DISA STIG library V1R3
| Ref | Title | Text | |
|---|---|---|---|
| RHEL-10-000500 | RHEL 10 must enable FIPS mode. | Verify RHEL 10 is in FIPS mode with the following command: $ cat /proc/sys/crypto/fips_enabled 1 If the command does not return "1", this is a finding. | |
| RHEL-10-000510 | RHEL 10 must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information on local disk partitions that requires at-rest protection. | Note: If there is a documented and approved reason for not having data-at-rest encryption at the operating system level, such as encryption provided by a hypervisor or a disk storage array in a virtualized environment, this requirement is n | |
| RHEL-10-000520 | RHEL 10 must use a separate file system for the system audit data path. | Verify RHEL 10 uses a separate file system/partition for the system audit data path with the following command: Note: /var/log/audit is used as the example as it is a common location. $ mount | grep /var/log/audit /dev/mapper/rootvg-varloga | |
| RHEL-10-000530 | RHEL 10 must use a separate file system for user home directories (such as "/home" or an equivalent). | Verify RHEL 10 uses a separate file system/partition for "/home" with the following command: $ mount | grep /home /dev/mapper/luks-ca2261ed-7b00-4b7b-84cd-8cd6d8fa4b28 on /home type xfs (rw,nodev,nosuid,noexec,seclabel) Note: Options displa | |
| RHEL-10-000540 | RHEL 10 must use a separate file system for "/tmp". | Verify RHEL 10 uses a separate file system/partition for "/tmp" with the following command: $ mount | grep /tmp /dev/mapper/luks-2d7e1b45-73c4-4282-8838-15a897e0d04e on /tmp type xfs(rw,nodev,nosuid,noexec,seclabel) Note: Options displayed | |
| RHEL-10-000550 | RHEL 10 must use a separate file system for "/var". | Verify RHEL 10 uses a separate file system/partition for "/var" with the following command: $ mount | grep /var /dev/mapper/luks-51150299-f295-4145-b8f0-ebe9c6dfd5a0 on /var type xfs (rw,nodev,relatime,seclabel,attr2) Note: Options displaye | |
| RHEL-10-000560 | RHEL 10 must use a separate file system for "/var/log". | Verify RHEL 10 uses a separate file system/partition for "/var/log" with the following command: $ mount | grep /var/log /dev/mapper/luks-c651f493-9fdc-4c6e-a711-0a4f03149661 on /var/log type xfs (rw,nosuid,nodev,noexec,relatime,seclabel,att | |
| RHEL-10-000570 | RHEL 10 must use a separate file system for "/var/tmp". | Verify RHEL 10 uses a separate file system/partition for "/var/tmp" with the following command: $ mount | grep /var/tmp /dev/mapper/luks-c98555c8-0462-4b97-9afa-6db8c4bfee3b on /var/tmp type xfs (rw,nosuid,nodev,noexec,relatime,seclabel,att | |
| RHEL-10-001000 | RHEL 10 must be a vendor-supported release. | Verify RHEL 10 is a vendor-supported version with the following command: $ cat /etc/redhat-release Red Hat Enterprise Linux release 10.0 (Coughlan) If the installed version of RHEL 10 is not supported, this is a finding. | |
| RHEL-10-001020 | RHEL 10 must ensure cryptographic verification of vendor software packages. | Verify RHEL 10 ensures cryptographic verification of vendor software packages. Confirm Red Hat package-signing keys are installed on the system and verify their fingerprints match vendor values. Note: For RHEL 10 software packages, Red Hat | |
| RHEL-10-001030 | RHEL 10 must check the GNU Privacy Guard (GPG) signature of software packages originating from external software repositories before installation. | Verify RHEL 10 dnf always checks the GPG signature of software packages originating from external software repositories before installation with the following command: $ sudo grep -w gpgcheck /etc/dnf/dnf.conf gpgcheck=1 If "gpgcheck" is no | |
| RHEL-10-001040 | RHEL 10 must check the GNU Privacy Guard (GPG) signature of locally installed software packages before installation. | Verify RHEL 10 dnf always checks the GPG signature of locally installed software packages before installation with the following command: $ sudo grep localpkg_gpgcheck /etc/dnf/dnf.conf localpkg_gpgcheck=1 If "localpkg_gpgcheck" is not set | |
| RHEL-10-001050 | RHEL 10 must have GNU Privacy Guard (GPG) signature verification enabled for all software repositories. | Verify RHEL 10 software repositories defined in "/etc/yum.repos.d/" have been configured with "gpgcheck" enabled with the following command: $ sudo grep -w gpgcheck /etc/yum.repos.d/*.repo | more gpgcheck = 1 If "gpgcheck" for software pack | |
| RHEL-10-200000 | RHEL 10 must remove all software components after updated versions have been installed. | Verify RHEL 10 removes all software components after updated versions have been installed with the following command: $ sudo grep -i clean_requirements_on_remove /etc/dnf/dnf.conf clean_requirements_on_remove=True If "clean_requirements_on_ | |
| RHEL-10-200010 | RHEL 10 must not have the "nfs-utils" package installed. | Verify RHEL 10 does not have the "nfs-utils" package installed with the following command: $ sudo dnf list --installed nfs-utils Error: No matching Packages to list If the "nfs-utils" package is installed, this is a finding. | |
| RHEL-10-200020 | RHEL 10 must not have the "telnet-server" package installed. | Verify RHEL 10 does not have the "telnet-server" package installed with the following command: $ sudo dnf list --installed telnet-server Error: No matching Packages to list If the "telnet-server" package is installed, this is a finding. | |
| RHEL-10-200030 | RHEL 10 must not have the "gssproxy" package installed. | Note: If Network File System (NFS) mounts are authorized and in use on the system, this control is not applicable. Verify RHEL 10 does not have the "gssproxy" package installed with the following command: $ sudo dnf list --installed gssprox | |
| RHEL-10-200040 | RHEL 10 must not have the tuned package installed. | Verify RHEL 10 does not have the tuned package installed with the following command: $ sudo dnf list --installed tuned Error: No matching Packages to list If the "tuned" package is installed and is not documented with the information system | |
| RHEL-10-200060 | RHEL 10 must not have the unbound package installed. | Verify RHEL 10 does not have a DNS package installed with the following command: $ sudo dnf list --installed unbound Error: No matching Packages to list If the "unbound" package is installed, and the information system security officer lack | |
| RHEL-10-200070 | RHEL 10 must not have the "tftp" package installed. | Verify RHEL 10 does not have the "tftp" package installed with the following command: $ sudo dnf list --installed tftp Error: No matching Packages to list If the "tftp" package is installed, this is a finding. | |
| RHEL-10-200080 | RHEL 10 must not have the "gdm" package installed. | Verify RHEL 10 does not have the "gdm" package installed with the following command: $ sudo dnf list --installed gdm Error: No matching Packages to list If the "gdm" package is installed and the need for a GUI interface has not been documen | |
| RHEL-10-200090 | RHEL 10 must not have a File Transfer Protocol (FTP) server package installed. | Verify RHEL 10 does not have an FTP server package installed with the following command: $ sudo dnf list --installed vsftpd Error: No matching Packages to list If the "vsftpd" package is installed, this is a finding. | |
| RHEL-10-200500 | RHEL 10 must have the "subscription-manager" package installed. | Note: If the system is not an internet connected system, this requirement is not applicable. Verify RHEL 10 has the "subscription-manager" package installed with the following command: $ sudo dnf list --installed subscription-manager Instal | |
| RHEL-10-200510 | RHEL 10 must have the "nss-tools" package installed. | Verify RHEL 10 has the "nss-tools" package installed with the following command: $ sudo dnf list --installed nss-tools Installed Packages nss-tools.x86_64 3.112.0-4.el10_0 @rhel-10-for-x86_64-appstream-rpms If the "nss-tools" package is not | |
| RHEL-10-200520 | RHEL 10 must have the "s-nail" package installed. | Verify RHEL 10 is configured to allow sending email notifications. Verify the "s-nail" package is installed on the system with the following command: $ sudo dnf list --installed s-nail Installed Packages s-nail.x86_64 14.9.24-12.el10 @rhel- | |
| RHEL-10-200530 | RHEL 10 must have the "firewalld" package installed. | Verify RHEL 10 has the "firewalld" package installed. Run the following command to determine if the "firewalld" package is installed: $ dnf list --installed firewalld Installed Packages firewalld.noarch 2.3.1-1.el10_0 @rhel-10-for-x86_64-ba | |
| RHEL-10-200531 | RHEL 10 must have the "firewalld" service set to active. | Verify RHEL 10 is configured so that "firewalld" is active with the following command: $ systemctl is-active firewalld active If the "firewalld" service is not active, this is a finding. | |
| RHEL-10-200532 | RHEL 10 must employ a deny-all, allow-by-exception policy for allowing connections to other systems. | Verify RHEL 10 is configured so that "firewalld" employs a deny-all, allow-by-exception policy for allowing connections to other systems with the following commands (using ens133 as an example interface): $ sudo firewall-cmd --state running | |
| RHEL-10-200540 | RHEL 10 must have the "chrony" package installed. | Verify RHEL 10 has the "chrony" package installed with the following command: $ sudo dnf list --installed chrony Installed Packages chrony.x86_64 4.6.1-1.el10 @anaconda If the "chrony" package is not installed, this is a finding. | |
| RHEL-10-200541 | RHEL 10 must enable the chronyd service. | Verify RHEL 10 sets the chronyd service to active with the following command: $ systemctl is-active chronyd active If the chronyd service is not active, this is a finding. | |
| RHEL-10-200542 | RHEL 10 must disable the chrony daemon from acting as a server. | Verify RHEL 10 disables the chrony daemon from acting as a server with the following command: $ sudo grep -w port /etc/chrony.conf port 0 If the "port" option is not set to "0", is commented out, or is missing, this is a finding. | |
| RHEL-10-200543 | RHEL 10 must disable network management of the chrony daemon. | Verify RHEL 10 disables network management of the chrony daemon with the following command: $ sudo grep -w cmdport /etc/chrony.conf cmdport 0 If the "cmdport" option is not set to "0", is commented out, or is missing, this is a finding. | |
| RHEL-10-200560 | RHEL 10 must have the USBGuard package installed. | Verify RHEL 10 has USBGuard installed on the operating system with the following command: $ sudo dnf list --installed usbguard Installed Packages usbguard.x86_64 1.1.3-6.el10 @rhel-10-for-x86_64-appstream-rpms If the USBGuard package is not | |
| RHEL-10-200561 | RHEL 10 must have the USBGuard package enabled. | Note: If the system is virtual machine with no virtual or physical USB peripherals attached, this is not applicable. Verify RHEL 10 has USBGuard enabled with the following command: $ systemctl is-active usbguard active If USBGuard is not ac | |
| RHEL-10-200562 | RHEL 10 must block unauthorized peripherals before establishing a connection. | Note: If the system is virtual machine with no virtual or physical USB peripherals attached, this is not applicable. Verify RHEL 10 USBGuard has a policy configured. Confirm the setting with the following command: $ sudo usbguard list-rules | |
| RHEL-10-200563 | RHEL 10 must enable audit logging for the USBGuard daemon. | Note: If the system is a virtual machine with no virtual or physical USB peripherals attached, this is not applicable. Verify RHEL 10 audit logging is enabled for the USBGuard daemon. Confirm the setting with the following command: $ sudo g | |
| RHEL-10-200570 | RHEL 10 must have the "policycoreutils" package installed. | Verify RHEL 10 has the "policycoreutils" package installed with the following command: $ sudo dnf list --installed policycoreutils Installed Packages policycoreutils.x86_64 3.8-1.el10 @anaconda If the "policycoreutils" package is not instal | |
| RHEL-10-200580 | RHEL 10 must have the "policycoreutils-python-utils" package installed. | Verify RHEL 10 has the "policycoreutils-python-utils" service package installed with the following command: $ sudo dnf list --installed policycoreutils-python-utils Installed Packages policycoreutils-python-utils.noarch 3.8-1.el10 @AppStrea | |
| RHEL-10-200590 | RHEL 10 must have the "sudo" package installed. | Verify RHEL 10 has the "sudo" package installed with the following command: $ sudo dnf list --installed sudo Installed Packages sudo.x86_64 1.9.15-8.p5.el10_0.2 @rhel-10-for-x86_64-baseos-rpms If the "sudo" package is not installed, this is | |
| RHEL-10-200600 | RHEL 10 must have the "fapolicy" module installed. | Verify RHEL 10 has the "fapolicyd" package installed with the following command: $ sudo dnf list --installed fapolicyd Installed Packages fapolicyd.x86_64 1.3.3-102.el10 @rhel-10-for-x86_64-appstream-rpms If the "fapolicyd" package is not i | |
| RHEL-10-200601 | RHEL 10 must enable the "fapolicy" module. | Verify RHEL 10 "fapolicyd" is active with the following command: $ systemctl is-active fapolicyd active If the "fapolicyd" module is not active, this is a finding. | |
| RHEL-10-200602 | RHEL 10 must be configured to employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs. | Verify the RHEL 10 "fapolicyd" employs a deny-all, permit-by-exception policy. Check that "fapolicyd" is in enforcement mode with the following command: $ sudo grep permissive /etc/fapolicyd/fapolicyd.conf permissive = 0 If "fapolicyd" is n | |
| RHEL-10-200610 | RHEL 10 must have the "pcsc-lite" package installed. | Note: If the system administrator demonstrates the use of an approved alternate multifactor authentication method, this requirement is not applicable. Verify RHEL 10 has the "pcsc-lite" package installed with the following command: $ sudo d | |
| RHEL-10-200611 | RHEL 10 must have the "pcscd" socket set to active. | Verify RHEL 10 has the "pcscd" socket set to active with the following command: $ systemctl is-active pcscd.socket active If the "pcscd" socket is not active, this is a finding. | |
| RHEL-10-200612 | RHEL 10 must have the "pcsc-lite-ccid" package installed. | Verify RHEL 10 has the "pcsc-lite-ccid" package installed with the following command: $ sudo dnf list --installed pcsc-lite-ccid Installed Packages pcsc-lite-ccid.x86_64 1.6.0-2.el10 @anaconda If the "pcsc-lite-ccid" package is not installe | |
| RHEL-10-200620 | RHEL 10 must have the "opensc" package installed. | Verify RHEL 10 has the "opensc" package installed with the following command: $ sudo dnf list --installed opensc Installed Packages opensc.x86_64 0.26.1-1.el10 @rhel-10-for-x86_64-baseos-rpm If the "opensc" package is not installed, this is | |
| RHEL-10-200621 | RHEL 10 must use the common access card (CAC) smart card driver. | Verify RHEL 10 loads the CAC driver with the following command: $ sudo opensc-tool --get-conf-entry app:default:card_drivers cac If "cac" is not listed as a card driver, or no line is returned for "card_drivers", this is a finding. | |
| RHEL-10-200630 | RHEL 10 must have the Advanced Intrusion Detection Environment (AIDE) package installed. | Verify RHEL 10 has the AIDE package installed with the following command: $ sudo dnf list --installed aide Installed Packages aide.x86_64 0.18.6-8.el10_0.2 @rhel-10-for-x86_64-appstream-rpms If AIDE is not installed, ask the system administ | |
| RHEL-10-200631 | RHEL 10 must use cryptographic mechanisms to protect the integrity of audit tools. | Verify RHEL 10 Advanced Intrusion Detection Environment (AIDE) is properly configured to protect the integrity of the audit tools. Verify the explicit rules for the audit tools with the following command: $ sudo grep /usr/sbin/au /etc/aide. | |
| RHEL-10-200632 | RHEL 10 must use a file integrity tool that is configured to use FIPS 140-3-approved cryptographic hashes for validating file contents and directories. | Verify RHEL 10 AIDE is configured to use FIPS 140-3 file hashing. Verify global default hash settings with the following command: $ sudo grep -iE 'sha|md5|rmd' /etc/aide.conf | grep -v ^# FIPSR = p+i+n+u+g+s+m+ftype+growing+acl+selinux+xatt | |
| RHEL-10-200633 | RHEL 10 must routinely check the baseline configuration for unauthorized changes and notify the system administrator when anomalies in the operation of any security functions are discovered. | Verify RHEL 10 routinely executes a file integrity scan for changes to the system baseline. The command used in the example will use a daily occurrence. Check the cron directories for scripts controlling the execution and notification of re | |
| RHEL-10-200634 | RHEL 10 must be configured so that the file integrity tool verifies Access Control Lists (ACLs). | Verify RHEL 10 AIDE is verifying ACLs. Verify ACL settings for all uncommented file and directory selection lists with the following command: $ sudo grep -E '^[^#]*acl' /etc/aide.conf FIPSR = p+i+n+u+g+s+m+growing+acl+selinux+xattrs+sha512 | |
| RHEL-10-200635 | RHEL 10 must be configured so that the file integrity tool verifies extended attributes. | Verify RHEL 10 AIDE is configured to verify extended attributes with the following command: $ sudo grep -E '^[^#]*xattrs' /etc/aide.conf FIPSR = p+i+n+u+g+s+m+growing+acl+selinux+xattrs+sha512 /usr/sbin/auditctl p+i+n+u+g+s+b+acl+xattrs+sha | |
| RHEL-10-200640 | RHEL 10 must have the "rsyslog" package installed. | Verify RHEL 10 has the "rsyslog" package installed with the following command: $ sudo dnf list --installed rsyslog Installed Packages rsyslog.x86_64 8.2412.0-1.el10 @AppStream If the "rsyslog" package is not installed, this is a finding. | |
| RHEL-10-200641 | RHEL 10 must have the rsyslog service set to active. | Verify RHEL 10 rsyslog is active with the following command: $ systemctl is-active rsyslog active If the rsyslog service is not active, this is a finding. | |
| RHEL-10-200642 | RHEL 10 must be configured to forward audit records via Transmission Control Protocol (TCP) to a different system or media from the system being audited via rsyslog. | Verify RHEL 10 audit system off-loads audit records onto a different system or media from the system being audited via rsyslog using TCP with the following commands: To check for legacy configuration syntax, perform the following: $ sudo gr | |
| RHEL-10-200643 | RHEL 10 must be configured so that the rsyslog daemon does not accept log messages from other servers unless the server is being used for log aggregation. | Note: If the SA can demonstrate that another tool (e.g., SPLUNK) is being used to manage log off-load and aggregation in lieu of rsyslog, this check is not applicable. Verify RHEL 10 is not configured to receive remote logs using rsyslog. V | |
| RHEL-10-200644 | RHEL 10 must authenticate the remote logging server for off-loading audit logs via "rsyslog". | Verify RHEL 10 authenticates the remote logging server for off-loading audit logs with the following command: $ sudo grep -r -E 'streamdriver.authmode|streamdriver.permittedpeer|tls.authmode|tls.permittedpeer' /etc/rsyslog.conf /etc/rsyslog | |
| RHEL-10-200645 | RHEL 10 must encrypt the transfer of audit records off-loaded onto a different system or media from the system being audited via rsyslog. | Verify RHEL 10 encrypts audit records offloaded onto a different system via rsyslog using the modern "omfwd" action. Search for active TLS-enabling configurations within "omfwd" action blocks with the following command: $ sudo grep -rE 'tls | |
| RHEL-10-200646 | RHEL 10 must encrypt, via the gtls driver, the transfer of audit records off-loaded onto a different system or media from the system being audited via rsyslog. | Verify RHEL 10 explicitly defines a TLS driver (gtls or ossl) for encrypted rsyslog off-loading. Search for an explicitly defined stream driver within "omfwd" action blocks with the following command: $ sudo grep -rE 'StreamDriver\s*=\s*"(g | |
| RHEL-10-200647 | RHEL 10 must monitor all remote access methods. | Verify RHEL 10 monitors all remote access methods with the following command: $ sudo grep -rE '(auth.\*|authpriv.\*|daemon.\*)' /etc/rsyslog.conf /etc/rsyslog.d/ /etc/rsyslog.conf:authpriv.* /var/log/secure If "auth.*", "authpriv.*", or "da | |
| RHEL-10-200648 | RHEL 10 must use cron logging. | Verify RHEL 10 rsyslog is configured to log cron events with the following command: Note: If another logging package is used, substitute the utility configuration file for "/etc/rsyslog.conf" or "/etc/rsyslog.d/*.conf" files. $ grep -s "cro | |
| RHEL-10-200650 | RHEL 10 must have the packages required for encrypting off-loaded audit logs installed. | Verify RHEL 10 has the "rsyslog-gnutls" package installed with the following command: $ sudo dnf list --installed rsyslog-gnutls Installed Packages rsyslog-gnutls.x86_64 8.2412.0-1.el10 @AppStream If the "rsyslog-gnutls" package is not inst | |
| RHEL-10-200660 | RHEL 10 must have the "audit" package installed. | Verify RHEL 10 has the "audit" service package installed with the following command: $ sudo dnf list --installed audit Installed Packages audit.x86_64 4.0.3-1.el10 @anaconda If the "audit" package is not installed, this is a finding. | |
| RHEL-10-200661 | RHEL 10 must enable the audit service. | Verify RHEL 10 enables the audit service to produce audit records with the following command: $ systemctl status auditd.service o auditd.service - Security Audit Logging Service Loaded: loaded (/usr/lib/systemd/system/auditd.service; enable | |
| RHEL-10-200662 | RHEL 10 must have the "audispd-plugins" package installed. | Verify RHEL 10 has the "audispd-plugins" package installed with the following command: $ sudo dnf list --installed audispd-plugins Installed Packages audispd-plugins.x86_64 4.0.3-1.el10 @rhel-10-for-x86_64-baseos-rpms If the "audispd-plugin | |
| RHEL-10-200680 | RHEL 10 must have the "libreswan" package installed. | Note: If there is no operational need for Libreswan to be installed, this rule is not applicable. Verify RHEL 10 has the "libreswan" service package installed with the following command: $ sudo dnf list --installed libreswan Installed Packa | |
| RHEL-10-200690 | RHEL 10 must notify designated personnel if baseline configurations are changed in an unauthorized manner. | Verify RHEL 10 is configured to allow sending email notifications. Note: The "postfix" package provides the "mail" command that is used to send email messages. Verify that the "postfix" package is installed on the system: $ sudo dnf list -- | |
| RHEL-10-200691 | RHEL 10 must have mail aliases to notify the information system security officer (ISSO) and system administrator (SA) (at a minimum) of an audit processing failure. | Verify RHEL 10 is configured to notify the appropriate interactive users of an audit processing failure. Find the alias maps that are being used with the following command: $ postconf alias_maps alias_maps = lmdb:/etc/aliases Query the Post | |
| RHEL-10-200692 | RHEL 10 must be configured to prevent unrestricted mail relaying. | Note: If postfix is not installed, this is not applicable. Verify RHEL 10 is configured to prevent unrestricted mail relaying with the following command: $ postconf -n smtpd_client_restrictions smtpd_client_restrictions = permit_mynetworks, | |
| RHEL-10-200700 | RHEL 10 must have the "cronie" package installed. | Verify RHEL 10 has the "cronie" package installed with the following command: $ sudo dnf list --installed cronie Installed Packages cronie.x86_64 1.7.0-9.el10 @anaconda If the "cronie" package is not installed, this is a finding. | |
| RHEL-10-200720 | RHEL 10 must have a Secure Shell (SSH) server installed for all networked systems. | Verify RHEL 10 has the "openssh-server" package installed with the following command: $ sudo dnf list --installed openssh-server Installed Packages openssh-server.x86_64 9.9p1-7.el10_0 @anaconda If the "openssh-server" package is not instal | |
| RHEL-10-200721 | RHEL 10 must, for all networked systems, have and implement Secure Shell (SSH) to protect the confidentiality and integrity of transmitted and received information. | Verify RHEL 10 "sshd" is active with the following command: $ systemctl is-active sshd active If the "sshd" service is not active, this is a finding. | |
| RHEL-10-200722 | RHEL 10 must have the "openssh-clients" package installed. | Verify RHEL 10 has the "openssh-clients" package installed with the following command: $ sudo dnf list --installed openssh-clients Installed Packages openssh-clients.x86_64 9.9p1-7.el10_0 @anaconda If the "openssh-clients" package is not in | |
| RHEL-10-200730 | RHEL 10 must have the "pkcs11-provider" package installed. | Note: If the system administrator demonstrates the use of an approved alternate multifactor authentication method, this requirement is not applicable. Verify RHEL 10 has the "pkcs11-provider" package installed with the following command: $ | |
| RHEL-10-200740 | RHEL 10 must have the "gnutls-utils" package installed. | Verify RHEL 10 has the "gnutls-utils" package installed with the following command: $ sudo dnf list --installed gnutls-utils Installed Packages gnutls-utils.x86_64 3.8.9-9.el10_0.14 @rhel-10-for-x86_64-appstream-rpms If the "gnutls-utils" p | |
| RHEL-10-300000 | RHEL 10 must have the "crypto-policies" package installed. | Verify RHEL 10 has the "crypto-policies" package installed with the following command: $ sudo dnf list --installed crypto-policies Installed Packages crypto-policies.noarch 20250214-1.gitfd9b9b9.el10_0.1 @rhel-10-for-x86_64-baseos-rpms If t | |
| RHEL-10-300010 | RHEL 10 must implement a FIPS 140-3-compliant systemwide cryptographic policy. | Verify RHEL 10 is set to use a FIPS 140-3-compliant systemwide cryptographic policy. Verify the current systemwide crypto-policy with the following command: $ update-crypto-policies --show FIPS If the systemwide crypto-policy is not set to | |
| RHEL-10-300030 | RHEL 10 must be configured so that Secure Shell (SSH) clients use only DoW-approved encryption ciphers employing FIPS 140-3-validated cryptographic hash algorithms to protect the confidentiality of SSH client connections. | Verify RHEL 10 SSH clients are configured to use only ciphers employing FIPS 140-3-approved algorithms. To verify the ciphers in the systemwide SSH configuration file, use the following command: $ sudo grep -i Ciphers /etc/crypto-policies/b | |
| RHEL-10-300040 | RHEL 10 must be configured so that Secure Shell (SSH) servers use only DoW-approved encryption ciphers employing FIPS 140-3-validated cryptographic hash algorithms to protect the confidentiality of SSH server connections. | Verify RHEL 10 SSH servers are configured to use only ciphers employing FIPS 140-3-approved algorithms. To verify the ciphers in the systemwide SSH configuration file, use the following command: $ sudo grep -i Ciphers /etc/crypto-policies/b | |
| RHEL-10-300050 | RHEL 10 must be configured so that Secure Shell (SSH) clients use only DoW-approved Message Authentication Codes (MACs) employing FIPS 140-3-validated cryptographic hash algorithms to protect the confidentiality of SSH client connections. | Verify RHEL 10 SSH clients are configured to use only MACs employing FIPS 140-3-approved algorithms. To verify the MACs in the systemwide SSH configuration file, use the following command: $ sudo grep -i MACs /etc/crypto-policies/back-ends/ | |
| RHEL-10-300060 | RHEL 10 must be configured so that Secure Shell (SSH) servers use only DoW-approved Message Authentication Codes (MACs) employing FIPS 140-3-validated cryptographic hash algorithms to protect the confidentiality of SSH server connections. | Verify RHEL 10 SSH servers are configured to use only MACs employing FIPS 140-3-approved algorithms with the following command: $ sudo grep -i MACs /etc/crypto-policies/back-ends/opensshserver.config MACs [email protected],hmac- | |
| RHEL-10-300070 | RHEL 10 must use FIPS 140-3-approved cryptographic algorithms for IP tunnels. | Note: If the IPsec service is not installed, this requirement is not applicable. Verify RHEL 10 sets the IPsec service to use the systemwide cryptographic policy with the following command: $ sudo grep include /etc/ipsec.conf /etc/ipsec.d/* | |
| RHEL-10-300080 | RHEL 10 must implement DoW-approved encryption in the bind package. | Note: If the "bind" package is not installed, this requirement is not applicable. Verify RHEL 10 BIND uses the systemwide cryptographic policy with the following command: $ sudo grep include /etc/named.conf include "/etc/crypto-policies/bac | |
| RHEL-10-300085 | RHEL 10 must implement DoW-approved encryption in the OpenSSL package. | Verify the RHEL 10 OpenSSL library is configured to use only ciphers employing FIPS 140-3-approved algorithms with the following command: $ grep -i opensslcnf.config /etc/pki/tls/openssl.cnf .include = /etc/crypto-policies/back-ends/openssl | |
| RHEL-10-300090 | RHEL 10 cryptographic policy must not be overridden. | Verify RHEL 10 cryptographic policies are not overridden. Verify the configured policy matches the generated policy with the following command: $ sudo update-crypto-policies --check The configured policy matches the generated policy If the | |
| RHEL-10-400000 | RHEL 10 must be configured so that the "/etc/group" file is owned by root. | Verify RHEL 10 is configured so that "/etc/group" file is owned by "root" with the following command: $ sudo stat -c "%U %n" /etc/group root /etc/group If the "/etc/group" file does not have an owner of "root", this is a finding. | |
| RHEL-10-400005 | RHEL 10 must be configured so that the "/etc/group" file is group-owned by "root". | Verify RHEL 10 is configured so that the "/etc/group" file is group-owned by "root" with the following command: $ sudo stat -c "%G %n" /etc/group root /etc/group If the "/etc/group" file does not have a group owner of "root", this is a find | |
| RHEL-10-400010 | RHEL 10 must be configured so that the "/etc/group-" file is owned by "root". | Verify RHEL 10 is configured so that the "/etc/group-" file is owned by "root" with the following command: $ sudo stat -c "%U %n" /etc/group- root /etc/group- If the "/etc/group-" file does not have an owner of "root", this is a finding. | |
| RHEL-10-400015 | RHEL 10 must be configured so that the "/etc/group-" file is group-owned by "root". | Verify RHEL 10 is configured so that the "/etc/group-" file is group-owned by "root" with the following command: $ sudo stat -c "%G %n" /etc/group- root /etc/group- If the "/etc/group-" file does not have a group owner of "root", this is a | |
| RHEL-10-400020 | RHEL 10 must be configured so that the "/etc/gshadow" file is owned by "root". | Verify RHEL 10 is configured so that the "/etc/gshadow" file is owned by "root" with the following command: $ sudo stat -c "%U %n" /etc/gshadow root /etc/gshadow If the "/etc/gshadow" file does not have an owner of "root", this is a finding | |
| RHEL-10-400025 | RHEL 10 must be configured so that the "/etc/gshadow" file is group-owned by "root". | Verify RHEL 10 is configured so that the "/etc/gshadow" file is group-owned by "root" with the following command: $ sudo stat -c "%G %n" /etc/gshadow root /etc/gshadow If the "/etc/gshadow" file does not have a group owner of "root", this i | |
| RHEL-10-400030 | RHEL 10 must be configured so that the "/etc/gshadow-" file is owned by "root". | Verify RHEL 10 is configured so that the "/etc/gshadow-" file is owned by "root" with the following command: $ sudo stat -c "%U %n" /etc/gshadow- root /etc/gshadow- If the "/etc/gshadow-" file does not have an owner of "root", this is a fin | |
| RHEL-10-400035 | RHEL 10 must be configured so that the "/etc/gshadow-" file is group-owned by "root". | Verify RHEL 10 is configured so that the "/etc/gshadow-" file is group-owned by "root" with the following command: $ sudo stat -c "%G %n" /etc/gshadow- root /etc/gshadow- If the "/etc/gshadow-" file does not have a group owner of "root", th | |
| RHEL-10-400040 | RHEL 10 must be configured so that the "/etc/passwd" file is owned by "root". | Verify RHEL 10 is configured so that the "/etc/passwd" file is owned by "root" with the following command: $ sudo stat -c "%U %n" /etc/passwd root /etc/passwd If the "/etc/passwd" file does not have an owner of "root", this is a finding. | |
| RHEL-10-400045 | RHEL 10 must be configured so that the "/etc/passwd" file is group-owned by "root". | Verify RHEL 10 is configured so that the "/etc/passwd" file is group-owned by "root" with the following command: $ sudo stat -c "%G %n" /etc/passwd root /etc/passwd If the "/etc/passwd" file does not have a group owner of "root", this is a | |
| RHEL-10-400050 | RHEL 10 must be configured so that the "/etc/passwd-" file is owned by "root". | Verify RHEL 10 is configured so that the "/etc/passwd-" file is owned by "root" with the following command: $ sudo stat -c "%U %n" /etc/passwd- root /etc/passwd- If the "/etc/passwd-" file does not have an owner of "root", this is a finding | |
| RHEL-10-400055 | RHEL 10 must be configured so that the "/etc/passwd-" file is group-owned by "root". | Verify RHEL 10 is configured so that the "/etc/passwd-" file is group-owned by "root" with the following command: $ sudo stat -c "%G %n" /etc/passwd- root /etc/passwd- If the "/etc/passwd-" file does not have a group owner of "root", this i | |
| RHEL-10-400060 | RHEL 10 must be configured so that the "/etc/shadow" file is owned by "root". | Verify RHEL 10 is configured so that the "/etc/shadow" file is owned by "root" with the following command: $ sudo stat -c "%U %n" /etc/shadow root /etc/shadow If the "/etc/shadow" file does not have an owner of "root", this is a finding. | |
| RHEL-10-400065 | RHEL 10 must be configured so that the "/etc/shadow" file is group-owned by "root". | Verify RHEL 10 is configured so that the "/etc/shadow" file is group-owned by "root" with the following command: $ sudo stat -c "%G %n" /etc/shadow root /etc/shadow If the "/etc/shadow" file does not have a group owner of "root", this is a | |
| RHEL-10-400070 | RHEL 10 must be configured so that the "/etc/shadow-" file is owned by "root". | Verify RHEL 10 is configured so that the "/etc/shadow-" file is owned by "root" with the following command: $ sudo stat -c "%U %n" /etc/shadow- root /etc/shadow- If the "/etc/shadow-" file does not have an owner of "root", this is a finding | |
| RHEL-10-400075 | RHEL 10 must be configured so that the "/etc/shadow-" file is group-owned by "root". | Verify RHEL 10 is configured so that the "/etc/shadow-" file is group-owned by "root" with the following command: $ sudo stat -c "%G %n" /etc/shadow- root /etc/shadow- If the "/etc/shadow-" file does not have a group owner of "root", this i | |
| RHEL-10-400080 | RHEL 10 must be configured so that the "/var/log" directory is owned by "root". | Verify RHEL 10 is configured so that the "/var/log" directory is owned by "root" with the following command: $ stat -c "%U %n" /var/log root /var/log If "/var/log" does not have an owner of "root", this is a finding. | |
| RHEL-10-400085 | RHEL 10 must be configured so that the "/var/log" directory is group-owned by "root". | Verify RHEL 10 is configured so that the "/var/log" directory is group-owned by "root" with the following command: $ stat -c "%G %n" /var/log root /var/log If "/var/log" does not have a group owner of "root", this is a finding. | |
| RHEL-10-400090 | RHEL 10 must be configured so that the "/var/log/"messages file is owned by root. | Verify RHEL 10 is configured so that the "/var/log/messages" file is owned by root with the following command: $ stat -c "%U %n" /var/log/messages root /var/log/messages If "/var/log/messages" does not have an owner of "root", this is a fin | |
| RHEL-10-400095 | RHEL 10 must be configured so that the "/var/log/messages" file is group-owned by "root". | Verify RHEL 10 is configured so that the "/var/log/messages" file is group-owned by "root" with the following command: $ stat -c "%G %n" /var/log/messages root /var/log/messages If "/var/log/messages" does not have a group owner of "root", | |
| RHEL-10-400100 | RHEL 10 must be configured so that system commands are owned by "root". | Verify RHEL 10 is configured so that the system commands contained in the following directories are owned by "root" with the following command: $ sudo find -L /bin /sbin /usr/bin /usr/sbin /usr/libexec /usr/local/bin /usr/local/sbin ! -user | |
| RHEL-10-400105 | RHEL 10 must be configured so that system commands are group-owned by root or a system account. | Verify RHEL 10 is configured so that the system commands contained in the following directories are group-owned by "root", or a required system account, with the following command: $ sudo find -L /bin /sbin /usr/bin /usr/sbin /usr/libexec / | |
| RHEL-10-400110 | RHEL 10 must be configured so that library files are owned by "root". | Verify RHEL 10 is configured so that the systemwide shared library files are owned by "root" with the following command: $ sudo find -L /lib /lib64 /usr/lib /usr/lib64 ! -user root ! -type d -exec stat -L -c "%U %n" {} \; If any systemwide | |
| RHEL-10-400115 | RHEL 10 must be configured so that library files are group-owned by "root" or a system account. | Verify RHEL 10 is configured so that the systemwide shared library files are group-owned by "root" or a system account with the following command: $ sudo find -L /lib /lib64 /usr/lib /usr/lib64 ! -group root ! -type d -exec stat -L -c "%G % | |
| RHEL-10-400120 | RHEL 10 must be configured so that library directories are owned by "root". | Verify RHEL 10 is configured so that the systemwide shared library directories are owned by "root" with the following command: $ sudo find /lib /lib64 /usr/lib /usr/lib64 ! -user root -type d -exec stat -c "%U %n" {} \; If any systemwide sh | |
| RHEL-10-400125 | RHEL 10 must be configured so that library directories are group-owned by "root" or a system account. | Verify RHEL 10 is configured so that the systemwide shared library directories are group-owned by "root" or a system account with the following command: $ sudo find /lib /lib64 /usr/lib /usr/lib64 ! -group root -type d -exec stat -c "%G %n" | |
| RHEL-10-400130 | RHEL 10 must be configured so that cron configuration file directories are owned by root. | Verify RHEL 10 ownership of all cron configuration files with the following command: $ stat -c "%U %n" /etc/cron* root /etc/cron.d root /etc/cron.daily root /etc/cron.deny root /etc/cron.hourly root /etc/cron.monthly root /etc/crontab root | |
| RHEL-10-400135 | RHEL 10 must be configured so that cron configuration files directories are group-owned by root. | Verify RHEL 10 group ownership of all cron configuration files with the following command: $ stat -c "%G %n" /etc/cron* root /etc/cron.d root /etc/cron.daily root /etc/cron.deny root /etc/cron.hourly root /etc/cron.monthly root /etc/crontab | |
| RHEL-10-400140 | RHEL 10 must be configured so that world-writable directories are owned by root, sys, bin, or an application user. | Verify RHEL 10 world-writable directories are owned by root, a system account, or an application account with the following command: $ sudo find / -xdev -type d -perm -0002 -uid +999 -exec stat -c "%U, %u, %A, %n" {} \; 2>/dev/null If outpu | |
| RHEL-10-400145 | RHEL 10 must be configured so that all system device files are correctly labeled to prevent unauthorized modification. | Verify RHEL 10 is configured so that all system device files are correctly labeled to prevent unauthorized modification. List all device files on the system that are incorrectly labeled with the following commands: Note: Device files are no | |
| RHEL-10-400150 | RHEL 10 must be configured so that the Secure Shell (SSH) server configuration file is group-owned by "root". | Verify RHEL 10 is configured so that the "/etc/ssh/sshd_config" file and the contents of "/etc/ssh/sshd_config.d" are group-owned by "root" with the following command: $ sudo find /etc/ssh/sshd_config /etc/ssh/sshd_config.d -exec stat -c "% | |
| RHEL-10-400155 | RHEL 10 must be configured so that the Secure Shell (SSH) server configuration file is owned by "root". | Verify RHEL 10 is configured so that the "/etc/ssh/sshd_config" file and the contents of "/etc/ssh/sshd_config.d" are owned by root with the following command: $ sudo find /etc/ssh/sshd_config /etc/ssh/sshd_config.d -exec stat -c "%U %n" {} | |
| RHEL-10-400160 | RHEL 10 must ensure that all local interactive user home directories are group-owned by the home directory owner's primary group. | Verify RHEL 10 interactive users' home directories are group-owned by the user's primary GID with the following command: Note: This may miss local interactive users that have been assigned a privileged user identifier (UID). Evidence of int | |
| RHEL-10-400165 | RHEL 10 must enforce group ownership of audit logs by "root" or by a restricted logging group to prevent unauthorized read access. | Verify RHEL 10 audit logs are group-owned by "root" or a restricted logging group. Determine where the audit logs are stored with the following command: $ sudo grep -iw log_file /etc/audit/auditd.conf log_file = /var/log/audit/audit.log Usi | |
| RHEL-10-400170 | RHEL 10 must enforce "root" ownership of the audit log directory to prevent unauthorized read access. | Verify RHEL 10 audit logs directory is owned by "root". Determine where the audit logs are stored with the following command: $ sudo grep -iw log_file /etc/audit/auditd.conf log_file = /var/log/audit/audit.log Using the location of the audi | |
| RHEL-10-400175 | RHEL 10 must enforce "root" ownership of audit logs to prevent unauthorized access. | Verify RHEL 10 enforces "root" ownership of audit logs to prevent unauthorized access. Determine where the audit logs are stored with the following command: $ sudo grep "^log_file" /etc/audit/auditd.conf log_file = /var/log/audit/audit.log | |
| RHEL-10-400180 | RHEL 10 must enforce group ownership by "root" or a restricted logging group for audit log files to prevent unauthorized access. | Verify RHEL 10 enforces group ownership by "root" or a restricted logging group for audit log files to prevent unauthorized access. Determine where the audit logs are stored with the following command: $ sudo grep "^log_file" /etc/audit/aud | |
| RHEL-10-400185 | RHEL 10 must set mode "0600" or less permissive for the audit logs file to prevent unauthorized access to the audit log. | Verify RHEL 10 audit logs have a mode of "0600". Determine where the audit logs are stored with the following command: $ sudo grep "^log_file" /etc/audit/auditd.conf log_file = /var/log/audit/audit.log Using the location of the audit log fi | |
| RHEL-10-400190 | RHEL 10 must enforce the audit log directory to have a mode of "0750" or less permissive to prevent unauthorized read access. | Verify RHEL 10 enforces the audit log directory to have a mode of "0750" or less permissive to prevent unauthorized read access. Determine where the audit logs are stored with the following command: $ sudo grep "^log_file" /etc/audit/auditd | |
| RHEL-10-400195 | RHEL 10 must enforce root ownership of the "/etc/audit/" directory. | Verify RHEL 10 enforces root ownership of the "/etc/audit/" directory with the following command: $ sudo stat -c "%U %n" /etc/audit/ root /etc/audit/ If the "/etc/audit/" directory does not have an owner of "root", this is a finding. | |
| RHEL-10-400200 | RHEL 10 must enforce root group ownership of the "/etc/audit/" directory. | Verify RHEL 10 enforces root group ownership of the "/etc/audit/" directory with the following command: $ sudo stat -c "%G %n" /etc/audit/ root /etc/audit/ If "/etc/audit/" does not have a group owner of "root", this is a finding. | |
| RHEL-10-400205 | RHEL 10 must enforce mode "755" or less permissive for system commands. | Verify RHEL 10 is configured so that the system commands contained in the following directories have mode "755" or less permissive with the following command: $ sudo find -L /bin /sbin /usr/bin /usr/sbin /usr/libexec /usr/local/bin /usr/loc | |
| RHEL-10-400210 | RHEL 10 must enforce mode "755" or less permissive on library directories. | Verify RHEL 10 is configured so that the systemwide shared library directories have mode "755" or less permissive with the following command: $ sudo find -L /lib /lib64 /usr/lib /usr/lib64 -perm /022 -type d -exec ls -l {} \; If any systemw | |
| RHEL-10-400215 | RHEL 10 must enforce mode "755" or less permissive for library files. | Verify RHEL 10 is configured so that the systemwide shared library files contained in the following directories have mode "755" or less permissive with the following command: $ sudo find -L /lib /lib64 /usr/lib /usr/lib64 -perm /022 -type f | |
| RHEL-10-400220 | RHEL 10 must enforce mode "0755" or less permissive for the "/var/log" directory. | Verify RHEL 10 is configured so that the "/var/log" directory has a mode of "0755" or less permissive with the following command: $ stat -c '%a %n' /var/log 755 /var/log If "/var/log" does not have a mode of "0755" or less permissive, this | |
| RHEL-10-400225 | RHEL 10 must enforce mode "0640" or less permissive for the "/var/log/messages" file. | Verify RHEL 10 is configured so that the "/var/log/messages" file has a mode of "0640" or less permissive with the following command: $ stat -c '%a %n' /var/log/messages 600 /var/log/messages If "/var/log/messages" does not have a mode of " | |
| RHEL-10-400230 | RHEL 10 must be configured to prohibit modification of permissions for cron configuration files and directories from the operating system defaults. | Verify RHEL 10 is configured so that the owner, group, and mode of cron configuration files and directories match the operating system defaults with the following command: $ rpm --verify cronie crontabs | awk '! ($2 == "c" && $1 ~ /^.\..\.\ | |
| RHEL-10-400235 | RHEL 10 must enforce mode "0740" or less permissive for local initialization files. | Verify RHEL 10 is configured so that all local initialization files have a mode of "0740" or less permissive with the following command: Note: The example will be for the "disauser" user, who has a home directory of "/home/disauser". $ sudo | |
| RHEL-10-400240 | RHEL 10 must enforce mode "0750" or less permissive for local interactive user home directories. | Verify RHEL 10 is configured so that the assigned home directory of all local interactive users has a mode of "0750" or less permissive with the following command: Note: This may miss interactive users that have been assigned a privileged u | |
| RHEL-10-400245 | RHEL 10 must enforce mode "0644" or less permissive for the "/etc/group" file to prevent unauthorized access. | Verify RHEL 10 is configured so that the "/etc/group" file has mode "0644" or less permissive with the following command: $ sudo stat -c "%a %n" /etc/group 644 /etc/group If a value of "0644" or less permissive is not returned, this is a fi | |
| RHEL-10-400250 | RHEL 10 must enforce mode "0644" or less permissive for the "/etc/group-" file to prevent unauthorized access. | Verify RHEL 10 is configured so that the "/etc/group-" file has mode "0644" or less permissive with the following command: $ sudo stat -c "%a %n" /etc/group- 644 /etc/group- If a value of "0644" or less permissive is not returned, this is a | |
| RHEL-10-400255 | RHEL 10 must enforce mode "0000" or less permissive for the "/etc/gshadow" file to prevent unauthorized access. | Verify RHEL 10 is configured so that the "/etc/gshadow" file has mode "0000" with the following command: $ sudo stat -c "%a %n" /etc/gshadow 0 /etc/gshadow If a value of "0" is not returned, this is a finding. | |
| RHEL-10-400260 | RHEL 10 must enforce mode "0000" or less permissive for the "/etc/gshadow-" file to prevent unauthorized access. | Verify RHEL 10 is configured so that the "/etc/gshadow-" file has mode "0000" with the following command: $ sudo stat -c "%a %n" /etc/gshadow- 0 /etc/gshadow- If a value of "0" is not returned, this is a finding. | |
| RHEL-10-400265 | RHEL 10 must enforce mode "0644" or less permissive for the "/etc/passwd" file to prevent unauthorized access. | Verify RHEL 10 is configured so that the "/etc/passwd" file has mode "0644" or less permissive with the following command: $ sudo stat -c "%a %n" /etc/passwd 644 /etc/passwd If a value of "0644" or less permissive is not returned, this is a | |
| RHEL-10-400270 | RHEL 10 must enforce mode "0644" or less permissive for "/etc/passwd-" file to prevent unauthorized access. | Verify RHEL 10 is configured so that the "/etc/passwd-" file has mode "0644" or less permissive with the following command: $ sudo stat -c "%a %n" /etc/passwd- 644 /etc/passwd- If a value of "0644" or less permissive is not returned, this i | |
| RHEL-10-400275 | RHEL 10 must enforce mode "0000" or less permissive for "/etc/shadow-" file to prevent unauthorized access. | Verify RHEL 10 is configured so that the "/etc/shadow-" file has mode "0000" with the following command: $ sudo stat -c "%a %n" /etc/shadow- 0 /etc/shadow- If a value of "0" is not returned, this is a finding. | |
| RHEL-10-400280 | RHEL 10 must be configured so that a sticky bit is set on all public directories. | Verify RHEL 10 is configured so that all world-writable directories have the sticky bit set with the following command: $ sudo find / -type d \( -perm -0002 -a ! -perm -1000 \) -print 2>/dev/null drwxrwxrwt 7 root root 4096 Jul 26 11:19 /tm | |
| RHEL-10-400285 | RHEL 10 must be configured so that all local files and directories have a valid group owner. | Verify RHEL 10 is configured so that all local files and directories have a valid group with the following command: $ df --local -P | awk {'if (NR!=1) print $6'} | sudo xargs -I '{}' find '{}' -xdev -nogroup If any files on the system do no | |
| RHEL-10-400290 | RHEL 10 must be configured so that all local files and directories must have a valid owner. | Verify RHEL 10 is configured so that all local files and directories have a valid owner with the following command: $ df --local -P | awk {'if (NR!=1) print $6'} | sudo xargs -I '{}' find '{}' -xdev -nouser If any files on the system do not | |
| RHEL-10-400295 | RHEL 10 must enforce mode "0000" for "/etc/shadow" to prevent unauthorized access. | Verify RHEL 10 is configured so that the "/etc/shadow" file has mode "0000" with the following command: $ sudo stat -c "%a %n" /etc/shadow 0 /etc/shadow If a value of "0" is not returned, this is a finding. | |
| RHEL-10-400300 | RHEL 10 must be configured so that audit tools are owned by "root". | Verify RHEL 10 audit tools are owned by "root" with the following command: $ sudo stat -c "%U %n" /sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/auditd /sbin/rsyslogd /sbin/augenrules root /sbin/auditctl root /sbin/aureport root /sbin/a | |
| RHEL-10-400305 | RHEL 10 must be configured so that audit tools are group-owned by "root". | Verify RHEL 10 audit tools are group-owned by "root" with the following command: $ sudo stat -c "%G %n" /sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/auditd /sbin/rsyslogd /sbin/augenrules root /sbin/auditctl root /sbin/aureport root / | |
| RHEL-10-400310 | RHEL 10 must set the umask value to "077" for all local interactive user accounts. | Verify RHEL 10 sets the default umask for all local interactive users to "077". Identify the locations of all local interactive user home directories by looking at the "/etc/passwd" file. Check all local interactive user initialization file | |
| RHEL-10-400315 | RHEL 10 must define default permissions for the bash shell. | Verify RHEL 10 "umask" setting is configured correctly in the "/etc/bashrc" file with the following command: Note: If the value of the "umask" parameter is set to "000" in the "/etc/bashrc" file, the Severity is raised to a CAT I. $ sudo gr | |
| RHEL-10-400320 | RHEL 10 must define default permissions for the c shell. | Verify the RHEL 10 "umask" setting is configured correctly in the "/etc/csh.cshrc" file with the following command: Note: If the value of the "umask" parameter is set to "000" in the "/etc/csh.cshrc" file, the Severity is raised to a CAT I. | |
| RHEL-10-400325 | RHEL 10 must define default permissions for all authenticated users in such a way that the user can read and modify only their own files. | Verify RHEL 10 defines default permissions for all authenticated users in such a way that the user can only read and modify their own files with the following command: Note: If the value of the "umask" parameter is set to "000" in "/etc/log | |
| RHEL-10-400330 | RHEL 10 must define default permissions for the system default profile. | Verify the RHEL 10 "umask" setting is configured correctly in the "/etc/profile" file with the following command: Note: If the value of the "umask" parameter is set to "000" in the "/etc/profile" file, the Severity is raised to a CAT I. $ s | |
| RHEL-10-400335 | RHEL 10 must enforce that all local initialization files configured by systemd-tmpfiles have mode "0600" or less permissive. | Verify RHEL 10 enforces that all local initialization files configured by systemd-tmpfiles have mode "0600" or less permissive. Check that all files from "/usr/share/rootfiles/" are overridden correctly in RHEL 10: $ sudo grep /usr/share/ro | |
| RHEL-10-400340 | RHEL 10 must enforce mode "0600" or less permissive for Secure Shell (SSH) private host key files. | Verify RHEL 10 enforces mode "0600" for SSH private host key files with the following command: $ sudo stat -c "%a %n" /etc/ssh/*_key 600 /etc/ssh/ssh_host_ecdsa_key 600 /etc/ssh/ssh_host_ed25519_key 600 /etc/ssh/ssh_host_rsa_key If any priv | |
| RHEL-10-400345 | RHEL 10 must enforce "root" group ownership of the "/boot/grub2/grub.cfg" file. | Verify RHEL 10 enforces group ownership of the "/boot/grub2/grub.cfg" file with the following command: $ sudo stat -c "%G %n" /boot/grub2/grub.cfg root /boot/grub2/grub.cfg If the "/boot/grub2/grub.cfg" file does not have a group owner of " | |
| RHEL-10-400350 | RHEL 10 must enforce "root" ownership of the "/boot/grub2/grub.cfg" file. | Verify RHEL 10 enforces ownership of the "/boot/grub2/grub.cfg" file with the following command: $ sudo stat -c "%U %n" /boot/grub2/grub.cfg root /boot/grub2/grub.cfg If the "/boot/grub2/grub.cfg" file does not have an owner of "root", this | |
| RHEL-10-400355 | RHEL 10 must prevent device files from being interpreted on file systems that contain user home directories. | Verify RHEL 10 is configured so that "/home" is mounted with the "nodev" option with the following command: Note: If a separate file system has not been created for the user home directories (user home directories are mounted under "/"), th | |
| RHEL-10-400360 | RHEL 10 must prevent files with the "setuid" and "setgid" bit set from being executed on file systems that contain user home directories. | Verify RHEL 10 is configured so that "/home" is mounted with the "nosuid" option with the following command: Note: If a separate file system has not been created for the user home directories (user home directories are mounted under "/"), t | |
| RHEL-10-400365 | RHEL 10 must prevent code from being executed on file systems that contain user home directories. | Verify RHEL 10 is configured so that "/home" is mounted with the "noexec" option with the following command: Note: If a separate file system has not been created for the user home directories (user home directories are mounted under "/"), t | |
| RHEL-10-400400 | RHEL 10 must mount "/var/log/audit" with the "nodev" option. | Verify RHEL 10 is configured so that "/var/log/audit" is mounted with the "nodev" option: $ mount | grep /var/log/audit /dev/mapper/luks-4e45e1ad-5337-42c4-a19f-ee12ccc1d502 on /var/log/audit type xfs (rw,nodev,nosuid,noexec,seclabel) If th | |
| RHEL-10-400405 | RHEL 10 must mount "/var/log/audit" with the "noexec" option. | Verify RHEL 10 is configured so that "/var/log/audit" is mounted with the "noexec" option: $ mount | grep /var/log/audit /dev/mapper/luks-4e45e1ad-5337-42c4-a19f-ee12ccc1d502 on /var/log/audit type xfs (rw,nodev,nosuid,noexec,seclabel) If t | |
| RHEL-10-400410 | RHEL 10 must mount "/var/log/audit" with the "nosuid" option. | Verify RHEL 10 is configured so that "/var/log/audit" is mounted with the "nosuid" option: $ mount | grep /var/log/audit /dev/mapper/luks-4e45e1ad-5337-42c4-a19f-ee12ccc1d502 on /var/log/audit type xfs (rw,nodev,nosuid,noexec,seclabel) If t | |
| RHEL-10-400450 | RHEL 10 must enforce a mode of "0755" or less permissive for audit tools. | Verify RHEL 10 is configured so that the audit tools have a mode of "0755" or less with the following command: $ stat -c "%a %n" /sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/auditd /sbin/rsyslogd /sbin/augenrules 755 /sbin/auditctl 75 | |
| RHEL-10-400500 | RHEL 10 must prohibit local initialization files from executing world-writable programs. | Verify RHEL 10 local initialization files do not execute world-writable programs with the following command: Note: The example will be for a system that is configured to create user home directories in the "/home" directory. $ sudo find /ho | |
| RHEL-10-500000 | RHEL 10 must enable the systemd-journald service. | Verify RHEL 10 enables the systemd-journald service with the following command: $ systemctl is-active systemd-journald active If the systemd-journald service is not active, this is a finding. | |
| RHEL-10-500005 | RHEL 10 must enable auditing of processes that start prior to the audit daemon. | Verify RHEL 10 is configured so that GRUB 2 enables auditing of processes that start prior to the audit daemon with the following commands: Check that the current GRUB 2 configuration enables auditing: $ sudo grubby --info=ALL | grep args | | |
| RHEL-10-500010 | RHEL 10 must audit local events. | Verify that RHEL 10 generates audit records for local events with the following command: $ sudo grep local_events /etc/audit/auditd.conf local_events = yes If "local_events" is not set to "yes", the command does not return a line, or the li | |
| RHEL-10-500015 | RHEL 10 must write audit records to disk. | Verify the RHEL 10 audit system is configured to write logs to the disk with the following command: $ sudo grep write_logs /etc/audit/auditd.conf write_logs = yes If "write_logs" does not have a value of "yes", the line is commented out, or | |
| RHEL-10-500020 | RHEL 10 must log username information when unsuccessful login attempts occur. | Verify RHEL 10 "/etc/security/faillock.conf" is configured to log username information when unsuccessful login attempts occur with the following command: $ sudo grep audit /etc/security/faillock.conf audit If the "audit" option is not set, | |
| RHEL-10-500025 | RHEL 10 must allow only the information system security manager (ISSM) (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited. | Verify RHEL 10 sets the files in directory "/etc/audit/rules.d/" and "/etc/audit/auditd.conf" file to have a mode of "0640" or less permissive with the following command: $ sudo find /etc/audit/rules.d/ /etc/audit/audit.rules /etc/audit/aud | |
| RHEL-10-500030 | RHEL 10 must allocate an "audit_backlog_limit" of sufficient size to capture processes that start prior to the audit daemon. | Verify RHEL 10 allocates a sufficient "audit_backlog_limit" to capture processes that start prior to the audit daemon with the following command: $ grep -oP 'audit_backlog_limit=\K[0-9]+' /proc/cmdline 8192 If the command returns any output | |
| RHEL-10-500035 | RHEL 10 must take appropriate action when a critical audit processing failure occurs. | Verify the RHEL 10 audit service is configured to panic on a critical error with the following command: $ sudo grep "\-f" /etc/audit/audit.rules -f 2 If the value for "-f" is not "2", and availability is not documented as an overriding conc | |
| RHEL-10-500040 | RHEL 10 must take action when allocated audit record storage volume reaches 75 percent of the audit record storage capacity. | Verify RHEL 10 takes action when allocated audit record storage volume reaches 75 percent of the repository maximum audit record storage capacity with the following command: $ sudo grep -w space_left /etc/audit/auditd.conf space_left = 25% | |
| RHEL-10-500045 | RHEL 10 must label all off-loaded audit logs before sending them to the central log server. | Verify the RHEL 10 audit daemon is configured to label all off-loaded audit logs with the following command: $ sudo grep name_format /etc/audit/auditd.conf name_format = hostname If the "name_format" option is not "hostname", "fqd", or "num | |
| RHEL-10-500100 | RHEL 10 must allocate audit record storage capacity to store at least one week's worth of audit records. | Verify RHEL 10 allocates audit record storage capacity to store at least one week of audit records when audit records are not immediately sent to a central audit record storage facility. Note: The partition size needed to capture a week of | |
| RHEL-10-500105 | RHEL 10 must take action when allocated audit record storage volume reaches 95 percent of the audit record storage capacity. | Verify RHEL 10 takes action when allocated audit record storage volume reaches 95 percent of the repository maximum audit record storage capacity with the following command: $ sudo grep -w admin_space_left /etc/audit/auditd.conf admin_space | |
| RHEL-10-500110 | RHEL 10 must take action when allocated audit record storage volume reaches 95 percent of the repository maximum audit record storage capacity. | Verify RHEL 10 is configured to take action if allocated audit record storage volume reaches 95 percent of the repository maximum audit record storage capacity with the following command: $ sudo grep admin_space_left_action /etc/audit/audit | |
| RHEL-10-500115 | RHEL 10 must take appropriate action when the internal event queue is full. | Verify the RHEL 10 audit system is configured to take an appropriate action when the internal event queue is full: $ sudo grep overflow_action /etc/audit/auditd.conf overflow_action = syslog If the value of the "overflow_action" option is n | |
| RHEL-10-500120 | RHEL 10 must produce audit records containing information to establish the identity of any individual or process associated with the event. | Verify the RHEL 10 audit system is configured to resolve audit information before writing to disk with the following command: $ sudo grep log_format /etc/audit/auditd.conf log_format = ENRICHED If the "log_format" option is not "ENRICHED", | |
| RHEL-10-500125 | RHEL 10 must periodically flush audit records to disk to ensure that audit records are not lost. | Verify RHEL 10 is configured to flush audit records to disk after every 100 records with the following command: $ sudo grep freq /etc/audit/auditd.conf freq = 100 If "freq" is not set to a value of "100" or greater, the value is missing, or | |
| RHEL-10-500205 | RHEL 10 must notify the system administrator (SA) and information system security officer (ISSO) (at a minimum) when allocated audit record storage volume 75 percent utilization. | Verify RHEL 10 notifies the SA and ISSO (at a minimum) when allocated audit record storage volume reaches 75 percent of the repository maximum audit record storage capacity with the following command: $ sudo grep -w space_left_action /etc/a | |
| RHEL-10-500210 | RHEL 10 must notify the system administrator (SA) and/or information system security officer (ISSO) (at a minimum) of an audit processing failure. | Verify RHEL 10 is configured to notify the SA and/or ISSO (at a minimum) of an audit processing failure with the following command: $ sudo grep action_mail_acct /etc/audit/auditd.conf action_mail_acct = root If the value of the "action_mail | |
| RHEL-10-500215 | RHEL 10 must log Secure Shell (SSH) connection attempts and failures to the server. | Verify RHEL 10 logs SSH connection attempts and failures to the server with the following command: $ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH '^\s*loglevel' /etc/ssh/sshd_co | |
| RHEL-10-500300 | RHEL 10 must generate audit records for successful and unsuccessful uses of the "execve" system call. | Verify RHEL 10 is configured to audit the execution of the "execve" system call with the following command: $ sudo auditctl -l | grep execve -a always,exit -F arch=b32 -S execve -C uid!=euid -F euid=0 -F key=execpriv -a always,exit -F arch= | |
| RHEL-10-500310 | RHEL 10 must generate audit records for successful and unsuccessful uses of the "setxattr", "fsetxattr", "lsetxattr", "removexattr", "fremovexattr", and "lremovexattr" system calls. | Verify RHEL 10 is configured to audit the execution of the "setxattr", "fsetxattr", "lsetxattr", "removexattr", "fremovexattr", and "lremovexattr" system calls with the following command: $ sudo auditctl -l | grep xattr -a always,exit -F ar | |
| RHEL-10-500320 | RHEL 10 must generate audit records for successful and unsuccessful uses of "umount" system calls. | Verify RHEL 10 is configured to audit the execution of the "umount" command with the following command: $ sudo auditctl -l | grep /usr/bin/umount -a always,exit -S all -F path=/usr/bin/umount -F perm=x -F auid>=1000 -F auid!=-1 -F key=privi | |
| RHEL-10-500330 | RHEL 10 must generate audit records for successful and unsuccessful uses of the "chacl" command. | Verify RHEL 10 is configured to audit the execution of the "chacl" command with the following command: $ sudo auditctl -l | grep chacl -a always,exit -S all -F path=/usr/bin/chacl -F perm=x -F auid>=1000 -F auid!=-1 -F key=perm_mod If the c | |
| RHEL-10-500340 | RHEL 10 must generate audit records for successful and unsuccessful uses of the "setfacl" command. | Verify RHEL 10 is configured to audit the execution of the "setfacl" command with the following command: $ sudo auditctl -l | grep setfacl -a always,exit -S all -F path=/usr/bin/setfacl -F perm=x -F auid>=1000 -F auid!=-1 -F key=perm_mod If | |
| RHEL-10-500350 | RHEL 10 must generate audit records for successful and unsuccessful uses of the "chcon" command. | Verify RHEL 10 is configured to audit the execution of the "chcon" command with the following command: $ sudo auditctl -l | grep chcon -a always,exit -S all -F path=/usr/bin/chcon -F perm=x -F auid>=1000 -F auid!=-1 -F key=perm_mod If the c | |
| RHEL-10-500360 | RHEL 10 must generate audit records for successful and unsuccessful uses of the "semanage" command. | Verify RHEL 10 is configured to audit the execution of the "semanage" command with the following command: $ sudo auditctl -l | grep semanage -a always,exit -S all -F path=/usr/sbin/semanage -F perm=x -F auid>=1000 -F auid!=-1 -F key=privile | |
| RHEL-10-500370 | RHEL 10 must generate audit records for successful and unsuccessful uses of the "setfiles" command. | Verify RHEL 10 is configured to audit the execution of the "setfiles" command with the following command: $ sudo auditctl -l | grep setfiles -a always,exit -S all -F path=/usr/sbin/setfiles -F perm=x -F auid>=1000 -F auid!=-1 -F key=privile | |
| RHEL-10-500380 | RHEL 10 must generate audit records for successful and unsuccessful uses of the "setsebool" command. | Verify RHEL 10 is configured to audit the execution of the "setsebool" command with the following command: $ sudo auditctl -l | grep setsebool -a always,exit -S all -F path=/usr/sbin/setsebool -F perm=x -F auid>=1000 -F auid!=-1 -F key=priv | |
| RHEL-10-500390 | RHEL 10 must generate audit records for successful and unsuccessful uses of the "truncate", "ftruncate", "creat", "open", "openat", and "open_by_handle_at" system calls. | Verify RHEL 10 is configured to audit successful/unsuccessful attempts to use the "truncate", "ftruncate", "creat", "open", "openat", and "open_by_handle_at" system calls with the following command: $ sudo auditctl -l | grep 'open\|truncate | |
| RHEL-10-500400 | RHEL 10 must generate audit records for successful and unsuccessful uses of the "delete_module" system call. | Verify RHEL 10 is configured to audit the execution of the "delete_module" system call with the following command: $ sudo auditctl -l | grep delete_module -a always,exit -F arch=b32 -S delete_module -F auid>=1000 -F auid!=-1 -F key=module_c | |
| RHEL-10-500410 | RHEL 10 must generate audit records for successful and unsuccessful uses of the "init_module" and "finit_module" system calls. | Verify RHEL 10 is configured to audit the execution of the "init_module" and "finit_module" syscalls with the following command: $ sudo auditctl -l | grep init_module -a always,exit -F arch=b32 -S init_module,finit_module -F auid>=1000 -F a | |
| RHEL-10-500420 | RHEL 10 must generate audit records for successful and unsuccessful uses of the "chage" command. | Verify RHEL 10 is configured to audit the execution of the "chage" command with the following command: $ sudo auditctl -l | grep chage -a always,exit -S all -F path=/usr/bin/chage -F perm=x -F auid>=1000 -F auid!=-1 -F key=privileged-chage | |
| RHEL-10-500430 | RHEL 10 must generate audit records for successful and unsuccessful uses of the "chsh" command. | Verify RHEL 10 is configured to audit the execution of the "chsh" command with the following command: $ sudo auditctl -l | grep chsh -a always,exit -S all -F path=/usr/bin/chsh -F perm=x -F auid>=1000 -F auid!=-1 -F key=priv_cmd If the comm | |
| RHEL-10-500440 | RHEL 10 must generate audit records for successful and unsuccessful uses of the "crontab" command. | Verify RHEL 10 is configured to audit the execution of the "crontab" command with the following command: $ sudo auditctl -l | grep crontab -a always,exit -S all -F path=/usr/bin/crontab -F perm=x -F auid>=1000 -F auid!=-1 -F key=privileged- | |
| RHEL-10-500450 | RHEL 10 must generate audit records for successful and unsuccessful uses of the "gpasswd" command. | Verify RHEL 10 generates audit records for the execution of the "gpasswd" command with the following command: $ sudo auditctl -l | grep '/usr/bin/gpasswd' -a always,exit -F arch=b32 -F path=/usr/bin/gpasswd -F perm=x -F key=privileged-gpass | |
| RHEL-10-500460 | RHEL 10 must generate audit records for successful and unsuccessful uses of the "kmod" command. | Verify RHEL 10 is configured to audit the execution of the "kmod" command with the following command: $ sudo auditctl -l | grep kmod -a always,exit -S all -F path=/usr/bin/kmod -F perm=x -F auid>=1000 -F auid!=-1 -F key=modules If the comma | |
| RHEL-10-500470 | RHEL 10 must generate audit records for successful and unsuccessful uses of the "newgrp" command. | Verify RHEL 10 is configured to audit the execution of the "newgrp" command with the following command: $ sudo auditctl -l | grep newgrp -a always,exit -S all -F path=/usr/bin/newgrp -F perm=x -F auid>=1000 -F auid!=-1 -F key=priv_cmd If th | |
| RHEL-10-500480 | RHEL 10 must generate audit records for successful and unsuccessful uses of the "pam_timestamp_check" command. | Verify RHEL 10 is configured to audit the execution of the "pam_timestamp_check" command with the following command: $ sudo auditctl -l | grep timestamp -a always,exit -S all -F path=/usr/sbin/pam_timestamp_check -F perm=x -F auid>=1000 -F | |
| RHEL-10-500490 | RHEL 10 must generate audit records for successful and unsuccessful uses of the "passwd" command. | Verify RHEL 10 generates audit records for successful and unsuccessful uses of the "passwd" command with the following command: $ sudo auditctl -l | grep '/usr/bin/passwd' -a always,exit -F arch=b32 -F path=/usr/bin/passwd -F perm=x -F key= | |
| RHEL-10-500500 | RHEL 10 must generate audit records for successful and unsuccessful uses of the "postdrop" command. | Verify RHEL 10 is configured to audit the execution of the "postdrop" command with the following command: $ sudo auditctl -l | grep postdrop -a always,exit -S all -F path=/usr/sbin/postdrop -F perm=x -F auid>=1000 -F auid!=-1 -F key=privile | |
| RHEL-10-500510 | RHEL 10 must generate audit records for successful and unsuccessful uses of the "postqueue" command. | Verify RHEL 10 is configured to audit the execution of the "postqueue" command with the following command: $ sudo auditctl -l | grep postqueue -a always,exit -S all -F path=/usr/sbin/postqueue -F perm=x -F auid>=1000 -F auid!=-1 -F key=priv | |
| RHEL-10-500520 | RHEL 10 must generate audit records for successful and unsuccessful uses of the ssh-agent command. | Verify RHEL 10 is configured to audit the execution of the "ssh-agent" command with the following command: $ sudo auditctl -l | grep ssh-agent -a always,exit -S all -F path=/usr/bin/ssh-agent -F perm=x -F auid>=1000 -F auid!=-1 -F key=privi | |
| RHEL-10-500530 | RHEL 10 must generate audit records for successful and unsuccessful uses of the "ssh-keysign" command. | Verify RHEL 10 is configured to audit the execution of the "ssh-keysign" command with the following command: $ sudo auditctl -l | grep ssh-keysign -a always,exit -S all -F path=/usr/libexec/openssh/ssh-keysign -F perm=x -F auid>=1000 -F aui | |
| RHEL-10-500540 | RHEL 10 must generate audit records for successful and unsuccessful uses of the "su" command. | Verify RHEL 10 is configured to audit the execution of the "su" command with the following command: $ sudo auditctl -l | grep '/usr/bin/su\b' -a always,exit -S all -F path=/usr/bin/su -F perm=x -F auid>=1000 -F auid!=-1 -F key=privileged-pr | |
| RHEL-10-500550 | RHEL 10 must generate audit records for successful and unsuccessful uses of the "sudo" command. | Verify RHEL 10 is configured to audit the execution of the "sudo" command with the following command: $ sudo auditctl -l | grep '/usr/bin/sudo\b' -a always,exit -S all -F path=/usr/bin/sudo -F perm=x -F auid>=1000 -F auid!=-1 -F key=priv_cm | |
| RHEL-10-500560 | RHEL 10 must generate audit records for successful and unsuccessful uses of the "sudoedit" command. | Verify RHEL 10 is configured to audit the execution of the "sudoedit" command with the following command: $ sudo auditctl -l | grep /usr/bin/sudoedit -a always,exit -S all -F path=/usr/bin/sudoedit -F perm=x -F auid>=1000 -F auid!=-1 -F key | |
| RHEL-10-500570 | RHEL 10 must generate audit records for successful and unsuccessful uses of the "unix_chkpwd" command. | Verify RHEL 10 is configured to audit the execution of the "unix_chkpwd" command with the following command: $ sudo auditctl -l | grep unix_chkpwd -a always,exit -S all -F path=/usr/sbin/unix_chkpwd -F perm=x -F auid>=1000 -F auid!=-1 -F ke | |
| RHEL-10-500580 | RHEL 10 must generate audit records for successful and unsuccessful uses of the "unix_update" command. | Verify RHEL 10 is configured to audit the execution of the "unix_update" command with the following command: $ sudo auditctl -l | grep unix_update -a always,exit -S all -F path=/usr/sbin/unix_update -F perm=x -F auid>=1000 -F auid!=-1 -F ke | |
| RHEL-10-500590 | RHEL 10 must generate audit records for successful and unsuccessful uses of the "userhelper" command. | Verify RHEL 10 is configured to audit the execution of the "userhelper" command with the following command: $ sudo auditctl -l | grep userhelper -a always,exit -S all -F path=/usr/sbin/userhelper -F perm=x -F auid>=1000 -F auid!=-1 -F key=p | |
| RHEL-10-500600 | RHEL 10 must generate audit records for successful and unsuccessful uses of the "usermod" command. | Verify RHEL 10 is configured to audit the execution of the "usermod" command with the following command: $ sudo auditctl -l | grep usermod -a always,exit -S all -F path=/usr/sbin/usermod -F perm=x -F auid>=1000 -F auid!=-1 -F key=privileged | |
| RHEL-10-500605 | RHEL 10 must generate audit records for successful and unsuccessful uses of the "useradd" command. | Verify RHEL 10 is configured to audit the execution of the "useradd" command with the following command: $ sudo auditctl -l | grep useradd -a always,exit -S all -F path=/usr/sbin/useradd -F perm=x -F auid>=1000 -F auid!=-1 -F key=privileged | |
| RHEL-10-500610 | RHEL 10 must generate audit records for successful and unsuccessful uses of the "mount" command. | Verify RHEL 10 is configured to audit the execution of the "mount" command with the following command: $ sudo auditctl -l | grep mount -a always,exit -F arch=b32 -S mount -F auid>=1000 -F auid!=unset -k privileged-mount -a always,exit -F ar | |
| RHEL-10-500620 | RHEL 10 must generate audit records for successful and unsuccessful uses of the "init" command. | Verify RHEL 10 is configured to audit the execution of the "init" command with the following command: $ sudo auditctl -l | grep /usr/sbin/init -a always,exit -S all -F path=/usr/sbin/init -F perm=x -F auid>=1000 -F auid!=-1 -F key=privilege | |
| RHEL-10-500630 | RHEL 10 must generate audit records for successful and unsuccessful uses of the "poweroff" command. | Verify RHEL 10 is configured to audit the execution of the "poweroff" command with the following command: $ sudo auditctl -l | grep poweroff -a always,exit -S all -F path=/usr/sbin/poweroff -F perm=x -F auid>=1000 -F auid!=-1 -F key=privile | |
| RHEL-10-500640 | RHEL 10 must generate audit records for successful and unsuccessful uses of the "reboot" command. | Verify RHEL 10 is configured to audit the execution of the "reboot" command with the following command: $ sudo auditctl -l | grep reboot -a always,exit -S all -F path=/usr/sbin/reboot -F perm=x -F auid>=1000 -F auid!=-1 -F key=privileged-re | |
| RHEL-10-500650 | RHEL 10 must generate audit records for successful and unsuccessful uses of the shutdown command. | Verify RHEL 10 is configured to audit the execution of the "shutdown" command with the following command: $ sudo cat /etc/audit/rules.d/* | grep shutdown -a always,exit -S all -F path=/usr/sbin/shutdown -F perm=x -F auid>=1000 -F auid!=-1 - | |
| RHEL-10-500660 | RHEL 10 must generate audit records for successful and unsuccessful uses of the "umount" system call. | Verify RHEL 10 generates an audit record for all uses of the "umount" system call with the following command: $ sudo auditctl -l | grep b32 | grep 'umount\b' -a always,exit -F arch=b32 -S umount -F auid>=1000 -F auid!=-1 -F key=privileged-u | |
| RHEL-10-500670 | RHEL 10 must generate audit records for successful and unsuccessful uses of the "umount2" system call. | Verify RHEL 10 generates an audit record for all uses of the "umount2" system call with the following command: $ sudo auditctl -l | grep umount2 -a always,exit -F arch=b64 -S umount2 -F auid>=1000 -F auid!=-1 -F key=privileged-umount -a alw | |
| RHEL-10-500680 | RHEL 10 must generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/sudoers". | Verify RHEL 10 generates audit records for all account creations, modifications, disabling, and termination events that affect "/etc/sudoers" with the following command: $ sudo auditctl -l | grep '/etc/sudoers[^.]' -a always,exit -F arch=b3 | |
| RHEL-10-500690 | RHEL 10 must generate audit records for all account creations, modifications, disabling, and termination events that affect the "/etc/sudoers.d/" directory. | Verify RHEL 10 generates audit records for all account creations, modifications, disabling, and termination events that affect "/etc/sudoers.d/" with the following command: $ sudo auditctl -l | grep /etc/sudoers.d -a always,exit -F arch=b32 | |
| RHEL-10-500700 | RHEL 10 must generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/group". | Verify RHEL 10 generates audit records for all account creations, modifications, disabling, and termination events that affect "/etc/group" with the following command: $ sudo auditctl -l | egrep '(/etc/group)' -a always,exit -F arch=b32 -F | |
| RHEL-10-500710 | RHEL 10 must generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/gshadow". | Verify RHEL 10 generates audit records for all account creations, modifications, disabling, and termination events that affect "/etc/gshadow" with the following command: $ sudo auditctl -l | egrep '(/etc/gshadow)' -a always,exit -F arch=b32 | |
| RHEL-10-500720 | RHEL 10 must generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/security/opasswd". | Verify RHEL 10 generates audit records for modifications to "/etc/security/opasswd" with the following command: $ sudo auditctl -l | grep '/etc/security/opasswd' -a always,exit -F arch=b32 -F path=/etc/security/opasswd -F perm=wa -F key=ide | |
| RHEL-10-500730 | RHEL 10 must generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/passwd". | Verify RHEL 10 generates audit records for all account creations, modifications, disabling, and termination events that affect "/etc/passwd" with the following command: $ sudo auditctl -l | egrep '(/etc/passwd)' -a always,exit -F arch=b32 - | |
| RHEL-10-500740 | RHEL 10 must generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/shadow". | Verify RHEL 10 generates audit records for all account creations, modifications, disabling, and termination events that affect "/etc/shadow" with the following command: $ sudo auditctl -l | egrep '(/etc/shadow)' -a always,exit -F arch=b32 - | |
| RHEL-10-500750 | RHEL 10 must generate audit records for all account creations, modifications, disabling, and termination events that affect "/var/log/faillock". | Verify RHEL 10 generates audit records for all account creations, modifications, disabling, and termination events that affect "/var/log/faillock" with the following command: $ sudo auditctl -l | grep /var/log/faillock -a always,exit -F arc | |
| RHEL-10-500760 | RHEL 10 must generate audit records for all account creations, modifications, disabling, and termination events that affect "/var/log/lastlog". | Verify RHEL 10 generates audit records for all account creations, modifications, disabling, and termination events that affect "/var/log/lastlog" with the following command: $ sudo auditctl -l | grep /var/log/lastlog -a always,exit -F arch= | |
| RHEL-10-500780 | RHEL 10 must generate audit records for all uses of the "chmod", "fchmod", "fchmodat", and "fchmodat2" syscalls. | Verify RHEL 10 is configured to audit the execution of the "chmod", "fchmod", "fchmodat", and "fchmodat2" syscalls with the following command: $ sudo auditctl -l | grep chmod -a always,exit -F arch=b32 -S chmod,fchmod,fchmodat,fchmodat2 -F | |
| RHEL-10-500790 | RHEL 10 must generate audit records for all uses of the "chown", "fchown", "fchownat", and "lchown" syscalls. | Verify RHEL 10 is configured to audit the execution of the "chown", "fchown", "fchownat", and "lchown" syscalls with the following command: $ sudo auditctl -l | grep chown -a always,exit -F arch=b32 -S chown,fchown,fchownat,lchown -F auid>= | |
| RHEL-10-500810 | RHEL 10 must generate audit records for all uses of the "rename", "unlink", "rmdir", "renameat", "renameat2", and "unlinkat" system calls. | Verify RHEL 10 is configured to audit successful/unsuccessful attempts to use the "rename", "unlink", "rmdir", "renameat", "renameat2", and "unlinkat" system calls with the following command: $ sudo auditctl -l | grep 'rename\|unlink\|rmdir | |
| RHEL-10-600000 | RHEL 10 must require authentication upon booting into single-user and maintenance modes. | Verify that RHEL 10 requires a password for the GRUB 2 bootloader to prevent unauthorized modifications to boot parameters. Check the unified configuration file where the GRUB 2 password is stored: # sudo grep -iw "GRUB2_PASSWORD" /boot/gru | |
| RHEL-10-600010 | RHEL 10 must require a unique superusers name upon booting into single-user and maintenance modes. | Verify RHEL 10 requires a unique superusers name upon booting into single-user and maintenance modes. Verify that the boot loader superuser account has been set with the following command: $ sudo grep -A1 "superusers" /etc/grub2.cfg set sup | |
| RHEL-10-600020 | RHEL 10 must not assign an interactive login shell for system accounts. | Verify that RHEL 10 system accounts do not have an interactive login shell. Run the following command to list any system account (UID 0 && $3 < 1000) && $1 !~ /^(halt|sync|shutdown)$/ && $7 !~ /(nologin|false)$/) {print $1 ":" $3 ":" $7}' / | |
| RHEL-10-600100 | RHEL 10 user account passwords for new users or password changes must have a 180-day maximum password lifetime restriction in /etc/login.defs. | Verify that RHEL 10 enforces a 180-day maximum password lifetime for new user accounts by running the following command: $ sudo grep -i pass_max_days /etc/login.defs PASS_MAX_DAYS 180 If the "PASS_MAX_DAYS" parameter value is greater than " | |
| RHEL-10-600110 | RHEL 10 must, for user account passwords, have a 180-day maximum password lifetime restriction | Verify RHEL 10 enforces a 180-day maximum time period for existing user account passwords with the following commands: $ sudo awk -F: '$5 > 180 {print $1 " " $5}' /etc/shadow $ sudo awk -F: '$5 <= 0 {print $1 " " $5}' /etc/shadow If any res | |
| RHEL-10-600120 | RHEL 10 must assign a home directory for local interactive user accounts upon creation. | Verify RHEL 10 assigns a home directory for local interactive user accounts upon creation with the following command: $ sudo grep -i create_home /etc/login.defs CREATE_HOME yes If the value for "CREATE_HOME" parameter is not set to "yes", t | |
| RHEL-10-600130 | RHEL 10 must not allow duplicate user IDs (UIDs) to exist for interactive users. | Verify RHEL 10 contains no duplicate UIDs for interactive users with the following command: $ sudo awk -F ":" 'list[$3]++{print $1, $3}' /etc/passwd If output is produced and the accounts listed are interactive user accounts, this is a find | |
| RHEL-10-600140 | RHEL 10 must automatically expire temporary accounts within 72 hours. | Verify RHEL 10 automatically expires temporary accounts within 72 hours. For every existing temporary account, run the following command to obtain its account expiration information: $ sudo chage -l | grep -i "account expires" Verify each o | |
| RHEL-10-600150 | RHEL 10 must assign a primary group to all interactive users. | Verify RHEL 10 interactive users have a valid GID. Check that the interactive users have a valid GID with the following command: $ sudo pwck -r If pwck reports "no group" for any interactive user, this is a finding. | |
| RHEL-10-600160 | RHEL 10 must disable account identifiers (individuals, groups, roles, and devices) after 35 days of inactivity. | Verify RHEL 10 account identifiers (individuals, groups, roles, and devices) are disabled after 35 days of inactivity. Check the account inactivity value by performing the following command: $ sudo grep -i inactive /etc/default/useradd INAC | |
| RHEL-10-600170 | RHEL 10 must be configured so that all local interactive user initialization file executable search path statements do not contain statements that will reference a working directory other than user home directories. | Verify RHEL 10 local interactive user initialization file executable search path statements do not contain statements that will reference a working directory other than user home directories with the following commands: $ sudo find /home -m | |
| RHEL-10-600180 | RHEL 10 must assign a home directory to all local interactive users in the "/etc/passwd" file. | Verify RHEL 10 interactive users have a home directory assigned with the following command: $ sudo awk -F: '($3>=1000)&&($7 !~ /nologin/){print $1, $3, $6}' /etc/passwd nsauser:x:1000:1000:nsauser:/home/nsauser:/bin/bash disauser:x:1001:100 | |
| RHEL-10-600190 | RHEL 10 must ensure that all local interactive user home directories defined in the "/etc/passwd" file must exist. | Verify RHEL 10 interactive users' home directories exist on the system with the following command: $ sudo pwck -r user 'mailnull': directory 'var/spool/mqueue' does not exist The output should not return any interactive users. If an interac | |
| RHEL-10-600200 | RHEL 10 must enforce a delay of at least four seconds between login prompts following a failed login attempt. | Verify RHEL 10 enforces a delay of at least four seconds between console login prompts following a failed login attempt with the following command: $ sudo grep -i fail_delay /etc/login.defs FAIL_DELAY 4 If the value of "FAIL_DELAY" is not s | |
| RHEL-10-600210 | RHEL 10 must enforce a 24-hours minimum password lifetime restriction for passwords for new users or password changes in "/etc/login.defs". | Verify RHEL 10 enforces 24 hours as the minimum password lifetime for new user accounts. Check for the value of "PASS_MIN_DAYS" in "/etc/login.defs" with the following command: $ sudo grep -i pass_min_days /etc/login.defs PASS_MIN_DAYS 1 If | |
| RHEL-10-600220 | RHEL 10 must enforce that passwords be created with a minimum of 15 characters. | Verify RHEL 10 enforces a minimum 15-character password length with the following command: $ sudo grep -s minlen /etc/security/pwquality.conf /etc/security/pwquality.conf.d/*.conf /etc/security/pwquality.conf:minlen = 15 If the command does | |
| RHEL-10-600230 | RHEL 10 must enforce password complexity by requiring at least one special character to be used. | Verify RHEL 10 enforces password complexity by requiring that at least one special character be used with the following command: $ sudo grep -s ocredit /etc/security/pwquality.conf /etc/security/pwquality.conf.d/*.conf /etc/security/pwquali | |
| RHEL-10-600240 | RHEL 10 must enforce password complexity by requiring that at least one lowercase character be used. | Verify RHEL 10 enforces password complexity by requiring that at least one lowercase character be used with the following command: $ sudo grep -s lcredit /etc/security/pwquality.conf /etc/security/pwquality.conf/*.conf /etc/security/pwquali | |
| RHEL-10-600250 | RHEL 10 must enforce password complexity by requiring that at least one uppercase character be used. | Verify RHEL 10 enforces password complexity by requiring that at least one uppercase character be used. Check the value for "ucredit" with the following command: $ sudo grep -s ucredit /etc/security/pwquality.conf /etc/security/pwquality.co | |
| RHEL-10-600260 | RHEL 10 must require the change of at least eight characters when passwords are changed. | Verify RHEL 10 requires the change of at least eight characters when passwords are changed by checking the value of the "difok" option in "/etc/security/pwquality.conf" with the following command: $ sudo grep difok -s /etc/security/pwqualit | |
| RHEL-10-600270 | RHEL 10 must enforce that passwords have a 24 hours/1 day minimum lifetime restriction in "/etc/shadow". | Verify the minimum time period between password changes for each user account is one day or greater with the following command: $ sudo awk -F: '$4 < 1 {printf "%s %d\n", $1, $4}' /etc/shadow If any results are returned that are not associat | |
| RHEL-10-600280 | RHEL 10 must require the maximum number of repeating characters of the same character class to be limited to four when passwords are changed. | Verify RHEL 10 limits the value of the "maxclassrepeat" option in "/etc/security/pwquality.conf" with the following command: $ sud grep -s maxclassrepeat /etc/security/pwquality.conf /etc/security/pwquality.conf.d/*.conf /etc/security/pwqua | |
| RHEL-10-600290 | RHEL 10 must require that the maximum number of repeating characters be limited to three when passwords are changed. | Verify RHEL 10 limits the value of the "maxrepeat" option in "/etc/security/pwquality.conf" with the following command: $ sudo grep -s maxrepeat /etc/security/pwquality.conf /etc/security/pwquality.conf.d/*.conf /etc/security/pwquality.conf | |
| RHEL-10-600300 | RHEL 10 must require the change of at least four character classes when passwords are changed. | Verify RHEL 10 sets the value of the "minclass" option in "/etc/security/pwquality.conf" with the following command: $ sudo grep -s minclass /etc/security/pwquality.conf /etc/security/pwquality.conf.d/*.conf /etc/security/pwquality.conf:min | |
| RHEL-10-600310 | RHEL 10 must enforce password complexity by requiring that at least one numeric character be used. | Verify RHEL 10 enforces password complexity by requiring that at least one numeric character be used. Check the value for "dcredit" with the following command: $ sudo grep -s dcredit /etc/security/pwquality.conf /etc/security/pwquality.conf | |
| RHEL-10-600320 | RHEL 10 must prevent the use of dictionary words for passwords. | Verify RHEL 10 prevents the use of dictionary words for passwords with the following command: $ sudo grep -s dictcheck /etc/security/pwquality.conf /etc/pwquality.conf.d/*.conf /etc/security/pwquality.conf:dictcheck=1 If "dictcheck" does no | |
| RHEL-10-600400 | RHEL 10 must allow only the root account to have unrestricted access to the system. | Verify RHEL 10 is configured so that only the "root" account has a UID "0" assignment with the following command: $ awk -F: '$3 == 0 {print $1}' /etc/passwd root If any accounts other than "root" have a UID of "0", this is a finding. | |
| RHEL-10-600405 | RHEL 10 must enforce password complexity rules for the "root" account. | Verify RHEL 10 enforces password complexity rules for the "root" account. Check if "root" user is required to use complex passwords with the following command: $ sudo grep enforce_for_root /etc/security/pwquality.conf /etc/security/pwqualit | |
| RHEL-10-600410 | RHEL 10 must automatically lock an account when three unsuccessful login attempts occur. | Verify RHEL 10 is configured to lock an account after three unsuccessful login attempts with the following command: $ sudo grep 'deny =' /etc/security/faillock.conf deny = 3 If the "deny" option is not set to "3" or less (but not "0"), or i | |
| RHEL-10-600415 | RHEL 10 must automatically lock the root account until the root account is released by an administrator when three unsuccessful login attempts occur during a 15-minute time period. | Verify RHEL 10 is configured to lock the root account after three unsuccessful login attempts with the following command: $ sudo grep even_deny_root /etc/security/faillock.conf even_deny_root If the "even_deny_root" option is not set or is | |
| RHEL-10-600420 | RHEL 10 must automatically lock an account when three unsuccessful login attempts occur during a 15-minute time period. | Verify RHEL 10 locks an account after three unsuccessful login attempts within a period of 15 minutes with the following command: $ sudo grep fail_interval /etc/security/faillock.conf fail_interval = 900 If the "fail_interval" option is not | |
| RHEL-10-600425 | RHEL 10 must maintain an account lock until the locked account is released by an administrator. | Verify RHEL 10 is configured to lock an account after three unsuccessful login attempts until released by an administrator with the following command: $ sudo grep 'unlock_time =' /etc/security/faillock.conf unlock_time = 0 If the "unlock_ti | |
| RHEL-10-600430 | RHEL 10 must ensure account lockouts persist. | Verify RHEL 10 is configured so that the "/etc/security/faillock.conf" file uses a nondefault "faillock" directory to ensure contents persist after reboot with the following command: $ sudo grep -w dir /etc/security/faillock.conf dir = /var | |
| RHEL-10-600450 | RHEL 10 must not have unauthorized accounts. | Verify RHEL 10 has no unauthorized local interactive user accounts with the following command: $ less /etc/passwd root:x:0:0:root:/root:/bin/bash ... nsauser:x:1000:1000:nsauser:/home/nsauser:/bin/bash doduser:x:1001:1001:doduser:/home/dodu | |
| RHEL-10-600455 | RHEL 10 must not allow blank or null passwords. | Verify RHEL 10 prohibits the use of null passwords with the following command: $ sudo grep -i nullok /etc/pam.d/system-auth /etc/pam.d/password-auth If output is produced, this is a finding. If the system administrator (SA) can demonstrate | |
| RHEL-10-600460 | RHEL 10 must not have accounts configured with blank or null passwords. | Verify RHEL 10 prohibits null or blank passwords with the following command: $ sudo awk -F: '!$2 {print $1}' /etc/shadow If the command returns any results, this is a finding. | |
| RHEL-10-600470 | RHEL 10 must have a unique group ID (GID) for each group in "/etc/group". | Verify RHEL 10 contains no duplicate GIDs for interactive users with the following command: $ cut -d : -f 3 /etc/group | uniq -d If the system has duplicate GIDs, this is a finding. | |
| RHEL-10-600475 | RHEL 10 must limit the number of concurrent sessions to 10 for all accounts and/or account types. | Verify RHEL 10 limits the number of concurrent sessions to "10" for all accounts and/or account types with the following command: $ sudo grep -rs maxlogins /etc/security/limits.conf /etc/security/limits.d/*.conf | grep -v '#' /etc/security/ | |
| RHEL-10-600485 | RHEL 10 must ensure the password complexity module in the system-auth file is configured for three or fewer retries. | Verify RHEL 10 is configured to limit the "pwquality" retry option to "3" with the following command: $ sudo grep -w retry /etc/security/pwquality.conf /etc/security/pwquality.conf.d/*.conf retry = 3 If the value of "retry" is set to "0" or | |
| RHEL-10-600500 | RHEL 10 must restrict the use of the "su" command. | Verify RHEL 10 requires users to be members of the "wheel" group to run "su". Verify the configuration with the following command: $ sudo grep pam_wheel /etc/pam.d/su auth required pam_wheel.so use_uid If a line for "pam_wheel.so" does not | |
| RHEL-10-600510 | RHEL 10 must be configured to not bypass password requirements for privilege escalation. | Verify RHEL 10 is not configured to bypass password requirements for privilege escalation with the following command: $ sudo grep pam_succeed_if /etc/pam.d/sudo If any occurrences of "pam_succeed_if" are returned, this is a finding. | |
| RHEL-10-600520 | RHEL 10 must restrict privilege elevation to authorized personnel. | Verify RHEL 10 restricts privilege elevation to authorized personnel with the following command: $ sudo grep -riw ALL /etc/sudoers /etc/sudoers.d/ | grep -v "#" If the either of the following entries is returned, this is a finding: ALL ALL= | |
| RHEL-10-600530 | RHEL 10 must require users to reauthenticate for privilege escalation. | Verify RHEL 10 "/etc/sudoers" has no occurrences of "!authenticate" with the following command: $ sudo grep -ir '!authenticate' /etc/sudoers /etc/sudoers.d/ If any occurrences of "!authenticate" are returned, this is a finding. | |
| RHEL-10-600540 | RHEL 10 must require reauthentication when using the "sudo" command. | Verify RHEL 10 requires reauthentication when using the "sudo" command to elevate privileges with the following command: $ sudo grep -ir 'timestamp_timeout' /etc/sudoers /etc/sudoers.d/ /etc/sudoers:Defaults timestamp_timeout=0 If results a | |
| RHEL-10-600550 | RHEL 10 must use the invoking user's password for privilege escalation when using "sudo". | Verify RHEL 10 sudoers security policy is configured to use the invoking user's password for privilege escalation with the following command: $ sudo grep -irE '(!rootpw|!targetpw|!runaspw)' /etc/sudoers /etc/sudoers.d/ | grep -v '#' /etc/su | |
| RHEL-10-600560 | RHEL 10 must require users to provide a password for privilege escalation. | Verify RHEL 10 has no occurrences of "NOPASSWD" in "/etc/sudoers" with the following command: $ sudo grep -ir nopasswd /etc/sudoers /etc/sudoers.d/ | grep -v '#' If any occurrences of "NOPASSWD" are returned from the command and have not be | |
| RHEL-10-600600 | RHEL 10 must configure the use of the pam_faillock.so module in the "/etc/pam.d/system-auth" file. | Verify RHEL 10 includes the use of the pam_faillock.so module in the "/etc/pam.d/system-auth" file: $ sudo grep pam_faillock.so /etc/pam.d/system-auth auth required pam_faillock.so preauth auth required pam_faillock.so authfail account requ | |
| RHEL-10-600610 | RHEL 10 must configure the use of the pam_faillock.so module in the "/etc/pam.d/password-auth" file. | Verify RHEL 10 includes the pam_faillock.so module in the "/etc/pam.d/password-auth" file: $ sudo grep pam_faillock.so /etc/pam.d/password-auth auth required pam_faillock.so preauth auth required pam_faillock.so authfail account required pa | |
| RHEL-10-600620 | RHEL 10 must ensure the password complexity module is enabled in the "password-auth" file. | Verify RHEL 10 uses "pwquality" to enforce the password complexity rules in the "password-auth" file with the following command: $ sudo grep pam_pwquality /etc/pam.d/password-auth password required pam_pwquality.so If the command does not r | |
| RHEL-10-600630 | RHEL 10 must ensure the password complexity module is enabled in the "system-auth" file. | Verify RHEL 10 uses "pwquality" to enforce the password complexity rules in the "system-auth" file with the following command: $ sudo grep pam_pwquality /etc/pam.d/system-auth password required pam_pwquality.so If the command does not retur | |
| RHEL-10-600640 | RHEL 10 must enable the Pluggable Authentication Module (PAM) interface for SSHD. | Verify RHEL 10 SSHD is configured to allow for the "UsePAM" interface with the following command: $ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH '^\s*usepam' UsePAM yes If the " | |
| RHEL-10-600650 | RHEL 10 must ensure that the pam_unix.so module is configured in the password-auth file to use a FIPS 140-3-approved cryptographic hashing algorithm for system authentication. | Verify RHEL 10 configures the pam_unix.so module to use sha512 in "/etc/pam.d/password-auth" with the following command: $ sudo grep "^password.*pam_unix.so.*sha512" /etc/pam.d/password-auth password sufficient pam_unix.so sha512 If "sha512 | |
| RHEL-10-600700 | RHEL 10 must be configured to use a sufficient number of hashing rounds for the shadow password suite. | Verify RHEL 10 uses a sufficient number of rounds for the shadow password suite hashing algorithm with the following command: $ sudo grep rounds /etc/pam.d/system-auth password sufficient pam_unix.so sha512 rounds=100000 If the setting is n | |
| RHEL-10-600710 | RHEL 10 must be configured to use a FIPS 140-3-approved cryptographic hashing algorithm for system authentication by ensuring that the pam_unix.so module is configured in the "system-auth" file. | Verify RHEL 10 is configured to use a FIPS 140-3-approved cryptographic hashing algorithm in "/etc/pam.d/system-auth" via the pam_unix.so module with the following command: $ sudo grep "^password.*pam_unix.so.*sha512" /etc/pam.d/system-auth | |
| RHEL-10-600720 | RHEL 10 must be configured so that password-auth uses a sufficient number of hashing rounds. | Verify RHEL 10 is configured to use a sufficient number of rounds for password hashing with the following command: $ sudo grep rounds /etc/pam.d/password-auth password sufficient pam_unix.so sha512 rounds=100000 If the setting is not config | |
| RHEL-10-600730 | RHEL 10 must employ FIPS 140-3-approved cryptographic hashing algorithms for all stored passwords. | Verify RHEL 10 employs FIPS 140-3-approved cryptographic hashing algorithms for all stored passwords for interactive user accounts with the following command: $ sudo cut -d: -f1,2 /etc/shadow nsauser:$6$kcOnRq/5$NUEYPuyL.wghQwWssXRcLRFiiru7 | |
| RHEL-10-600740 | RHEL 10 must be configured to use the shadow file to store only encrypted representations of passwords. | Verify RHEL 10 is configured so that the shadow file stores only encrypted representations of passwords with a hash value of SHA512 with the following command: $ sudo grep -i encrypt_method /etc/login.defs ENCRYPT_METHOD SHA512 If "ENCRYPT_ | |
| RHEL-10-600750 | RHEL 10 must be configured so that user and group account administration utilities are configured to store only encrypted representations of passwords. | Note: If the libuser package is not installed, this requirement is not applicable. Verify RHEL 10 user and group account administration utilities are configured to store only encrypted representations of passwords with the following command | |
| RHEL-10-700010 | RHEL 10 must display the Standard Mandatory DoW Notice and Consent Banner before granting local or remote access to the system via a Secure Shell (SSH) login. | Verify RHEL 10 is configured so that any SSH connection to the operating system displays the Standard Mandatory DoW Notice and Consent Banner before granting access to the system. Check for the location of the banner file currently being us | |
| RHEL-10-700020 | RHEL 10 must display the Standard Mandatory DoW Notice and Consent Banner before granting local or remote access to the system via a graphical user login. | Note: This requirement assumes the use of the RHEL 10 default graphical user interface, Gnome Shell. If the system does not have any graphical user interface installed, this requirement is not applicable. Verify RHEL 10 displays the Standar | |
| RHEL-10-700030 | RHEL 10 must prevent a user from overriding the banner-message-enable setting for the graphical user interface. | Note: This requirement assumes the use of the RHEL 10 default graphical user interface, the GNOME desktop environment. If the system does not have any graphical user interface installed, this requirement is not applicable. Verify RHEL 10 pr | |
| RHEL-10-700040 | RHEL 10 must display the Standard Mandatory DoW Notice and Consent Banner before granting local or remote access to the system via a command line user login. | Verify RHEL 10 displays the Standard Mandatory DoW Notice and Consent Banner before granting access to the operating system via a command line login screen with the following command: $ cat /etc/issue If the banner is set correctly, it will | |
| RHEL-10-700100 | RHEL 10 must prevent special devices on file systems that are imported via Network File System (NFS). | Note: If no NFS mounts are configured, this requirement is not applicable. Verify RHEL 10 has the "nodev" option configured for all NFS mounts with the following command: $ sudo grep nfs /etc/fstab 192.168.22.2:/mnt/export /data nfs4 rw,nos | |
| RHEL-10-700105 | RHEL 10 must prevent code from being executed on file systems that are imported via Network File System (NFS). | Note: If no NFS mounts are configured, this requirement is not applicable. Verify RHEL 10 has the "noexec" option configured for all NFS mounts with the following command: $ sudo grep nfs /etc/fstab 192.168.22.2:/mnt/export /data nfs4 rw,no | |
| RHEL-10-700110 | RHEL 10 must prevent files with the "setuid" and "setgid" bit set from being executed on file systems that are imported via Network File System (NFS). | Note: If no NFS mounts are configured, this requirement is not applicable. Verify RHEL 10 has the "nosuid" option configured for all NFS mounts with the following command: $ sudo grep nfs /etc/fstab 192.168.22.2:/mnt/export /data nfs4 rw,no | |
| RHEL-10-700115 | RHEL 10 must be configured so that the Network File System (NFS) is configured to use RPCSEC_GSS. | Note: If no NFS mounts are configured, this requirement is not applicable. Verify RHEL 10 has the "sec" option configured for all NFS mounts with the following command: $ sudo grep nfs /etc/fstab 192.168.22.2:/mnt/export /data nfs4 rw,nosui | |
| RHEL-10-700120 | RHEL 10 must mount "/boot" with the "nodev" option. | Verify RHEL 10 is configured so that the "/boot" mount point has the "nodev" option with the following command: $ mount | grep '\s/boot\s' /dev/sda1 on /boot type xfs (rw,nodev,nosuid,relatime,seclabel,attr2) If the "/boot" file system does | |
| RHEL-10-700125 | RHEL 10 must prevent files with the "setuid" and "setgid" bit set from being executed on the "/boot" directory. | Verify RHEL 10 is configured so that the "/boot" directory is mounted with the "nosuid" option with the following command: $ mount | grep '\s/boot\s' /dev/sda1 on /boot type xfs (rw,nodev,nosuid,relatime,seclabel,attr2) If the "/boot" file | |
| RHEL-10-700130 | RHEL 10 must prevent files with the "setuid" and "setgid" bit set from being executed on the "/boot/efi" directory. | Note: For systems that use BIOS and for vfat systems, this requirement is not applicable. Verify RHEL 10 is configured so that the "/boot/efi "directory is mounted with the "nosuid" option with the following command: $ mount | grep '\s/boot | |
| RHEL-10-700135 | RHEL 10 must mount "/dev/shm" with the "nodev" option. | Verify RHEL 10 is configured so that "/dev/shm" is mounted with the "nodev" option with the following command: $ mount | grep /dev/shm tmpfs on /dev/shm type tmpfs (rw,nodev,nosuid,noexec,seclabel) If the "/dev/shm" file system is mounted w | |
| RHEL-10-700140 | RHEL 10 must mount "/dev/shm" with the "noexec" option. | Verify RHEL 10 is configured so that "/dev/shm" is mounted with the "noexec" option with the following command: $ mount | grep /dev/shm tmpfs on /dev/shm type tmpfs (rw,nodev,nosuid,noexec,seclabel) If the "/dev/shm" file system is mounted | |
| RHEL-10-700145 | RHEL 10 must mount "/dev/shm" with the "nosuid" option. | Verify RHEL 10 is configured so that "/dev/shm" is mounted with the "nosuid" option with the following command: $ mount | grep /dev/shm tmpfs on /dev/shm type tmpfs (rw,nodev,nosuid,noexec,seclabel) If the "/dev/shm" file system is mounted | |
| RHEL-10-700150 | RHEL 10 must mount "/tmp" with the "nodev" option. | Verify RHEL 10 is configured so that "/tmp" is mounted with the "nodev" option: $ mount | grep /tmp /dev/mapper/luks-c98555c8-0462-4b97-9afa-6db8c4bfee3b on /var/tmp type xfs (rw,nosuid,nodev,noexec,relatime,seclabel,attr2) If the "/tmp" fi | |
| RHEL-10-700155 | RHEL 10 must mount "/tmp" with the "noexec" option. | Verify RHEL 10 is configured so that "/tmp" is mounted with the "noexec" option: $ mount | grep /tmp /dev/mapper/luks-c98555c8-0462-4b97-9afa-6db8c4bfee3b on /var/tmp type xfs (rw,nosuid,nodev,noexec,relatime,seclabel,attr2) If the "/tmp" f | |
| RHEL-10-700160 | RHEL 10 must mount "/tmp" with the "nosuid" option. | Verify RHEL 10 is configured so that "/tmp" is mounted with the "nosuid" option: $ mount | grep /tmp /dev/mapper/luks-c98555c8-0462-4b97-9afa-6db8c4bfee3b on /var/tmp type xfs (rw,nosuid,nodev,noexec,relatime,seclabel,attr2) If the "/tmp" f | |
| RHEL-10-700165 | RHEL 10 must mount "/var" with the "nodev" option. | Verify RHEL 10 is configured so that "/var" is mounted with the "nodev" option: $ mount | grep /var /dev/mapper/luks-51150299-f295-4145-b8f0-ebe9c6dfd5a0 on /var type xfs (rw,nodev,relatime,seclabel,attr2) If the "/var" file system is mount | |
| RHEL-10-700170 | RHEL 10 must mount "/var/log" with the "nodev" option. | Verify RHEL 10 is configured so that "/var/log" is mounted with the "nodev" option: $ mount | grep /var/log /dev/mapper/luks-c651f493-9fdc-4c6e-a711-0a4f03149661 on /var/log type xfs (rw,nosuid,nodev,noexec,relatime,seclabel,attr2) If the " | |
| RHEL-10-700175 | RHEL 10 must mount "/var/log" with the "noexec" option. | Verify RHEL 10 is configured so that "/var/log" is mounted with the "noexec" option: $ mount | grep /var/log /dev/mapper/luks-c651f493-9fdc-4c6e-a711-0a4f03149661 on /var/log type xfs (rw,nosuid,nodev,noexec,relatime,seclabel,attr2) If the | |
| RHEL-10-700180 | RHEL 10 must mount "/var/log" with the "nosuid" option. | Verify RHEL 10 is configured so that "/var/log" is mounted with the "nosuid" option: $ mount | grep /var/log /dev/mapper/luks-c651f493-9fdc-4c6e-a711-0a4f03149661 on /var/log type xfs (rw,nosuid,nodev,noexec,relatime,seclabel,attr2) If the | |
| RHEL-10-700185 | RHEL 10 must mount "/var/tmp" with the "nodev" option. | Verify RHEL 10 is configured so that "/var/tmp" is mounted with the "nodev" option: $ mount | grep /var/tmp /dev/mapper/luks-c98555c8-0462-4b97-9afa-6db8c4bfee3b on /var/tmp type xfs (rw,nosuid,nodev,noexec,relatime,seclabel,attr2) If the " | |
| RHEL-10-700190 | RHEL 10 must mount "/var/tmp" with the "noexec" option. | Verify RHEL 10 is configured so that "/var/tmp" is mounted with the "noexec" option: $ mount | grep /var/tmp /dev/mapper/luks-c98555c8-0462-4b97-9afa-6db8c4bfee3b on /var/tmp type xfs (rw,nosuid,nodev,noexec,relatime,seclabel,attr2) If the | |
| RHEL-10-700195 | RHEL 10 must mount "/var/tmp" with the "nosuid" option. | Verify RHEL 10 is configured so that "/var/tmp" is mounted with the "nosuid" option: $ mount | grep /var/tmp /dev/mapper/luks-c98555c8-0462-4b97-9afa-6db8c4bfee3b on /var/tmp type xfs (rw,nosuid,nodev,noexec,relatime,seclabel,attr2) If the | |
| RHEL-10-700200 | RHEL 10 must prevent special devices on nonroot local partitions. | Verify RHEL 10 is configured so that all nonroot local partitions are mounted with the "nodev" option with the following command: $ sudo mount | grep '^/dev\S* on /\S' | grep --invert-match 'nodev' If any output is produced, this is a findi | |
| RHEL-10-700400 | RHEL 10 must enable the SELinux targeted policy. | Verify RHEL 10 SELINUX is using the targeted policy with the following command: $ sestatus | grep policy Loaded policy name: targeted If the loaded policy name is not "targeted", this is a finding. | |
| RHEL-10-700410 | RHEL 10 must elevate the SELinux context when an administrator calls the sudo command. | Verify RHEL 10 elevates the SELinux context when an administrator calls the sudo command with the following command: This command must be run as root: $ sudo grep -r sysadm_r /etc/sudoers /etc/sudoers.d %{designated_group_or_user_name} ALL= | |
| RHEL-10-700420 | RHEL 10 must use a Linux Security Module configured to enforce limits on system services. | Verify RHEL 10 enforces correct operation of security functions through the use of SELinux with the following command: $ getenforce Enforcing If SELINUX is not set to "Enforcing", this is a finding. Verify SELinux is configured to be enforc | |
| RHEL-10-700430 | RHEL 10 must configure SELinux context type to allow the use of a nondefault faillock tally directory. | Note: If the system does not have SELinux enabled and enforcing a targeted policy, or if the pam_faillock module is not configured for use, this requirement is not applicable. Verify RHEL 10 SELinux context type allows the use of a nondefau | |
| RHEL-10-700500 | RHEL 10 must be configured so that Secure Shell (SSH) public host key files have mode "0644" or less permissive. | Verify RHEL 10 SSH public host key files have a mode of "0644" or less permissive with the following command: Note: SSH public key files may be found in other directories on the system depending on the installation. $ sudo stat -c "%a %n" / | |
| RHEL-10-700510 | RHEL 10 must be configured so that the Secure Shell (SSH) daemon does not allow Generic Security Service Application Program Interface (GSSAPI) authentication. | Verify RHEL 10 SSH daemons do not allow GSSAPI authentication with the following command: $ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH '^\s*gssapiauthentication' /etc/ssh/sshd | |
| RHEL-10-700520 | RHEL 10 must be configured so that the Secure Shell (SSH) daemon does not allow Kerberos authentication. | Verify RHEL 10 SSH daemons do not allow Kerberos authentication with the following command: $ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH '^\s*kerberosauthentication' /etc/ssh/ | |
| RHEL-10-700530 | RHEL 10 must be configured so that the Secure Shell (SSH) daemon does not allow rhosts authentication. | Verify RHEL 10 SSH daemons do not allow rhosts authentication with the following command: $ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH '^\s*ignorerhosts' /etc/ssh/sshd_config. | |
| RHEL-10-700540 | RHEL 10 must be configured so that the Secure Shell (SSH) daemon does not allow known hosts authentication. | Verify RHEL 10 SSH daemons do not allow known hosts authentication with the following command: $ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH '^\s*ignoreuserknownhosts' /etc/ssh | |
| RHEL-10-700550 | RHEL 10 must be configured so that the Secure Shell (SSH) daemon disables remote X connections for interactive users. | Verify RHEL 10 SSH daemons do not allow X11Forwarding with the following command: $ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH '^\s*x11forwarding' /etc/ssh/sshd_config.d/10-st | |
| RHEL-10-700560 | RHEL 10 must be configured so that the Secure Shell (SSH) daemon performs strict mode checking of home directory configuration files. | Verify RHEL 10 SSH daemons perform strict mode checking of home directory configuration files with the following command: $ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH '^\s*str | |
| RHEL-10-700570 | RHEL 10 must be configured so that the Secure Shell (SSH) daemon displays the date and time of the last successful account login upon an SSH login. | Verify RHEL 10 SSH daemons provide users with feedback on when account accesses last occurred with the following command: $ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH '^\s*pri | |
| RHEL-10-700580 | RHEL 10 must be configured so that the Secure Shell (SSH) daemon prevents remote hosts from connecting to the proxy display. | Verify RHEL 10 SSH daemons prevent remote hosts from connecting to the proxy display with the following command: $ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH '^\s*x11uselocalh | |
| RHEL-10-700590 | RHEL 10 must be configured so that Secure Shell (SSH) server configuration files' permissions are not modified. | Verify RHEL 10 is configured so that SSH server configuration files' permissions are not modified. Check the permissions of the "/etc/ssh/sshd_config" file with the following command: $ sudo rpm --verify openssh-server | awk '! ($2 == "c" & | |
| RHEL-10-700600 | RHEL 10 must be configured so that SSHD accepts public key authentication. | Note: If the system administrator demonstrates the use of an approved alternate multifactor authentication method, this requirement is not applicable. Verify RHEL 10 SSH daemons accept public key encryption with the following command: $ sud | |
| RHEL-10-700610 | RHEL 10 must be configured so that SSHD does not allow blank passwords. | Verify RHEL 10 remote access using SSH prevents logging on with a blank password with the following command: $ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH '^\s*permitemptypassw | |
| RHEL-10-700620 | RHEL 10 must not permit direct logins to the root account using remote access via Secure Shell (SSH). | Verify RHEL 10 remote access using SSH prevents users from logging on directly as "root" with the following command: $ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH '^\s*permitro | |
| RHEL-10-700630 | RHEL 10 must not allow a noncertificate trusted host Secure Shell (SSH) login to the system. | Verify RHEL 10 does not allow a noncertificate trusted host SSH login to the system with the following command: $ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH '^\s*hostbasedauth | |
| RHEL-10-700640 | RHEL 10 must not allow users to override Secure Shell (SSH) environment variables. | Verify RHEL 10 disables unattended or automatic login via SSH with the following command: $ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH '^\s*permituserenvironment' /etc/ssh/ssh | |
| RHEL-10-700650 | RHEL 10 must force a frequent session key renegotiation for Secure Shell (SSH) connections to the server. | Verify RHEL 10 SSH servers are configured to force frequent session key renegotiation with the following command: $ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH '^\s*rekeylimit' | |
| RHEL-10-700660 | RHEL 10 must be configured so that all network connections associated with Secure Shell (SSH) traffic terminate after becoming unresponsive. | Verify RHEL 10 network connections associated with SSH traffic terminate after becoming unresponsive. Set the "ClientAliveCountMax" to "1" by performing the following command: $ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | t | |
| RHEL-10-700670 | RHEL 10 must forward mail from postmaster to the root account using a postfix alias. | Verify RHEL 10 notifies administrators in the event of an audit processing failure. Check that the "/etc/aliases" file has a defined value for "root". $ sudo grep "postmaster:\s*root$" /etc/aliases postmaster: root If the command does not r | |
| RHEL-10-700680 | RHEL 10 must not have a "shosts.equiv" file on the system. | Verify RHEL 10 does not have a "shosts.equiv" file on the system with the following command: $ sudo find / -name shosts.equiv If a "shosts.equiv" file is found, this is a finding. | |
| RHEL-10-700690 | RHEL 10 must not have any ".shosts" files on the system. | Verify RHEL 10 does not have any ".shosts" files on the system with the following command: $ sudo find / -name .shosts If a ".shosts" file is found, this is a finding. | |
| RHEL-10-700700 | RHEL 10 must prevent a user from overriding the disabling of the graphical user interface automount function. | Note: This requirement assumes the use of the RHEL 10 default graphical user interface, the GNOME desktop environment. If the system does not have any graphical user interface installed, this requirement is not applicable. Verify RHEL 10 di | |
| RHEL-10-700710 | RHEL 10 must prevent a user from overriding the disabling of the graphical user interface autorun function. | Note: This requirement assumes the use of the RHEL 10 default graphical user interface, the GNOME desktop environment. If the system does not have any graphical user interface installed, this requirement is not applicable. Verify RHEL 10 di | |
| RHEL-10-700720 | RHEL 10 must not allow unattended or automatic login via the graphical user interface. | Note: This requirement assumes the use of the RHEL 10 default graphical user interface, the GNOME desktop environment. If the system does not have any graphical user interface installed, this requirement is not applicable. Verify RHEL 10 do | |
| RHEL-10-700730 | RHEL 10 must prevent a user from overriding the disabling of the graphical user smart card removal action. | Note: This requirement assumes the use of the RHEL 10 default graphical user interface, the GNOME desktop environment. If the system does not have any graphical user interface installed, this requirement is not applicable. Verify RHEL 10 di | |
| RHEL-10-700740 | RHEL 10 must prevent a user from overriding the screensaver lock-enabled setting for the graphical user interface. | Note: This requirement assumes the use of the RHEL 10 default graphical user interface, Gnome Shell. If the system does not have any graphical user interface installed, this requirement is not applicable. Verify RHEL 10 prevents a user from | |
| RHEL-10-700750 | RHEL 10 must automatically lock graphical user sessions after 10 minutes of inactivity. | Note: This requirement assumes the use of the RHEL 10 default graphical user interface, the GNOME desktop environment. If the system does not have any graphical user interface installed, this requirement is not applicable. Verify RHEL 10 in | |
| RHEL-10-700760 | RHEL 10 must prevent a user from overriding the session idle-delay setting for the graphical user interface. | Note: This requirement assumes the use of the RHEL 10 default graphical user interface, the GNOME desktop environment. If the system does not have any graphical user interface installed, this requirement is not applicable. Verify RHEL 10 pr | |
| RHEL-10-700770 | RHEL 10 must initiate a session lock for graphical user interfaces when the screensaver is activated. | Note: This requirement assumes the use of the RHEL 10 default graphical user interface, the GNOME desktop environment. If the system does not have any graphical user interface installed, this requirement is not applicable. Verify RHEL 10 in | |
| RHEL-10-700780 | RHEL 10 must prevent a user from overriding the session lock-delay setting for the graphical user interface. | Note: This requirement assumes the use of the RHEL 10 default graphical user interface, the GNOME desktop environment. If the system does not have any graphical user interface installed, this requirement is not applicable. Verify RHEL 10 pr | |
| RHEL-10-700790 | RHEL 10 must conceal, via the session lock, information previously visible on the display with a publicly viewable image. | Note: This requirement assumes the use of the RHEL 10 default graphical user interface, the GNOME desktop environment. If the system does not have any graphical user interface installed, this requirement is not applicable. Verify RHEL 10 pr | |
| RHEL-10-700800 | RHEL 10 must ensure effective dconf policy matches the policy keyfiles. | Note: This requirement assumes the use of the RHEL 10 default graphical user interface, the GNOME desktop environment. If the system does not have any graphical user interface installed, this requirement is not applicable. Verify RHEL 10 en | |
| RHEL-10-700810 | RHEL 10 must prevent a user from overriding the disable-restart-buttons setting for the graphical user interface. | Note: This requirement assumes the use of the RHEL 10 default graphical user interface, the GNOME desktop environment. If the system does not have any graphical user interface installed, this requirement is not applicable. Verify RHEL 10 pr | |
| RHEL-10-700820 | RHEL 10 must prevent a user from overriding the Ctrl-Alt-Del sequence settings for the graphical user interface. | Note: This requirement assumes the use of the RHEL 10 default graphical user interface, the GNOME desktop environment. If the system does not have any graphical user interface installed, this requirement is not applicable. Verify RHEL 10 us | |
| RHEL-10-700830 | RHEL 10 must disable the ability of a user to accidentally press Ctrl-Alt-Del and cause a system to shut down or reboot. | Note: This requirement assumes the use of the RHEL 10 default graphical user interface, the GNOME desktop environment. If the system does not have any graphical user interface installed, this requirement is not applicable. Verify RHEL 10 is | |
| RHEL-10-700840 | RHEL 10 must disable the user list at login for graphical user interfaces. | Note: This requirement assumes the use of the RHEL 10 default graphical user interface, the GNOME desktop environment. If the system does not have any graphical user interface installed, this requirement is not applicable. Verify RHEL 10 di | |
| RHEL-10-700850 | RHEL 10 must be configured to disable USB mass storage. | Verify RHEL 10 disables the ability to load the USB Storage kernel module with the following command: $ sudo grep -rs usb-storage /etc/modprobe.conf /etc/modprobe.d/* /etc/modprobe.d/usb-storage.conf:install usb-storage /bin/false /etc/modp | |
| RHEL-10-700860 | RHEL 10 must disable Bluetooth. | Verify RHEL 10 disables the ability to load the Bluetooth kernel module with the following command: $ sudo grep -rs bluetooth /etc/modprobe.conf /etc/modprobe.d/* /etc/modprobe.d/bluetooth.conf:install bluetooth /bin/false /etc/modprobe.d/b | |
| RHEL-10-700870 | RHEL 10 must disable wireless network adapters. | Note: This requirement is not applicable for systems that do not have physical wireless network radios. Verify RHEL 10 disables wireless interfaces on the system with the following command: $ nmcli device status DEVICE TYPE STATE CONNECTION | |
| RHEL-10-700880 | RHEL 10 must disable the graphical user interface automounter unless required. | Note: This requirement assumes the use of the RHEL 10 default graphical user interface, the GNOME desktop environment. If the system does not have any graphical user interface installed, this requirement is not applicable. Verify RHEL 10 di | |
| RHEL-10-700890 | RHEL 10 must disable the graphical user interface autorunner unless required. | Note: This requirement assumes the use of the RHEL 10 default graphical user interface, the GNOME desktop environment. If the system does not have any graphical user interface installed, this requirement is not applicable. Verify RHEL 10 di | |
| RHEL-10-700900 | RHEL 10 must implement nonexecutable data to protect its memory from unauthorized code execution. | Verify RHEL 10 implements nonexecutable data to protect its memory from unauthorized code execution. Run the following command: $ sudo grep ^flags /proc/cpuinfo | grep -Ev '([^[:alnum:]])(nx)([^[:alnum:]]|$)' If any output is returned, this | |
| RHEL-10-700920 | RHEL 10 must automatically exit interactive command shell user sessions after 10 minutes of inactivity. | Verify RHEL 10 is configured to exit interactive command shell user sessions after 10 minutes of inactivity or less with the following command: $ sudo grep -i tmout /etc/profile /etc/profile.d/*.sh /etc/profile.d/tmout.sh:declare -xr TMOUT= | |
| RHEL-10-700930 | RHEL 10 must be configured with a timeout interval for the Secure Shell (SSH) daemon. | Verify RHEL 10 is configured with an SSH timeout interval. Verify the "ClientAliveInterval" variable is set to a value of "600" or less by performing the following command: $ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | tr - | |
| RHEL-10-700940 | RHEL 10 must not default to the graphical display manager unless approved. | Verify RHEL 10 is configured to boot to the command line with the following command: $ systemctl get-default multi-user.target If the system default target is not set to "multi-user.target", and the information system security officer lacks | |
| RHEL-10-700950 | RHEL 10 must disable the systemd Ctrl-Alt-Delete burst key sequence. | Verify RHEL 10 is configured to not reboot the system when Ctrl-Alt-Delete is pressed seven times within two seconds with the following command: $ sudo grep -iR CtrlAltDelBurstAction /etc/systemd/system* /etc/systemd/system.conf.d/55-CtrlAl | |
| RHEL-10-700960 | RHEL 10 must disable the x86 Ctrl-Alt-Delete key sequence. | Verify RHEL 10 is not configured to reboot the system when Ctrl-Alt-Delete is pressed with the following command: $ sudo systemctl status ctrl-alt-del.target o ctrl-alt-del.target Loaded: masked (Reason: Unit ctrl-alt-del.target is masked.) | |
| RHEL-10-700970 | RHEL 10 must disable the debug-shell systemd service. | Verify RHEL 10 is configured to mask the debug-shell systemd service with the following command: $ sudo systemctl status debug-shell.service o debug-shell.service Loaded: masked (Reason: Unit debug-shell.service is masked.) Active: inactive | |
| RHEL-10-700980 | RHEL 10 must disable the ability of systemd to spawn an interactive boot process. | Verify RHEL 10 is configured so that the current GRUB 2 configuration disables the ability of systemd to spawn an interactive boot process with the following command: $ sudo grubby --info=ALL | grep args | grep 'systemd.confirm_spawn' If an | |
| RHEL-10-700990 | RHEL 10 must disable virtual system calls. | Verify RHEL 10 is configured so that the current GRUB 2 configuration disables virtual system calls with the following command: $ sudo grubby --info=ALL | grep args | grep -v 'vsyscall=none' If any output is returned, this is a finding. Che | |
| RHEL-10-701000 | RHEL 10 must clear the page allocator to prevent use-after-free attacks. | Verify RHEL 10 is configured so that the current GRUB 2 configuration enables page poisoning to mitigate use-after-free vulnerabilities. Check that the current GRUB 2 configuration has page poisoning enabled with the following command: $ su | |
| RHEL-10-701010 | RHEL 10 must clear memory when it is freed to prevent use-after-free attacks. | Verify RHEL 10 is configured so that the current GRUB2 configuration mitigates use-after-free vulnerabilities by employing memory poisoning. Check that the current GRUB2 configuration mitigates use-after-free vulnerabilities by employing me | |
| RHEL-10-701020 | RHEL 10 must enable mitigations against processor-based vulnerabilities. | Verify RHEL 10 enables kernel page-table isolation with the following command: $ sudo grubby --info=ALL | grep args | grep -v 'pti=on' If any output is returned, this is a finding. Check that kernel page-table isolation is enabled by defaul | |
| RHEL-10-701030 | RHEL 10 must restrict access to the kernel message buffer. | Verify RHEL 10 is configured to restrict access to the kernel message buffer. Check the status of the "kernel.dmesg_restrict" kernel parameter with the following command: $ sudo sysctl kernel.dmesg_restrict kernel.dmesg_restrict = 1 If "ker | |
| RHEL-10-701040 | RHEL 10 must prevent kernel profiling by nonprivileged users. | Verify RHEL 10 is configured to prevent kernel profiling by nonprivileged users. Check the status of the "kernel.perf_event_paranoid" kernel parameter: $ sudo sysctl kernel.perf_event_paranoid kernel.perf_event_paranoid = 2 If "kernel.perf_ | |
| RHEL-10-701050 | RHEL 10 must prevent the loading of a new kernel for later execution. | Verify RHEL 10 is configured to disable kernel image loading. Check the status of the "kernel.kexec_load_disabled" kernel parameter with the following command: $ sudo sysctl kernel.kexec_load_disabled kernel.kexec_load_disabled = 1 If "kern | |
| RHEL-10-701060 | RHEL 10 must restrict exposed kernel pointer address access. | Verify RHEL 10 is configured to restrict exposed kernel pointer address access. Verify the runtime status of the "kernel.kptr_restrict" kernel parameter with the following command: $ sudo sysctl kernel.kptr_restrict kernel.kptr_restrict = 1 | |
| RHEL-10-701070 | RHEL 10 must enable kernel parameters to enforce discretionary access control (DAC) on hardlinks. | Verify RHEL 10 is configured to enable DAC on hardlinks. Check the status of the "fs.protected_hardlinks" kernel parameter with the following command: $ sudo sysctl fs.protected_hardlinks fs.protected_hardlinks = 1 If "fs.protected_hardlink | |
| RHEL-10-701080 | RHEL 10 must enable kernel parameters to enforce discretionary access control (DAC) on symlinks. | Verify RHEL 10 is configured to enable DAC on symlinks. Check the status of the "fs.protected_symlinks" kernel parameter with the following command: $ sudo sysctl fs.protected_symlinks fs.protected_symlinks = 1 If "fs.protected_symlinks" is | |
| RHEL-10-701090 | RHEL 10 must disable the "kernel.core_pattern". | Verify RHEL 10 disables storing core dumps. Check the status of the "kernel.core_pattern" kernel parameter with the following command: $ sudo sysctl kernel.core_pattern kernel.core_pattern = |/bin/false If "kernel.core_pattern" is not set t | |
| RHEL-10-701100 | RHEL 10 must be configured to disable the Controller Area Network (CAN) kernel module. | Verify RHEL 10 disables the ability to load the CAN kernel module with the following command: $ sudo grep -rs can /etc/modprobe.conf /etc/modprobe.d/* | grep -v '#' /etc/modprobe.d/can.conf:install can /bin/false /etc/modprobe.d/can.conf:bl | |
| RHEL-10-701110 | RHEL 10 must disable the Stream Control Transmission Protocol (SCTP) kernel module. | Verify RHEL 10 disables the ability to load the sctp kernel module with the following command: $ sudo grep -rs sctp /etc/modprobe.conf /etc/modprobe.d/* | grep -v '#' /etc/modprobe.d/sctp-blacklist.conf:install sctp /bin/false /etc/modprobe | |
| RHEL-10-701120 | RHEL 10 must disable the Transparent Inter Process Communication (TIPC) kernel module. | Verify RHEL 10 disables the ability to load the tipc kernel module with the following command: $ sudo grep -rs tipc /etc/modprobe.conf /etc/modprobe.d/* | grep -v '#' /etc/modprobe.d/tipc-blacklist.conf:install tipc /bin/false /etc/modprobe | |
| RHEL-10-701130 | RHEL 10 must implement address space layout randomization (ASLR) to protect its memory from unauthorized code execution. | Verify RHEL 10 is implementing ASLR. Check the status of the "kernel.randomize_va_space" kernel parameter with the following command: $ sudo sysctl kernel.randomize_va_space kernel.randomize_va_space = 2 If "kernel.randomize_va_space" is no | |
| RHEL-10-701140 | RHEL 10 must restrict usage of ptrace to descendant processes. | Verify RHEL 10 restricts the usage of ptrace to descendant processes. Check the status of the "kernel.yama.ptrace_scope" kernel parameter with the following command: $ sysctl kernel.yama.ptrace_scope kernel.yama.ptrace_scope = 1 If the netw | |
| RHEL-10-701150 | RHEL 10 must disable core dump backtraces. | Note: If kernel dumps are disabled in accordance with RHEL-10-701090, this requirement is not applicable. Verify RHEL 10 disables core dump backtraces by issuing the following command: $ sudo grep -ir ProcessSizeMax /etc/systemd/ | grep -v | |
| RHEL-10-701160 | RHEL 10 must disable storing core dumps. | Note: If kernel dumps are disabled in accordance with RHEL-10-701090, this requirement is not applicable. Verify RHEL 10 disables storing core dumps for all users by issuing the following command: $ sudo grep -ir storage /etc/systemd/ | gre | |
| RHEL-10-701170 | RHEL 10 must disable core dumps for all users. | Note: If kernel dumps are disabled in accordance with RHEL-10-701090, this requirement is not applicable. Verify RHEL 10 disables core dumps for all users by issuing the following command: $ sudo grep -r core /etc/security/ | grep -v '#' /e | |
| RHEL-10-701180 | RHEL 10 must disable acquiring, saving, and processing core dumps. | Note: If kernel dumps are disabled in accordance with RHEL-10-701090, this requirement is not applicable. Verify RHEL 10 is not configured to acquire, save, or process core dumps with the following command: $ sudo systemctl status systemd-c | |
| RHEL-10-701190 | RHEL 10 must implement nonexecutable data to protect its memory from unauthorized code execution. | Verify RHEL 10 enables ExecShield. Run the following command: $ sudo grep ^flags /proc/cpuinfo | grep -Ev '([^[:alnum:]])(nx)([^[:alnum:]]|$)' If any output is returned, this is a finding. Run the following command: $ sudo grubby --info=ALL | |
| RHEL-10-701200 | RHEL 10 must disable the kdump service. | Verify RHEL 10 disables the kdump service in system boot configuration with the following command: $ sudo systemctl is-enabled kdump masked Verify the kdump service is not active (i.e., not running) through current runtime configuration wit | |
| RHEL-10-701210 | RHEL 10 must disable file system automount function. | Note: If the "autofs" service is not installed, this requirement is not applicable. Verify RHEL 10 is configured so that the file system automount function has been disabled with the following command: $ systemctl is-enabled autofs not-foun | |
| RHEL-10-701220 | RHEL 10 must enable certificate-based smart card authentication. | Note: If the system administrator demonstrates the use of an approved alternate multifactor authentication method, this requirement is not applicable. Verify RHEL 10 enables smart cards in the System Security Services Daemon (SSSD) with the | |
| RHEL-10-701230 | RHEL 10 must implement certificate status checking for multifactor authentication. | Note: If the system administrator (SA) demonstrates the use of an approved alternate multifactor authentication method, this requirement is not applicable. Verify RHEL 10 implements OCSP and is using the proper digest value on the system wi | |
| RHEL-10-701240 | RHEL 10 must, for PKI-based authentication, enforce authorized access to the corresponding private key. | Note: If the system administrator demonstrates the use of an approved alternate multifactor authentication method, this requirement is not applicable. Verify RHEL 10 SSH private key files have a passcode. For each private key stored on the | |
| RHEL-10-701250 | RHEL 10 must require authentication to access emergency mode. | Verify RHEL 10 requires authentication for emergency mode with the following command: $ sudo grep systemd-sulogin /usr/lib/systemd/system/emergency.service # ExecStart=-/usr/lib/systemd/systemd-sulogin-shell emergency If the line is not ret | |
| RHEL-10-701260 | RHEL 10 must require authentication to access single-user mode. | Verify RHEL 10 requires authentication for single-user mode with the following command: $ sudo grep systemd-sulogin /usr/lib/systemd/system/rescue.service # ExecStart=-/usr/lib/systemd/systemd-sulogin-shell rescue If the line is not returne | |
| RHEL-10-701270 | RHEL 10 must, for PKI-based authentication, validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor. | Note: If the system administrator demonstrates the use of an approved alternate multifactor authentication method, this requirement is not applicable. Verify RHEL 10, for PKI-based authentication, has valid certificates by constructing a ce | |
| RHEL-10-701280 | RHEL 10 must map the authenticated identity to the user or group account for public key infrastructure (PKI)-based authentication. | Note: If the system administrator (SA) demonstrates the use of an approved alternate multifactor authentication method, this requirement is not applicable. Verify RHEL 10 maps the authenticated identity to the user or group account for PKI- |
Showing 400 of 435; narrow with the search or a family.