	Configure the confidence in TPM for entropy	The TPM security chip that is available in most modern systems has a hardware RNG. It is also used to feed the entropy pool, but generally not credited entropy. Use `rng_core.default_quality` in the kernel command line to set the trust level on the hardware generators. The trust level defines the amount of entropy to credit. A value of `0` tells the system not to trust the hardware random number generators available, and doesn't credit any entropy to the pool. A value of `1000` assigns full confidence in the generators, and credits all the entropy it provides to the pool. Note that the value of `rng_core.default_quality` is global, affecting the trust on all hardware random number generators. Select the appropriate confidence by adding the argument `rng_core.default_quality=500` to the default GRUB 2 command line for the Linux operating system. To ensure that `rng_core.default_quality=500` is added as a kernel command line argument to newly installed kernels, add `rng_core.default_quality=500` to the default Grub2 command line for Linux operating systems. Modify the line within `/etc/default/grub` as shown below: GRUB_CMDLINE_LINUX="... rng_core.default_quality=`500` ..." Run the following command to update command line for already installed kernels: # grubby --update-kernel=ALL --args="rng_core.default_quality=`500`" If the system is distributed as a bootable container image, GRUB2 can't be configured using the method described above, but the following method needs to be used instead. The kernel arguments should be set in `/usr/lib/bootc/kargs.d` in a TOML file that has the following form: # /usr/lib/bootc/kargs.d/10-example.toml kargs = ["rng_core.default_quality=`500`"] For more details on configuring kernel arguments in bootable container images, please refer to Bootc documentation.	A system may struggle to initialize its entropy pool and end up starving. Crediting entropy from the hardware number generators available in the system helps fill up the entropy pool.
CCE-90569-5	Record Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE	The audit system should collect detailed unauthorized file accesses for all users and root. The `open` syscall can be used to modify files if called for write operation of with O_TRUNC_WRITE flag. The following auidt rules will assure that unsuccessful attempts to modify a file via `open` syscall are collected. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the rules below to a file with suffix `.rules` in the directory `/etc/audit/rules.d`. If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the rules below to `/etc/audit/audit.rules` file. -a always,exit -F arch=b32 -S open -F a1&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification -a always,exit -F arch=b32 -S open -F a1&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification If the system is 64 bit then also add the following lines: -a always,exit -F arch=b64 -S open -F a1&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification -a always,exit -F arch=b64 -S open -F a1&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification	Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing these events could serve as evidence of potential system compromise.
CCE-90586-9	Support session locking with tmux	The `tmux` terminal multiplexer is used to implement automatic session locking. It should be started from `/etc/bashrc` or drop-in files within `/etc/profile.d/`.	Unlike `bash` itself, the `tmux` terminal multiplexer provides a mechanism to lock sessions after period of inactivity. A session lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not want to log out because of the temporary nature of the absence.
CCE-90590-1	Set Password Hashing Algorithm in /etc/login.defs	In `/etc/login.defs`, add or update the following line to ensure the system will use `SHA512` as the hashing algorithm: ENCRYPT_METHOD `SHA512`	Passwords need to be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. Passwords that are encrypted with a weak algorithm are no more protected than if they are kept in plain text. Using a stronger hashing algorithm makes password cracking attacks more difficult.
CCE-90607-3	Ensure network interfaces are assigned to appropriate zone	Firewall zones define the trust level of network connections or interfaces. Note: Changing firewall settings while connected over network can result in being locked out of the system.	A network interface not assigned to the appropriate zone can allow unexpected or undesired network traffic to be accepted on the interface.
CCE-90724-6	Disable debug-shell SystemD Service	SystemD's `debug-shell` service is intended to diagnose SystemD related boot issues with various `systemctl` commands. Once enabled and following a system reboot, the root shell will be available on `tty9` which is access by pressing `CTRL-ALT-F9`. The `debug-shell` service should only be used for SystemD related issues and should otherwise be disabled. By default, the `debug-shell` SystemD service is already disabled. The `debug-shell` service can be disabled with the following command: $ sudo systemctl mask --now debug-shell.service	This prevents attackers with physical access from trivially bypassing security on the machine through valid troubleshooting configurations and gaining root access when the system is rebooted.
CCE-90726-1	Avoid using remember in pam_unix module	The `remember` option stores the last n passwords for each user in `/etc/security/opasswd`, enforcing password history and preventing users from reusing the same passwords. However, this feature relies on the MD5 password hash algorithm, which is less secure. Instead, the `pam_pwhistory` module should be used. This module also stores the last n passwords in `/etc/security/opasswd` and it uses the password hash algorithm configured in the pam_unix module, such as yescrypt or SHA512, offering enhanced security. The `remember` option should be removed from the PAM configuration in `/etc/pam.d/system-auth` and `/etc/pam.d/password-auth` files.	Removing the `remember` argument ensures the use of a stronger password hashing algorithm. A more robust hash algorithm increases the difficulty for attackers to crack stored passwords in `/etc/security/opasswd`, thereby improving system security and protecting user credentials.
CCE-90727-9	Disable Kernel iwlmvm Module	To configure the system to prevent the `iwlmvm` kernel module from being loaded, add the following line to the file `/etc/modprobe.d/iwlmvm.conf`: install iwlmvm /bin/false This entry will cause a non-zero return value during a `iwlmvm` module installation and additionally convey the meaning of the entry to the user in form of an error message. If you would like to omit a non-zero return value and an error message, you may want to add a different line instead (both `/bin/true` and `/bin/false` are allowed by OVAL and will be accepted by the scan): install iwlmvm /bin/true	If Wireless functionality must be disabled, preventing the kernel from loading the kernel module provides an additional safeguard against its activation.
CCE-90736-0	Ensure tftp Daemon Uses Secure Mode	If running the Trivial File Transfer Protocol (TFTP) service is necessary, it should be configured to change its root directory at startup. To do so, find the path for the `tftp` systemd service: $ sudo systemctl show tftp \| grep FragmentPath= FragmentPath=/etc/systemd/system/tftp.service and ensure the `ExecStart` line on that file includes the `-s` option with a subdirectory: ExecStart=/usr/sbin/in.tftpd -s `/var/lib/tftpboot`	Using the `-s` option causes the TFTP service to only serve files from the given directory. Serving files from an intentionally-specified directory reduces the risk of sharing files which should remain private.
CCE-90754-3	Record Unsuccessful Delete Attempts to Files - unlinkat	The audit system should collect unsuccessful file deletion attempts for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`. If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file. -a always,exit -F arch=b32 -S unlinkat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete -a always,exit -F arch=b32 -S unlinkat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete If the system is 64 bit then also add the following lines: -a always,exit -F arch=b64 -S unlinkat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete -a always,exit -F arch=b64 -S unlinkat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete	Unsuccessful attempts to delete files could be an indicator of malicious activity on a system. Auditing these events could serve as evidence of potential system compromise.
CCE-90764-2	Disable IPv6 Addressing on IPv6 Interfaces by Default	To disable support for (`ipv6`) addressing on interfaces by default add the following line to `/etc/sysctl.d/ipv6.conf` (or another file in `/etc/sysctl.d`): net.ipv6.conf.default.disable_ipv6 = 1 This disables IPv6 on network interfaces by default as other services and system functionality require the IPv6 stack loaded to work.	Any unnecessary network stacks - including IPv6 - should be disabled, to reduce the vulnerability to exploitation.
CCE-90785-7	Configure Logind to terminate idle sessions after certain time of inactivity	To configure `logind` service to terminate inactive user sessions after `300` seconds, edit the file `/etc/systemd/logind.conf`. Ensure that there is a section [Login] which contains the configuration StopIdleSessionSec=`300` .	Terminating an idle session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled on the console or console port that has been let unattended.
CCE-90786-5	Perform general configuration of Audit for OSPP (ppc64le)	Configure some basic `Audit` parameters specific for OSPP profile. In particular, configure `Audit` to watch for direct modification of files storing system user and group information, and usage of applications with special rights which can change system configuration. Further audited events include access to audit log it self, attempts to Alter Process and Session Initiation Information, and attempts to modify MAC controls. The following rules configure audit as described above: ## The purpose of these rules is to meet the requirements for Operating ## System Protection Profile (OSPP)v4.2. These rules depends on having ## the following rule files copied to /etc/audit/rules.d: ## ## 10-base-config.rules, 11-loginuid.rules, ## 30-ospp-v42-1-create-failed.rules, 30-ospp-v42-1-create-success.rules, ## 30-ospp-v42-2-modify-failed.rules, 30-ospp-v42-2-modify-success.rules, ## 30-ospp-v42-3-access-failed.rules, 30-ospp-v42-3-access-success.rules, ## 30-ospp-v42-4-delete-failed.rules, 30-ospp-v42-4-delete-success.rules, ## 30-ospp-v42-5-perm-change-failed.rules, ## 30-ospp-v42-5-perm-change-success.rules, ## 30-ospp-v42-6-owner-change-failed.rules, ## 30-ospp-v42-6-owner-change-success.rules ## ## original copies may be found in /usr/share/audit/sample-rules/ ## User add delete modify. This is covered by pam. However, someone could ## open a file and directly create or modify a user, so we'll watch passwd and ## shadow for writes -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=user-modify -a always,exit -F arch=b64 -S open -F a1&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=user-modify -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify -a always,exit -F arch=b64 -S open -F a1&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify ## User enable and disable. This is entirely handled by pam. ## Group add delete modify. This is covered by pam. However, someone could ## open a file and directly create or modify a user, so we'll watch group and ## gshadow for writes -a always,exit -F arch=b64 -F path=/etc/passwd -F perm=wa -F auid>=1000 -F auid!=unset -F key=user-modify -a always,exit -F arch=b64 -F path=/etc/shadow -F perm=wa -F auid>=1000 -F auid!=unset -F key=user-modify -a always,exit -F arch=b64 -F path=/etc/group -F perm=wa -F auid>=1000 -F auid!=unset -F key=group-modify -a always,exit -F arch=b64 -F path=/etc/gshadow -F perm=wa -F auid>=1000 -F auid!=unset -F key=group-modify ## Use of special rights for config changes. This would be use of setuid ## programs that relate to user accts. This is not all setuid apps because ## requirements are only for ones that affect system configuration. -a always,exit -F arch=b64 -F path=/usr/sbin/unix_chkpwd -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F arch=b64 -F path=/usr/sbin/usernetctl -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F arch=b64 -F path=/usr/sbin/userhelper -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F arch=b64 -F path=/usr/sbin/seunshare -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F arch=b64 -F path=/usr/bin/mount -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F arch=b64 -F path=/usr/bin/newgrp -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F arch=b64 -F path=/usr/bin/newuidmap -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F arch=b64 -F path=/usr/bin/gpasswd -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F arch=b64 -F path=/usr/bin/newgidmap -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F arch=b64 -F path=/usr/bin/umount -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F arch=b64 -F path=/usr/bin/passwd -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F arch=b64 -F path=/usr/bin/crontab -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F arch=b64 -F path=/usr/bin/at -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F arch=b64 -F path=/usr/sbin/grub2-set-bootflag -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes ## Privilege escalation via su or sudo. This is entirely handled by pam. ## Special case for systemd-run. It is not audit aware, specifically watch it -a always,exit -F arch=b64 -F path=/usr/bin/systemd-run -F perm=x -F auid!=unset -F key=maybe-escalation ## Special case for pkexec. It is not audit aware, specifically watch it -a always,exit -F arch=b64 -F path=/usr/bin/pkexec -F perm=x -F key=maybe-escalation ## Watch for configuration changes to privilege escalation. -a always,exit -F arch=b64 -F path=/etc/sudoers -F perm=wa -F key=special-config-changes -a always,exit -F arch=b64 -F dir=/etc/sudoers.d/ -F perm=wa -F key=special-config-changes ## Audit log access -a always,exit -F arch=b64 -F dir=/var/log/audit/ -F perm=r -F auid>=1000 -F auid!=unset -F key=access-audit-trail ## Attempts to Alter Process and Session Initiation Information -a always,exit -F arch=b64 -F path=/var/run/utmp -F perm=wa -F auid>=1000 -F auid!=unset -F key=session -a always,exit -F arch=b64 -F path=/var/log/btmp -F perm=wa -F auid>=1000 -F auid!=unset -F key=session -a always,exit -F arch=b64 -F path=/var/log/wtmp -F perm=wa -F auid>=1000 -F auid!=unset -F key=session ## Attempts to modify MAC controls -a always,exit -F arch=b64 -F dir=/etc/selinux/ -F perm=wa -F auid>=1000 -F auid!=unset -F key=MAC-policy ## Software updates. This is entirely handled by rpm. ## System start and shutdown. This is entirely handled by systemd ## Kernel Module loading. This is handled in 43-module-load.rules ## Application invocation. The requirements list an optional requirement ## FPT_SRP_EXT.1 Software Restriction Policies. This event is intended to ## state results from that policy. This would be handled entirely by ## that daemon. Load new Audit rules into kernel by running: augenrules --load Note: This rule uses a special set of Audit rules to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are aligned with your needs.	Auditing of events listed in the description provides data for monitoring and investigation of potentially malicious events e.g. tampering with `Audit` logs, malicious access to files storing information about system users and groups etc.
CCE-90787-3	Configure auditing of unsuccessful file deletions (ppc64le)	Ensure that unsuccessful attempts to delete a file are audited. The following rules configure audit as described above: ## Unsuccessful file delete -a always,exit -F arch=b64 -S unlink,unlinkat,rename,renameat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete -a always,exit -F arch=b64 -S unlink,unlinkat,rename,renameat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete Load new Audit rules into kernel by running: augenrules --load Note: This rule uses a special set of Audit rules to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are aligned with your needs.	Unsuccessful attempts to delete a file might be signs of malicious activities. Auditing of such events help in monitoring and investigating of such activities.
CCE-90788-1	Configure auditing of loading and unloading of kernel modules (ppc64le)	Ensure that loading and unloading of kernel modules is audited. The following rules configure audit as described above: ## These rules watch for kernel module insertion. By monitoring ## the syscall, we do not need any watches on programs. -a always,exit -F arch=b64 -S init_module,finit_module -F key=module-load -a always,exit -F arch=b64 -S delete_module -F key=module-unload Load new Audit rules into kernel by running: augenrules --load	Loading of a malicious kernel module introduces a risk to the system, as the module has access to sensitive data and perform actions at the operating system kernel level. Having such events audited helps in monitoring and investigating of malicious activities.
CCE-90789-9	Configure auditing of successful file deletions (ppc64le)	Ensure that successful attempts to delete a file are audited. The following rules configure audit as described above: ## Successful file delete -a always,exit -F arch=b64 -S unlink,unlinkat,rename,renameat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-delete Load new Audit rules into kernel by running: augenrules --load Note: This rule uses a special set of Audit rules to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are aligned with your needs.	Auditing of successful attempts to delete a file may help in monitoring and investigation of activities performed on the system.
CCE-90790-7	Configure auditing of unsuccessful file modifications (ppc64le)	Ensure that unsuccessful attempts to modify a file are audited. The following rules configure audit as described above: ## Unsuccessful file modifications (open for write or truncate) -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification -a always,exit -F arch=b64 -S open -F a1&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification -a always,exit -F arch=b64 -S truncate,ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification -a always,exit -F arch=b64 -S open -F a1&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification -a always,exit -F arch=b64 -S truncate,ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification Load new Audit rules into kernel by running: augenrules --load Note: This rule uses a special set of Audit rules to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are aligned with your needs.	Unsuccessful file modifications might be a sign of a malicious action being performed on the system. Auditing of such events helps in detection and investigation of such actions.
CCE-90791-5	Configure auditing of successful file modifications (ppc64le)	Ensure that successful attempts to modify a file are audited. The following rules configure audit as described above: ## Successful file modifications (open for write or truncate) -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&01003 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-modification -a always,exit -F arch=b64 -S open -F a1&01003 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-modification -a always,exit -F arch=b64 -S truncate,ftruncate -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-modification Load new Audit rules into kernel by running: augenrules --load Note: This rule uses a special set of Audit rules to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are aligned with your needs.	Auditing of successful attempts to modify a file helps in investigation of actions which happened on the system.
CCE-90795-6	Disable the CUPS Service	The `cups` service can be disabled with the following command: $ sudo systemctl mask --now cups.service	Turn off unneeded services to reduce attack surface.
CCE-90796-4	Disable SSH Support for User Known Hosts	SSH can allow system users to connect to systems if a cache of the remote systems public keys is available. This should be disabled. To ensure this behavior is disabled, add or correct the following line in `/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf`: IgnoreUserKnownHosts yes	Configuring this setting for the SSH daemon provides additional assurance that remote login via SSH will require a password, even in the event of misconfiguration elsewhere.
CCE-90797-2	Disable SSH Support for .rhosts Files	SSH can emulate the behavior of the obsolete rsh command in allowing users to enable insecure access to their accounts via `.rhosts` files. The default SSH configuration disables support for `.rhosts`. The appropriate configuration is used if no value is set for `IgnoreRhosts`. To explicitly disable support for .rhosts files, add or correct the following line in `/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf`: IgnoreRhosts yes	SSH trust relationships mean a compromise on one host can allow an attacker to move trivially to other hosts.
CCE-90798-0	Disable X11 Forwarding	The X11Forwarding parameter provides the ability to tunnel X11 traffic through the connection to enable remote graphic connections. SSH has the capability to encrypt remote X11 connections when SSH's `X11Forwarding` option is enabled. The default SSH configuration disables X11Forwarding. The appropriate configuration is used if no value is set for `X11Forwarding`. To explicitly disable X11 Forwarding, add or correct the following line in `/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf`: X11Forwarding no	Disable X11 forwarding unless there is an operational requirement to use X11 applications directly. There is a small risk that the remote X11 servers of users who are logged in via SSH with X11 forwarding could be compromised by other users on the X11 server. Note that even if X11 forwarding is disabled, users can always install their own forwarders.
CCE-90799-8	Disable SSH Access via Empty Passwords	Disallow SSH login with empty passwords. The default SSH configuration disables logins with empty passwords. The appropriate configuration is used if no value is set for `PermitEmptyPasswords`. To explicitly disallow SSH login from accounts with empty passwords, add or correct the following line in `/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf`: PermitEmptyPasswords no Any accounts with empty passwords should be disabled immediately, and PAM configuration should prevent users from being able to assign themselves empty passwords.	Configuring this setting for the SSH daemon provides additional assurance that remote login via SSH will require a password, even in the event of misconfiguration elsewhere.
CCE-90800-4	Disable SSH Root Login	The root user should never be allowed to login to a system directly over a network. To disable root login via SSH, add or correct the following line in `/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf`: PermitRootLogin no	Even though the communications channel may be encrypted, an additional layer of security is gained by extending the policy of not logging directly on as root. In addition, logging in with a user-specific account provides individual accountability of actions performed on the system and also helps to minimize direct attack attempts on root's password.
CCE-90801-2	Disable Compression Or Set Compression to delayed	Compression is useful for slow network connections over long distances but can cause performance issues on local LANs. If use of compression is required, it should be enabled only after a user has authenticated; otherwise, it should be disabled. To disable compression or delay compression until after a user has successfully authenticated, add or correct the following line in the `/etc/ssh/sshd_config` file: Compression `no`	If compression is allowed in an SSH connection prior to authentication, vulnerabilities in the compression software could result in compromise of the system from an unauthenticated connection, potentially with root privileges.
CCE-90802-0	Disable Kerberos Authentication	Unless needed, SSH should not permit extraneous or unnecessary authentication mechanisms like Kerberos. The default SSH configuration disallows authentication validation through Kerberos. The appropriate configuration is used if no value is set for `KerberosAuthentication`. To explicitly disable Kerberos authentication, add or correct the following line in `/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf`: KerberosAuthentication no	Kerberos authentication for SSH is often implemented using GSSAPI. If Kerberos is enabled through SSH, the SSH daemon provides a means of access to the system's Kerberos implementation. Configuring these settings for the SSH daemon provides additional assurance that remote logon via SSH will not use unused methods of authentication, even in the event of misconfiguration elsewhere.
CCE-90803-8	Do Not Allow SSH Environment Options	Ensure that users are not able to override environment variables of the SSH daemon. The default SSH configuration disables environment processing. The appropriate configuration is used if no value is set for `PermitUserEnvironment`. To explicitly disable Environment options, add or correct the following `/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf`: PermitUserEnvironment no	SSH environment options potentially allow users to bypass access restriction in some configurations.
CCE-90804-6	Enable SSH Print Last Log	Ensure that SSH will display the date and time of the last successful account logon. The default SSH configuration enables print of the date and time of the last login. The appropriate configuration is used if no value is set for `PrintLastLog`. To explicitly enable LastLog in SSH, add or correct the following line in `/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf`: PrintLastLog yes	Providing users feedback on when account accesses last occurred facilitates user recognition and reporting of unauthorized account use.
CCE-90805-3	Set SSH Client Alive Count Max	The SSH server sends at most `ClientAliveCountMax` messages during a SSH session and waits for a response from the SSH client. The option `ClientAliveInterval` configures timeout after each `ClientAliveCountMax` message. If the SSH server does not receive a response from the client, then the connection is considered unresponsive and terminated. For SSH earlier than v8.2, a `ClientAliveCountMax` value of `0` causes a timeout precisely when the `ClientAliveInterval` is set. Starting with v8.2, a value of `0` disables the timeout functionality completely. If the option is set to a number greater than `0`, then the session will be disconnected after `ClientAliveInterval * ClientAliveCountMax` seconds without receiving a keep alive message.	This ensures a user login will be terminated as soon as the `ClientAliveInterval` is reached.
CCE-90806-1	Disable SSH TCP Forwarding	The `AllowTcpForwarding` parameter specifies whether TCP forwarding is permitted. To disable TCP forwarding, add or correct the following line in `/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf`: AllowTcpForwarding no	Leaving port forwarding enabled can expose the organization to security risks and back-doors.
CCE-90807-9	Enable SSH Warning Banner	To enable the warning banner and ensure it is consistent across the system, add or correct the following line in `/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf`: Banner /etc/issue Another section contains information on how to create an appropriate system-wide warning banner.	The warning message reinforces policy awareness during the logon process and facilitates possible legal action against attackers. Alternatively, systems whose ownership should not be obvious should ensure usage of a banner that does not provide easy attribution.
CCE-90808-7	Disable GSSAPI Authentication	Unless needed, SSH should not permit extraneous or unnecessary authentication mechanisms like GSSAPI. The default SSH configuration disallows authentications based on GSSAPI. The appropriate configuration is used if no value is set for `GSSAPIAuthentication`. To explicitly disable GSSAPI authentication, add or correct the following line in `/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf`: GSSAPIAuthentication no	GSSAPI authentication is used to provide additional authentication mechanisms to applications. Allowing GSSAPI authentication through SSH exposes the system's GSSAPI to remote hosts, increasing the attack surface of the system.
CCE-90809-5	Enable Use of Strict Mode Checking	SSHs `StrictModes` option checks file and ownership permissions in the user's home directory `.ssh` folder before accepting login. If world- writable permissions are found, logon is rejected. The default SSH configuration has `StrictModes` enabled. The appropriate configuration is used if no value is set for `StrictModes`. To explicitly enable `StrictModes` in SSH, add or correct the following line in `/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf`: StrictModes yes	If other users have access to modify user-specific SSH configuration files, they may be able to log into the system as another user.
CCE-90810-3	Set SSH authentication attempt limit	The `MaxAuthTries` parameter specifies the maximum number of authentication attempts permitted per connection. Once the number of failures reaches half this value, additional failures are logged. to set MaxAUthTries edit `/etc/ssh/sshd_config` as follows: MaxAuthTries `4`	Setting the MaxAuthTries parameter to a low number will minimize the risk of successful brute force attacks to the SSH server.
CCE-90811-1	Set SSH Client Alive Interval	SSH allows administrators to set a network responsiveness timeout interval. After this interval has passed, the unresponsive client will be automatically logged out. To set this timeout interval, edit the following line in `/etc/ssh/sshd_config` as follows: ClientAliveInterval `300` The timeout interval is given in seconds. For example, have a timeout of 10 minutes, set interval to 600. If a shorter timeout has already been set for the login shell, that value will preempt any SSH setting made in `/etc/ssh/sshd_config`. Keep in mind that some processes may stop SSH from correctly detecting that the user is idle.	Terminating an idle ssh session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled on the console or console port that has been let unattended.
CCE-90812-9	Allow Only SSH Protocol 2	Only SSH protocol version 2 connections should be permitted. The default setting in `/etc/ssh/sshd_config` is correct, and can be verified by ensuring that the following line appears: Protocol 2	SSH protocol version 1 is an insecure implementation of the SSH protocol and has many well-known vulnerability exploits. Exploits of the SSH daemon could provide immediate root access to the system.
CCE-90813-7	Set LogLevel to INFO	The INFO parameter specifies that record login and logout activity will be logged. The default SSH configuration sets the log level to INFO. The appropriate configuration is used if no value is set for `LogLevel`. To explicitly specify the log level in SSH, add or correct the following line in `/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf`: LogLevel INFO	SSH provides several logging levels with varying amounts of verbosity. `DEBUG` is specifically not recommended other than strictly for debugging SSH communications since it provides so much data that it is difficult to identify important security information. `INFO` level is the basic level that only records login activity of SSH users. In many situations, such as Incident Response, it is important to determine when a particular user was active on a system. The logout record can eliminate those users who disconnected, which helps narrow the field.
CCE-90814-5	Configure auditing of loading and unloading of kernel modules	Ensure that loading and unloading of kernel modules is audited. The following rules configure audit as described above: ## These rules watch for kernel module insertion. By monitoring ## the syscall, we do not need any watches on programs. -a always,exit -F arch=b32 -S init_module,finit_module -F key=module-load -a always,exit -F arch=b64 -S init_module,finit_module -F key=module-load -a always,exit -F arch=b32 -S delete_module -F key=module-unload -a always,exit -F arch=b64 -S delete_module -F key=module-unload Load new Audit rules into kernel by running: augenrules --load	Loading of a malicious kernel module introduces a risk to the system, as the module has access to sensitive data and perform actions at the operating system kernel level. Having such events audited helps in monitoring and investigating of malicious activities.
CCE-90815-2	Force frequent session key renegotiation	The `RekeyLimit` parameter specifies how often the session key of the is renegotiated, both in terms of amount of data that may be transmitted and the time elapsed. To decrease the default limits, add or correct the following line in `/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf`: RekeyLimit `512M` `1h`	By decreasing the limit based on the amount of data and enabling time-based limit, effects of potential attacks against encryption keys are limited.
CCE-90816-0	Disable Host-Based Authentication	SSH's cryptographic host-based authentication is more secure than `.rhosts` authentication. However, it is not recommended that hosts unilaterally trust one another, even within an organization. The default SSH configuration disables host-based authentication. The appropriate configuration is used if no value is set for `HostbasedAuthentication`. To explicitly disable host-based authentication, add or correct the following line in `/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf`: HostbasedAuthentication no	SSH trust relationships mean a compromise on one host can allow an attacker to move trivially to other hosts.
CCE-90817-8	Verify Group Who Owns SSH Server config file	To properly set the group owner of `/etc/ssh/sshd_config`, run the command: $ sudo chgrp root /etc/ssh/sshd_config	Service configuration files enable or disable features of their respective services that if configured incorrectly can lead to insecure and vulnerable configurations. Therefore, service configuration files should be owned by the correct group to prevent unauthorized changes.
CCE-90818-6	Verify Permissions on SSH Server config file	To properly set the permissions of `/etc/ssh/sshd_config`, run the command: $ sudo chmod 0600 /etc/ssh/sshd_config	Service configuration files enable or disable features of their respective services that if configured incorrectly can lead to insecure and vulnerable configurations. Therefore, service configuration files should be owned by the correct group to prevent unauthorized changes.
CCE-90819-4	Verify Permissions on SSH Server Public *.pub Key Files	To properly set the permissions of `/etc/ssh/.pub`, run the command: $ sudo chmod 0644 /etc/ssh/.pub	If a public host key file is modified by an unauthorized user, the SSH service may be compromised.
CCE-90820-2	Verify Permissions on SSH Server Private *_key Key Files	SSH server private keys - files that match the `/etc/ssh/*_key` glob, have to have restricted permissions. If those files are owned by the `root` user and the `root` group, they have to have the `0600` permission or stricter. If they are owned by the `root` user, but by a dedicated group `ssh_keys`, they can have the `0640` permission or stricter.	If an unauthorized user obtains the private SSH host key file, the host could be impersonated.
CCE-90821-0	Verify Owner on SSH Server config file	To properly set the owner of `/etc/ssh/sshd_config`, run the command: $ sudo chown root /etc/ssh/sshd_config	Service configuration files enable or disable features of their respective services that if configured incorrectly can lead to insecure and vulnerable configurations. Therefore, service configuration files should be owned by the correct group to prevent unauthorized changes.
CCE-90822-8	Enable the OpenSSH Service	The SSH server service, sshd, is commonly needed. The `sshd` service can be enabled with the following command: $ sudo systemctl enable sshd.service	Without protection of the transmitted information, confidentiality, and integrity may be compromised because unprotected communications can be intercepted and either read or altered. This checklist item applies to both internal and external networks and all types of information system components from which information can be transmitted (e.g., servers, mobile devices, notebook computers, printers, copiers, scanners, etc). Communication paths outside the physical protection of a controlled boundary are exposed to the possibility of interception and modification.
CCE-90823-6	Install the OpenSSH Server Package	The `openssh-server` package should be installed. The `openssh-server` package can be installed with the following command: $ sudo dnf install openssh-server	Without protection of the transmitted information, confidentiality, and integrity may be compromised because unprotected communications can be intercepted and either read or altered.
CCE-90824-4	Disable Avahi Server Software	The `avahi-daemon` service can be disabled with the following command: $ sudo systemctl mask --now avahi-daemon.service	Because the Avahi daemon service keeps an open network port, it is subject to network attacks. Its functionality is convenient but is only appropriate if the local network can be trusted.
CCE-90825-1	Disable Postfix Network Listening	Edit the file `/etc/postfix/main.cf` to ensure that only the following `inet_interfaces` line appears: inet_interfaces = `loopback-only`	This ensures `postfix` accepts mail messages (such as cron job reports) from the local system only, and not from the network, which protects it from network attack.
CCE-90826-9	Configure System to Forward All Mail For The Root Account	Make sure that mails delivered to root user are forwarded to a monitored email address. Make sure that the address `change_me@localhost` is a valid email address reachable from the system in question. Use the following command to configure the alias: $ sudo echo "root: `change_me@localhost`" >> /etc/aliases $ sudo newaliases	A number of system services utilize email messages sent to the root user to notify system administrators of active or impending issues. These messages must be forwarded to at least one monitored email address.
CCE-90827-7	Configure Polyinstantiation of /tmp Directories	To configure polyinstantiated /tmp directories, first create the parent directories which will hold the polyinstantiation child directories. Use the following command: $ sudo mkdir --mode 000 /tmp/tmp-inst Then, add the following entry to `/etc/security/namespace.conf`: /tmp /tmp/tmp-inst/ level root,adm	Polyinstantiation of temporary directories is a proactive security measure which reduces chances of attacks that are made possible by /tmp directories being world-writable.
CCE-90828-5	Ensure the Default Umask is Set Correctly in /etc/profile	To ensure the default umask controlled by `/etc/profile` is set properly, add or correct the `umask` setting in `/etc/profile` to read as follows: umask `027` Note that `/etc/profile` also reads scripts within `/etc/profile.d` directory. These scripts are also valid files to set umask value. Therefore, they should also be considered during the check and properly remediated, if necessary.	The umask value influences the permissions assigned to files when they are created. A misconfigured umask value could result in files with excessive permissions that can be read or written to by unauthorized users.
CCE-90829-3	Enable auditd Service	The `auditd` service is an essential userspace component of the Linux Auditing System, as it is responsible for writing audit records to disk. The `auditd` service can be enabled with the following command: $ sudo systemctl enable auditd.service	Without establishing what type of events occurred, it would be difficult to establish, correlate, and investigate the events leading up to an outage or attack. Ensuring the `auditd` service is active ensures audit records generated by the kernel are appropriately recorded. Additionally, a properly configured audit subsystem ensures that actions of individual system users can be uniquely traced to those users so they can be held accountable for their actions.
CCE-90830-1	Uninstall Sendmail Package	Sendmail is not the default mail transfer agent and is not installed by default. The `sendmail` package can be removed with the following command: $ sudo dnf remove sendmail	The sendmail software was not developed with security in mind and its design prevents it from being effectively contained by SELinux. Postfix should be used instead.
CCE-90831-9	Ensure LDAP client is not installed	The Lightweight Directory Access Protocol (LDAP) is a service that provides a method for looking up information from a central database. The `openldap-clients` package can be removed with the following command: $ sudo dnf remove openldap-clients	If the system does not need to act as an LDAP client, it is recommended that the software is removed to reduce the potential attack surface.
CCE-90832-7	Disable snmpd Service	The `snmpd` service can be disabled with the following command: $ sudo systemctl mask --now snmpd.service	Running SNMP software provides a network-based avenue of attack, and should be disabled if not needed.
CCE-90833-5	Verify firewalld Enabled	The `firewalld` service can be enabled with the following command: $ sudo systemctl enable firewalld.service	Access control methods provide the ability to enhance system security posture by restricting services and known good IP addresses and address ranges. This prevents connections from unknown hosts and protocols.
CCE-90834-3	Set Kernel Parameter to Increase Local Port Range	To set the runtime status of the `net.ipv4.ip_local_port_range` kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.ip_local_port_range=32768 65535 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: net.ipv4.ip_local_port_range = 32768 65535	This setting defines the local port range that is used by TCP and UDP to choose the local port. The first number is the first, the second the last local port number.
CCE-90835-0	Ensure auditd Collects Information on Kernel Module Loading - init_module	To capture kernel module loading and unloading events, use the following line, setting ARCH to either b32 for 32-bit system, or having two lines for both b32 and b64 in case your system is 64-bit: -a always,exit -F arch=ARCH -S init_module -F auid>=1000 -F auid!=unset -F key=modules Place to add the line depends on a way `auditd` daemon is configured. If it is configured to use the `augenrules` program (the default), add the line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`. If the `auditd` daemon is configured to use the `auditctl` utility, add the line to file `/etc/audit/audit.rules`.	The addition of kernel modules can be used to alter the behavior of the kernel and potentially introduce malicious code into kernel space. It is important to have an audit trail of modules that have been introduced into the kernel.
CCE-90836-8	Install OpenSSH client software	The `openssh-clients` package can be installed with the following command: $ sudo dnf install openssh-clients	This package includes utilities to make encrypted connections and transfer files securely to SSH servers.
CCE-90837-6	Configure AIDE to Verify Access Control Lists (ACLs)	By default, the `acl` option is added to the `FIPSR` ruleset in AIDE. If using a custom ruleset or the `acl` option is missing, add `acl` to the appropriate ruleset. For example, add `acl` to the following line in `/etc/aide.conf`: FIPSR = p+i+n+u+g+s+m+c+acl+selinux+xattrs+sha256 AIDE rules can be configured in multiple ways; this is merely one example that is already configured by default. The remediation provided with this rule adds `acl` to all rule sets available in `/etc/aide.conf`	ACLs can provide permissions beyond those permitted through the file mode and must be verified by the file integrity tools.
CCE-90838-4	Mount Remote Filesystems with nodev	Add the `nodev` option to the fourth column of `/etc/fstab` for the line which controls mounting of any NFS mounts.	Legitimate device files should only exist in the /dev directory. NFS mounts should not present device files to users.
CCE-90839-2	Prefer to use a 64-bit Operating System when supported	Prefer installation of 64-bit operating systems when the CPU supports it.	Use of a 64-bit operating system offers a few advantages, like a larger address space range for Address Space Layout Randomization (ASLR) and systematic presence of No eXecute and Execute Disable (NX/XD) protection bits.
CCE-90840-0	Verify and Correct File Permissions with RPM	The RPM package management system can check file access permissions of installed software packages, including many that are important to system security. Verify that the file permissions of system files and commands match vendor values. Check the file permissions with the following command: $ sudo rpm -Va \| awk '{ if (substr($0,2,1)=="M") print $NF }' Output indicates files that do not match vendor defaults. After locating a file with incorrect permissions, run the following command to determine which package owns it: $ rpm -qf FILENAME Next, run the following command to reset its permissions to the correct values: $ sudo rpm --restore PACKAGENAME	Permissions on system binaries and configuration files that are too generous could allow an unauthorized user to gain privileges that they should not have. The permissions set by the vendor should be maintained. Any deviations from this baseline should be investigated.
CCE-90841-8	Verify File Hashes with RPM	Without cryptographic integrity protections, system executables and files can be altered by unauthorized users without detection. The RPM package management system can check the hashes of installed software packages, including many that are important to system security. To verify that the cryptographic hash of system files and commands matches vendor values, run the following command to list which files on the system have hashes that differ from what is expected by the RPM database: $ rpm -Va --noconfig \| grep '^..5' If the file was not expected to change, investigate the cause of the change using audit logs or other means. The package can then be reinstalled to restore the file. Run the following command to determine which package owns the file: $ rpm -qf FILENAME The package can be reinstalled from a dnf repository using the command: $ sudo dnf reinstall PACKAGENAME Alternatively, the package can be reinstalled from trusted media using the command: $ sudo rpm -Uvh PACKAGENAME	The hashes of important files like system executables should match the information given by the RPM database. Executables with erroneous hashes could be a sign of nefarious activity on the system.
CCE-90842-6	Verify and Correct Ownership with RPM	The RPM package management system can check file ownership permissions of installed software packages, including many that are important to system security. After locating a file with incorrect permissions, which can be found with: rpm -Va \| awk '{ if (substr($0,6,1)=="U" \|\| substr($0,7,1)=="G") print $NF }' run the following command to determine which package owns it: $ rpm -qf FILENAME Next, run the following command to reset its permissions to the correct values: $ sudo rpm --restore PACKAGENAME	Ownership of binaries and configuration files that is incorrect could allow an unauthorized user to gain privileges that they should not have. The ownership set by the vendor should be maintained. Any deviations from this baseline should be investigated.
CCE-90843-4	Install AIDE	The `aide` package can be installed with the following command: $ sudo dnf install aide	The AIDE package must be installed if it is to be available for integrity checking.
CCE-90844-2	Configure Notification of Post-AIDE Scan Details	AIDE should notify appropriate personnel of the details of a scan after the scan has been run. If AIDE has already been configured for periodic execution in `/etc/crontab`, append the following line to the existing AIDE line: \| /bin/mail -s "$(hostname) - AIDE Integrity Check" root@localhost Otherwise, add the following line to `/etc/crontab`: 05 4 * * * root /usr/sbin/aide --check \| /bin/mail -s "$(hostname) - AIDE Integrity Check" root@localhost AIDE can be executed periodically through other means; this is merely one example.	Unauthorized changes to the baseline configuration could make the system vulnerable to various attacks or allow unauthorized access to the operating system. Changes to operating system configurations can have unintended side effects, some of which may be relevant to security. Detecting such changes and providing an automated response can help avoid unintended, negative consequences that could ultimately affect the security state of the operating system. The operating system's Information Management Officer (IMO)/Information System Security Officer (ISSO) and System Administrators (SAs) must be notified via email and/or monitoring system trap when there is an unauthorized modification of a configuration item.
CCE-90845-9	Ensure /tmp Located On Separate Partition	The `/tmp` directory is a world-writable directory used for temporary file storage. Ensure it has its own partition or logical volume at installation time, or migrate it using LVM.	The `/tmp` partition is used as temporary storage by many programs. Placing `/tmp` in its own partition enables the setting of more restrictive mount options, which can help protect programs which use it.
CCE-90846-7	Ensure /srv Located On Separate Partition	If a file server (FTP, TFTP...) is hosted locally, create a separate partition for `/srv` at installation time (or migrate it later using LVM). If `/srv` will be mounted from another system such as an NFS server, then creating a separate partition is not necessary at installation time, and the mountpoint can instead be configured later.	Srv deserves files for local network file server such as FTP. Ensuring that `/srv` is mounted on its own partition enables the setting of more restrictive mount options, and also helps ensure that users cannot trivially fill partitions used for log or audit data storage.
CCE-90847-5	Ensure /var/log/audit Located On Separate Partition	Audit logs are stored in the `/var/log/audit` directory. Ensure that `/var/log/audit` has its own partition or logical volume at installation time, or migrate it using LVM. Make absolutely certain that it is large enough to store all audit logs that will be created by the auditing daemon.	Placing `/var/log/audit` in its own partition enables better separation between audit files and other files, and helps ensure that auditing cannot be halted due to the partition running out of space.
CCE-90848-3	Ensure /var/log Located On Separate Partition	System logs are stored in the `/var/log` directory. Ensure that `/var/log` has its own partition or logical volume at installation time, or migrate it using LVM.	Placing `/var/log` in its own partition enables better separation between log files and other files in `/var/`.
CCE-90849-1	Encrypt Partitions	Red Hat Enterprise Linux 9 natively supports partition encryption through the Linux Unified Key Setup-on-disk-format (LUKS) technology. The easiest way to encrypt a partition is during installation time. For manual installations, select the `Encrypt` checkbox during partition creation to encrypt the partition. When this option is selected the system will prompt for a passphrase to use in decrypting the partition. The passphrase will subsequently need to be entered manually every time the system boots. For automated/unattended installations, it is possible to use Kickstart by adding the `--encrypted` and `--passphrase=` options to the definition of each partition to be encrypted. For example, the following line would encrypt the root partition: part / --fstype=ext4 --size=100 --onpart=hda1 --encrypted --passphrase=PASSPHRASE Any PASSPHRASE is stored in the Kickstart in plaintext, and the Kickstart must then be protected accordingly. Omitting the `--passphrase=` option from the partition definition will cause the installer to pause and interactively ask for the passphrase during installation. By default, the `Anaconda` installer uses `aes-xts-plain64` cipher with a minimum `512` bit key size which should be compatible with FIPS enabled. Detailed information on encrypting partitions using LUKS or LUKS ciphers can be found on the Red Hat Enterprise Linux 9 Documentation web site: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/security_hardening/encrypting-block-devices-using-luks_security-hardening .	The risk of a system's physical compromise, particularly mobile systems such as laptops, places its data at risk of compromise. Encrypting this data mitigates the risk of its loss if the system is lost.
CCE-90850-9	Disable Network File System (nfs)	The Network File System (NFS) service allows remote hosts to mount and interact with shared filesystems on the local system. If the local system is not designated as a NFS server then this service should be disabled. The `nfs-server` service can be disabled with the following command: $ sudo systemctl mask --now nfs-server.service	Unnecessary services should be disabled to decrease the attack surface of the system.