DISA STIG library V2R10
| Ref | Title | Text | |
|---|---|---|---|
| UBTU-22-211000 | Ubuntu 22.04 LTS must be a vendor-supported release. | Verify the version of Ubuntu 22.04 LTS is vendor supported with the following command: $ grep DISTRIB_DESCRIPTION /etc/lsb-release DISTRIB_DESCRIPTION="Ubuntu 22.04.1 LTS" Check the subscription status of the system with the following comma | |
| UBTU-22-211015 | Ubuntu 22.04 LTS must disable the x86 Ctrl-Alt-Delete key sequence. | Verify Ubuntu 22.04 LTS is not configured to reboot the system when Ctrl-Alt-Delete is pressed by using the following command: $ systemctl status ctrl-alt-del.target ctrl-alt-del.target Loaded: masked (Reason: Unit ctrl-alt-del.target is ma | |
| UBTU-22-212010 | Ubuntu 22.04 LTS, when booted, must require authentication upon booting into single-user and maintenance modes. | Verify Ubuntu 22.04 LTS requires a password for authentication upon booting into single-user and maintenance modes by using the following command: $ sudo grep -i password /boot/grub/grub.cfg password_pbkdf2 root grub.pbkdf2.sha512.10000.032 | |
| UBTU-22-212015 | Ubuntu 22.04 LTS must initiate session audits at system startup. | Verify that Ubuntu 22.04 LTS enables auditing at system startup in GRUB. Check the main GRUB defaults to ensure auditing is enabled: $ sudo grep -ir GRUB_CMDLINE_LINUX /etc/default/grub /etc/default/grub:GRUB_CMDLINE_LINUX_DEFAULT="audit=1" | |
| UBTU-22-213010 | Ubuntu 22.04 LTS must restrict access to the kernel message buffer. | Verify Ubuntu 22.04 LTS is configured to restrict access to the kernel message buffer by using the following command: $ sysctl kernel.dmesg_restrict kernel.dmesg_restrict = 1 If "kernel.dmesg_restrict" is not set to "1" or is missing, this | |
| UBTU-22-213015 | Ubuntu 22.04 LTS must disable kernel core dumps so that it can fail to a secure state if system initialization fails, shutdown fails or aborts fail. | Verify that kernel core dumps are disabled unless needed by using the following command: $ systemctl status kdump-tools.service o kdump-tools.service Loaded: masked (Reason: Unit kdump-tools.service is masked.) Active: inactive (dead) If kd | |
| UBTU-22-213020 | Ubuntu 22.04 LTS must implement address space layout randomization to protect its memory from unauthorized code execution. | Verify Ubuntu 22.04 LTS implements address space layout randomization (ASLR) by using the following command: $ sysctl kernel.randomize_va_space kernel.randomize_va_space = 2 If no output is returned, verify the kernel parameter "randomize_v | |
| UBTU-22-213025 | Ubuntu 22.04 LTS must implement nonexecutable data to protect its memory from unauthorized code execution. | Verify the NX (no-execution) bit flag is set on the system by using the following command: $ sudo dmesg | grep -i "execute disable" [ 0.000000] NX (Execute Disable) protection: active If "dmesg" does not show "NX (Execute Disable) protectio | |
| UBTU-22-214010 | Ubuntu 22.04 LTS must be configured so that the Advance Package Tool (APT) prevents the installation of patches, service packs, device drivers, or operating system components without verification they have been digitally signed using a certificate that is recognized and approved by the organization. | Verify that APT is configured to prevent the installation of patches, service packs, device drivers, or Ubuntu operating system components without verification they have been digitally signed using a certificate that is recognized and appro | |
| UBTU-22-214015 | Ubuntu 22.04 LTS must be configured so that the Advance Package Tool (APT) removes all software components after updated versions have been installed. | Verify APT is configured to remove all software components after updated versions have been installed by using the following command: $ grep -i remove-unused /etc/apt/apt.conf.d/50unattended-upgrades Unattended-Upgrade::Remove-Unused-Kernel | |
| UBTU-22-215010 | Ubuntu 22.04 LTS must have the "libpam-pwquality" package installed. | Verify Ubuntu 22.04 LTS has the "libpam-pwquality" package installed with the following command: $ dpkg -l | grep libpam-pwquality ii libpam-pwquality:amd64 1.4.4-1build2 amd64 PAM module to check password strength If "libpam-pwquality" is | |
| UBTU-22-215015 | Ubuntu 22.04 LTS must have the "chrony" package installed. | Verify the "chrony" package is installed using the following command: $ dpkg -l | grep chrony ii chrony 4.2-2ubuntu2 amd64 Versatile implementation of the Network Time Protocol If the "chrony" package is not installed, this is a finding. | |
| UBTU-22-215020 | Ubuntu 22.04 LTS must not have the "systemd-timesyncd" package installed. | Verify that the "systemd-timesyncd" package is not installed by using the following command: $ dpkg -l | grep systemd-timesyncd If the "systemd-timesyncd" package is installed, this is a finding. | |
| UBTU-22-215025 | Ubuntu 22.04 LTS must not have the "ntp" package installed. | Verify that the "ntp" package is not installed by using the following command: $ dpkg -l | grep ntp If the "ntp" package is installed, this is a finding. | |
| UBTU-22-215030 | Ubuntu 22.04 LTS must not have the "rsh-server" package installed. | Verify the "rsh-server" package is not installed by using the following command: $ dpkg -l | grep rsh-server If the "rsh-server" package is installed, this is a finding. | |
| UBTU-22-215035 | Ubuntu 22.04 LTS must not have the "telnet" package installed. | Verify that the "telnetd" package is not installed on Ubuntu 22.04 LTS by using the following command: $ dpkg -l | grep telnetd If the "telnetd" package is installed, this is a finding. | |
| UBTU-22-215040 | Ubuntu 22.04 LTS must not have the nfs-kernel-server package installed. | Note: If NFS mounts are authorized and in use on the system, this control is not applicable. Verify that Ubuntu does not have the nfs-kernel-server package installed. Determine if packages are installed: $ sudo dpkg -l | grep -E 'nfs-kernel | |
| UBTU-22-231010 | Ubuntu 22.04 LTS must implement cryptographic mechanisms to prevent unauthorized disclosure and modification of all information that requires protection at rest. | Verify Ubuntu 22.04 LTS prevents unauthorized disclosure or modification of all information requiring at-rest protection by using disk encryption. Note: If there is a documented and approved reason for not having data-at-rest encryption, th | |
| UBTU-22-232010 | Ubuntu 22.04 LTS must have directories that contain system commands set to a mode of "755" or less permissive. | Verify the system commands directories have mode "755" or less permissive by using the following command: $ find /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin -perm /022 -type d -exec stat -c "%n %a" '{}' \; If any directorie | |
| UBTU-22-232015 | Ubuntu 22.04 LTS must have system commands set to a mode of "755" or less permissive. | Verify the system commands contained in the following directories have mode "755" or less permissive by using the following command: $ sudo find /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin -perm /022 -type f -exec stat -c " | |
| UBTU-22-232020 | Ubuntu 22.04 LTS library files must have mode "755" or less permissive. | Verify the systemwide shared library files contained in the directories "/lib", "/lib64", "/usr/lib", and "/usr/lib64" have mode 0755 or less permissive. Check that the systemwide shared library files have mode 0755 or less permissive with | |
| UBTU-22-232025 | Ubuntu 22.04 LTS must configure the "/var/log" directory to have mode "755" or less permissive. | Verify the "/var/log" directory has mode of "755" or less permissive by using the following command: Note: If rsyslog is active and enabled on the operating system, this requirement is not applicable. $ stat -c "%n %a" /var/log /var/log 755 | |
| UBTU-22-232026 | Ubuntu 22.04 LTS must generate error messages that provide information necessary for corrective actions without revealing information that could be exploited by adversaries. | Verify Ubuntu 22.04 LTS has all system log files under the "/var/log" directory with a permission set to "640" or less permissive by using the following command: Note: The btmp, wtmp, and lastlog files are excluded. Refer to the Discussion | |
| UBTU-22-232027 | Ubuntu 22.04 LTS must generate system journal entries without revealing information that could be exploited by adversaries. | Verify the /run/log/journal and /var/log/journal directories have permissions set to "2750" or less permissive by using the following command: $ sudo find /run/log/journal /var/log/journal -type d -exec stat -c "%n %a" {} \; /run/log/journa | |
| UBTU-22-232030 | Ubuntu 22.04 LTS must configure "/var/log/syslog" file with mode "640" or less permissive. | Verify that Ubuntu 22.04 LTS configures the "/var/log/syslog" file with mode "640" or less permissive by using the following command: $ stat -c "%n %a" /var/log/syslog /var/log/syslog 640 If a value of "640" or less permissive is not return | |
| UBTU-22-232035 | Ubuntu 22.04 LTS must configure audit tools with a mode of "755" or less permissive. | Verify Ubuntu 22.04 LTS configures the audit tools to have a file permission of "755" or less to prevent unauthorized access by using the following command: $ stat -c "%n %a" /sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/autrace /sbin/ | |
| UBTU-22-232040 | Ubuntu 22.04 LTS must have directories that contain system commands owned by "root". | Verify the system commands directories are owned by "root" by using the following command: $ sudo find /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin ! -user root -type d -exec stat -c "%n %U" '{}' \; If any system commands di | |
| UBTU-22-232045 | Ubuntu 22.04 LTS must have directories that contain system commands group-owned by "root". | Verify the system commands directories are group-owned by "root" by using the following command: $ sudo find /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin ! -group root -type d -exec stat -c "%n %G" '{}' \; If any system comm | |
| UBTU-22-232050 | Ubuntu 22.04 LTS must have system commands owned by "root" or a system account. | Verify the system commands contained in the following directories are owned by "root", or a required system account, by using the following command: $ sudo find /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin ! -user root -type | |
| UBTU-22-232055 | Ubuntu 22.04 LTS must have system commands group-owned by "root" or a system account. | Verify the system commands contained in the following directories are group-owned by "root" or a required system account by using the following command: $ sudo find -L /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin ! -group ro | |
| UBTU-22-232060 | Ubuntu 22.04 LTS library directories must be owned by "root". | Verify the systemwide shared library directories "/lib", "/lib64", and "/usr/lib" are owned by "root" by using the following command: $ sudo find /lib /usr/lib /lib64 ! -user root -type d -exec stat -c "%n %U" '{}' \; If any systemwide libr | |
| UBTU-22-232065 | Ubuntu 22.04 LTS library directories must be group-owned by "root". | Verify the systemwide library directories "/lib", "/lib64", and "/usr/lib" are group-owned by "root" by using the following command: $ sudo find /lib /usr/lib /lib64 ! -group root -type d -exec stat -c "%n %G" '{}' \; If any systemwide shar | |
| UBTU-22-232070 | Ubuntu 22.04 LTS library files must be owned by "root". | Verify the systemwide shared library files contained in the directories "/lib", "/lib64", "/usr/lib", and "/usr/lib64" are owned by root with the following command: $ sudo find /lib /lib64 /usr/lib /usr/lib64 -type f -name '*.so*' ! -user r | |
| UBTU-22-232075 | Ubuntu 22.04 LTS library files must be group-owned by "root". | Verify the systemwide shared library files contained in the directories "/lib", "/lib64", "/usr/lib", and "/usr/lib64" are group owned by root with the following command: $ sudo find /lib /lib64 /usr/lib /usr/lib64 -type f -name '*.so*' ! - | |
| UBTU-22-232080 | Ubuntu 22.04 LTS must configure the directories used by the system journal to be owned by "root". | Verify the /run/log/journal and /var/log/journal directories are owned by "root" by using the following command: $ sudo find /run/log/journal /var/log/journal -type d -exec stat -c "%n %U" {} \; /run/log/journal root /var/log/journal root / | |
| UBTU-22-232085 | Ubuntu 22.04 LTS must configure the directories used by the system journal to be group-owned by "systemd-journal". | Verify the /run/log/journal and /var/log/journal directories are group-owned by "systemd-journal" by using the following command: $ sudo find /run/log/journal /var/log/journal -type d -exec stat -c "%n %G" {} \; /run/log/journal systemd-jou | |
| UBTU-22-232090 | Ubuntu 22.04 LTS must configure the files used by the system journal to be owned by "root". | Verify the /run/log/journal and /var/log/journal files are owned by "root" by using the following command: $ sudo find /run/log/journal /var/log/journal -type f -exec stat -c "%n %U" {} \; /var/log/journal/3b018e681c904487b11671b9c1987cce/s | |
| UBTU-22-232095 | Ubuntu 22.04 LTS must configure the files used by the system journal to be group-owned by "systemd-journal". | Verify the /run/log/journal and /var/log/journal files are group-owned by "systemd-journal" by using the following command: $ sudo find /run/log/journal /var/log/journal -type f -exec stat -c "%n %G" {} \; /var/log/journal/3b018e681c904487b | |
| UBTU-22-232100 | Ubuntu 22.04 LTS must be configured so that the "journalctl" command is owned by "root". | Verify that the "journalctl" command is owned by "root" by using the following command: $ sudo find /usr/bin/journalctl -exec stat -c "%n %U" {} \; /usr/bin/journalctl root If "journalctl" is not owned by "root", this is a finding. | |
| UBTU-22-232105 | Ubuntu 22.04 LTS must be configured so that the "journalctl" command is group-owned by "root". | Verify that the "journalctl" command is group-owned by "root" by using the following command: $ sudo find /usr/bin/journalctl -exec stat -c "%n %G" {} \; /usr/bin/journalctl root If "journalctl" is not group-owned by "root", this is a findi | |
| UBTU-22-232110 | Ubuntu 22.04 LTS must configure audit tools to be owned by "root". | Verify Ubuntu 22.04 LTS configures the audit tools to be owned by "root" to prevent any unauthorized access with the following command: $ stat -c "%n %U" /sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/autrace /sbin/auditd /sbin/audisp* | |
| UBTU-22-232120 | Ubuntu 22.04 LTS must configure the "/var/log" directory to be owned by "root". | Verify Ubuntu 22.04 LTS configures the "/var/log" directory to be owned by "root" by using the following command: $ stat -c "%n %U" /var/log /var/log root If the "/var/log" directory is not owned by "root", this is a finding. | |
| UBTU-22-232125 | Ubuntu 22.04 LTS must configure the "/var/log" directory to be group-owned by "syslog". | Verify that Ubuntu 22.04 LTS configures the "/var/log" directory to be group-owned by "syslog" by using the following command: $ stat -c "%n %G" /var/log /var/log syslog If the "/var/log" directory is not group-owned by "syslog", this is a | |
| UBTU-22-232130 | Ubuntu 22.04 LTS must configure "/var/log/syslog" file to be owned by "syslog". | Verify that Ubuntu 22.04 LTS configures the "/var/log/syslog" file to be owned by "syslog" by using the following command: $ stat -c "%n %U" /var/log/syslog /var/log/syslog If the "/var/log/syslog" file is not owned by "syslog", this is a f | |
| UBTU-22-232135 | Ubuntu 22.04 LTS must configure the "/var/log/syslog" file to be group-owned by "adm". | Verify that Ubuntu 22.04 LTS configures the "/var/log/syslog" file to be group-owned by "adm" by using the following command: $ stat -c "%n %G" /var/log/syslog /var/log/syslog adm If the "/var/log/syslog" file is not group-owned by "adm", t | |
| UBTU-22-232140 | Ubuntu 22.04 LTS must be configured so that the "journalctl" command is not accessible by unauthorized users. | Verify that the "journalctl" command has a permission set of "740" by using the following command: $ sudo find /usr/bin/journalctl -exec stat -c "%n %a" {} \; /usr/bin/journalctl 740 If "journalctl" is not set to "740", this is a finding. | |
| UBTU-22-232145 | Ubuntu 22.04 LTS must set a sticky bit on all public directories to prevent unauthorized and unintended information transferred via shared system resources. | Verify that all public directories have the public sticky bit set by using the following command: $ sudo find / -type d -perm -002 ! -perm -1000 If any public directories are found missing the sticky bit, this is a finding. | |
| UBTU-22-251010 | Ubuntu 22.04 LTS must have an application firewall installed in order to control remote access methods. | Verify that the Uncomplicated Firewall is installed by using the following command: $ dpkg -l | grep ufw ii ufw 0.36.1-4ubuntu0.1 all program for managing a Netfilter firewall If the "ufw" package is not installed, ask the system administra | |
| UBTU-22-251015 | Ubuntu 22.04 LTS must enable and run the Uncomplicated Firewall (ufw). | Verify the ufw is enabled on the system with the following command: $ sudo ufw status Status: active If the above command returns the status as "inactive" or any type of error, this is a finding. | |
| UBTU-22-251020 | Ubuntu 22.04 LTS must have an application firewall enabled. | Verify the ufw is enabled on the system with the following command: $ sudo ufw status Status: active If the above command returns the status as "inactive" or any type of error, this is a finding. If the ufw is not installed, ask the system | |
| UBTU-22-251025 | Ubuntu 22.04 LTS must configure the Uncomplicated Firewall (ufw) to rate-limit impacted network interfaces. | Verify an application firewall is configured to rate limit any connection to the system. Check all the services listening to the ports by using the following command: $ ss -l46ut Netid State Recv-Q Send-Q Local Address:Port Peer Address:Por | |
| UBTU-22-251030 | Ubuntu 22.04 LTS must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments. | Check the firewall configuration for any unnecessary or prohibited functions, ports, protocols, and/or services by using the following command: $ sudo ufw show raw Chain INPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in | |
| UBTU-22-252010 | Ubuntu 22.04 LTS must, for networked systems, compare internal information system clocks at least every 24 hours with a server synchronized to one of the redundant United States Naval Observatory (USNO) time servers, or a time server designated for the appropriate DoW network (NIPRNet/SIPRNet), and/or the Global Positioning System (GPS). | Verify Ubuntu 22.04 LTS is configured to compare the system clock at least every 24 hours to the authoritative time source by using the following command: Note: If the system is not networked, this requirement is not applicable. $ sudo grep | |
| UBTU-22-252015 | Ubuntu 22.04 LTS must synchronize internal information system clocks to the authoritative time source when the time difference is greater than one second. | Verify Ubuntu 22.04 LTS synchronizes internal system clocks to the authoritative time source when the time difference is greater than one second. Note: If the system is not networked, this requirement is not applicable. Check the value of " | |
| UBTU-22-252020 | Ubuntu 22.04 LTS must record time stamps for audit records that can be mapped to Coordinated Universal Time (UTC). | Verify the time zone is configured to use UTC by using the following command: $ timedatectl status | grep -i "time zone" Time zone: Etc/UTC (UTC, +0000) If "Time zone" is not set to UTC, this is a finding. | |
| UBTU-22-253010 | Ubuntu 22.04 LTS must be configured to use TCP syncookies. | Verify Ubuntu 22.04 LTS is configured to use TCP syncookies by using the following command: $ sysctl net.ipv4.tcp_syncookies net.ipv4.tcp_syncookies = 1 If the value is not "1", this is a finding. Check the saved value of TCP syncookies by | |
| UBTU-22-254010 | Ubuntu 22.04 LTS must have the "SSSD" package installed. | Verify Ubuntu 22.04 LTS has the packages required for multifactor authentication installed with the following command: $ dpkg -l | grep sssd ii sssd 2.9.4-1.1ubuntu6.1 amd64 System Security Services Daemon -- metapackage ii sssd-ad 2.9.4-1. | |
| UBTU-22-254015 | Ubuntu 22.04 LTS must use the "SSSD" package for multifactor authentication services. | Verify the "sssd.service" is enabled and active with the following commands: $ sudo systemctl is-enabled sssd enabled $ sudo systemctl is-active sssd active If "sssd.service" is not active or enabled, this is a finding. | |
| UBTU-22-254020 | Ubuntu 22.04 LTS must ensure SSSD performs certificate path validation, including revocation checking, against a trusted anchor for PKI-based authentication. | Verify Ubuntu 22.04 LTS, for PKI-based authentication, has valid certificates by constructing a certification path to an accepted trust anchor. Verify the pam service is listed under [sssd] with the following command: $ sudo grep -A 1 '^\[s | |
| UBTU-22-254030 | Ubuntu 22.04 LTS must map the authenticated identity to the user or group account for PKI-based authentication. | Verify that authenticated certificates are mapped to the appropriate user group in the "/etc/sssd/sssd.conf" file with the following command: $ grep -i ldap_user_certificate /etc/sssd/sssd.conf ldap_user_certificate=userCertificate;binary | |
| UBTU-22-255010 | Ubuntu 22.04 LTS must have SSH installed. | Verify the SSH package is installed by using the following command: $ sudo dpkg -l | grep openssh ii openssh-client 1:8.9p1-3ubuntu0.4 amd64 secure shell (SSH) client, for secure access to remote machines ii openssh-server 1:8.9p1-3ubuntu0. | |
| UBTU-22-255015 | Ubuntu 22.04 LTS must use SSH to protect the confidentiality and integrity of transmitted information. | Verify the "ssh.service" is enabled and active by using the following commands: $ sudo systemctl is-enabled ssh enabled $ sudo systemctl is-active ssh active If "ssh.service" is not enabled and active, this is a finding. | |
| UBTU-22-255020 | Ubuntu 22.04 LTS must display the Standard Mandatory DoW Notice and Consent Banner before granting any local or remote connection to the system. | Verify Ubuntu 22.04 LTS displays the Standard Mandatory DoW Notice and Consent Banner before granting access to Ubuntu 22.04 LTS via an SSH logon by using the following command: $ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | | |
| UBTU-22-255025 | Ubuntu 22.04 LTS must not allow unattended or automatic login via SSH. | Verify that unattended or automatic login via SSH is disabled by using the following command: $ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iEH '(permit(.*?)(passwords|environment | |
| UBTU-22-255030 | Ubuntu 22.04 LTS must be configured so that all network connections associated with SSH traffic terminate after becoming unresponsive. | Verify the SSH server automatically terminates a user session after the SSH client has become unresponsive by using the following command: $ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo | |
| UBTU-22-255035 | Ubuntu 22.04 LTS must be configured so that all network connections associated with SSH traffic are terminated after 10 minutes of becoming unresponsive. | Verify the SSH server automatically terminates a user session after the SSH client has been unresponsive for 10 minutes by using the following command: $ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | |
| UBTU-22-255040 | Ubuntu 22.04 LTS must be configured so that remote X connections are disabled, unless to fulfill documented and validated mission requirements. | Verify that X11 forwarding is disabled by using the following command: $ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH 'x11forwarding' /etc/ssh/sshd_config:X11Forwarding no If "X | |
| UBTU-22-255045 | Ubuntu 22.04 LTS SSH daemon must prevent remote hosts from connecting to the proxy display. | Verify the SSH server prevents remote hosts from connecting to the proxy display by using the following command: $ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH 'x11uselocalhost' | |
| UBTU-22-255050 | Ubuntu 22.04 LTS must configure the SSH daemon to use FIPS 140-3-approved ciphers to prevent the unauthorized disclosure of information and/or detect changes to information during transmission. | Verify the SSH server is configured to only implement FIPS-approved ciphers with the following command: $ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH 'ciphers' /etc/ssh/sshd_co | |
| UBTU-22-255055 | Ubuntu 22.04 LTS must configure the SSH daemon to use Message Authentication Codes (MACs) employing FIPS 140-3-approved cryptographic hashes to prevent the unauthorized disclosure of information and/or detect changes to information during transmission. | Verify the SSH server is configured to only use MACs that employ FIPS 140-3 approved ciphers by using the following command: $ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH 'macs | |
| UBTU-22-255060 | Ubuntu 22.04 LTS SSH server must be configured to use only FIPS-validated key exchange algorithms. | Verify that the SSH server is configured to use only FIPS-validated key exchange algorithms by using the following command: $ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH 'kexal | |
| UBTU-22-255065 | Ubuntu 22.04 LTS must use strong authenticators in establishing nonlocal maintenance and diagnostic sessions. | Verify Ubuntu 22.04 LTS is configured to use strong authenticators in the establishment of nonlocal maintenance and diagnostic maintenance by using the following command: $ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | tr -d | |
| UBTU-22-271010 | Ubuntu 22.04 LTS must enable the graphical user logon banner to display the Standard Mandatory DoW Notice and Consent Banner before granting local access to the system via a graphical user logon. | Verify Ubuntu 22.04 LTS is configured to display the Standard Mandatory DoW Notice and Consent Banner before granting access to the operating system via a graphical user logon by using the following command: Note: If no graphical user inter | |
| UBTU-22-271015 | Ubuntu 22.04 LTS must display the Standard Mandatory DoW Notice and Consent Banner before granting local access to the system via a graphical user logon. | Verify Ubuntu 22.04 LTS displays the Standard Mandatory DoW Notice and Consent Banner before granting access to the operating system via a graphical user logon with the command: Note: If no graphical user interface is installed, this requir | |
| UBTU-22-271020 | Ubuntu 22.04 LTS must retain a user's session lock until that user reestablishes access using established identification and authentication procedures. | Verify Ubuntu 22.04 LTS has a graphical user interface session lock enabled by using the following command: Note: If no graphical user interface is installed, this requirement is not applicable. $ sudo gsettings get org.gnome.desktop.screen | |
| UBTU-22-271025 | Ubuntu 22.04 LTS must initiate a graphical session lock after 10 minutes of inactivity. | Note: If no graphical user interface is installed, this requirement is not applicable. Verify Ubuntu 22.04 LTS has a graphical user interface session lock configured to activate after 10 minutes of inactivity by using the following commands | |
| UBTU-22-271030 | Ubuntu 22.04 LTS must disable the x86 Ctrl-Alt-Delete key sequence if a graphical user interface is installed. | Verify Ubuntu 22.04 LTS is not configured to reboot the system when Ctrl-Alt-Delete is pressed when using a graphical user interface by using the following command: Note: If no graphical user interface is installed, this requirement is not | |
| UBTU-22-291010 | Ubuntu 22.04 LTS must disable automatic mounting of Universal Serial Bus (USB) mass storage driver. | Verify Ubuntu 22.04 LTS disables ability to load the USB storage kernel module by using the following command: $ grep usb-storage /etc/modprobe.d/* | grep "/bin/false" /etc/modprobe.d/stig.conf:install usb-storage /bin/false If the command | |
| UBTU-22-291015 | Ubuntu 22.04 LTS must disable all wireless network adapters. | Verify that there are no wireless interfaces configured on the system by using the following command: Note: If the system does not have any physical wireless network radios, this requirement is not applicable. $ cat /proc/net/wireless If an | |
| UBTU-22-411010 | Ubuntu 22.04 LTS must prevent direct login into the root account. | Verify Ubuntu 22.04 LTS prevents direct logins to the root account by using the following command: $ sudo passwd -S root root L 08/09/2022 0 99999 7 -1 If the output does not contain "L" in the second field to indicate the account is locked | |
| UBTU-22-411015 | Ubuntu 22.04 LTS must uniquely identify interactive users. | Verify Ubuntu 22.04 LTS contains no duplicate User IDs (UIDs) for interactive users by using the following command: $ awk -F ":" 'list[$3]++{print $1, $3}' /etc/passwd If output is produced and the accounts listed are interactive user accou | |
| UBTU-22-411025 | Ubuntu 22.04 LTS must enforce 24 hours/one day as the minimum password lifetime. Passwords for new users must have a 24 hours/one day minimum password lifetime restriction. | Verify Ubuntu 22.04 LTS enforces a 24 hours/one day minimum password lifetime for new user accounts by using the following command: $ grep -i pass_min_days /etc/login.defs PASS_MIN_DAYS 1 If "PASS_MIN_DAYS" is less than "1", is commented ou | |
| UBTU-22-411030 | Ubuntu 22.04 LTS must be able to enforce a 180-day maximum password lifetime restriction. | Verify Ubuntu 22.04 LTS enforces a 180-day maximum password lifetime for new user accounts by using the following command: $ grep -i pass_max_days /etc/login.defs PASS_MAX_DAYS 180 If "PASS_MAX_DAYS" is less than "180", is commented out, or | |
| UBTU-22-411035 | Ubuntu 22.04 LTS must disable account identifiers (individuals, groups, roles, and devices) after 35 days of inactivity. | Verify the account identifiers (individuals, groups, roles, and devices) are disabled after 35 days of inactivity by using the following command: Check the account inactivity value by performing the following command: $ grep INACTIVE /etc/d | |
| UBTU-22-411040 | Ubuntu 22.04 LTS must automatically expire temporary accounts within 72 hours. | Verify temporary accounts have been provisioned with an expiration date of 72 hours by using the following command: $ sudo chage -l | grep -E '(Password|Account) expires' Password expires : Apr 1, 2024 Account expires : Apr 1, 2024 Verify e | |
| UBTU-22-411045 | Ubuntu 22.04 LTS must automatically lock an account until the locked account is released by an administrator when three unsuccessful logon attempts have been made. | Verify that Ubuntu 22.04 LTS utilizes the "pam_faillock" module by using the following command: $ grep faillock /etc/pam.d/common-auth auth [default=die] pam_faillock.so authfail auth sufficient pam_faillock.so authsucc If the "pam_faillock | |
| UBTU-22-412010 | Ubuntu 22.04 LTS must enforce a delay of at least four seconds between logon prompts following a failed logon attempt. | Verify Ubuntu 22.04 LTS enforces a delay of at least four seconds between logon prompts following a failed logon attempt by using the following command: $ grep pam_faildelay /etc/pam.d/common-auth auth required pam_faildelay.so delay=400000 | |
| UBTU-22-412020 | Ubuntu 22.04 LTS must limit the number of concurrent sessions to ten for all accounts and/or account types. | Verify Ubuntu 22.04 LTS limits the number of concurrent sessions to 10 for all accounts and/or account types by using the following command: $ sudo grep -r -s '^[^#].*maxlogins' /etc/security/limits.conf /etc/security/limits.d/*.conf /etc/s | |
| UBTU-22-412025 | Ubuntu 22.04 LTS must allow users to directly initiate a session lock for all connection types. | Verify Ubuntu 22.04 LTS has the "vlock" package installed by using the following command: $ dpkg -l | grep vlock ii vlock 2.2.2-10 amd64 Virtual Console locking program If "vlock" is not installed, this is a finding. | |
| UBTU-22-412030 | Ubuntu 22.04 LTS must automatically exit interactive command shell user sessions after 15 minutes of inactivity. | Verify Ubuntu 22.04 LTS is configured to automatically exit interactive command shell user sessions after 15 minutes of inactivity or less by using the following command: $ sudo grep -E "\bTMOUT=[0-9]+" /etc/bash.bashrc /etc/profile.d/* /et | |
| UBTU-22-412035 | Ubuntu 22.04 LTS default filesystem permissions must be defined in such a way that all authenticated users can read and modify only their own files. | Verify Ubuntu 22.04 LTS defines default permissions for all authenticated users in such a way that the user can read and modify only their own files by using the following command: $ grep -i '^\s*umask' /etc/login.defs UMASK 077 If the "UMA | |
| UBTU-22-412040 | Ubuntu 22.04 LTS must not assign an interactive login shell for system accounts. | Verify Ubuntu 22.04 LTS system accounts do not have an interactive login shell with the following command: Run the following command to list any system account (UID 0 && $3 < 1000) && $1 !~ /^(halt|sync|shutdown)$/ && $7 !~ /(nologin|false) | |
| UBTU-22-431010 | Ubuntu 22.04 LTS must have the "apparmor" package installed. | Verify Ubuntu 22.04 LTS has the "apparmor" package installed by using the following command: $ dpkg -l | grep apparmor ii apparmor 3.0.4-2ubuntu2.3 amd64 user-space parser utility for AppArmor If the "apparmor" package is not installed, thi | |
| UBTU-22-431015 | Ubuntu 22.04 LTS must be configured to use AppArmor. | Verify Ubuntu 22.04 LTS AppArmor is active by using the following commands: $ systemctl is-enabled apparmor.service enabled $ systemctl is-active apparmor.service active If "apparmor.service" is not enabled and active, this is a finding. Ch | |
| UBTU-22-432010 | Ubuntu 22.04 LTS must require users to reauthenticate for privilege escalation or when changing roles. | Verify the "/etc/sudoers" file has no occurrences of "!authenticate" with the following command: $ sudo egrep -iR '!authenticate' /etc/sudoers /etc/sudoers.d/ If any occurrences of "!authenticate" return from the command, this is a finding. | |
| UBTU-22-432011 | Ubuntu 22.04 LTS must require users to provide a password for privilege escalation. | Verify "/etc/sudoers" has no occurrences of "NOPASSWD" with the following command: $ sudo egrep -iR 'NOPASSWD' /etc/sudoers /etc/sudoers.d/ If any occurrences of "NOPASSWD" are returned from the command and have not been documented with the | |
| UBTU-22-432015 | Ubuntu 22.04 LTS must ensure only users who need access to security functions are part of sudo group. | Verify the sudo group has only members who require access to security functions by using the following command: $ grep sudo /etc/group sudo:x:27: If the sudo group contains users not needing access to security functions, this is a finding. | |
| UBTU-22-611010 | Ubuntu 22.04 LTS must enforce password complexity by requiring at least one uppercase character be used. | Verify Ubuntu 22.04 LTS enforces password complexity by requiring at least one uppercase character be used by using the following command: $ grep -i ucredit /etc/security/pwquality.conf ucredit = -1 If "ucredit" is greater than "-1", is com | |
| UBTU-22-611015 | Ubuntu 22.04 LTS must enforce password complexity by requiring at least one lowercase character be used. | Verify Ubuntu 22.04 LTS enforces password complexity by requiring that at least one lowercase character be used by using the following command: $ grep -i lcredit /etc/security/pwquality.conf lcredit = -1 If "lcredit" is greater than "-1", i | |
| UBTU-22-611020 | Ubuntu 22.04 LTS must enforce password complexity by requiring that at least one numeric character be used. | Verify Ubuntu 22.04 LTS enforces password complexity by requiring that at least one numeric character be used by using the following command: $ grep -i dcredit /etc/security/pwquality.conf dcredit = -1 If "dcredit" is greater than "-1", is | |
| UBTU-22-611025 | Ubuntu 22.04 LTS must enforce password complexity by requiring that at least one special character be used. | Verify Ubuntu 22.04 LTS enforces password complexity by requiring that at least one special character be used by using the following command: $ grep -i ocredit /etc/security/pwquality.conf ocredit = -1 If "ocredit" is greater than "-1", is | |
| UBTU-22-611030 | Ubuntu 22.04 LTS must prevent the use of dictionary words for passwords. | Verify Ubuntu 22.04 LTS prevents the use of dictionary words for passwords by using the following command: $ grep -i dictcheck /etc/security/pwquality.conf dictcheck = 1 If "dictcheck" is not set to "1", is commented out, or is missing, thi | |
| UBTU-22-611035 | Ubuntu 22.04 LTS must enforce a minimum 15-character password length. | Verify the pwquality configuration file enforces a minimum 15-character password length by using the following command: $ grep -i minlen /etc/security/pwquality.conf minlen = 15 If "minlen" is not "15" or higher, is commented out, or is mis | |
| UBTU-22-611040 | Ubuntu 22.04 LTS must require the change of at least eight characters when passwords are changed. | Verify Ubuntu 22.04 LTS requires the change of at least eight characters when passwords are changed by using the following command: $ grep -i difok /etc/security/pwquality.conf difok = 8 If "difok" is less than "8", is commented out, or is | |
| UBTU-22-611045 | Ubuntu 22.04 LTS must be configured so that when passwords are changed or new passwords are established, pwquality must be used. | Verify Ubuntu 22.04 LTS enforces password complexity rules by using the following command: $ grep -i enforcing /etc/security/pwquality.conf enforcing = 1 If "enforcing" is not "1", is commented out, or is missing, this is a finding. Check f | |
| UBTU-22-611055 | Ubuntu 22.04 LTS must store only encrypted representations of passwords. | Verify the Ubuntu operating stores only encrypted representations of passwords with the following command: $ grep pam_unix.so /etc/pam.d/common-password password [success=1 default=ignore] pam_unix.so obscure sha512 shadow rounds=100000 If | |
| UBTU-22-611060 | Ubuntu 22.04 LTS must not allow accounts configured with blank or null passwords. | Verify that null passwords cannot be used. Run the following command: $ grep nullok /etc/pam.d/common-auth /etc/pam.d/common-password If this produces any output, this is a finding. | |
| UBTU-22-611065 | Ubuntu 22.04 LTS must not have accounts configured with blank or null passwords. | Verify all accounts on the system to have a password by using the following command: $ sudo awk -F: '!$2 {print $1}' /etc/shadow If the command returns any results, this is a finding. | |
| UBTU-22-611070 | Ubuntu 22.04 LTS must encrypt all stored passwords with a FIPS 140-3-approved cryptographic hashing algorithm. | Verify that the shadow password suite configuration is set to encrypt passwords with a FIPS 140-3 approved cryptographic hashing algorithm by using the following command: $ grep -i '^\s*encrypt_method' /etc/login.defs ENCRYPT_METHOD SHA512 | |
| UBTU-22-612010 | Ubuntu 22.04 LTS must implement multifactor authentication for remote access to privileged accounts in such a way that one of the factors is provided by a device separate from the system gaining access. | Verify Ubuntu 22.04 LTS has the packages required for multifactor authentication installed by using the following command: $ dpkg -l | grep libpam-pkcs11 ii libpam-pkcs11 0.6.11-4build2 amd64 Fully featured PAM module for using PKCS#11 smar | |
| UBTU-22-612015 | Ubuntu 22.04 LTS must accept personal identity verification (PIV) credentials. | Verify the "opensc-pcks11" package is installed on the system by using the following command: $ dpkg -l | grep opensc-pkcs11 ii opensc-pkcs11:amd64 0.22.0-1Ubuntu2 amd64 Smart card utilities with support for PKCS#15 compatible cards If the | |
| UBTU-22-612020 | Ubuntu 22.04 LTS must implement smart card logins for multifactor authentication for local and network access to privileged and nonprivileged accounts. | Verify that the "pam_pkcs11.so" module is configured by using the following command: $ grep -i pam_pkcs11.so /etc/pam.d/common-auth auth [success=3 default=ignore] pam_pkcs11.so If "pam_pkcs11.so" is commented out or is missing, this is a f | |
| UBTU-22-612025 | Ubuntu 22.04 LTS must electronically verify personal identity verification (PIV) credentials. | Verify Ubuntu 22.04 LTS electronically verifies PIV credentials via certificate status checking by using the following command: $ sudo grep use_pkcs11_module /etc/pam_pkcs11/pam_pkcs11.conf | sudo awk '/pkcs11_module opensc {/,/}/' /etc/pam | |
| UBTU-22-612030 | Ubuntu 22.04 LTS, for PKI-based authentication, must validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor. | Verify Ubuntu 22.04 LTS, for PKI-based authentication, has valid certificates by constructing a certification path to an accepted trust anchor. Determine which pkcs11 module is being used via the "use_pkcs11_module" in "/etc/pam_pkcs11/pam_ | |
| UBTU-22-612035 | Ubuntu 22.04 LTS for PKI-based authentication, must implement a local cache of revocation data in case of the inability to access revocation information via the network. | Verify Ubuntu 22.04 LTS, for PKI-based authentication, uses local revocation data when unable to access it from the network by using the following command: Note: If smart card authentication is not being used on the system, this is not appl | |
| UBTU-22-612040 | Ubuntu 22.04 LTS must map the authenticated identity to the user or group account for PKI-based authentication. | Verify that "use_mappers" is set to "pwent" in "/etc/pam_pkcs11/pam_pkcs11.conf" file by using the following command: $ grep -i use_mappers /etc/pam_pkcs11/pam_pkcs11.conf use_mappers = pwent If "use_mappers" does not contain "pwent", is co | |
| UBTU-22-631010 | Ubuntu 22.04 LTS must use DoW PKI-established certificate authorities for verification of the establishment of protected sessions. | Verify the directory containing the root certificates for Ubuntu 22.04 LTS contains certificate files for DoW PKI-established certificate authorities by iterating over all files in the "/etc/ssl/certs" directory and checking if, at least on | |
| UBTU-22-631015 | Ubuntu 22.04 LTS must be configured such that Pluggable Authentication Module (PAM) prohibits the use of cached authentications after one day. | Verify that PAM prohibits the use of cached authentications after one day by using the following command: Note: If smart card authentication is not being used on the system, this requirement is not applicable. $ sudo grep -i '^\s*offline_cr | |
| UBTU-22-651010 | Ubuntu 22.04 LTS must use a file integrity tool to verify correct operation of all security functions. | Verify that Advanced Intrusion Detection Environment (AIDE) is installed by using the following command: $ dpkg -l | grep aide ii aide 0.17.4-1 amd64 Advanced Intrusion Detection Environment - dynamic binary If AIDE is not installed, ask th | |
| UBTU-22-651015 | Ubuntu 22.04 LTS must configure Advanced Intrusion Detection Environment (AIDE) to perform file integrity checking on the file system. | Note: If a file integrity tool other than AIDE is employed, this requirement is not applicable. Verify AIDE is configured and operating correctly by using the following command (this will take a few minutes): $ sudo aide -c /etc/aide/aide.c | |
| UBTU-22-651020 | Ubuntu 22.04 LTS must notify designated personnel if baseline configurations are changed in an unauthorized manner. The file integrity tool must notify the system administrator when changes to the baseline configuration or anomalies in the operation of any security functions are discovered. | Verify that Advanced Intrusion Detection Environment (AIDE) notifies the system administrator when anomalies in the operation of any security functions are discovered by using the following command: $ grep -i '^\s*silentreports' /etc/defaul | |
| UBTU-22-651025 | Ubuntu 22.04 LTS must be configured so that the script that runs each 30 days or less to check file integrity is the default. | Verify that the Advanced Intrusion Detection Environment (AIDE) default script used to check file integrity each 30 days or less is unchanged. Download the original aide-common package in the /tmp directory: $ cd /tmp; apt download aide-com | |
| UBTU-22-651030 | Ubuntu 22.04 LTS must use cryptographic mechanisms to protect the integrity of audit tools. | Verify that Advanced Intrusion Detection Environment (AIDE) is properly configured to use cryptographic mechanisms to protect the integrity of audit tools by using the following command: $ grep -E '(\/sbin\/(audit|au))' /etc/aide/aide.conf | |
| UBTU-22-651035 | Ubuntu 22.04 LTS must have a crontab script running weekly to offload audit events of standalone systems. | Verify there is a script that offloads audit data and that script runs weekly by using the following command: Note: If the system is not connected to a network, this requirement is not applicable. $ ls /etc/cron.weekly Check if the script i | |
| UBTU-22-652010 | Ubuntu 22.04 LTS must be configured to preserve log records from failure events. | Verify the log service is installed properly by using the following command: $ dpkg -l | grep rsyslog ii rsyslog 8.2112.0-2ubuntu2.2 amd64 reliable system and kernel logging daemon If the "rsyslog" package is not installed, this is a findin | |
| UBTU-22-652015 | Ubuntu 22.04 LTS must monitor remote access methods. | Verify that Ubuntu 22.04 LTS monitors all remote access methods by using the following command: $ grep -Er '^(auth\.\*,authpriv\.\*|daemon\.\*)' /etc/rsyslog.* /etc/rsyslog.d/50-default.conf:auth.*,authpriv.* /var/log/secure /etc/rsyslog.d/ | |
| UBTU-22-653010 | Ubuntu 22.04 LTS must have the "auditd" package installed. | Verify the "auditd" package is installed by using the following command: $ dpkg -l | grep auditd ii libauditd 1:3.0.7-1build1 amd64 User space tools for security auditing If the "auditd" package is not installed, this is a finding. | |
| UBTU-22-653015 | Ubuntu 22.04 LTS must produce audit records and reports containing information to establish when, where, what type, the source, and the outcome for all DoW-defined auditable events and actions in near real time. | Verify the "auditd.service" is enabled and active by using the following commands: $ systemctl is-enabled auditd.service enabled $ systemctl is-active auditd.service active If the "auditd.service" is not enabled and active, this is a findin | |
| UBTU-22-653020 | Ubuntu 22.04 LTS audit event multiplexor must be configured to offload audit logs onto a different system from the system being audited. | Verify the audit event multiplexor is configured to offload audit records to a different system from the system being audited. Check if the "audispd-plugins" package is installed: $ dpkg -l | grep audispd-plugins ii audispd-plugins 1:3.0.7- | |
| UBTU-22-653025 | Ubuntu 22.04 LTS must alert the information system security officer (ISSO) and system administrator (SA) in the event of an audit processing failure. | Verify that the SA and ISSO are notified in the event of an audit processing failure by using the following command: Note: An email package must be installed on the system for email notifications to be sent. $ sudo grep -i action_mail_acct | |
| UBTU-22-653030 | Ubuntu 22.04 LTS must shut down by default upon audit failure. | Verify Ubuntu 22.04 LTS takes the appropriate action when the audit storage volume is full by using the following command: $ sudo grep -i disk_full_action /etc/audit/auditd.conf disk_full_action = HALT If "disk_full_action" is not set to "H | |
| UBTU-22-653035 | Ubuntu 22.04 LTS must allocate audit record storage capacity to store at least one weeks' worth of audit records, when audit records are not immediately sent to a central audit record storage facility. | Verify Ubuntu 22.04 LTS allocates audit record storage capacity to store at least one week's worth of audit records when audit records are not immediately sent to a central audit record storage facility. Determine which partition the audit | |
| UBTU-22-653040 | Ubuntu 22.04 LTS must immediately notify the system administrator (SA) and information system security officer (ISSO) when the audit record storage volume reaches 25 percent remaining of the allocated capacity. | Verify Ubuntu 22.04 LTS is configured to notify the SA and ISSO when the audit record storage volume reaches 25 percent remaining of the allocated capacity by using the following command: $ sudo grep -i space_left /etc/audit/auditd.conf spa | |
| UBTU-22-653045 | Ubuntu 22.04 LTS must be configured so that audit log files are not read- or write-accessible by unauthorized users. | Verify that the audit log files have a mode of "600" or less permissive. Determine where the audit logs are stored by using the following command: $ sudo grep -iw log_file /etc/audit/auditd.conf log_file = /var/log/audit/audit.log Using the | |
| UBTU-22-653050 | Ubuntu 22.04 LTS must be configured to permit only authorized users ownership of the audit log files. | Verify the audit log files are owned by "root" account. Determine where the audit logs are stored by using the following command: $ sudo grep -iw log_file /etc/audit/auditd.conf log_file = /var/log/audit/audit.log Using the path of the dire | |
| UBTU-22-653055 | Ubuntu 22.04 LTS must permit only authorized groups ownership of the audit log files. | Verify the group owner of newly created audit logs is "root" by using the following command: $ sudo grep -iw log_group /etc/audit/auditd.conf log_group = root If "log_group" is not set to "root", this is a finding. | |
| UBTU-22-653060 | Ubuntu 22.04 LTS must be configured so that the audit log directory is not write-accessible by unauthorized users. | Verify that the audit log directory has a mode of "750" or less permissive. Determine where the audit logs are stored by using the following command: $ sudo grep -iw log_file /etc/audit/auditd.conf log_file = /var/log/audit/audit.log Using | |
| UBTU-22-653065 | Ubuntu 22.04 LTS must be configured so that audit configuration files are not write-accessible by unauthorized users. | Verify that "/etc/audit/audit.rules", "/etc/audit/auditd.conf", and "/etc/audit/rules.d/*" files have a mode of "640" or less permissive by using the following command: $ sudo ls -al /etc/audit/audit.rules /etc/audit/auditd.conf /etc/audit/ | |
| UBTU-22-653070 | Ubuntu 22.04 LTS must permit only authorized accounts to own the audit configuration files. | Verify that "/etc/audit/audit.rules", "/etc/audit/auditd.conf", and "/etc/audit/rules.d/*" files are owned by root account by using the following command: $ sudo ls -al /etc/audit/audit.rules /etc/audit/auditd.conf /etc/audit/rules.d/* | aw | |
| UBTU-22-653075 | Ubuntu 22.04 LTS must permit only authorized groups to own the audit configuration files. | Verify that "/etc/audit/audit.rules", "/etc/audit/auditd.conf", and "/etc/audit/rules.d/*" files are owned by root group by using the following command: $ sudo ls -al /etc/audit/audit.rules /etc/audit/auditd.conf /etc/audit/rules.d/* | awk | |
| UBTU-22-654010 | Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the apparmor_parser command. | Verify Ubuntu 22.04 LTS generates an audit record upon successful/unsuccessful attempts to use the "apparmor_parser" command by using the following command: $ sudo auditctl -l | grep apparmor_parser -a always,exit -S all -F path=/sbin/appar | |
| UBTU-22-654015 | Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the chacl command. | Verify Ubuntu 22.04 LTS generates an audit record upon successful/unsuccessful attempts to use the "chacl" command by using the following command: $ sudo auditctl -l | grep chacl -a always,exit -S all -F path=/usr/bin/chacl -F perm=x -F aui | |
| UBTU-22-654020 | Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the chage command. | Verify that an audit event is generated for any successful/unsuccessful use of the "chage" command by using the following command: $ sudo auditctl -l | grep -w chage -a always,exit -S all -F path=/usr/bin/chage -F perm=x -F auid>=1000 -F au | |
| UBTU-22-654025 | Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the chcon command. | Verify Ubuntu 22.04 LTS generates an audit record upon successful/unsuccessful attempts to use the "chcon" command by using the following command: $ sudo auditctl -l | grep chcon -a always,exit -S all -F path=/usr/bin/chcon -F perm=x -F aui | |
| UBTU-22-654030 | Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the chfn command. | Verify Ubuntu 22.04 LTS generates audit records upon successful/unsuccessful attempts to use the "chfn" command by using the following command: $ sudo auditctl -l | grep /usr/bin/chfn -a always,exit -S all -F path=/usr/bin/chfn -F perm=x -F | |
| UBTU-22-654035 | Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the chsh command. | Verify Ubuntu 22.04 LTS generates an audit record upon successful/unsuccessful attempts to use the "chsh" command by using the following command: $ sudo auditctl -l | grep chsh -a always,exit -S all -F path=/usr/bin/chsh -F perm=x -F auid>= | |
| UBTU-22-654040 | Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the crontab command. | Verify that an audit event is generated for any successful/unsuccessful use of the "crontab" command by using the following command: $ sudo auditctl -l | grep -w crontab -a always,exit -S all -F path=/usr/bin/crontab -F perm=x -F auid>=1000 | |
| UBTU-22-654041 | Ubuntu 22.04 LTS must audit any script or executable called by cron as root or by any privileged user. | Verify Ubuntu 22.04 LTS is configured to audit the execution of any system call made by cron as root or as any privileged user. $ sudo auditctl -l | grep /etc/cron.d -w /etc/cron.d -p wa -k cronjobs $ sudo auditctl -l | grep /var/spool/cron | |
| UBTU-22-654045 | Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful attempts to use the fdisk command. | Verify Ubuntu 22.04 LTS is configured to audit the execution of the partition management program "fdisk" by using the following command: $ sudo auditctl -l | grep fdisk -w /usr/sbin/fdisk -p x -k fdisk If the command does not return a line, | |
| UBTU-22-654050 | Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the gpasswd command. | Verify that an audit event is generated for any successful/unsuccessful use of the "gpasswd" command by using the following command: $ sudo auditctl -l | grep -w gpasswd -a always,exit -S all -F path=/usr/bin/gpasswd -F perm=x -F auid>=1000 | |
| UBTU-22-654055 | Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful attempts to use the kmod command. | Verify Ubuntu 22.04 LTS is configured to audit the execution of the module management program "kmod" by using the following command: $ sudo auditctl -l | grep kmod -w /bin/kmod -p x -k module If the command does not return a line, or the li | |
| UBTU-22-654060 | Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful attempts to use modprobe command. | Verify if Ubuntu 22.04 LTS is configured to audit the execution of the module management program "modprobe" with the following command: $ sudo auditctl -l | grep /sbin/modprobe -w /sbin/modprobe -p x -k modules If the command does not retur | |
| UBTU-22-654065 | Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the mount command. | Verify Ubuntu 22.04 LTS generates audit records upon successful/unsuccessful attempts to use the "mount" command by using the following command: $ sudo auditctl -l | grep /usr/bin/mount -a always,exit -S all -F path=/usr/bin/mount -F perm=x | |
| UBTU-22-654070 | Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the newgrp command. | Verify Ubuntu 22.04 LTS generates an audit record upon successful/unsuccessful attempts to use the "newgrp" command by using the following command: $ sudo auditctl -l | grep newgrp -a always,exit -S all -F path=/usr/bin/newgrp -F perm=x -F | |
| UBTU-22-654075 | Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the pam_timestamp_check command. | Verify that an audit event is generated for any successful/unsuccessful use of the "pam_timestamp_check" command by using the following command: $ sudo auditctl -l | grep -w pam_timestamp_check -a always,exit -S all -F path=/usr/sbin/pam_ti | |
| UBTU-22-654080 | Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the passwd command. | Verify that an audit event is generated for any successful/unsuccessful use of the "passwd" command by using the following command: $ sudo auditctl -l | grep -w passwd -a always,exit -S all -F path=/usr/bin/passwd -F perm=x -F auid>=1000 -F | |
| UBTU-22-654085 | Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the setfacl command. | Verify Ubuntu 22.04 LTS generates an audit record upon successful/unsuccessful attempts to use the "setfacl" command by using the following command: $ sudo auditctl -l | grep setfacl -a always,exit -S all -F path=/usr/bin/setfacl -F perm=x | |
| UBTU-22-654090 | Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the ssh-agent command. | Verify Ubuntu 22.04 LTS generates an audit record upon successful/unsuccessful attempts to use the "ssh-agent" command by using the following command: $ sudo auditctl -l | grep /usr/bin/ssh-agent -a always,exit -S all -F path=/usr/bin/ssh-a | |
| UBTU-22-654095 | Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the ssh-keysign command. | Verify Ubuntu 22.04 LTS generates an audit record upon successful/unsuccessful attempts to use the "ssh-keysign" command by using the following command: $ sudo auditctl -l | grep ssh-keysign -a always,exit -S all -F path=/usr/lib/openssh/ss | |
| UBTU-22-654100 | Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the su command. | Verify Ubuntu 22.04 LTS generates audit records upon successful/unsuccessful attempts to use the "su" command by using the following command: $ sudo auditctl -l | grep /bin/su -a always,exit -S all -F path=/bin/su -F perm=x -F auid>=1000 -F | |
| UBTU-22-654105 | Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the sudo command. | Verify that an audit event is generated for any successful/unsuccessful use of the "sudo" command by using the following command: $ sudo auditctl -l | grep /usr/bin/sudo -a always,exit -S all -F path=/usr/bin/sudo -F perm=x -F auid>=1000 -F | |
| UBTU-22-654110 | Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the sudoedit command. | Verify Ubuntu 22.04 LTS generates an audit record upon successful/unsuccessful attempts to use the "sudoedit" command by using the following command: $ sudo auditctl -l | grep /usr/bin/sudoedit -a always,exit -S all -F path=/usr/bin/sudoedi | |
| UBTU-22-654115 | Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the umount command. | Verify if Ubuntu 22.04 LTS generates audit records upon successful/unsuccessful attempts to use the "umount" command by using the following command: $ sudo auditctl -l | grep /usr/bin/umount -a always,exit -S all -F path=/usr/bin/umount -F | |
| UBTU-22-654120 | Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the unix_update command. | Verify that an audit event is generated for any successful/unsuccessful use of the "unix_update" command by using the following command: $ sudo auditctl -l | grep -w unix_update -a always,exit -S all -F path=/sbin/unix_update -F perm=x -F a | |
| UBTU-22-654125 | Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the usermod command. | Verify that an audit event is generated for any successful/unsuccessful use of the "usermod" command by using the following command: $ sudo auditctl -l | grep -w usermod -a always,exit -S all -F path=/usr/sbin/usermod -F perm=x -F auid>=100 | |
| UBTU-22-654126 | Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the useradd command. | Verify that an audit event is generated for any successful/unsuccessful use of the "useradd" command by using the following command: $ sudo auditctl -l | grep -w useradd -a always,exit -S all -F path=/usr/sbin/useradd -F perm=x -F auid>=100 | |
| UBTU-22-654130 | Ubuntu 22.04 LTS must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/group. | Verify Ubuntu 22.04 LTS generates audit records for all account creations, modifications, disabling, and termination events that affect "/etc/group" by using the following command: $ sudo auditctl -l | grep group -w /etc/group -p wa -k user | |
| UBTU-22-654135 | Ubuntu 22.04 LTS must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/gshadow. | Verify Ubuntu 22.04 LTS generates audit records for all account creations, modifications, disabling, and termination events that affect "/etc/gshadow" by using the following command: $ sudo auditctl -l | grep gshadow -w /etc/gshadow -p wa - | |
| UBTU-22-654140 | Ubuntu 22.04 LTS must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/opasswd. | Verify Ubuntu 22.04 LTS generates audit records for all account creations, modifications, disabling, and termination events that affect "/etc/security/opasswd" by using the following command: $ sudo auditctl -l | grep opasswd -w /etc/securi | |
| UBTU-22-654145 | Ubuntu 22.04 LTS must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/passwd. | Verify Ubuntu 22.04 LTS generates audit records for all account creations, modifications, disabling, and termination events that affect "/etc/passwd" by using the following command: $ sudo auditctl -l | grep passwd -w /etc/passwd -p wa -k u | |
| UBTU-22-654150 | Ubuntu 22.04 LTS must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/shadow. | Verify Ubuntu 22.04 LTS generates audit records for all account creations, modifications, disabling, and termination events that affect "/etc/shadow" by using the following command: $ sudo auditctl -l | grep shadow -w /etc/shadow -p wa -k u | |
| UBTU-22-654155 | Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the chmod, fchmod, and fchmodat system calls. | Verify Ubuntu 22.04 LTS generates an audit record upon successful/unsuccessful attempts to use the "chmod", "fchmod", and "fchmodat" system calls by using the following command: $ sudo auditctl -l | grep chmod -a always,exit -F arch=b32 -S | |
| UBTU-22-654160 | Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the chown, fchown, fchownat, and lchown system calls. | Verify Ubuntu 22.04 LTS generates an audit record upon successful/unsuccessful attempts to use the "chown", "fchown", "fchownat", and "lchown" system calls by using the following command: $ sudo auditctl -l | grep chown -a always,exit -F ar | |
| UBTU-22-654165 | Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the creat, open, openat, open_by_handle_at, truncate, and ftruncate system calls. | Verify Ubuntu 22.04 LTS generates an audit record upon unsuccessful attempts to use the "creat", "open", "openat", "open_by_handle_at", "truncate", and "ftruncate" system calls by using the following command: $ sudo auditctl -l | grep 'open | |
| UBTU-22-654170 | Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the delete_module system call. | Verify Ubuntu 22.04 LTS generates an audit record for any successful/unsuccessful attempts to use the "delete_module" syscall by using the following command: $ sudo auditctl -l | grep -w delete_module -a always,exit -F arch=b32 -S delete_mo | |
| UBTU-22-654175 | Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the init_module and finit_module system calls. | Verify Ubuntu 22.04 LTS generates an audit record for any successful/unsuccessful attempts to use the "init_module" and "finit_module" syscalls by using the following command: $ sudo auditctl -l | grep init_module -a always,exit -F arch=b32 | |
| UBTU-22-654180 | Ubuntu 22.04 LTS must generate audit records for any use of the setxattr, fsetxattr, lsetxattr, removexattr, fremovexattr, and lremovexattr system calls. | Verify Ubuntu 22.04 LTS generates an audit record upon successful/unsuccessful attempts to use the "setxattr", "fsetxattr", "lsetxattr", "removexattr", "fremovexattr", and "lremovexattr" system calls by using the following command: $ sudo a | |
| UBTU-22-654185 | Ubuntu 22.04 LTS must generate audit records for any successful/unsuccessful use of unlink, unlinkat, rename, renameat, and rmdir system calls. | Verify Ubuntu 22.04 LTS generates audit records for any successful/unsuccessful use of "unlink", "unlinkat", "rename", "renameat", and "rmdir" system calls by using the following command: $ sudo auditctl -l | grep 'unlink\|rename\|rmdir' -a | |
| UBTU-22-654190 | Ubuntu 22.04 LTS must generate audit records for all events that affect the systemd journal files. | Verify Ubuntu 22.04 LTS generates audit records for all events that affect "/var/log/journal" by using the following command: $ sudo auditctl -l | grep journal -w /var/log/journal -p wa -k systemd_journal If the command does not return a li | |
| UBTU-22-654195 | Ubuntu 22.04 LTS must generate audit records for the /var/log/btmp file. | Verify Ubuntu 22.04 LTS generates audit records showing start and stop times for user access to the system via the "/var/log/btmp" file by using the following command: $ sudo auditctl -l | grep '/var/log/btmp' -w /var/log/btmp -p wa -k logi | |
| UBTU-22-654200 | Ubuntu 22.04 LTS must generate audit records for the /var/log/wtmp file. | Verify Ubuntu 22.04 LTS generates audit records showing start and stop times for user access to the system via the "/var/log/wtmp" file by using the following command: $ sudo auditctl -l | grep '/var/log/wtmp' -w /var/log/wtmp -p wa -k logi | |
| UBTU-22-654205 | Ubuntu 22.04 LTS must generate audit records for the /var/run/utmp file. | Verify Ubuntu 22.04 LTS generates audit records showing start and stop times for user access to the system via the "/var/run/utmp" file by using the following command: $ sudo auditctl -l | grep '/var/run/utmp' -w /var/run/utmp -p wa -k logi | |
| UBTU-22-654210 | Ubuntu 22.04 LTS must generate audit records for the use and modification of faillog file. | Verify Ubuntu 22.04 LTS generates an audit record upon successful/unsuccessful modifications to the "faillog" file by using the following command: $ sudo auditctl -l | grep faillog -w /var/log/faillog -p wa -k logins If the command does not | |
| UBTU-22-654215 | Ubuntu 22.04 LTS must generate audit records for the use and modification of the lastlog file. | Verify Ubuntu 22.04 LTS generates an audit record when successful/unsuccessful modifications to the "lastlog" file occur by using the following command: $ sudo auditctl -l | grep lastlog -w /var/log/lastlog -p wa -k logins If the command do | |
| UBTU-22-654220 | Ubuntu 22.04 LTS must generate audit records when successful/unsuccessful attempts to modify the /etc/sudoers file occur. | Verify Ubuntu 22.04 LTS generates audit records for all modifications that affect "/etc/sudoers" by using the following command: $ sudo auditctl -l | grep sudoers -w /etc/sudoers -p wa -k privilege_modification If the command does not retur | |
| UBTU-22-654224 | The operating system must restrict privilege elevation to authorized personnel. | Verify the operating system restricts privilege elevation to authorized personnel with the following command: $ sudo grep -iwR 'ALL' /etc/sudoers /etc/sudoers.d/ | grep -v '#' If the either of the following entries are returned, this is a f | |
| UBTU-22-654225 | Ubuntu 22.04 LTS must generate audit records when successful/unsuccessful attempts to modify the /etc/sudoers.d directory occur. | Verify Ubuntu 22.04 LTS generates audit records for all modifications that affect "/etc/sudoers.d" directory by using the following command: $ sudo auditctl -l | grep sudoers.d -w /etc/sudoers.d -p wa -k privilege_modification If the comman | |
| UBTU-22-654230 | Ubuntu 22.04 LTS must prevent all software from executing at higher privilege levels than users executing the software and the audit system must be configured to audit the execution of privileged functions. | Verify Ubuntu 22.04 LTS audits the execution of privilege functions by auditing the "execve" system call by using the following command: $ sudo auditctl -l | grep execve -a always,exit -F arch=b64 -S execve -C uid!=euid -F euid=0 -F key=exe | |
| UBTU-22-654235 | Ubuntu 22.04 LTS must generate audit records for privileged activities, nonlocal maintenance, diagnostic sessions and other system-level access. | Verify Ubuntu 22.04 LTS audits activities performed during nonlocal maintenance and diagnostic sessions by using the following command: $ sudo auditctl -l | grep sudo.log -w /var/log/sudo.log -p wa -k maintenance If the command does not ret | |
| UBTU-22-654240 | Ubuntu 24.04 LTS audit system must protect auditing rules from unauthorized change. | Verify the running audit system prevents unauthorized changes (is immutable) with the following command: $ sudo auditctl -s | grep "enabled" enabled 2 If the "enabled" value returned is not "2", this is a finding. Verify that the audit syst | |
| UBTU-22-671010 | Ubuntu 22.04 LTS must implement NIST FIPS-validated cryptography to protect classified information and for the following: To provision digital signatures, to generate cryptographic hashes, and to protect unclassified information requiring confidentiality and cryptographic protection in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards. | Verify the system is configured to run in FIPS mode by using the following command: $ grep -i 1 /proc/sys/crypto/fips_enabled 1 If a value of "1" is not returned, this is a finding. |
191 of 191.