Linux strictest published profile

STIG rules: CAT I 31 kept

Every CAT I rule of Red Hat Enterprise Linux 10 V1R3: the ones DISA rates most severe.

1. RHEL-10-000500 CAT I RHEL 10 must enable FIPS mode.
   Recommended: apply AC-17(2), MA-4, MA-4(6), SC-8, SC-13
2. RHEL-10-000510 CAT I RHEL 10 must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information on local disk partitions that requires at-rest protection.
   Recommended: apply SC-28, SC-28(1)
3. RHEL-10-001000 CAT I RHEL 10 must be a vendor-supported release.
   Recommended: apply SA-22
4. RHEL-10-001030 CAT I RHEL 10 must check the GNU Privacy Guard (GPG) signature of software packages originating from external software repositories before installation.
   Recommended: apply CM-14
5. RHEL-10-001040 CAT I RHEL 10 must check the GNU Privacy Guard (GPG) signature of locally installed software packages before installation.
   Recommended: apply CM-14
6. RHEL-10-001050 CAT I RHEL 10 must have GNU Privacy Guard (GPG) signature verification enabled for all software repositories.
   Recommended: apply CM-14
7. RHEL-10-200020 CAT I RHEL 10 must not have the "telnet-server" package installed.
   Recommended: apply CM-7
8. RHEL-10-200070 CAT I RHEL 10 must not have the "tftp" package installed.
   Recommended: apply IA-5(1)
9. RHEL-10-200090 CAT I RHEL 10 must not have a File Transfer Protocol (FTP) server package installed.
   Recommended: apply CM-7, IA-5(1)
10. RHEL-10-200631 CAT I RHEL 10 must use cryptographic mechanisms to protect the integrity of audit tools.
    Recommended: apply AU-9(3)
11. RHEL-10-300000 CAT I RHEL 10 must have the "crypto-policies" package installed.
    Recommended: apply MA-4(6), SC-13
12. RHEL-10-300010 CAT I RHEL 10 must implement a FIPS 140-3-compliant systemwide cryptographic policy.
    Recommended: apply AC-17(2), MA-4(6), SC-13
13. RHEL-10-300030 CAT I RHEL 10 must be configured so that Secure Shell (SSH) clients use only DoW-approved encryption ciphers employing FIPS 140-3-validated cryptographic hash algorithms to protect the confidentiality of SSH client connections.
    Recommended: apply AC-17(2), MA-4, MA-4(6), SC-8
14. RHEL-10-300040 CAT I RHEL 10 must be configured so that Secure Shell (SSH) servers use only DoW-approved encryption ciphers employing FIPS 140-3-validated cryptographic hash algorithms to protect the confidentiality of SSH server connections.
    Recommended: apply AC-17(2), MA-4
15. RHEL-10-300050 CAT I RHEL 10 must be configured so that Secure Shell (SSH) clients use only DoW-approved Message Authentication Codes (MACs) employing FIPS 140-3-validated cryptographic hash algorithms to protect the confidentiality of SSH client connections.
    Recommended: apply AC-17(2), MA-4
16. RHEL-10-300060 CAT I RHEL 10 must be configured so that Secure Shell (SSH) servers use only DoW-approved Message Authentication Codes (MACs) employing FIPS 140-3-validated cryptographic hash algorithms to protect the confidentiality of SSH server connections.
    Recommended: apply AC-17(2), MA-4
17. RHEL-10-300070 CAT I RHEL 10 must use FIPS 140-3-approved cryptographic algorithms for IP tunnels.
    Recommended: apply AC-17(2)
18. RHEL-10-300080 CAT I RHEL 10 must implement DoW-approved encryption in the bind package.
    Recommended: apply SC-8, SC-8(2)
19. RHEL-10-300085 CAT I RHEL 10 must implement DoW-approved encryption in the OpenSSL package.
    Recommended: apply AC-17(2)
20. RHEL-10-300090 CAT I RHEL 10 cryptographic policy must not be overridden.
    Recommended: apply MA-4(6), SC-13
21. RHEL-10-600560 CAT I RHEL 10 must require users to provide a password for privilege escalation.
    Recommended: apply IA-11
22. RHEL-10-600640 CAT I RHEL 10 must enable the Pluggable Authentication Module (PAM) interface for SSHD.
    Recommended: apply MA-4
23. RHEL-10-600730 CAT I RHEL 10 must employ FIPS 140-3-approved cryptographic hashing algorithms for all stored passwords.
    Recommended: apply IA-5(1), IA-7
24. RHEL-10-600740 CAT I RHEL 10 must be configured to use the shadow file to store only encrypted representations of passwords.
    Recommended: apply IA-5(1)
25. RHEL-10-600750 CAT I RHEL 10 must be configured so that user and group account administration utilities are configured to store only encrypted representations of passwords.
    Recommended: apply IA-5(1)
26. RHEL-10-700640 CAT I RHEL 10 must not allow users to override Secure Shell (SSH) environment variables.
    Recommended: apply CM-7
27. RHEL-10-700650 CAT I RHEL 10 must force a frequent session key renegotiation for Secure Shell (SSH) connections to the server.
    Recommended: apply AC-17(2), SC-8, SC-8(1)
28. RHEL-10-700720 CAT I RHEL 10 must not allow unattended or automatic login via the graphical user interface.
    Recommended: apply AC-3
29. RHEL-10-700950 CAT I RHEL 10 must disable the systemd Ctrl-Alt-Delete burst key sequence.
    Recommended: apply AC-6(10)
30. RHEL-10-700960 CAT I RHEL 10 must disable the x86 Ctrl-Alt-Delete key sequence.
    Recommended: apply AC-6(10)
31. RHEL-10-701050 CAT I RHEL 10 must prevent the loading of a new kernel for later execution.
    Recommended: apply CM-14