DISA STIG library V1R7
| Ref | Title | Text | |
|---|---|---|---|
| UBTU-24-100010 | Ubuntu 24.04 LTS must not have the "systemd-timesyncd" package installed. | Verify the "systemd-timesyncd" package is not installed with the following command: $ dpkg -l | grep systemd-timesyncd If the "systemd-timesyncd" package is installed, this is a finding. | |
| UBTU-24-100020 | Ubuntu 24.04 LTS must not have the "ntp" package installed. | Verify the "ntp" package is not installed with the following command: $ dpkg -l | grep ntp If the "ntp" package is installed, this is a finding. | |
| UBTU-24-100030 | Ubuntu 24.04 LTS must not have the telnet package installed. | Verify the telnet package is not installed on Ubuntu 24.04 LTS with the following command: $ dpkg -l | grep telnetd If the telnetd package is installed, this is a finding. | |
| UBTU-24-100040 | Ubuntu 24.04 LTS must not have the rsh-server package installed. | Verify the rsh-server package is installed with the following command: $ dpkg -l | grep rsh-server If the rsh-server package is installed, this is a finding. | |
| UBTU-24-100050 | Ubuntu 24.04 LTS must not have the nfs-kernel-server package installed. | Note: If NFS mounts are authorized and in use on the system, this control is not applicable. Verify that Ubuntu 24.04 LTS does not have the nfs-kernel-server package installed. Determine if packages are installed: $ sudo dpkg -l | grep -E ' | |
| UBTU-24-100100 | Ubuntu 24.04 LTS must use a file integrity tool to verify correct operation of all security functions. | Verify that Advanced Intrusion Detection Environment (AIDE) is installed and verifies the correct operation of all security functions with the following command: $ dpkg -l | grep aide ii aide 0.18.6-2build2 amd64 Advanced Intrusion Detectio | |
| UBTU-24-100110 | Ubuntu 24.04 LTS must configure AIDE to perform file integrity checking on the file system if installed. | Note: If a file integrity tool other than Advanced Intrusion Detection Environment (AIDE) is employed, this requirement is not applicable. Verify AIDE is configured on the system by performing a manual check: $ sudo aide -c /etc/aide/aide.c | |
| UBTU-24-100120 | Ubuntu 24.04 LTS must be configured so that the script which runs each 30 days or less to check file integrity is the default one. | Note: If AIDE is not installed, this finding is not applicable. Check the AIDE configuration file integrity installed on the system (the default configuration file is located at /etc/aide/aide.conf or in /etc/aide/aide.conf.d/) with the fol | |
| UBTU-24-100130 | Ubuntu 24.04 LTS must notify designated personnel if baseline configurations are changed in an unauthorized manner. The file integrity tool must notify the system administrator (SA) when changes to the baseline configuration or anomalies in the operation of any security functions are discovered. | Verify that Advanced Intrusion Detection Environment (AIDE) notifies the SA when anomalies in the operation of any security functions are discovered with the following command: $ grep SILENTREPORTS /etc/default/aide SILENTREPORTS=no If "SIL | |
| UBTU-24-100200 | Ubuntu 24.04 LTS must be configured to preserve log records from failure events. | Verify the log service is installed properly with the following command: $ dpkg -l | grep rsyslog ii rsyslog 8.2312.0-3ubuntu9 amd64 reliable system and kernel logging daemon If the "rsyslog" package is not installed, this is a finding. Che | |
| UBTU-24-100300 | Ubuntu 24.04 LTS must have an application firewall installed in order to control remote access methods. | Verify that the Uncomplicated Firewall (ufw) is installed with the following command: $ dpkg -l | grep ufw ii ufw 0.36.2-6 all program for managing a Netfilter firewall If the "ufw" package is not installed, ask the system administrator if | |
| UBTU-24-100310 | Ubuntu 24.04 LTS must enable and run the Uncomplicated Firewall (ufw). | Verify the ufw is enabled on the system with the following command: $ sudo ufw status Status: active If the above command returns the status as "inactive" or any type of error, this is a finding. If the ufw is not installed, ask the system | |
| UBTU-24-100400 | Ubuntu 24.04 LTS must have the "auditd" package installed. | Verify the audit service is configured to produce audit records with the following command: $ dpkg -l | grep auditd ii auditd 1:3.0.7-1build1 amd64 User space tools for security auditing If the "auditd" package is not installed, this is a f | |
| UBTU-24-100410 | Ubuntu 24.04 LTS must produce audit records and reports containing information to establish when, where, what type, the source, and the outcome for all DoW-defined auditable events and actions in near real time. | Verify the audit service is enabled with the following command: $ systemctl is-enabled auditd.service enabled If the command above returns "disabled", this is a finding. Verify the audit service is properly running and active on the system | |
| UBTU-24-100450 | Ubuntu 24.04 LTS audit event multiplexor must be configured to offload audit logs onto a different system or storage media from the system being audited. | Verify the audit event multiplexor is configured to offload audit records to a different system or storage media from the system being audited. Check that audisp-remote plugin is installed: $ dpkg -l | grep audispd-plugins ii audispd-plugin | |
| UBTU-24-100500 | Ubuntu 24.04 LTS must have AppArmor installed. | Verify Ubuntu 24.04 LTS has AppArmor installed with the following command: $ dpkg -l | grep apparmor ii apparmor 4.0.1really4.0.1-0ubuntu0.24.04.3 amd64 user-space parser utility for AppArmor ii libapparmor1:amd64 4.0.1really4.0.1-0ubuntu0. | |
| UBTU-24-100510 | Ubuntu 24.04 LTS must be configured to use AppArmor. | Verify Ubuntu 24.04 LTS AppArmor active with the following commands: $ systemctl is-active apparmor.service active If "active" is not returned, this is a finding. $ systemctl is-enabled apparmor.service enabled If "enabled" is not returned, | |
| UBTU-24-100600 | Ubuntu 24.04 LTS must have the "libpam-pwquality" package installed. | Verify Ubuntu 24.04 LTS has the "libpam-pwquality" package installed with the following command: $ dpkg -l | grep libpam-pwquality ii libpam-pwquality:amd64 1.4.5-3build1 amd64 PAM module to check password strength If "libpam-pwquality" is | |
| UBTU-24-100650 | Ubuntu 24.04 LTS must have the "SSSD" package installed. | Verify Ubuntu 24.04 LTS has the packages required for multifactor authentication installed with the following command: $ dpkg -l | grep sssd ii sssd 2.9.4-1.1ubuntu6.1 amd64 System Security Services Daemon -- metapackage ii sssd-ad 2.9.4-1. | |
| UBTU-24-100660 | Ubuntu 24.04 LTS must use the "SSSD" package for multifactor authentication services. | Verify the "sssd.service" is enabled and active with the following commands: $ sudo systemctl is-enabled sssd enabled $ sudo systemctl is-active sssd active If "sssd.service" is not active or enabled, this is a finding. | |
| UBTU-24-100700 | Ubuntu 24.04 LTS must have the "chrony" package installed. | Verify the "chrony" package is installed using the following command: $ dpkg -l | grep chrony ii chrony 4.5-1ubuntu4.1 amd64 Versatile implementation of the Network Time Protocol If the "chrony" package is not installed, this is a finding. | |
| UBTU-24-100800 | Ubuntu 24.04 LTS must have SSH installed. | Verify the SSH package is installed with the following command: $ dpkg -l | grep openssh ii openssh-client 1:9.6p1-3ubuntu13.5 amd64 secure shell (SSH) client, for secure access to remote machines ii openssh-server 1:9.6p1-3ubuntu13.5 amd64 | |
| UBTU-24-100810 | Ubuntu 24.04 LTS must use SSH to protect the confidentiality and integrity of transmitted information. | Verify the "sshd.service" is enabled and active with the following commands: $ sudo systemctl is-enabled ssh enabled $ sudo systemctl is-active ssh active If "ssh.service" is not active or loaded, this is a finding. | |
| UBTU-24-100820 | Ubuntu 24.04 LTS must configure the SSH daemon to use FIPS 140-3 approved ciphers to prevent the unauthorized disclosure of information and/or detect changes to information during transmission. | Verify that the SSH daemon is configured to implement only FIPS-approved algorithms with the following command: $ sudo grep -r 'Ciphers' /etc/ssh/sshd_config* Ciphers [email protected],[email protected],aes256-ctr,aes128-ctr If an | |
| UBTU-24-100830 | Ubuntu 24.04 LTS must configure the SSH daemon to use Message Authentication Codes (MACs) employing FIPS 140-3 approved cryptographic hashes to prevent the unauthorized disclosure of information and/or detect changes to information during transmission. | Verify the SSH daemon is configured to only use MACs that employ FIPS 140-3 approved ciphers with the following command: $ grep -irs macs /etc/ssh/sshd_config* MACs [email protected],[email protected],hmac-sha2-512,h | |
| UBTU-24-100840 | Ubuntu 24.04 LTS SSH server must be configured to use only FIPS 140-3 validated key exchange algorithms. | Verify that the SSH daemon is configured to use only FIPS-validated key exchange algorithms with the following command: $ sudo grep -ir kexalgorithms /etc/ssh/sshd_config* KexAlgorithms ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp2 | |
| UBTU-24-100850 | Ubuntu 24.04 LTS must configure the SSH client to use FIPS 140-3 approved ciphers to prevent the unauthorized disclosure of information and/or detect changes to information during transmission. | Verify the SSH client is configured to use only ciphers employing FIPS 140-3 approved algorithms with the following command: $ sudo grep -r 'Ciphers' /etc/ssh/ssh_config* Ciphers [email protected],[email protected],aes256-ctr,aes1 | |
| UBTU-24-100860 | Ubuntu 24.04 LTS SSH client must be configured to use only Message Authentication Codes (MACs) employing FIPS 140-3 validated cryptographic hash algorithms. | Verify the SSH client is configured to only use MACs employing FIPS 140-3 approved algorithms with the following command: $ sudo grep -ir macs /etc/ssh/ssh_config* MACs [email protected],[email protected],hmac-sha2-5 | |
| UBTU-24-100900 | Ubuntu 24.04 LTS must accept Personal Identity Verification (PIV) credentials. | Verify the "opensc-pcks11" package is installed on the system with the following command: $ dpkg -l | grep opensc-pkcs11 ii opensc-pkcs11:amd64 0.25.0~rc1-1build2 amd64 Smart card utilities with support for PKCS#15 compatible cards If the " | |
| UBTU-24-100910 | Ubuntu 24.04 LTS must accept Personal Identity Verification (PIV) credentials managed through the Privileged Access Management (PAM) framework. | Verify the "libpam-pcks11" package is installed on the system with the following command: $ dpkg -l | grep libpam-pkcs11 ii libpam-pkcs11 0.6.12-2build3 amd64 Fully featured PAM module for using PKCS#11 smart cards If the "libpam-pcks11" pa | |
| UBTU-24-101000 | Ubuntu 24.04 LTS must allow users to directly initiate a session lock for all connection types. | Verify Ubuntu 24.04 LTS has the "vlock" package installed with the following command: $ dpkg -l | grep vlock ii vlock 2.2.2-10 amd64 Virtual Console locking program If "vlock" is not installed, this is a finding. | |
| UBTU-24-101100 | Ubuntu 24.04 LTS must not assign an interactive login shell for system accounts. | Verify Ubuntu 24.04 LTS system accounts do not have an interactive login shell with the following command: Run the following command to list any system account (UID 0 && $3 < 1000) && $1 !~ /^(halt|sync|shutdown)$/ && $7 !~ /(nologin|false) | |
| UBTU-24-102000 | Ubuntu 24.04 LTS when booted must require authentication upon booting into single-user and maintenance modes. | Verify Ubuntu 24.04 LTS requires a password for authentication upon booting into single-user and maintenance modes with the following command: $ sudo grep -i password /boot/grub/grub.cfg password_pbkdf2 root grub.pbkdf2.sha512.10000.MFU4893 | |
| UBTU-24-102010 | Ubuntu 24.04 LTS must initiate session audits at system startup. | Verify Ubuntu 24.04 LTS enables auditing at system startup in GRUB. Check the main GRUB defaults to ensure that auditing is enabled: $ sudo grep -ir GRUB_CMDLINE_LINUX /etc/default/grub /etc/default/grub:GRUB_CMDLINE_LINUX_DEFAULT="audit=1" | |
| UBTU-24-200000 | Ubuntu 24.04 LTS must limit the number of concurrent sessions to 10 for all accounts and/or account types. | Verify Ubuntu 24.04 LTS limits the number of concurrent sessions to 10 for all accounts and/or account types with the following command: $ grep -r maxlogins /etc/security/limits.conf /etc/security/limits.d/*.conf /etc/security/limits.d/maxl | |
| UBTU-24-200020 | Ubuntu 24.04 LTS must initiate a graphical session lock after 10 minutes of inactivity. | Note: If Ubuntu 24.04 LTS does not have a graphical user interface installed, this requirement is not applicable. Verify the Ubuntu operation system has a graphical user interface session lock configured to activate after 10 minutes of inac | |
| UBTU-24-200040 | Ubuntu 24.04 LTS must prevent a user from overriding the disabling of the graphical user interface automount function. | Note: This requirement assumes the use of the Ubuntu 24.04 LTS default graphical user interface, the GNOME desktop environment. If the system does not have any graphical user interface installed, this requirement is Not Applicable. Verify U | |
| UBTU-24-200041 | Ubuntu 24.04 LTS must prevent a user from overriding the disabling of the graphical user interface autorun function. | Note: This requirement assumes the use of the Ubuntu 24.04 LTS default graphical user interface, the GNOME desktop environment. If the system does not have any graphical user interface installed, this requirement is Not Applicable. Verify U | |
| UBTU-24-200042 | Ubuntu 24.04 LTS must prevent a user from overriding the disabling of the graphical user smart card removal action. | Note: This requirement assumes the use of the Ubuntu 24.04 LTS default graphical user interface, the GNOME desktop environment. If the system does not have any graphical user interface installed, this requirement is Not Applicable. Verify U | |
| UBTU-24-200043 | Ubuntu 24.04 LTS must conceal, via the session lock, information previously visible on the display with a publicly viewable image. | Note: This requirement assumes the use of the Ubuntu 24.04 LTS default graphical user interface, the GNOME desktop environment. If the system does not have any graphical user interface installed, this requirement is Not Applicable. To verif | |
| UBTU-24-200060 | Ubuntu 24.04 LTS must automatically terminate a user session after inactivity timeouts have expired. | Verify Ubuntu 24.04 LTS automatically terminates a user session after inactivity timeouts have expired with the following command: $ sudo grep -E "\bTMOUT=[0-9]+" /etc/bash.bashrc /etc/profile.d/* /etc/profile.d/99-terminal_tmout.sh:TMOUT=6 | |
| UBTU-24-200090 | Ubuntu 24.04 LTS must monitor remote access methods. | Verify that Ubuntu 24.04 LTS monitors all remote access methods with the following command: $ grep -E -r '^(auth,authpriv\.\*|daemon\.\*)' /etc/rsyslog.* /etc/rsyslog.d/50-default.conf:auth,authpriv.* /var/log/auth.log If "auth.*", "authpri | |
| UBTU-24-200250 | Ubuntu 24.04 LTS must automatically remove or disable emergency accounts after 72 hours. | Verify temporary accounts have been provisioned with an expiration date of 72 hours with the following command: $ sudo chage -l | grep -i "account expires" Verify each of these accounts has an expiration date set within 72 hours. If any tem | |
| UBTU-24-200260 | Ubuntu 24.04 LTS must disable account identifiers (individuals, groups, roles, and devices) after 35 days of inactivity. | Verify the account identifiers (individuals, groups, roles, and devices) are disabled after 35 days of inactivity with the following command: Check the account inactivity value by performing the following command: $ grep INACTIVE /etc/defau | |
| UBTU-24-200270 | Ubuntu 24.04 LTS must audit any script or executable called by cron as root or by any privileged user. | Verify Ubuntu 24.04 LTS is configured to audit the execution of any system call made by cron as root or as any privileged user. $ sudo auditctl -l | grep /etc/cron.d -w /etc/cron.d -p wa -k cronjobs $ sudo auditctl -l | grep /var/spool/cron | |
| UBTU-24-200280 | Ubuntu 24.04 LTS must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/passwd. | Verify Ubuntu 24.04 LTS generates audit records for all account creations, modifications, disabling, and termination events that affect "/etc/passwd" with the following command: $ sudo auditctl -l | grep passwd -w /etc/passwd -p wa -k userg | |
| UBTU-24-200290 | Ubuntu 24.04 LTS must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/group. | Verify Ubuntu 24.04 LTS generates audit records for all account creations, modifications, disabling, and termination events that affect "/etc/group" with the following command: $ sudo auditctl -l | grep group -w /etc/group -p wa -k usergrou | |
| UBTU-24-200300 | Ubuntu 24.04 LTS must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/shadow. | Verify Ubuntu 24.04 LTS generates audit records for all account creations, modifications, disabling, and termination events that affect "/etc/shadow" with the following command: $ sudo auditctl -l | grep shadow -w /etc/shadow -p wa -k userg | |
| UBTU-24-200310 | Ubuntu 24.04 LTS must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/gshadow. | Verify Ubuntu 24.04 LTS generates audit records for all account creations, modifications, disabling, and termination events that affect "/etc/gshadow" with the following command: $ sudo auditctl -l | grep gshadow -w /etc/gshadow -p wa -k us | |
| UBTU-24-200320 | Ubuntu 24.04 LTS must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/opasswd. | Verify Ubuntu 24.04 LTS generates audit records for all account creations, modifications, disabling, and termination events that affect "/etc/security/opasswd" with the following command: $ sudo auditctl -l | grep opasswd -w /etc/security/o | |
| UBTU-24-200580 | Ubuntu 24.04 LTS must prevent all software from executing at higher privilege levels than users executing the software and the audit system must be configured to audit the execution of privileged functions. | Verify Ubuntu 24.04 LTS audits the execution of privilege functions by auditing the "execve" system call with the following command: $ sudo auditctl -l | grep execve -a always,exit -F arch=b64 -S execve -C uid!=euid -F euid=0 -F key=execpri | |
| UBTU-24-200610 | Ubuntu 24.04 LTS must automatically lock an account until the locked account is released by an administrator when three unsuccessful logon attempts have been made. | Verify that Ubuntu 24.04 LTS utilizes the "pam_faillock" module with the following command: $ grep faillock /etc/pam.d/common-auth auth [default=die] pam_faillock.so authfail auth sufficient pam_faillock.so authsucc If the pam_faillock.so m | |
| UBTU-24-200640 | Ubuntu 24.04 LTS must display the Standard Mandatory DoW Notice and Consent Banner before granting access to via an SSH logon. | Verify Ubuntu 24.04 LTS displays the Standard Mandatory DoW Notice and Consent Banner before granting access via an SSH logon with the following command: $ sudo grep -ir banner /etc/ssh/sshd_config* /etc/ssh/sshd_config:Banner /etc/issue.ne | |
| UBTU-24-200650 | Ubuntu 24.04 LTS must enable the graphical user logon banner to display the Standard Mandatory DoW Notice and Consent Banner before granting local access to the system via a graphical user logon. | Note: If the system does not have a graphical user interface installed, this requirement is not applicable. Verify Ubuntu 24.04 LTS is configured to display the Standard Mandatory DoW Notice and Consent Banner before granting access to Ubun | |
| UBTU-24-200660 | Ubuntu 24.04 LTS must display the Standard Mandatory DoW Notice and Consent Banner before granting local access to the system via a graphical user logon. | Note: If the system does not have a graphical user interface installed, this requirement is not applicable. Verify Ubuntu 24.04 LTS displays the Standard Mandatory DoW Notice and Consent Banner before granting access to Ubuntu 24.04 LTS via | |
| UBTU-24-300001 | Ubuntu 24.04 LTS Advance Package Tool (APT) must be configured to prevent the installation of patches, service packs, device drivers, or Ubuntu 24.04 LTS components without verification they have been digitally signed using a certificate that is recognized and approved by the organization. | Verify that APT is configured to prevent the installation of patches, service packs, device drivers, or Ubuntu 24.04 LTS components without verification they have been digitally signed using a certificate recognized and approved by the orga | |
| UBTU-24-300006 | Ubuntu 24.04 LTS library files must have mode 0755 or less permissive. | Verify the systemwide shared library files contained in the directories "/lib", "/lib64", "/usr/lib", and "/usr/lib64" have mode 0755 or less permissive. Check that the systemwide shared library files have mode 0755 or less permissive with | |
| UBTU-24-300007 | Ubuntu 24.04 LTS library files must be owned by root. | Verify the systemwide shared library files contained in the directories "/lib", "/lib64", "/usr/lib", and "/usr/lib64" are owned by root with the following command: $ sudo find /lib /lib64 /usr/lib /usr/lib64 -type f -name '*.so*' ! -user r | |
| UBTU-24-300008 | Ubuntu 24.04 LTS library directories must be owned by root. | Verify the systemwide shared library directories "/lib", "/lib64", "/usr/lib", and "/usr/lib64" are owned by root with the following command: $ sudo find /lib /lib64 /usr/lib /usr/lib64 ! -user root -type d -exec stat -c "%n %U" '{}' \; If | |
| UBTU-24-300009 | Ubuntu 24.04 LTS library files must be group-owned by root or a system account. | Verify the systemwide shared library files contained in the directories "/lib", "/lib64", "/usr/lib", and "/usr/lib64" are group owned by root with the following command: $ sudo find /lib /lib64 /usr/lib /usr/lib64 -type f -name '*.so*' ! - | |
| UBTU-24-300010 | Ubuntu 24.04 LTS library directories must be group-owned by root. | Verify the systemwide library directories "/lib", "/lib64", and "/usr/lib" are group-owned by root with the following command: $ sudo find /lib /usr/lib /lib64 ! -group root -type d -exec stat -c "%n %G" '{}' \; If any systemwide shared lib | |
| UBTU-24-300011 | Ubuntu 24.04 LTS must have system commands set to a mode of 0755 or less permissive. | Verify the system commands contained in the following directories have mode 0755 or less permissive with the following command: $ sudo find /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin -perm /022 -type f -exec stat -c "%n %a | |
| UBTU-24-300012 | Ubuntu 24.04 LTS must have system commands owned by root or a system account. | Verify the system commands contained in the following directories are owned by root, or a required system account, with the following command: $ sudo find /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin ! -user root -type f -ex | |
| UBTU-24-300013 | Ubuntu 24.04 LTS must have system commands group-owned by root or a system account. | Verify the system commands contained in the following directories are group-owned by root or a required system account with the following command: $ find /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin \-type f -perm -u=x -exec | |
| UBTU-24-300014 | Ubuntu 24.04 LTS must prevent the use of dictionary words for passwords. | Verify Ubuntu 24.04 LTS uses the "cracklib" library to prevent the use of dictionary words with the following command: $ grep dictcheck /etc/security/pwquality.conf dictcheck=1 If the "dictcheck" parameter is not set to "1" or is commented | |
| UBTU-24-300016 | Ubuntu 24.04 LTS must be configured so that when passwords are changed or new passwords are established, pwquality must be used. | Verify that Ubuntu 24.04 LTS uses "pwquality" to enforce the password complexity rules. Verify the pwquality module is being enforced by Ubuntu 24.04 LTS with the following command: $ grep -i enforcing /etc/security/pwquality.conf enforcing | |
| UBTU-24-300017 | Ubuntu 24.04 LTS must enforce a delay of at least four seconds between logon prompts following a failed logon attempt. | Verify Ubuntu 24.04 LTS enforces a delay of at least four seconds between logon prompts following a failed logon attempt with the following command: $ grep pam_faildelay /etc/pam.d/common-auth auth required pam_faildelay.so delay=4000000 If | |
| UBTU-24-300019 | Ubuntu 24.04 LTS must restrict privilege elevation to authorized personnel. | Verify the operating system restricts privilege elevation to authorized personnel with the following command: $ sudo grep -iwR 'ALL' /etc/sudoers /etc/sudoers.d/ | grep -v '#' If either of the following entries are returned, this is a findi | |
| UBTU-24-300020 | Ubuntu 24.04 LTS must require users to provide a password for privilege escalation. | Verify that "/etc/sudoers" has no occurrences of "NOPASSWD" with the following command: $ sudo egrep -iR 'NOPASSWD' /etc/sudoers /etc/sudoers.d/ If any occurrences of "NOPASSWD" are returned from the command and have not been documented wit | |
| UBTU-24-300021 | Ubuntu 24.04 LTS must require users to reauthenticate for privilege escalation or when changing roles. | Verify the "/etc/sudoers" file has no occurrences of "!authenticate" with the following command: $ sudo egrep -iR '!authenticate' /etc/sudoers /etc/sudoers.d/ If any occurrences of "!authenticate" return from the command, this is a finding. | |
| UBTU-24-300022 | Ubuntu 24.04 LTS must be configured so that remote X connections are disabled, unless to fulfill documented and validated mission requirements. | Verify that X11Forwarding is disabled with the following command: $ sudo grep -ir x11forwarding /etc/ssh/sshd_config* | grep -v "^#" X11Forwarding no If the "X11Forwarding" keyword is set to "yes" and is not documented with the information | |
| UBTU-24-300023 | Ubuntu 24.04 LTS SSH daemon must prevent remote hosts from connecting to the proxy display. | Verify the SSH daemon prevents remote hosts from connecting to the proxy display with the following command: $ sudo grep -ir x11uselocalhost /etc/ssh/sshd_config* X11UseLocalhost yes If the "X11UseLocalhost" keyword is set to "no", is comme | |
| UBTU-24-300025 | Ubuntu 24.04 LTS must disable the x86 Ctrl-Alt-Delete key sequence if a graphical user interface is installed. | Verify Ubuntu 24.04 LTS is not configured to reboot the system when Ctrl-Alt-Delete is pressed when using a graphical user interface with the following command: $ gsettings get org.gnome.settings-daemon.plugins.media-keys logout @as [] If t | |
| UBTU-24-300026 | Ubuntu 24.04 LTS must disable the x86 Ctrl-Alt-Delete key sequence. | Verify Ubuntu 24.04 LTS is not configured to reboot the system when Ctrl-Alt-Delete is pressed with the following command: $ systemctl status ctrl-alt-del.target o ctrl-alt-del.target Loaded: masked (Reason: Unit ctrl-alt-del.target is mask | |
| UBTU-24-300027 | Ubuntu 24.04 LTS must not have accounts configured with blank or null passwords. | Check the "/etc/shadow" file for blank passwords with the following command: $ sudo awk -F: '!$2 {print $1}' /etc/shadow If the command returns any results, this is a finding. | |
| UBTU-24-300028 | Ubuntu 24.04 LTS must not allow accounts configured in Pluggable Authentication Modules (PAM) with blank or null passwords. | To verify null passwords cannot be used, run the following command: $ grep nullok /etc/pam.d/common-password /etc/pam.d/common-auth If this produces any output, this is a finding. | |
| UBTU-24-300029 | Ubuntu 24.04 LTS must generate audit records for all events that affect the systemd journal files. | Verify Ubuntu 24.04 LTS generates audit records for all events that affect "/var/log/journal" with the following command: $ sudo auditctl -l | grep journal -w /var/log/journal -p wa -k systemd_journal If the command does not return a line t | |
| UBTU-24-300030 | Ubuntu 24.04 LTS default filesystem permissions must be defined in such a way that all authenticated users can read and modify only their own files. | Verify Ubuntu 24.04 LTS defines default permissions for all authenticated users in such a way that the user can read and modify only their own files with the following command: $ grep -i '^\s*umask' /etc/login.defs UMASK 077 If the "UMASK" | |
| UBTU-24-300031 | Ubuntu 24.04 LTS must not allow unattended or automatic login via SSH. | Verify unattended or automatic login via SSH is disabled with the following command: $ egrep -r '(Permit(.*?)(Passwords|Environment))' /etc/ssh/sshd_config PermitEmptyPasswords no PermitUserEnvironment no If the "PermitEmptyPasswords" or "P | |
| UBTU-24-300039 | Ubuntu 24.04 LTS must disable automatic mounting of Universal Serial Bus (USB) mass storage driver. | Verify that Ubuntu 24.04 LTS disables the ability to load the USB storage kernel module with the following command: $ sudo grep usb-storage /etc/modprobe.d/* | grep "/bin/false" /etc/modprobe.d/DISASTIG.conf:install usb-storage /bin/false I | |
| UBTU-24-300041 | Ubuntu 24.04 LTS must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services, as defined in the Ports, Protocols, and Services Management Category Assurance List (PPSM CAL) and vulnerability assessments. | Check the firewall configuration for any unnecessary or prohibited functions, ports, protocols, and/or services with the following command: $ sudo ufw show raw Chain OUTPUT (policy ACCEPT) target prot opt sources destination Chain INPUT (po | |
| UBTU-24-400000 | Ubuntu 24.04 LTS must uniquely identify interactive users. | Verify Ubuntu 24.04 LTS contains no duplicate User IDs (UIDs) for interactive users with the following command: $ awk -F ":" 'list[$3]++{print $1, $3}' /etc/passwd If output is produced and the accounts listed are interactive user accounts, | |
| UBTU-24-400020 | Ubuntu 24.04 LTS must implement smart card logins for multifactor authentication for local and network access to privileged and nonprivileged accounts. | Verify that the "pam_pkcs11.so" module is configured with the following command: $ grep -r pam_pkcs11.so /etc/pam.d/common-auth auth [success=2 default=ignore] pam_pkcs11.so If the module is not configured, is missing, or commented out, thi | |
| UBTU-24-400030 | Ubuntu 24.04 LTS must implement smart card logins for multifactor authentication for local and network access to privileged and nonprivileged accounts over SSH. | Verify the sshd daemon allows public key authentication with the following command: $ sudo grep -r ^PubkeyAuthentication /etc/ssh/sshd_config* /etc/ssh/sshd_config:PubkeyAuthentication yes If "PubkeyAuthentication" is not set to "yes", is c | |
| UBTU-24-400060 | Ubuntu 24.04 LTS must electronically verify Personal Identity Verification (PIV) credentials. | Verify Ubuntu 24.04 LTS electronically verifies PIV credentials via certificate status checking with the following command: $ sudo grep use_pkcs11_module /etc/pam_pkcs11/pam_pkcs11.conf | awk '/pkcs11_module opensc {/,/}/' /etc/pam_pkcs11/p | |
| UBTU-24-400110 | Ubuntu 24.04 LTS must prevent direct login to the root account. | Verify Ubuntu 24.04 LTS prevents direct logins to the root account with the following command: $ sudo passwd -S root root L 04/08/2024 0 99999 7 -1 If the output does not contain "L" in the second field to indicate the account is locked, th | |
| UBTU-24-400220 | Ubuntu 24.04 LTS must store only encrypted representations of passwords. | Verify the Ubuntu operating system stores only encrypted representations of passwords with the following command: $ grep pam_unix.so /etc/pam.d/common-password password [success=1 default=ignore] pam_unix.so obscure sha512 shadow rounds=100 | |
| UBTU-24-400260 | Ubuntu 24.04 LTS must enforce password complexity by requiring that at least one uppercase character be used. | Verify Ubuntu 24.04 LTS enforces password complexity by requiring that at least one uppercase character be used with the following command: $ grep -i "ucredit" /etc/security/pwquality.conf ucredit=-1 If the "ucredit" parameter is greater th | |
| UBTU-24-400270 | Ubuntu 24.04 LTS must enforce password complexity by requiring that at least one lowercase character be used. | Verify Ubuntu 24.04 LTS enforces password complexity by requiring that at least one lowercase character be used with the following command: $ grep -i "lcredit" /etc/security/pwquality.conf lcredit=-1 If the "lcredit" parameter is greater th | |
| UBTU-24-400280 | Ubuntu 24.04 LTS must enforce password complexity by requiring that at least one numeric character be used. | Verify Ubuntu 24.04 LTS enforces password complexity by requiring that at least one numeric character be used. Determine if the field "dcredit" is set in the "/etc/security/pwquality.conf" file with the following command: $ grep -i "dcredit | |
| UBTU-24-400290 | Ubuntu 24.04 LTS must require the change of at least eight characters when passwords are changed. | Verify Ubuntu 24.04 LTS requires the change of at least eight characters when passwords are changed with the following command: $ grep -i "difok" /etc/security/pwquality.conf difok=8 If the "difok" parameter is less than "8" or is commented | |
| UBTU-24-400300 | Ubuntu 24.04 LTS must enforce 24 hours/1 day as the minimum password lifetime. Passwords for new users must have a 24 hours/1 day minimum password lifetime restriction. | Verify Ubuntu 24.04 LTS enforces a 24 hours/1 day minimum password lifetime for new user accounts with the following command: $ grep -i ^PASS_MIN_DAYS /etc/login.defs PASS_MIN_DAYS 1 If the "PASS_MIN_DAYS" parameter value is less than "1" o | |
| UBTU-24-400310 | Ubuntu 24.04 LTS must be able to enforce a 180-day maximum password lifetime restriction. | Verify Ubuntu 24.04 LTS enforces a 180-day maximum password lifetime for new user accounts with the following command: $ grep -i ^PASS_MAX_DAYS /etc/login.defs PASS_MAX_DAYS 180 If the "PASS_MAX_DAYS" parameter value is less than "180" or i | |
| UBTU-24-400320 | Ubuntu 24.04 LTS must enforce a minimum 15-character password length. | Verify the pwquality configuration file enforces a minimum 15-character password length with the following command: $ grep -i minlen /etc/security/pwquality.conf minlen=15 If "minlen" parameter value is not "15" or higher, is commented out, | |
| UBTU-24-400330 | Ubuntu 24.04 LTS must enforce password complexity by requiring that at least one special character be used. | Determine if the field "ocredit" is set in the "/etc/security/pwquality.conf" file with the following command: $ grep -i "ocredit" /etc/security/pwquality.conf ocredit=-1 If the "ocredit" parameter is greater than "-1", is commented out, or | |
| UBTU-24-400340 | Ubuntu 24.04 LTS must be configured such that Pluggable Authentication Module (PAM) prohibits the use of cached authentications after one day. | Note: If smart card authentication is not being used on the system, this requirement is not applicable. Verify PAM prohibits the use of cached authentications after one day with the following command: $ sudo grep offline_credentials_expirat | |
| UBTU-24-400360 | Ubuntu 24.04 LTS, for PKI-based authentication, SSSD must validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor. | Verify Ubuntu 24.04 LTS, for PKI-based authentication, has valid certificates by constructing a certification path to an accepted trust anchor. Ensure the pam service is listed under [sssd] with the following command: $ sudo grep -A 1 '^\[s | |
| UBTU-24-400370 | Ubuntu 24.04 LTS must map the authenticated identity to the user or group account for PKI-based authentication. | Verify that authenticated certificates are mapped to the appropriate user group in the "/etc/sssd/sssd.conf" file with the following command: $ grep -i ldap_user_certificate /etc/sssd/sssd.conf ldap_user_certificate=userCertificate;binary | |
| UBTU-24-400375 | Ubuntu 24.04 LTS, for PKI-based authentication, Privileged Access Management (PAM) must validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor. | Verify Ubuntu 24.04 LTS, for PKI-based authentication, has valid certificates by constructing a certification path to an accepted trust anchor. Determine which pkcs11 module is being used via the "use_pkcs11_module" in "/etc/pam_pkcs11/pam_ | |
| UBTU-24-400380 | Ubuntu 24.04 LTS for PKI-based authentication, must implement a local cache of revocation data in case of the inability to access revocation information via the network. | Note: If smart card authentication is not being used on the system, this is not applicable. Verify Ubuntu 24.04 LTS, for PKI-based authentication, uses local revocation data when unable to access it from the network with the following comma | |
| UBTU-24-400400 | Ubuntu 24.04 LTS must encrypt all stored passwords with a FIPS 140-3 approved cryptographic hashing algorithm. | Verify the shadow password suite configuration is set to encrypt passwords with a FIPS 140-3 approved cryptographic hashing algorithm with the following command: $ grep -i ENCRYPT_METHOD /etc/login.defs ENCRYPT_METHOD SHA512 If "ENCRYPT_MET | |
| UBTU-24-500010 | Ubuntu 24.04 LTS must generate audit records for privileged activities, nonlocal maintenance, diagnostic sessions, and other system-level access. | Verify Ubuntu 24.04 LTS audits activities performed during nonlocal maintenance and diagnostic sessions with the following command: $ sudo auditctl -l | grep sudo.log -w /var/log/sudo.log -p wa -k maintenance If the command does not return | |
| UBTU-24-500050 | Ubuntu 24.04 LTS must use strong authenticators in establishing nonlocal maintenance and diagnostic sessions. | Verify Ubuntu 24.04 LTS is configured to use strong authenticators in the establishment of nonlocal maintenance and diagnostic maintenance with the following command: $ sudo grep -r ^UsePAM /etc/ssh/sshd_config* /etc/ssh/sshd_config:UsePAM | |
| UBTU-24-600000 | Ubuntu 24.04 LTS must immediately terminate all network connections associated with SSH traffic after a period of inactivity. | Verify that all network connections associated with SSH traffic automatically terminate after a period of inactivity with the following command: $ sudo grep -ir ClientAliveCountMax /etc/ssh/sshd_config* /etc/ssh/sshd_config:ClientAliveCount | |
| UBTU-24-600010 | Ubuntu 24.04 LTS must immediately terminate all network connections associated with SSH traffic at the end of the session or after 10 minutes of inactivity. | Verify that all network connections associated with SSH traffic are automatically terminated at the end of the session or after 10 minutes of inactivity with the following command: $ grep -ir ClientAliveInterval /etc/ssh/sshd_config* /etc/s | |
| UBTU-24-600030 | Ubuntu 24.04 LTS must implement NIST FIPS-validated cryptography to protect classified information and for the following: To provision digital signatures, to generate cryptographic hashes, and to protect unclassified information requiring confidentiality and cryptographic protection in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards. | Verify the system is configured to run in FIPS mode with the following command: $ grep -i 1 /proc/sys/crypto/fips_enabled 1 If a value of "1" is not returned, this is a finding. | |
| UBTU-24-600060 | Ubuntu 24.04 LTS must use DoW PKI-established certificate authorities (CAs) for verification of the establishment of protected sessions. | Verify the directory containing the root certificates for Ubuntu 24.04 LTS contains certificate files for DoW PKI-established CAs by iterating over all files in the "/etc/ssl/certs" directory and checking if, at least one, has the subject m | |
| UBTU-24-600070 | Ubuntu 24.04 LTS must disable kernel core dumps. | Verify kernel core dumps are disabled unless needed with the following command: $ systemctl status kdump-tools.service o kdump-tools.service Loaded: masked (Reason: Unit kdump-tools.service is masked.) Active: inactive (dead) If kdump-tools | |
| UBTU-24-600090 | Ubuntu 24.04 LTS handling data requiring data-at-rest protections must employ cryptographic mechanisms to prevent unauthorized disclosure and modification of the information at rest. | Note: If there is a documented and approved mission requirement for data-at-rest to not be encrypted, this requirement is not applicable. Verify Ubuntu 24.04 LTS prevents unauthorized disclosure or modification of all information requiring | |
| UBTU-24-600130 | Ubuntu 24.04 LTS must ensure only users who need access to security functions are part of sudo group. | Verify the sudo group has only members who require access to security functions with the following command: $ grep sudo /etc/group sudo:x:27:foo If the sudo group contains users not needing access to security functions, this is a finding. | |
| UBTU-24-600140 | Ubuntu 24.04 LTS must restrict access to the kernel message buffer. | Verify Ubuntu 24.04 LTS is configured to restrict access to the kernel message buffer with the following command: $ sysctl kernel.dmesg_restrict kernel.dmesg_restrict = 1 If "kernel.dmesg_restrict" is not set to "1" or is missing, this is a | |
| UBTU-24-600150 | Ubuntu 24.04 LTS must set a sticky bit on all public directories to prevent unauthorized and unintended information transferred via shared system resources. | Verify all public (world-writeable) directories have the public sticky bit set with the following command: $ sudo find / -type d -perm -002 ! -perm -1000 If any world-writable directories are found missing the sticky bit, this is a finding. | |
| UBTU-24-600160 | Ubuntu 24.04 LTS must compare internal information system clocks at least every 24 hours with an authoritative time server. | Note: If the system is not networked, this requirement is not applicable. Verify Ubuntu 24.04 LTS is configured to compare the system clock at least every 24 hours to an authoritative time source with the following command: $ sudo grep -ir | |
| UBTU-24-600180 | Ubuntu 24.04 LTS must synchronize internal information system clocks to the authoritative time source when the time difference is greater than one second. | Verify Ubuntu 24.04 LTS synchronizes internal system clocks to the authoritative time source when the time difference is greater than one second. Check the value of "makestep" with the following command: $ grep makestep /etc/chrony/chrony.c | |
| UBTU-24-600190 | Ubuntu 24.04 LTS must be configured to use TCP syncookies. | Verify Ubuntu 24.04 LTS is configured to use TCP syncookies with the following command: $ sysctl net.ipv4.tcp_syncookies net.ipv4.tcp_syncookies = 1 If the value is not "1", this is a finding. Check the saved value of TCP syncookies with th | |
| UBTU-24-600200 | Ubuntu 24.04 LTS must configure the uncomplicated firewall to rate-limit impacted network interfaces. | Verify an application firewall is configured to rate limit any connection to the system. Check all the services listening to the ports with the following command: $ ss -l46ut Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port Pr | |
| UBTU-24-600230 | Ubuntu 24.04 LTS must disable all wireless network adapters. | Note: This requirement is not applicable for systems that do not have physical wireless network radios. Verify there are no wireless interfaces configured on the system with the following command: $ ls -L -d /sys/class/net/*/wireless | xarg | |
| UBTU-24-700010 | Ubuntu 24.04 LTS must generate error messages that provide information necessary for corrective actions without revealing information that could be exploited by adversaries. | Verify Ubuntu 24.04 LTS has all system log files under the /var/log directory with a permission set to "640" or less permissive with the following command: Note: The btmp, wtmp, lastlog, history, and eipp.log.xz files are excluded from this | |
| UBTU-24-700020 | Ubuntu 24.04 LTS must generate system journal entries without revealing information that could be exploited by adversaries. | Verify the /run/log/journal and /var/log/journal directories have permissions set to default values with the following command: $ sudo find /run/log/journal /var/log/journal -type d -exec stat -c "%n %a" {} \; /run/log/journal 2755 /var/log | |
| UBTU-24-700030 | Ubuntu 24.04 LTS must be configured so that the "journalctl" command is not accessible by unauthorized users. | Verify the journalctl command has a permission set of "740" with the following command: $ sudo find /usr/bin/journalctl -exec stat -c "%n %a" {} \; /usr/bin/journalctl 740 If journalctl is not set to "740", this is a finding | |
| UBTU-24-700040 | Ubuntu 24.04 LTS must be configured so that the "journalctl" command is owned by "root". | Verify the journalctl command is owned by "root" with the following command: $ sudo find /usr/bin/journalctl -exec stat -c "%n %U" {} \; /usr/bin/journalctl root If journalctl is not owned by "root", this is a finding. | |
| UBTU-24-700050 | Ubuntu 24.04 LTS must be configured so that the "journalctl" command is group-owned by "root". | Verify the journalctl command is group-owned by "root" with the following command: $ sudo find /usr/bin/journalctl -exec stat -c "%n %G" {} \; /usr/bin/journalctl root If journalctl is not group-owned by "root", this is a finding | |
| UBTU-24-700060 | Ubuntu 24.04 LTS must configure the directories used by the system journal to be group-owned by "systemd-journal". | Verify the /run/log/journal and /var/log/journal directories are group-owned by "systemd-journal" with the following command: $ sudo find /run/log/journal /var/log/journal -type d -exec stat -c "%n %G" {} \; /run/log/journal systemd-journal | |
| UBTU-24-700070 | Ubuntu 24.04 LTS must configure the files used by the system journal to be group-owned by "systemd-journal". | Verify the /run/log/journal and /var/log/journal files are group-owned by "systemd-journal" with the following command: $ sudo find /run/log/journal /var/log/journal -type f -exec stat -c "%n %G" {} \; /var/log/journal/d5745ad455d34fb8b6f78 | |
| UBTU-24-700080 | Ubuntu 24.04 LTS must configure the directories used by the system journal to be owned by "root". | Verify the /run/log/journal and /var/log/journal directories are owned by "root" with the following command: $ sudo find /run/log/journal /var/log/journal -type d -exec stat -c "%n %U" {} \; /run/log/journal root /var/log/journal root /var/ | |
| UBTU-24-700090 | Ubuntu 24.04 LTS must configure the files used by the system journal to be owned by "root" | Verify the /run/log/journal and /var/log/journal files are owned by "root" with the following command: $ sudo find /run/log/journal /var/log/journal -type f -exec stat -c "%n %U" {} \; /var/log/journal/d5745ad455d34fb8b6f78be37c1fcd3e/syste | |
| UBTU-24-700100 | Ubuntu 24.04 LTS must configure the /var/log directory to be group-owned by syslog. | Verify that Ubuntu 24.04 LTS configures the /var/log directory to be group-owned by "syslog" with the following command: $ stat -c "%n %G" /var/log /var/log syslog If the "/var/log" directory is not group-owned by syslog, this is a finding. | |
| UBTU-24-700110 | Ubuntu 24.04 LTS must configure the /var/log directory to be owned by root. | Verify Ubuntu 24.04 LTS configures the /var/log directory to be owned by "root" with the following command: $ stat -c "%n %U" /var/log /var/log root If the "/var/log" directory is not owned by root, this is a finding. | |
| UBTU-24-700120 | Ubuntu 24.04 LTS must configure the /var/log directory to have mode "0755" or less permissive. | Note: If rsyslog is active and enabled on Ubuntu 24.04 LTS, this requirement is not applicable. Verify Ubuntu 24.04 LTS configures the /var/log directory with a mode of "755" or less permissive with the following command: $ stat -c "%n %a" | |
| UBTU-24-700130 | Ubuntu 24.04 LTS must configure the /var/log/syslog file to be group-owned by adm. | Verify that Ubuntu 24.04 LTS configures the /var/log/syslog file to be group-owned by "adm" with the following command: $ stat -c "%n %G" /var/log/syslog /var/log/syslog adm If the /var/log/syslog file is not group-owned by "adm", this is a | |
| UBTU-24-700140 | Ubuntu 24.04 LTS must configure /var/log/syslog file to be owned by syslog. | Verify that Ubuntu 24.04 LTS configures the /var/log/syslog file to be owned by "syslog" with the following command: $ stat -c "%n %U" /var/log/syslog /var/log/syslog syslog If the "/var/log/syslog" file is not owned by syslog, this is a fi | |
| UBTU-24-700150 | Ubuntu 24.04 LTS must configure /var/log/syslog file with mode "0640" or less permissive. | Verify that Ubuntu 24.04 LTS configures the /var/log/syslog file with mode "0640" or less permissive with the following command: $ stat -c "%n %a" /var/log/syslog /var/log/syslog 640 If a value of "640" or less permissive is not returned, t | |
| UBTU-24-700300 | Ubuntu 24.04 LTS must implement nonexecutable data to protect its memory from unauthorized code execution. | Verify the NX (no-execution) bit flag is set on the system with the following command: $ sudo dmesg | grep -i "execute disable" [ 0.000000] NX (Execute Disable) protection: active If "dmesg" does not show "NX (Execute Disable) protection: a | |
| UBTU-24-700310 | Ubuntu 24.04 LTS must implement address space layout randomization to protect its memory from unauthorized code execution. | Verify Ubuntu 24.04 LTS implements address space layout randomization (ASLR) with the following command: $ sysctl kernel.randomize_va_space kernel.randomize_va_space = 2 If nothing is returned, verify the kernel parameter "randomize_va_spac | |
| UBTU-24-700320 | Ubuntu 24.04 LTS must be configured so that Advance Package Tool (APT) removes all software components after updated versions have been installed. | Verify APT is configured to remove all software components after updated versions have been installed with the following command: $ grep -i remove-unused /etc/apt/apt.conf.d/50unattended-upgrades Unattended-Upgrade::Remove-Unused-Dependenci | |
| UBTU-24-700400 | Ubuntu 24.04 LTS must be a vendor-supported release. | Verify the version of Ubuntu 24.04 LTS is vendor supported with the following command: $ grep DISTRIB_DESCRIPTION /etc/lsb-release DISTRIB_DESCRIPTION="Ubuntu 24.04.3 LTS" Check the subscription status of the system with the following comma | |
| UBTU-24-900040 | Ubuntu 24.04 LTS must be configured so that audit configuration files are not write-accessible by unauthorized users. | Verify /etc/audit/audit.rules, /etc/audit/rules.d/*, and /etc/audit/auditd.conf files have a mode of "0640" or less permissive with the following command: $ sudo ls -al /etc/audit/ /etc/audit/rules.d/ /etc/audit/: -rw-r----- 1 root root 804 | |
| UBTU-24-900050 | Ubuntu 24.04 LTS must permit only authorized accounts to own the audit configuration files. | Verify /etc/audit/audit.rules, /etc/audit/rules.d/*, and /etc/audit/auditd.conf files are owned by "root" account with the following command: $ sudo ls -al /etc/audit/ /etc/audit/rules.d/ /etc/audit/: -rw-r----- 1 root root 804 Nov 25 11:01 | |
| UBTU-24-900060 | Ubuntu 24.04 LTS must permit only authorized groups to own the audit configuration files. | Verify /etc/audit/audit.rules, /etc/audit/rules.d/*, and /etc/audit/auditd.conf files are owned by "root" group with the following command: $ sudo ls -al /etc/audit/ /etc/audit/rules.d/ /etc/audit/: -rw-r----- 1 root root 804 Nov 25 11:01 a | |
| UBTU-24-900070 | Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the su command. | Verify Ubuntu 24.04 LTS generates audit records upon successful/unsuccessful attempts to use the "su" command with the following command: $ sudo auditctl -l | grep /bin/su -a always,exit -F path=/bin/su -F perm=x -F auid>=1000 -F auid!=-1 - | |
| UBTU-24-900080 | Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the chfn command. | Verify Ubuntu 24.04 LTS generates audit records upon successful/unsuccessful attempts to use the "chfn" command with the following command: $ sudo auditctl -l | grep /usr/bin/chfn -a always,exit -F path=/usr/bin/chfn -F perm=x -F auid>=1000 | |
| UBTU-24-900090 | Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the mount command. | Verify Ubuntu 24.04 LTS generates audit records upon successful/unsuccessful attempts to use the "mount" command with the following command: $ sudo auditctl -l | grep /usr/bin/mount -a always,exit -F path=/usr/bin/mount -F perm=x -F auid>=1 | |
| UBTU-24-900100 | Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the umount command. | Verify Ubuntu 24.04 LTS generates audit records upon successful/unsuccessful attempts to use the "umount" command with the following command: $ sudo auditctl -l | grep /usr/bin/umount -a always,exit -F path=/usr/bin/umount -F perm=x -F auid | |
| UBTU-24-900110 | Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the ssh-agent command. | Verify Ubuntu 24.04 LTS generates an audit record upon successful/unsuccessful attempts to use the "ssh-agent" command with the following command: $ sudo auditctl -l | grep /usr/bin/ssh-agent -a always,exit -F path=/usr/bin/ssh-agent -F per | |
| UBTU-24-900120 | Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the ssh-keysign command. | Verify Ubuntu 24.04 LTS generates an audit record upon successful/unsuccessful attempts to use the "ssh-keysign" command with the following command: $ sudo auditctl -l | grep ssh-keysign -a always,exit -F path=/usr/lib/openssh/ssh-keysign - | |
| UBTU-24-900130 | Ubuntu 24.04 LTS must generate audit records for any use of the setxattr, fsetxattr, lsetxattr, removexattr, fremovexattr, and lremovexattr system calls. | Verify Ubuntu 24.04 LTS generates an audit record upon successful/unsuccessful attempts to use the "setxattr", "fsetxattr", "lsetxattr", "removexattr", "fremovexattr", and "lremovexattr" system calls with the following command: $ sudo audit | |
| UBTU-24-900140 | Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the chown, fchown, fchownat, and lchown system calls. | Verify Ubuntu 24.04 LTS generates an audit record upon successful/unsuccessful attempts to use the "chown", "fchown", "fchownat", and "lchown" system calls with the following command: $ sudo auditctl -l | grep chown -a always,exit -F arch=b | |
| UBTU-24-900150 | Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the chmod, fchmod, and fchmodat system calls. | Verify Ubuntu 24.04 LTS generates an audit record upon successful/unsuccessful attempts to use the "chmod", "fchmod", and "fchmodat" system calls with the following command: $ sudo auditctl -l | grep chmod -a always,exit -F arch=b32 -S chmo | |
| UBTU-24-900160 | Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the creat, open, openat, open_by_handle_at, truncate, and ftruncate system calls. | Verify Ubuntu 24.04 LTS generates an audit record upon unsuccessful attempts to use the "creat", "open", "openat", "open_by_handle_at", "truncate", and "ftruncate" system calls with the following command: $ sudo auditctl -l | grep 'open\|tr | |
| UBTU-24-900170 | Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the sudo command. | Verify an audit event is generated for any successful/unsuccessful use of the "sudo" command with the following command: $ sudo auditctl -l | grep /usr/bin/sudo -a always,exit -F path=/usr/bin/sudo -F perm=x -F auid>=1000 -F auid!=-1 -k pri | |
| UBTU-24-900180 | Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the sudoedit command. | Verify Ubuntu 24.04 LTS generates an audit record upon successful/unsuccessful attempts to use the "sudoedit" command with the following command: $ sudo auditctl -l | grep /usr/bin/sudoedit -a always,exit -F path=/usr/bin/sudoedit -F perm=x | |
| UBTU-24-900190 | Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the chsh command. | Verify Ubuntu 24.04 LTS generates an audit record upon successful/unsuccessful attempts to use the "chsh" command with the following command: $ sudo auditctl -l | grep chsh -a always,exit -F path=/usr/bin/chsh -F perm=x -F auid>=1000 -F aui | |
| UBTU-24-900200 | Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the newgrp command. | Verify Ubuntu 24.04 LTS generates an audit record upon successful/unsuccessful attempts to use the "newgrp" command with the following command: $ sudo auditctl -l | grep newgrp -a always,exit -F path=/usr/bin/newgrp -F perm=x -F auid>=1000 | |
| UBTU-24-900210 | Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the chcon command. | Verify Ubuntu 24.04 LTS generates an audit record upon successful/unsuccessful attempts to use the "chcon" command with the following command: $ sudo auditctl -l | grep chcon -a always,exit -F path=/usr/bin/chcon -F perm=x -F auid>=1000 -F | |
| UBTU-24-900220 | Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the apparmor_parser command. | Verify Ubuntu 24.04 LTS generates an audit record upon successful/unsuccessful attempts to use the "apparmor_parser" command with the following command: $ sudo auditctl -l | grep apparmor_parser -a always,exit -F path=/sbin/apparmor_parser | |
| UBTU-24-900230 | Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the setfacl command. | Verify Ubuntu 24.04 LTS generates an audit record upon successful/unsuccessful attempts to use the "setfacl" command with the following command: $ sudo auditctl -l | grep setfacl -a always,exit -F path=/usr/bin/setfacl -F perm=x -F auid>=10 | |
| UBTU-24-900240 | Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the chacl command. | Verify Ubuntu 24.04 LTS generates an audit record upon successful/unsuccessful attempts to use the "chacl" command with the following command: $ sudo audtctl -l | grep chacl -a always,exit -F path=/usr/bin/chacl -F perm=x -F auid>=1000 -F a | |
| UBTU-24-900250 | Ubuntu 24.04 LTS must generate audit records for the use and modification of faillog file. | Verify Ubuntu 24.04 LTS generates an audit record upon successful/unsuccessful modifications to the "faillog" file with the following command: $ sudo auditctl -l | grep faillog -w /var/log/faillog -p wa -k logins If the command does not ret | |
| UBTU-24-900260 | Ubuntu 24.04 LTS must generate audit records for the use and modification of the lastlog file. | Verify Ubuntu 24.04 LTS generates an audit record when successful/unsuccessful modifications to the "lastlog" file occur with the following command: $ sudo auditctl -l | grep lastlog -w /var/log/lastlog -p wa -k logins If the command does n | |
| UBTU-24-900270 | Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the passwd command. | Verify that an audit event is generated for any successful/unsuccessful use of the "passwd" command with the following command: $ sudo auditctl -l | grep -w passwd -a always,exit -S all -F path=/usr/bin/passwd -F perm=x -F auid>=1000 -F aui | |
| UBTU-24-900280 | Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the unix_update command. | Verify that an audit event is generated for any successful/unsuccessful use of the "unix_update" command with the following command: $ sudo auditctl -l | grep -w unix_update -a always,exit -F path=/sbin/unix_update -F perm=x -F auid>=1000 - | |
| UBTU-24-900290 | Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the gpasswd command. | Verify that an audit event is generated for any successful/unsuccessful use of the "gpasswd" command with the following command: $ sudo auditctl -l | grep -w gpasswd -a always,exit -F path=/usr/bin/gpasswd -F perm=x -F auid>=1000 -F auid!=- | |
| UBTU-24-900300 | Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the chage command. | Verify that an audit event is generated for any successful/unsuccessful use of the "chage" command with the following command: $ sudo auditctl -l | grep -w chage -a always,exit -F path=/usr/bin/chage -F perm=x -F auid>=1000 -F auid!=-1 -k p | |
| UBTU-24-900310 | Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the usermod command. | Verify an audit event is generated for any successful/unsuccessful use of the "usermod" command with the following command: $ sudo auditctl -l | grep -w usermod -a always,exit -F path=/usr/sbin/usermod -F perm=x -F auid>=1000 -F auid!=-1 -k | |
| UBTU-24-900315 | Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the useradd command. | Verify an audit event is generated for any successful/unsuccessful use of the "useradd" command with the following command: $ sudo auditctl -l | grep -w useradd -a always,exit -F path=/usr/sbin/useradd -F perm=x -F auid>=1000 -F auid!=-1 -k | |
| UBTU-24-900320 | Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the crontab command. | Verify an audit event is generated for any successful/unsuccessful use of the "crontab" command with the following command: $ sudo auditctl -l | grep -w crontab -a always,exit -F path=/usr/bin/crontab -F perm=x -F auid>=1000 -F auid!=-1 -k | |
| UBTU-24-900330 | Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the pam_timestamp_check command. | Verify an audit event is generated for any successful/unsuccessful use of the "pam_timestamp_check" command with the following command: $ sudo auditctl -l | grep -w pam_timestamp_check -a always,exit -F path=/usr/sbin/pam_timestamp_check -F | |
| UBTU-24-900340 | Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the init_module and finit_module syscalls. | Verify Ubuntu 24.04 LTS generates an audit record for any successful/unsuccessful attempts to use the "init_module" and "finit_module" syscalls with the following command: $ sudo auditctl -l | grep init_module -a always,exit -F arch=b32 -S | |
| UBTU-24-900350 | Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the delete_module syscall. | Verify Ubuntu 24.04 LTS generates an audit record for any successful/unsuccessful attempts to use the "delete_module" syscall with the following command: $ sudo auditctl -l | grep -w delete_module -a always,exit -F arch=b32 -S delete_module | |
| UBTU-24-900510 | Ubuntu 24.04 LTS must generate audit records when successful/unsuccessful attempts to modify the /etc/sudoers file occur. | Verify Ubuntu 24.04 LTS generates audit records for all modifications that affect "/etc/sudoers" with the following command: $ sudo auditctl -l | grep sudoers -w /etc/sudoers -p wa -k privilege_modification If the command does not return a | |
| UBTU-24-900520 | Ubuntu 24.04 LTS must generate audit records when successful/unsuccessful attempts to modify the /etc/sudoers.d directory occur. | Verify Ubuntu 24.04 LTS generates audit records for all modifications that affect "/etc/sudoers.d" directory with the following command: $ sudo auditctl -l | grep sudoers.d -w /etc/sudoers.d -p wa -k privilege_modification If the command do | |
| UBTU-24-900540 | Ubuntu 24.04 LTS must generate audit records for any successful/unsuccessful use of unlink, unlinkat, rename, renameat, and rmdir system calls. | Verify Ubuntu 24.04 LTS generates audit records for any successful/unsuccessful use of "unlink", "unlinkat", "rename", "renameat", and "rmdir" system calls with the following command: $ sudo auditctl -l | grep 'unlink\|rename\|rmdir' -a alw | |
| UBTU-24-900590 | Ubuntu 24.04 LTS must generate audit records for the /var/log/wtmp file. | Verify Ubuntu 24.04 LTS generates audit records showing start and stop times for user access to the system via the "/var/log/wtmp" file with the following command: $ sudo auditctl -l | grep '/var/log/wtmp' -w /var/log/wtmp -p wa -k logins I | |
| UBTU-24-900600 | Ubuntu 24.04 LTS must generate audit records for the /var/run/utmp file. | Verify Ubuntu 24.04 LTS generates audit records showing start and stop times for user access to the system via the "/var/run/utmp" file with the following command: $ sudo auditctl -l | grep '/var/run/utmp' -w /var/run/utmp -p wa -k logins I | |
| UBTU-24-900610 | Ubuntu 24.04 LTS must generate audit records for the /var/log/btmp file. | Verify Ubuntu 24.04 LTS generates audit records showing start and stop times for user access to the system via the "/var/log/btmp" file with the following command: $ sudo auditctl -l | grep '/var/log/btmp' -w /var/log/btmp -p wa -k logins I | |
| UBTU-24-900730 | Ubuntu 24.04 LTS must generate audit records when successful/unsuccessful attempts to use modprobe command. | Verify if Ubuntu 24.04 LTS is configured to audit the execution of the module management program "modprobe" with the following command: $ sudo auditctl -l | grep '/sbin/modprobe' -w /sbin/modprobe -p x -k modules If the command does not ret | |
| UBTU-24-900740 | Ubuntu 24.04 LTS must generate audit records when successful/unsuccessful attempts to use the kmod command. | Verify Ubuntu 24.04 LTS is configured to audit the execution of the module management program "kmod" with the following command: $ sudo auditctl -l | grep kmod -w /bin/kmod -p x -k module If the command does not return a line, or the line i | |
| UBTU-24-900750 | Ubuntu 24.04 LTS must generate audit records when successful/unsuccessful attempts to use the fdisk command. | Verify Ubuntu 24.04 LTS is configured to audit the execution of the partition management program "fdisk" with the following command: $ sudo auditctl -l | grep fdisk -w /usr/sbin/fdisk -p x -k fdisk If the command does not return a line, or | |
| UBTU-24-900920 | Ubuntu 24.04 LTS must allocate audit record storage capacity to store at least one week's worth of audit records, when audit records are not immediately sent to a central audit record storage facility. | Verify Ubuntu 24.04 LTS allocates audit record storage capacity to store at least one week's worth of audit records when audit records are not immediately sent to a central audit record storage facility. Determine which partition the audit | |
| UBTU-24-900950 | Ubuntu 24.04 LTS must have a crontab script running weekly to offload audit events of standalone systems. | Note: If this is an interconnected system, this is not applicable. Verify there is a script that offloads audit data and that script runs weekly with the following command: $ ls /etc/cron.weekly audit-offload Check if the script inside the | |
| UBTU-24-900960 | Ubuntu 24.04 LTS must immediately notify the system administrator (SA) and information system security officer (ISSO) (at a minimum) when allocated audit record storage volume reaches 75 percent of the repository maximum audit record storage capacity. | Verify Ubuntu 24.04 LTS notifies the SA and ISSO (at a minimum) when allocated audit record storage volume reaches 75 percent of the repository maximum audit record storage capacity with the following command: Note: If the space_left_action | |
| UBTU-24-900980 | Ubuntu 24.04 LTS must alert the system administrator (SA) and information system security officer (ISSO) (at a minimum) in the event of an audit processing failure. | Verify that the SA and ISSO (at a minimum) are notified in the event of an audit processing failure with the following command: $ sudo grep '^action_mail_acct' /etc/audit/auditd.conf action_mail_acct = If the value of the "action_mail_acct" | |
| UBTU-24-901220 | Ubuntu 24.04 LTS must record time stamps for audit records that can be mapped to Coordinated Universal Time (UTC) or Greenwich Mean Time (GMT). | Verify the time zone is configured to use UTC or GMT with the following command: $ timedatectl status | grep -i "time zone" Time zone: UTC (UTC, +0000) If "Timezone" is not set to UTC or GMT, this is a finding. | |
| UBTU-24-901230 | Ubuntu 24.04 LTS must configure audit tools with a mode of "0755" or less permissive. | Verify Ubuntu 24.04 LTS configures the audit tools to have a file permission of "0755" or less to prevent unauthorized access with the following command: $ stat -c "%n %a" /sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/autrace /sbin/aud | |
| UBTU-24-901240 | Ubuntu 24.04 LTS must configure audit tools to be owned by root. | Verify Ubuntu 24.04 LTS configures the audit tools to be owned by root to prevent any unauthorized access with the following command: $ stat -c "%n %U" /sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/autrace /sbin/auditd /sbin/audispd* / | |
| UBTU-24-901250 | Ubuntu 24.04 LTS must configure the audit tools to be group owned by root. | Verify Ubuntu 24.04 LTS configures the audit tools to be group owned by root to prevent any unauthorized access with the following command: $ stat -c "%n %G" /sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/autrace /sbin/auditd /sbin/audi | |
| UBTU-24-901260 | Ubuntu 24.04 LTS must have directories that contain system commands set to a mode of "0755" or less permissive. | Verify the system commands directories have mode "0755" or less permissive with the following command: $ find /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin -perm /022 -type d -exec stat -c "%n %a" '{}' \; If any directories a | |
| UBTU-24-901270 | Ubuntu 24.04 LTS must have directories that contain system commands owned by root. | Verify the system commands directories are owned by root with the following command: $ sudo find /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin ! -user root -type d -exec stat -c "%n %U" '{}' \; If any system commands director | |
| UBTU-24-901280 | Ubuntu 24.04 LTS must have directories that contain system commands group-owned by root. | Verify the system commands directories are group-owned by root with the following command: $ sudo find /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin ! -group root -type d -exec stat -c "%n %G" '{}' \; If any system commands d | |
| UBTU-24-901300 | Ubuntu 24.04 LTS must be configured so that audit log files are not read or write-accessible by unauthorized users. | Verify that the audit log files have a mode of "0600" or less permissive. Determine where the audit logs are stored with the following command: $ sudo grep -iw log_file /etc/audit/auditd.conf log_file = /var/log/audit/audit.log Using the pa | |
| UBTU-24-901310 | Ubuntu 24.04 LTS must be configured to permit only authorized users ownership of the audit log files. | Verify the audit log files are owned by "root" account. Determine where the audit logs are stored with the following command: $ sudo grep -iw log_file /etc/audit/auditd.conf log_file = /var/log/audit/audit.log Using the path of the director | |
| UBTU-24-901350 | Ubuntu 24.04 LTS must permit only authorized groups ownership of the audit log files. | Verify the group owner is set to own newly created audit logs in the audit configuration file with the following command: $ sudo grep -iw log_group /etc/audit/auditd.conf log_group = root If the value of the "log_group" parameter is other t | |
| UBTU-24-901380 | Ubuntu 24.04 LTS must be configured so that the audit log directory is not write-accessible by unauthorized users. | Verify that the audit log directory has a mode of "0750" or less permissive. Determine where the audit logs are stored with the following command: $ sudo grep -iw ^log_file /etc/audit/auditd.conf log_file = /var/log/audit/audit.log Using th | |
| UBTU-24-909000 | Ubuntu 24.04 LTS audit system must protect auditing rules from unauthorized change. | Verify the running audit system prevents unauthorized changes (is immutable) with the following command: $ sudo auditctl -s | grep "enabled" enabled 2 If the "enabled" value returned is not "2", this is a finding. Verify that the audit syst | |
| UBTU-24-909890 | Ubuntu 24.04 LTS must use cryptographic mechanisms to protect the integrity of audit tools. | Verify that the Advanced Intrusion Detection Environment (AIDE) is configured to use cryptographic mechanisms to protect the integrity of the audit tools. First, verify that the audit tools are configured within AIDE's sub-configuration dir |
195 of 195.