DISA STIG library V2R10
| Ref | Title | Text | |
|---|---|---|---|
| RHEL-09-211010 | RHEL 9 must be a vendor-supported release. | Verify the version or RHEL 9 is vendor supported with the following command: $ cat /etc/redhat-release Red Hat Enterprise Linux release 9.6 (Plow) If the installed version of RHEL 9 is not supported, this is a finding. | |
| RHEL-09-211015 | RHEL 9 vendor packaged system security patches and updates must be installed and up to date. | Verify RHEL 9 security patches and updates are installed and up to date. Updates are required to be applied with a frequency determined by organizational policy. Obtain the list of available package security updates from Red Hat. The URL fo | |
| RHEL-09-211020 | RHEL 9 must display the Standard Mandatory DoW Notice and Consent Banner before granting local or remote access to the system via a command line user logon. | Verify RHEL 9 displays the Standard Mandatory DoW Notice and Consent Banner before granting access to the operating system via a command line user logon. Check that a banner is displayed at the command line login screen with the following c | |
| RHEL-09-211030 | The graphical display manager must not be the default target on RHEL 9 unless approved. | Verify that RHEL 9 is configured to boot to the command line: $ systemctl get-default multi-user.target If the system default target is not set to "multi-user.target" and the information system security officer (ISSO) lacks a documented req | |
| RHEL-09-211035 | RHEL 9 must enable the hardware random number generator entropy gatherer service. | Note: For RHEL 9 systems running with kernel FIPS mode enabled as specified by RHEL-09-671010, this requirement is Not Applicable. Verify that RHEL 9 has enabled the hardware random number generator entropy gatherer service with the followi | |
| RHEL-09-211040 | RHEL 9 systemd-journald service must be enabled. | Verify that "systemd-journald" is active with the following command: $ systemctl is-active systemd-journald active If the systemd-journald service is not active, this is a finding. | |
| RHEL-09-211045 | The systemd Ctrl-Alt-Delete burst key sequence in RHEL 9 must be disabled. | Verify RHEL 9 is configured to not reboot the system when Ctrl-Alt-Delete is pressed seven times within two seconds with the following command: $ sudo grep -iR CtrlAltDelBurstAction /etc/systemd/system* /etc/systemd/system.conf.d/55-CtrlAlt | |
| RHEL-09-211050 | The x86 Ctrl-Alt-Delete key sequence must be disabled on RHEL 9. | Verify RHEL 9 is not configured to reboot the system when Ctrl-Alt-Delete is pressed with the following command: $ sudo systemctl status ctrl-alt-del.target ctrl-alt-del.target Loaded: masked (Reason: Unit ctrl-alt-del.target is masked.) Ac | |
| RHEL-09-211055 | RHEL 9 debug-shell systemd service must be disabled. | Verify RHEL 9 is configured to mask the debug-shell systemd service with the following command: $ sudo systemctl status debug-shell.service debug-shell.service Loaded: masked (Reason: Unit debug-shell.service is masked.) Active: inactive (d | |
| RHEL-09-212010 | RHEL 9 must require authentication upon booting into single-user and maintenance modes. | Verify that RHEL 9 requires a password for the GRUB 2 bootloader to prevent unauthorized modifications to boot parameters. Check the unified configuration file where the GRUB 2 password is stored: # sudo grep -iw "GRUB2_PASSWORD" /boot/grub | |
| RHEL-09-212015 | RHEL 9 must disable the ability of systemd to spawn an interactive boot process. | Verify that GRUB 2 is configured to disable interactive boot. Check that the current GRUB 2 configuration disables the ability of systemd to spawn an interactive boot process with the following command: $ sudo grubby --info=ALL | grep args | |
| RHEL-09-212020 | RHEL 9 must require a unique superusers name upon booting into single-user and maintenance modes. | Verify the RHEL 9 boot loader superuser account has been set with the following command: $ sudo grep -A1 "superusers" /etc/grub2.cfg set superusers="" export superusers password_pbkdf2 ${GRUB2_PASSWORD} Verify is not a common name such as r | |
| RHEL-09-212025 | RHEL 9 /boot/grub2/grub.cfg file must be group-owned by root. | Verify the group ownership of the "/boot/grub2/grub.cfg" file with the following command: $ sudo stat -c "%G %n" /boot/grub2/grub.cfg root /boot/grub2/grub.cfg If "/boot/grub2/grub.cfg" file does not have a group owner of "root", this is a | |
| RHEL-09-212030 | RHEL 9 /boot/grub2/grub.cfg file must be owned by root. | Verify the ownership of the "/boot/grub2/grub.cfg" file with the following command: $ sudo stat -c "%U %n" /boot/grub2/grub.cfg root /boot/grub2/grub.cfg If "/boot/grub2/grub.cfg" file does not have an owner of "root", this is a finding. | |
| RHEL-09-212035 | RHEL 9 must disable virtual system calls. | Verify the current GRUB 2 configuration disables virtual system calls with the following command: $ sudo grubby --info=ALL | grep args | grep -v 'vsyscall=none' If any output is returned, this is a finding. Check that virtual system calls a | |
| RHEL-09-212040 | RHEL 9 must clear the page allocator to prevent use-after-free attacks. | Verify that GRUB 2 is configured to enable page poisoning to mitigate use-after-free vulnerabilities. Check that the current GRUB 2 configuration has page poisoning enabled with the following command: $ sudo grubby --info=ALL | grep args | | |
| RHEL-09-212045 | RHEL 9 must clear memory when it is freed to prevent use-after-free attacks. | Verify that GRUB2 is configured to mitigate use-after-free vulnerabilities by employing memory poisoning. Inspect the "GRUB_CMDLINE_LINUX" entry of /etc/default/grub as follows: $ sudo grep -i grub_cmdline_linux /etc/default/grub GRUB_CMDLI | |
| RHEL-09-212050 | RHEL 9 must enable mitigations against processor-based vulnerabilities. | Verify RHEL 9 enables kernel page-table isolation with the following command: $ sudo grubby --info=ALL | grep args | grep -v 'pti=on' If any output is returned, this is a finding. Check that kernel page-table isolation is enabled by default | |
| RHEL-09-212055 | RHEL 9 must enable auditing of processes that start prior to the audit daemon. | Verify that GRUB 2 is configured to enable auditing of processes that start prior to the audit daemon with the following commands: Check that the current GRUB 2 configuration enables auditing: $ sudo grubby --info=ALL | grep args | grep -v | |
| RHEL-09-213010 | RHEL 9 must restrict access to the kernel message buffer. | Verify RHEL 9 is configured to restrict access to the kernel message buffer. Check the status of the "kernel.dmesg_restrict" kernel parameter with the following command: $ sudo sysctl kernel.dmesg_restrict kernel.dmesg_restrict = 1 If "kern | |
| RHEL-09-213015 | RHEL 9 must prevent kernel profiling by nonprivileged users. | Verify RHEL 9 is configured to prevent kernel profiling by nonprivileged users. Check the status of the "kernel.perf_event_paranoid" kernel parameter. $ sudo sysctl kernel.perf_event_paranoid kernel.perf_event_paranoid = 2 If "kernel.perf_e | |
| RHEL-09-213020 | RHEL 9 must prevent the loading of a new kernel for later execution. | Verify RHEL 9 is configured to disable kernel image loading. Check the status of the "kernel.kexec_load_disabled" kernel parameter with the following command: $ sudo sysctl kernel.kexec_load_disabled kernel.kexec_load_disabled = 1 If "kerne | |
| RHEL-09-213025 | RHEL 9 must restrict exposed kernel pointer addresses access. | Verify RHEL 9 is configured to restrict exposed kernel pointer address access. Verify the runtime status of the "kernel.kptr_restrict" kernel parameter with the following command: $ sudo sysctl kernel.kptr_restrict kernel.kptr_restrict = 1 | |
| RHEL-09-213030 | RHEL 9 must enable kernel parameters to enforce discretionary access control (DAC) on hardlinks. | Verify RHEL 9 is configured to enable DAC on hardlinks. Check the status of the "fs.protected_hardlinks" kernel parameter with the following command: $ sudo sysctl fs.protected_hardlinks fs.protected_hardlinks = 1 If "fs.protected_hardlinks | |
| RHEL-09-213035 | RHEL 9 must enable kernel parameters to enforce discretionary access (DAC) control on symlinks. | Verify RHEL 9 is configured to enable DAC on symlinks. Check the status of the "fs.protected_symlinks" kernel parameter with the following command: $ sudo sysctl fs.protected_symlinks fs.protected_symlinks = 1 If "fs.protected_symlinks" is | |
| RHEL-09-213040 | RHEL 9 must disable the kernel.core_pattern. | Verify RHEL 9 disables storing core dumps. Check the status of the "kernel.core_pattern" kernel parameter with the following command: $ sudo sysctl kernel.core_pattern kernel.core_pattern = |/bin/false If "kernel.core_pattern" is not set to | |
| RHEL-09-213045 | RHEL 9 must be configured to disable the Asynchronous Transfer Mode kernel module. | Verify that RHEL 9 disables the ability to load the ATM kernel module with the following command: $ grep -r atm /etc/modprobe.conf /etc/modprobe.d/* install atm /bin/false blacklist atm If the command does not return any output, or the line | |
| RHEL-09-213050 | RHEL 9 must be configured to disable the Controller Area Network kernel module. | Verify that RHEL 9 disables the ability to load the CAN kernel module with the following command: $ grep -r can /etc/modprobe.conf /etc/modprobe.d/* install can /bin/false blacklist can If the command does not return any output, or the line | |
| RHEL-09-213055 | RHEL 9 must be configured to disable the FireWire kernel module. | Verify that RHEL 9 disables the ability to load the firewire-core kernel module with the following command: $ grep -r firewire-core /etc/modprobe.conf /etc/modprobe.d/* install firewire-core /bin/false blacklist firewire-core If the command | |
| RHEL-09-213060 | RHEL 9 must disable the Stream Control Transmission Protocol (SCTP) kernel module. | Verify that RHEL 9 disables the ability to load the sctp kernel module with the following command: $ grep -r sctp /etc/modprobe.conf /etc/modprobe.d/* install sctp /bin/false blacklist sctp If the command does not return any output, or the | |
| RHEL-09-213065 | RHEL 9 must disable the Transparent Inter Process Communication (TIPC) kernel module. | Verify that RHEL 9 disables the ability to load the tipc kernel module with the following command: $ grep -r tipc /etc/modprobe.conf /etc/modprobe.d/* install tipc /bin/false blacklist tipc If the command does not return any output, or the | |
| RHEL-09-213070 | RHEL 9 must implement address space layout randomization (ASLR) to protect its memory from unauthorized code execution. | Verify RHEL 9 is implementing ASLR. $ sudo sysctl kernel.randomize_va_space kernel.randomize_va_space = 2 If "kernel.randomize_va_space" is not set to "2", this is a finding. Check that the configuration files are present to enable this ker | |
| RHEL-09-213075 | RHEL 9 must disable access to network bpf system call from nonprivileged processes. | Verify RHEL 9 prevents privilege escalation through the kernel by disabling access to the bpf system call. Check the status of the "kernel.unprivileged_bpf_disabled" kernel parameter with the following command: $ sysctl kernel.unprivileged_ | |
| RHEL-09-213080 | RHEL 9 must restrict usage of ptrace to descendant processes. | Verify RHEL 9 restricts the usage of ptrace to descendant processes. Check the status of the "kernel.yama.ptrace_scope" kernel parameter with the following command: $ sysctl kernel.yama.ptrace_scope kernel.yama.ptrace_scope = 1 If the netwo | |
| RHEL-09-213085 | RHEL 9 must disable core dump backtraces. | Note: If kernel dumps are disabled in accordance with RHEL-09-213040, this requirement is not applicable. Verify RHEL 9 disables core dump backtraces by issuing the following command: $ grep -i ProcessSizeMax /etc/systemd/coredump.conf Proc | |
| RHEL-09-213090 | RHEL 9 must disable storing core dumps. | Note: If kernel dumps are disabled in accordance with RHEL-09-213040, this requirement is not applicable. Verify RHEL 9 disables storing core dumps for all users by issuing the following command: $ grep -i storage /etc/systemd/coredump.conf | |
| RHEL-09-213095 | RHEL 9 must disable core dumps for all users. | Note: If kernel dumps are disabled in accordance with RHEL-09-213040, this requirement is not applicable. Verify RHEL 9 disables core dumps for all users by issuing the following command: $ grep -rs core /etc/security/limits.conf /etc/secur | |
| RHEL-09-213100 | RHEL 9 must disable acquiring, saving, and processing core dumps. | Note: If kernel dumps are disabled in accordance with RHEL-09-213040, this requirement is not applicable. Verify RHEL 9 is not configured to acquire, save, or process core dumps with the following command: $ sudo systemctl status systemd-co | |
| RHEL-09-213105 | RHEL 9 must disable the use of user namespaces. | Verify RHEL 9 disables the use of user namespaces. Check the status of the "user.max_user_namespaces" parameter with the following command: $ sudo sysctl user.max_user_namespaces user.max_user_namespaces = 0 If "user.max_user_namespaces" is | |
| RHEL-09-213110 | RHEL 9 must implement nonexecutable data to protect its memory from unauthorized code execution. | Verify ExecShield is enabled on 64-bit RHEL 9 systems. Run the following command: $ grep ^flags /proc/cpuinfo | grep -Ev '([^[:alnum:]])(nx)([^[:alnum:]]|$)' If any output is returned, this is a finding. Next, run the following command: $ s | |
| RHEL-09-213115 | The kdump service on RHEL 9 must be disabled. | Verify that the kdump service is disabled in system boot configuration with the following command: $ sudo systemctl is-enabled kdump disabled Verify that the kdump service is not active (i.e., not running) through current runtime configurat | |
| RHEL-09-214010 | RHEL 9 must ensure cryptographic verification of vendor software packages. | Confirm Red Hat package-signing keys are installed on the system and verify their fingerprints match vendor values. Note: For RHEL 9 software packages, Red Hat uses GPG keys labeled "release key 2" and "auxiliary key 3". The keys are define | |
| RHEL-09-214015 | RHEL 9 must check the GPG signature of software packages originating from external software repositories before installation. | Verify RHEL 9 dnf always checks the GPG signature of software packages originating from external software repositories before installation with the following command: $ sudo grep -w gpgcheck /etc/dnf/dnf.conf gpgcheck=1 If "gpgcheck" is not | |
| RHEL-09-214020 | RHEL 9 must check the GPG signature of locally installed software packages before installation. | Verify RHEL 9 dnf always checks the GPG signature of locally installed software packages before installation with the following command: $ sudo grep localpkg_gpgcheck /etc/dnf/dnf.conf localpkg_gpgcheck=1 If "localpkg_gpgcheck" is not set t | |
| RHEL-09-214025 | RHEL 9 must have GPG signature verification enabled for all software repositories. | Verify RHEL 9 software repositories defined in "/etc/yum.repos.d/" have been configured with "gpgcheck" enabled with the following command: $ sudo grep -w gpgcheck /etc/yum.repos.d/*.repo | more gpgcheck = 1 If "gpgcheck" for software packa | |
| RHEL-09-214030 | RHEL 9 must be configured so that the cryptographic hashes of system files match vendor values. | Verify RHEL 9 is configured so that the cryptographic hashes of system files match vendor values. List files on the system that have file hashes different from what is expected by the RPM database with the following command: $ sudo rpm -Va | |
| RHEL-09-214035 | RHEL 9 must remove all software components after updated versions have been installed. | Verify RHEL 9 removes all software components after updated versions have been installed with the following command: $ sudo grep -i clean_requirements_on_remove /etc/dnf/dnf.conf clean_requirements_on_remove=True If "clean_requirements_on_r | |
| RHEL-09-215010 | RHEL 9 subscription-manager package must be installed. | Note: If the system is not an internet connected system, this requirement is not applicable. Verify that RHEL 9 subscription-manager package is installed with the following command: $ dnf list --installed subscription-manager Example output | |
| RHEL-09-215015 | RHEL 9 must not have a File Transfer Protocol (FTP) server package installed. | Verify RHEL 9 does not have an FTP server package installed with the following command: $ sudo dnf list --installed | grep vsftpd If the "vsftpd" package is installed, this is a finding. | |
| RHEL-09-215020 | RHEL 9 must not have the sendmail package installed. | Verify that the sendmail package is not installed with the following command: $ dnf list --installed sendmail Error: No matching Packages to list If the "sendmail" package is installed, this is a finding. | |
| RHEL-09-215025 | RHEL 9 must not have the nfs-utils package installed. | Verify that the nfs-utils package is not installed with the following command: $ dnf list --installed nfs-utils Error: No matching Packages to list If the "nfs-utils" package is installed, this is a finding. | |
| RHEL-09-215035 | RHEL 9 must not install packages from the Extra Packages for Enterprise Linux (EPEL) repository. | Verify that RHEL 9 is not able to install packages from the EPEL with the following command: $ dnf repolist rhel-9-for-x86_64-appstream-rpms Red Hat Enterprise Linux 9 for x86_64 - AppStream (RPMs) rhel-9-for-x86_64-baseos-rpms Red Hat Ente | |
| RHEL-09-215040 | RHEL 9 must not have the telnet-server package installed. | Verify that the telnet-server package is not installed with the following command: $ dnf list --installed telnet-server Error: No matching Packages to list If the "telnet-server" package is installed, this is a finding. | |
| RHEL-09-215045 | RHEL 9 must not have the gssproxy package installed. | Note: If NFS mounts are authorized and in use on the system, this control is not applicable. Verify the gssproxy package is not installed with the following command: $ dnf list --installed gssproxy Error: No matching Packages to list If the | |
| RHEL-09-215050 | RHEL 9 must not have the iprutils package installed. | Verify that the iprutils package is not installed with the following command: $ dnf list --installed iprutils Error: No matching Packages to list If the "iprutils" package is installed and is not documented with the information system secur | |
| RHEL-09-215055 | RHEL 9 must not have the tuned package installed. | Verify that the tuned package is not installed with the following command: $ dnf list --installed tuned Error: No matching Packages to list If the "tuned" package is installed and is not documented with the information system security offic | |
| RHEL-09-215060 | The Trivial File Transfer Protocol (TFTP) server must not be installed unless it is required, and if required, the RHEL 9 TFTP daemon must be configured to operate in secure mode. | Verify if TFTP is installed, it is configured to operate in secure mode. Note: If TFTP is not required, it must not be installed. If TFTP is not installed, this rule is not applicable. Check to see if TFTP server is installed with the follo | |
| RHEL-09-215070 | A graphical display manager must not be installed on RHEL 9 unless approved. | Verify that a graphical user interface is not installed with the following command: $ dnf list --installed "xorg-x11-server-common" Error: No matching Packages to list If the "xorg-x11-server-common" package is installed, and the use of a g | |
| RHEL-09-215075 | RHEL 9 must have the openssl-pkcs11 package installed. | Note: If the system administrator demonstrates the use of an approved alternate multifactor authentication method, this requirement is Not Applicable. Verify that RHEL 9 has the openssl-pkcs11 package installed with the following command: $ | |
| RHEL-09-215080 | RHEL 9 must have the gnutls-utils package installed. | Verify that RHEL 9 has the gnutls-utils package installed with the following command: $ dnf list --installed gnutls-utils Example output: gnutls-utils.x86_64 3.7.3-9.el9 If the "gnutls-utils" package is not installed, this is a finding. | |
| RHEL-09-215085 | RHEL 9 must have the nss-tools package installed. | Verify that RHEL 9 has the nss-tools package installed with the following command: $ dnf list --installed nss-tools Example output: nss-tools.x86_64 3.71.0-7.el9 If the "nss-tools" package is not installed, this is a finding. | |
| RHEL-09-215090 | RHEL 9 must have the rng-tools package installed. | Verify that RHEL 9 has the rng-tools package installed with the following command: $ dnf list --installed rng-tools Example output: rng-tools.x86_64 6.14-2.git.b2b7934e.el9 If the "rng-tools" package is not installed, this is a finding. | |
| RHEL-09-215095 | RHEL 9 must have the s-nail package installed. | Verify that RHEL 9 is configured to allow sending email notifications. Note: The "s-nail" package provides the "mail" command that is used to send email messages. Verify that the "s-nail" package is installed on the system: $ dnf list --ins | |
| RHEL-09-215100 | RHEL 9 must have the crypto-policies package installed. | Verify that the RHEL 9 crypto-policies package is installed with the following command: $ dnf list --installed crypto-policies Example output: crypto-policies.noarch 20240828-2.git626aa59.el9_5 If the crypto-policies package is not installe | |
| RHEL-09-215101 | RHEL 9 must have the Postfix package installed. | Note: If the admin can demonstrate that there is another system/service to send audit failure notifications to the administrator/ISSO, this control is not applicable. Verify RHEL 9 has the Postfix package installed with the following comman | |
| RHEL-09-215105 | RHEL 9 must implement a FIPS 140-3-compliant systemwide cryptographic policy. | Verify RHEL 9 is set to use a FIPS 140-3-compliant systemwide cryptographic policy. Verify the current systemwide crypto-policy with the following command: $ update-crypto-policies --show FIPS If the systemwide crypto-policy is not set to " | |
| RHEL-09-231010 | A separate RHEL 9 file system must be used for user home directories (such as /home or an equivalent). | Verify that a separate file system/partition has been created for "/home" with the following command: $ mount | grep /home UUID=fba5000f-2ffa-4417-90eb-8c54ae74a32f on /home type ext4 (rw,nodev,nosuid,noexec,seclabel) If a separate entry fo | |
| RHEL-09-231015 | RHEL 9 must use a separate file system for /tmp. | Verify that a separate file system/partition has been created for "/tmp" with the following command: $ mount | grep /tmp /dev/mapper/rhel-tmp on /tmp type xfs (rw,nodev,nosuid,noexec,seclabel) If a separate entry for "/tmp" is not in use, t | |
| RHEL-09-231020 | RHEL 9 must use a separate file system for /var. | Verify that a separate file system/partition has been created for "/var" with the following command: $ mount | grep /var /dev/mapper/rootvg-varlv on /var type xfs (rw,relatime,seclabel,attr2,inode64,logbufs=8,logbsize=32k,noquota) Note: Opt | |
| RHEL-09-231025 | RHEL 9 must use a separate file system for /var/log. | Verify that a separate file system/partition has been created for "/var/log" with the following command: $ mount | grep /var/log /dev/mapper/rhel-var_log on /var/log type xfs (rw,nosuid,nodev,noexec,relatime,seclabel,attr2,inode64,logbufs=8 | |
| RHEL-09-231030 | RHEL 9 must use a separate file system for the system audit data path. | Verify that a separate file system/partition has been created for the system audit data path with the following command: Note: /var/log/audit is used as the example as it is a common location. $ mount | grep /var/log/audit /dev/mapper/rootv | |
| RHEL-09-231035 | RHEL 9 must use a separate file system for /var/tmp. | Verify that a separate file system/partition has been created for "/var/tmp" with the following command: $ mount | grep /var/tmp /dev/mapper/rhel-tmp on /var/tmp type xfs (rw,nosuid,nodev,noexec,relatime,seclabel,attr2,inode64,logbufs=8,log | |
| RHEL-09-231040 | The RHEL 9 file system automounter must be disabled. | Verify that RHEL 9 file system automount function has been disabled and masked with the following command: $ $ systemctl is-enabled autofs masked If the returned value is not "masked", "disabled", or "not-found", this is a finding. | |
| RHEL-09-231045 | RHEL 9 must prevent device files from being interpreted on file systems that contain user home directories. | Verify "/home" is mounted with the "nodev" option with the following command: Note: If a separate file system has not been created for the user home directories (user home directories are mounted under "/"), this is automatically a finding, | |
| RHEL-09-231050 | RHEL 9 must prevent files with the setuid and setgid bit set from being executed on file systems that contain user home directories. | Verify "/home" is mounted with the "nosuid" option with the following command: Note: If a separate file system has not been created for the user home directories (user home directories are mounted under "/"), this is automatically a finding | |
| RHEL-09-231055 | RHEL 9 must prevent code from being executed on file systems that contain user home directories. | Verify "/home" is mounted with the "noexec" option with the following command: Note: If a separate file system has not been created for the user home directories (user home directories are mounted under "/"), this is automatically a finding | |
| RHEL-09-231065 | RHEL 9 must prevent special devices on file systems that are imported via Network File System (NFS). | Note: If no NFS mounts are configured, this requirement is Not Applicable. Verify RHEL 9 has the "nodev" option configured for all NFS mounts with the following command: $ grep nfs /etc/fstab 192.168.22.2:/mnt/export /data nfs4 rw,nosuid,no | |
| RHEL-09-231070 | RHEL 9 must prevent code from being executed on file systems that are imported via Network File System (NFS). | Note: If no NFS mounts are configured, this requirement is Not Applicable. Verify RHEL 9 has the "noexec" option configured for all NFS mounts with the following command: $ grep nfs /etc/fstab 192.168.22.2:/mnt/export /data nfs4 rw,nosuid,n | |
| RHEL-09-231075 | RHEL 9 must prevent files with the setuid and setgid bit set from being executed on file systems that are imported via Network File System (NFS). | Note: If no NFS mounts are configured, this requirement is Not Applicable. Verify RHEL 9 has the "nosuid" option configured for all NFS mounts with the following command: $ grep nfs /etc/fstab 192.168.22.2:/mnt/export /data nfs4 rw,nosuid,n | |
| RHEL-09-231080 | RHEL 9 must prevent code from being executed on file systems that are used with removable media. | Verify file systems that are used for removable media are mounted with the "noexec" option with the following command: $ more /etc/fstab UUID=2bc871e4-e2a3-4f29-9ece-3be60c835222 /mnt/usbflash vfat noauto,owner,ro,nosuid,nodev,noexec 0 0 If | |
| RHEL-09-231085 | RHEL 9 must prevent special devices on file systems that are used with removable media. | Verify file systems that are used for removable media are mounted with the "nodev" option with the following command: $ more /etc/fstab UUID=2bc871e4-e2a3-4f29-9ece-3be60c835222 /mnt/usbflash vfat noauto,owner,ro,nosuid,nodev,noexec 0 0 If | |
| RHEL-09-231090 | RHEL 9 must prevent files with the setuid and setgid bit set from being executed on file systems that are used with removable media. | Verify file systems that are used for removable media are mounted with the "nosuid" option with the following command: $ more /etc/fstab UUID=2bc871e4-e2a3-4f29-9ece-3be60c835222 /mnt/usbflash vfat noauto,owner,ro,nosuid,nodev,noexec 0 0 If | |
| RHEL-09-231095 | RHEL 9 must mount /boot with the nodev option. | Verify that the "/boot" mount point has the "nodev" option with the following command: $ mount | grep '\s/boot\s' /dev/sda1 on /boot type xfs (rw,nodev,relatime,seclabel,attr2) If the "/boot" file system does not have the "nodev" option set | |
| RHEL-09-231100 | RHEL 9 must prevent files with the setuid and setgid bit set from being executed on the /boot directory. | Verify the /boot directory is mounted with the "nosuid" option with the following command: $ mount | grep '\s/boot\s' /dev/sda1 on /boot type xfs (rw,nosuid,relatime,seclabe,attr2,inode64,noquota) If the /boot file system does not have the | |
| RHEL-09-231105 | RHEL 9 must prevent files with the setuid and setgid bit set from being executed on the /boot/efi directory. | Note: For systems that use BIOS, this is not applicable. Verify the /boot/efi directory is mounted with the "nosuid" option with the following command: $ mount | grep '\s/boot/efi\s' /dev/sda1 on /boot/efi type vfat (rw,nosuid,relatime,fmas | |
| RHEL-09-231110 | RHEL 9 must mount /dev/shm with the nodev option. | Verify "/dev/shm" is mounted with the "nodev" option with the following command: $ findmnt /dev/shm TARGET SOURCE FSTYPE OPTIONS /dev/shm tmpfs tmpfs rw,nodev,nosuid,noexec,seclabel If the mount options for /dev/shm does not include nodev, | |
| RHEL-09-231115 | RHEL 9 must mount /dev/shm with the noexec option. | Verify "/dev/shm" is mounted with the "noexec" option with the following command: $ findmnt /dev/shm /dev/shm tmpfs tmpfs rw,nodev,nosuid,noexec,seclabel If the mount options for /dev/shm does not include noexec, this is a finding. | |
| RHEL-09-231120 | RHEL 9 must mount /dev/shm with the nosuid option. | Verify "/dev/shm" is mounted with the "nosuid" option with the following command: $ findmnt /dev/shm /dev/shm tmpfs tmpfs rw,nodev,nosuid,noexec,seclabel If the mount options for /dev/shm does not include nosuid, this is a finding. | |
| RHEL-09-231125 | RHEL 9 must mount /tmp with the nodev option. | Verify "/tmp" is mounted with the "nodev" option: $ mount | grep /tmp /dev/mapper/rhel-tmp on /tmp type xfs (rw,nodev,nosuid,noexec,seclabel) If the "/tmp" file system is mounted without the "nodev" option, this is a finding. | |
| RHEL-09-231130 | RHEL 9 must mount /tmp with the noexec option. | Verify "/tmp" is mounted with the "noexec" option: $ mount | grep /tmp /dev/mapper/rhel-tmp on /tmp type xfs (rw,nodev,nosuid,noexec,seclabel) If the "/tmp" file system is mounted without the "noexec" option, this is a finding. | |
| RHEL-09-231135 | RHEL 9 must mount /tmp with the nosuid option. | Verify "/tmp" is mounted with the "nosuid" option: $ mount | grep /tmp /dev/mapper/rhel-tmp on /tmp type xfs (rw,nodev,nosuid,noexec,seclabel) If the "/tmp" file system is mounted without the "nosuid" option, this is a finding. | |
| RHEL-09-231140 | RHEL 9 must mount /var with the nodev option. | Verify "/var" is mounted with the "nodev" option: $ mount | grep /var /dev/mapper/rhel-var on /var type xfs (rw,nodev,nosuid,noexec,seclabel) If the "/var" file system is mounted without the "nodev" option, this is a finding. | |
| RHEL-09-231145 | RHEL 9 must mount /var/log with the nodev option. | Verify "/var/log" is mounted with the "nodev" option: $ mount | grep /var/log /dev/mapper/rhel-var-log on /var/log type xfs (rw,nodev,nosuid,noexec,seclabel) If the "/var/log" file system is mounted without the "nodev" option, this is a fin | |
| RHEL-09-231150 | RHEL 9 must mount /var/log with the noexec option. | Verify "/var/log" is mounted with the "noexec" option: $ mount | grep /var/log /dev/mapper/rhel-var-log on /var/log type xfs (rw,nodev,nosuid,noexec,seclabel) If the "/var/log" file system is mounted without the "noexec" option, this is a f | |
| RHEL-09-231155 | RHEL 9 must mount /var/log with the nosuid option. | Verify "/var/log" is mounted with the "nosuid" option: $ mount | grep /var/log /dev/mapper/rhel-var-log on /var/log type xfs (rw,nodev,nosuid,noexec,seclabel) If the "/var/log" file system is mounted without the "nosuid" option, this is a f | |
| RHEL-09-231160 | RHEL 9 must mount /var/log/audit with the nodev option. | Verify "/var/log/audit" is mounted with the "nodev" option: $ mount | grep /var/log/audit /dev/mapper/rhel-var-log-audit on /var/log/audit type xfs (rw,nodev,nosuid,noexec,seclabel) If the "/var/log/audit" file system is mounted without the | |
| RHEL-09-231165 | RHEL 9 must mount /var/log/audit with the noexec option. | Verify "/var/log/audit" is mounted with the "noexec" option: $ mount | grep /var/log/audit /dev/mapper/rhel-var-log-audit on /var/log/audit type xfs (rw,nodev,nosuid,noexec,seclabel) If the "/var/log/audit" file system is mounted without th | |
| RHEL-09-231170 | RHEL 9 must mount /var/log/audit with the nosuid option. | Verify "/var/log/audit" is mounted with the "nosuid" option: $ mount | grep /var/log/audit /dev/mapper/rhel-var-log-audit on /var/log/audit type xfs (rw,nodev,nosuid,noexec,seclabel) If the "/var/log/audit" file system is mounted without th | |
| RHEL-09-231175 | RHEL 9 must mount /var/tmp with the nodev option. | Verify "/var/tmp" is mounted with the "nodev" option: $ mount | grep /var/tmp /dev/mapper/rhel-var-tmp on /var/tmp type xfs (rw,nodev,nosuid,noexec,seclabel) If the "/var/tmp" file system is mounted without the "nodev" option, this is a fin | |
| RHEL-09-231180 | RHEL 9 must mount /var/tmp with the noexec option. | Verify "/var/tmp" is mounted with the "noexec" option: $ mount | grep /var/tmp /dev/mapper/rhel-var-tmp on /var/tmp type xfs (rw,nodev,nosuid,noexec,seclabel) If the "/var/tmp" file system is mounted without the "noexec" option, this is a f | |
| RHEL-09-231185 | RHEL 9 must mount /var/tmp with the nosuid option. | Verify "/var/tmp" is mounted with the "nosuid" option: $ mount | grep /var/tmp /dev/mapper/rhel-var-tmp on /var/tmp type xfs (rw,nodev,nosuid,noexec,seclabel) If the "/var/tmp" file system is mounted without the "nosuid" option, this is a f | |
| RHEL-09-231190 | RHEL 9 local disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at rest protection. | Note: If there is a documented and approved reason for not having data-at-rest encryption at the operating system level, such as encryption provided by a hypervisor or a disk storage array in a virtualized environment, this requirement is N | |
| RHEL-09-231195 | RHEL 9 must disable mounting of cramfs. | Verify that RHEL 9 disables the ability to load the cramfs kernel module with the following command: $ grep -r cramfs /etc/modprobe.conf /etc/modprobe.d/* install cramfs /bin/false blacklist cramfs If the command does not return any output | |
| RHEL-09-231200 | RHEL 9 must prevent special devices on non-root local partitions. | Verify all nonroot local partitions are mounted with the "nodev" option with the following command: $ sudo mount | grep '^/dev\S* on /\S' | grep --invert-match 'nodev' If any output is produced, this is a finding. | |
| RHEL-09-232010 | RHEL 9 system commands must have mode 755 or less permissive. | Verify the system commands contained in the following directories have mode "755" or less permissive with the following command: $ sudo find -L /bin /sbin /usr/bin /usr/sbin /usr/libexec /usr/local/bin /usr/local/sbin -perm /022 -exec ls -l | |
| RHEL-09-232015 | RHEL 9 library directories must have mode 755 or less permissive. | Verify the system-wide shared library directories have mode "755" or less permissive with the following command: $ sudo find -L /lib /lib64 /usr/lib /usr/lib64 -perm /022 -type d -exec ls -l {} \; If any system-wide shared library file is f | |
| RHEL-09-232020 | RHEL 9 library files must have mode 755 or less permissive. | Verify the systemwide shared library files contained in the directories "/lib", "/lib64", "/usr/lib", and "/usr/lib64" have mode 0755 or less permissive. Check that the systemwide shared library files have mode 0755 or less permissive with | |
| RHEL-09-232025 | RHEL 9 /var/log directory must have mode 0755 or less permissive. | Verify that the "/var/log" directory has a mode of "0755" or less permissive with the following command: $ stat -c '%a %n' /var/log 755 /var/log If "/var/log" does not have a mode of "0755" or less permissive, this is a finding. | |
| RHEL-09-232030 | RHEL 9 /var/log/messages file must have mode 0640 or less permissive. | Verify the "/var/log/messages" file has a mode of "0640" or less permissive with the following command: $ stat -c '%a %n' /var/log/messages 600 /var/log/messages If "/var/log/messages" does not have a mode of "0640" or less permissive, this | |
| RHEL-09-232035 | RHEL 9 audit tools must have a mode of 0755 or less permissive. | Verify the audit tools have a mode of "0755" or less with the following command: $ stat -c "%a %n" /sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/autrace /sbin/auditd /sbin/rsyslogd /sbin/augenrules 755 /sbin/auditctl 755 /sbin/aureport | |
| RHEL-09-232040 | RHEL 9 permissions of cron configuration files and directories must not be modified from the operating system defaults. | Run the following command to verify that the owner, group, and mode of cron configuration files and directories match the operating system defaults: $ rpm --verify cronie crontabs | awk '! ($2 == "c" && $1 ~ /^.\..\.\.\.\..\./) {print $0}' | |
| RHEL-09-232045 | All RHEL 9 local initialization files must have mode 0740 or less permissive. | Verify all local initialization files have a mode of "0740" or less permissive with the following command: Note: The example will be for the "disauser" user, who has a home directory of "/home/disauser". $ sudo find /home /root -maxdepth 2 | |
| RHEL-09-232050 | All RHEL 9 local interactive user home directories must have mode 0750 or less permissive. | Verify the assigned home directory of all local interactive users has a mode of "0750" or less permissive with the following command: Note: This may miss interactive users that have been assigned a privileged user identifier (UID). Evidence | |
| RHEL-09-232055 | RHEL 9 /etc/group file must have mode 0644 or less permissive to prevent unauthorized access. | Verify that the "/etc/group" file has mode "0644" or less permissive with the following command: $ sudo stat -c "%a %n" /etc/group 644 /etc/group If a value of "0644" or less permissive is not returned, this is a finding. | |
| RHEL-09-232060 | RHEL 9 /etc/group- file must have mode 0644 or less permissive to prevent unauthorized access. | Verify that the "/etc/group-" file has mode "0644" or less permissive with the following command: $ sudo stat -c "%a %n" /etc/group- 644 /etc/group- If a value of "0644" or less permissive is not returned, this is a finding. | |
| RHEL-09-232065 | RHEL 9 /etc/gshadow file must have mode 0000 or less permissive to prevent unauthorized access. | Verify that the "/etc/gshadow" file has mode "0000" with the following command: $ sudo stat -c "%a %n" /etc/gshadow 0 /etc/gshadow If a value of "0" is not returned, this is a finding. | |
| RHEL-09-232070 | RHEL 9 /etc/gshadow- file must have mode 0000 or less permissive to prevent unauthorized access. | Verify that the "/etc/gshadow-" file has mode "0000" with the following command: $ sudo stat -c "%a %n" /etc/gshadow- 0 /etc/gshadow- If a value of "0" is not returned, this is a finding. | |
| RHEL-09-232075 | RHEL 9 /etc/passwd file must have mode 0644 or less permissive to prevent unauthorized access. | Verify that the "/etc/passwd" file has mode "0644" or less permissive with the following command: $ sudo stat -c "%a %n" /etc/passwd 644 /etc/passwd If a value of "0644" or less permissive is not returned, this is a finding. | |
| RHEL-09-232080 | RHEL 9 /etc/passwd- file must have mode 0644 or less permissive to prevent unauthorized access. | Verify that the "/etc/passwd-" file has mode "0644" or less permissive with the following command: $ sudo stat -c "%a %n" /etc/passwd- 644 /etc/passwd- If a value of "0644" or less permissive is not returned, this is a finding. | |
| RHEL-09-232085 | RHEL 9 /etc/shadow- file must have mode 0000 or less permissive to prevent unauthorized access. | Verify that the "/etc/shadow-" file has mode "0000" with the following command: $ sudo stat -c "%a %n" /etc/shadow- 0 /etc/shadow- If a value of "0" is not returned, this is a finding. | |
| RHEL-09-232090 | RHEL 9 /etc/group file must be owned by root. | Verify the ownership of the "/etc/group" file with the following command: $ sudo stat -c "%U %n" /etc/group root /etc/group If "/etc/group" file does not have an owner of "root", this is a finding. | |
| RHEL-09-232095 | RHEL 9 /etc/group file must be group-owned by root. | Verify the group ownership of the "/etc/group" file with the following command: $ sudo stat -c "%G %n" /etc/group root /etc/group If "/etc/group" file does not have a group owner of "root", this is a finding. | |
| RHEL-09-232100 | RHEL 9 /etc/group- file must be owned by root. | Verify the ownership of the "/etc/group-" file with the following command: $ sudo stat -c "%U %n" /etc/group- root /etc/group- If "/etc/group-" file does not have an owner of "root", this is a finding. | |
| RHEL-09-232103 | RHEL 9 "/etc/audit/" must be owned by root. | Verify the ownership of the "/etc/audit/" directory with the following command: $ sudo stat -c "%U %n" /etc/audit/ root /etc/audit/ If the "/etc/audit/" directory does not have an owner of "root", this is a finding. | |
| RHEL-09-232104 | RHEL 9 "/etc/audit/" must be group-owned by root. | Verify the group ownership of the "/etc/audit/" directory with the following command: $ sudo stat -c "%G %n" /etc/audit/ root /etc/audit/ If "/etc/audit/" does not have a group owner of "root", this is a finding. | |
| RHEL-09-232105 | RHEL 9 /etc/group- file must be group-owned by root. | Verify the group ownership of the "/etc/group-" file with the following command: $ sudo stat -c "%G %n" /etc/group- root /etc/group- If "/etc/group-" file does not have a group owner of "root", this is a finding. | |
| RHEL-09-232110 | RHEL 9 /etc/gshadow file must be owned by root. | Verify the ownership of the "/etc/gshadow" file with the following command: $ sudo stat -c "%U %n" /etc/gshadow root /etc/gshadow If "/etc/gshadow" file does not have an owner of "root", this is a finding. | |
| RHEL-09-232115 | RHEL 9 /etc/gshadow file must be group-owned by root. | Verify the group ownership of the "/etc/gshadow" file with the following command: $ sudo stat -c "%G %n" /etc/gshadow root /etc/gshadow If "/etc/gshadow" file does not have a group owner of "root", this is a finding. | |
| RHEL-09-232120 | RHEL 9 /etc/gshadow- file must be owned by root. | Verify the ownership of the "/etc/gshadow-" file with the following command: $ sudo stat -c "%U %n" /etc/gshadow- root /etc/gshadow- If "/etc/gshadow-" file does not have an owner of "root", this is a finding. | |
| RHEL-09-232125 | RHEL 9 /etc/gshadow- file must be group-owned by root. | Verify the group ownership of the "/etc/gshadow-" file with the following command: $ sudo stat -c "%G %n" /etc/gshadow- root /etc/gshadow- If "/etc/gshadow-" file does not have a group owner of "root", this is a finding. | |
| RHEL-09-232130 | RHEL 9 /etc/passwd file must be owned by root. | Verify the ownership of the "/etc/passwd" file with the following command: $ sudo stat -c "%U %n" /etc/passwd root /etc/passwd If "/etc/passwd" file does not have an owner of "root", this is a finding. | |
| RHEL-09-232135 | RHEL 9 /etc/passwd file must be group-owned by root. | Verify the group ownership of the "/etc/passwd" file with the following command: $ sudo stat -c "%G %n" /etc/passwd root /etc/passwd If "/etc/passwd" file does not have a group owner of "root", this is a finding. | |
| RHEL-09-232140 | RHEL 9 /etc/passwd- file must be owned by root. | Verify the ownership of the "/etc/passwd-" file with the following command: $ sudo stat -c "%U %n" /etc/passwd- root /etc/passwd- If "/etc/passwd-" file does not have an owner of "root", this is a finding. | |
| RHEL-09-232145 | RHEL 9 /etc/passwd- file must be group-owned by root. | Verify the group ownership of the "/etc/passwd-" file with the following command: $ sudo stat -c "%G %n" /etc/passwd- root /etc/passwd- If "/etc/passwd-" file does not have a group owner of "root", this is a finding. | |
| RHEL-09-232150 | RHEL 9 /etc/shadow file must be owned by root. | Verify the ownership of the "/etc/shadow" file with the following command: $ sudo stat -c "%U %n" /etc/shadow root /etc/shadow If "/etc/shadow" file does not have an owner of "root", this is a finding. | |
| RHEL-09-232155 | RHEL 9 /etc/shadow file must be group-owned by root. | Verify the group ownership of the "/etc/shadow" file with the following command: $ sudo stat -c "%G %n" /etc/shadow root /etc/shadow If "/etc/shadow" file does not have a group owner of "root", this is a finding. | |
| RHEL-09-232160 | RHEL 9 /etc/shadow- file must be owned by root. | Verify the ownership of the "/etc/shadow-" file with the following command: $ sudo stat -c "%U %n" /etc/shadow- root /etc/shadow- If "/etc/shadow-" file does not have an owner of "root", this is a finding. | |
| RHEL-09-232165 | RHEL 9 /etc/shadow- file must be group-owned by root. | Verify the group ownership of the "/etc/shadow-" file with the following command: $ sudo stat -c "%G %n" /etc/shadow- root /etc/shadow- If "/etc/shadow-" file does not have a group owner of "root", this is a finding. | |
| RHEL-09-232170 | RHEL 9 /var/log directory must be owned by root. | Verify the "/var/log" directory is owned by root with the following command: $ stat -c "%U %n" /var/log root /var/log If "/var/log" does not have an owner of "root", this is a finding. | |
| RHEL-09-232175 | RHEL 9 /var/log directory must be group-owned by root. | Verify the "/var/log" directory is group-owned by root with the following command: $ stat -c "%G %n" /var/log root /var/log If "/var/log" does not have a group owner of "root", this is a finding. | |
| RHEL-09-232180 | RHEL 9 /var/log/messages file must be owned by root. | Verify the "/var/log/messages" file is owned by root with the following command: $ stat -c "%U %n" /var/log/messages root /var/log/messages If "/var/log/messages" does not have an owner of "root", this is a finding. | |
| RHEL-09-232185 | RHEL 9 /var/log/messages file must be group-owned by root. | Verify the "/var/log/messages" file is group-owned by root with the following command: $ stat -c "%G %n" /var/log/messages root /var/log/messages If "/var/log/messages" does not have a group owner of "root", this is a finding. | |
| RHEL-09-232190 | RHEL 9 system commands must be owned by root. | Verify the system commands contained in the following directories are owned by "root" with the following command: $ sudo find -L /bin /sbin /usr/bin /usr/sbin /usr/libexec /usr/local/bin /usr/local/sbin ! -user root -exec stat -L -c "%U %n" | |
| RHEL-09-232195 | RHEL 9 system commands must be group-owned by root or a system account. | Verify the system commands contained in the following directories are group-owned by "root", or a required system account, with the following command: $ sudo find -L /bin /sbin /usr/bin /usr/sbin /usr/libexec /usr/local/bin /usr/local/sbin | |
| RHEL-09-232200 | RHEL 9 library files must be owned by root. | Verify the systemwide shared library files contained in the directories "/lib", "/lib64", "/usr/lib", and "/usr/lib64" are owned by root with the following command: $ sudo find /lib /lib64 /usr/lib /usr/lib64 -type f -name '*.so*' ! -user r | |
| RHEL-09-232205 | RHEL 9 library files must be group-owned by root or a system account. | Verify the systemwide shared library files contained in the directories "/lib", "/lib64", "/usr/lib", and "/usr/lib64" are group owned by root with the following command: $ sudo find /lib /lib64 /usr/lib /usr/lib64 -type f -name '*.so*' ! - | |
| RHEL-09-232210 | RHEL 9 library directories must be owned by root. | Verify the systemwide shared library directories are owned by "root" with the following command: $ sudo find /lib /lib64 /usr/lib /usr/lib64 ! -user root -type d -exec stat -c "%U %n" {} \; If any systemwide shared library directory is not | |
| RHEL-09-232215 | RHEL 9 library directories must be group-owned by root or a system account. | Verify the systemwide shared library directories are group-owned by "root" with the following command: $ sudo find /lib /lib64 /usr/lib /usr/lib64 ! -group root -type d -exec stat -c "%G %n" {} \; If any systemwide shared library directory | |
| RHEL-09-232220 | RHEL 9 audit tools must be owned by root. | Verify the audit tools are owned by "root" with the following command: $ sudo stat -c "%U %n" /sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/autrace /sbin/auditd /sbin/rsyslogd /sbin/augenrules root /sbin/auditctl root /sbin/aureport ro | |
| RHEL-09-232225 | RHEL 9 audit tools must be group-owned by root. | Verify the audit tools are group owned by "root" with the following command: $ sudo stat -c "%G %n" /sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/autrace /sbin/auditd /sbin/rsyslogd /sbin/augenrules root /sbin/auditctl root /sbin/aurep | |
| RHEL-09-232230 | RHEL 9 cron configuration files directory must be owned by root. | Verify the ownership of all cron configuration files with the command: $ stat -c "%U %n" /etc/cron* root /etc/cron.d root /etc/cron.daily root /etc/cron.deny root /etc/cron.hourly root /etc/cron.monthly root /etc/crontab root /etc/cron.week | |
| RHEL-09-232235 | RHEL 9 cron configuration files directory must be group-owned by root. | Verify the group ownership of all cron configuration files with the following command: $ stat -c "%G %n" /etc/cron* root /etc/cron.d root /etc/cron.daily root /etc/cron.deny root /etc/cron.hourly root /etc/cron.monthly root /etc/crontab roo | |
| RHEL-09-232240 | All RHEL 9 world-writable directories must be owned by root, sys, bin, or an application user. | Verify RHEL 9 world writable directories are owned by root, a system account, or an application account with the following command: $ sudo find / -xdev -type d -perm -0002 -uid +999 -exec stat -c "%U, %u, %A, %n" {} \; 2>/dev/null If there | |
| RHEL-09-232245 | A sticky bit must be set on all RHEL 9 public directories. | Verify that all world-writable directories have the sticky bit set. Determine if all world-writable directories have the sticky bit set by running the following command: $ sudo find / -type d \( -perm -0002 -a ! -perm -1000 \) -print 2>/dev | |
| RHEL-09-232250 | All RHEL 9 local files and directories must have a valid group owner. | Verify all local files and directories on RHEL 9 have a valid group with the following command: $ df --local -P | awk {'if (NR!=1) print $6'} | sudo xargs -I '{}' find '{}' -xdev -nogroup If any files on the system do not have an assigned g | |
| RHEL-09-232255 | All RHEL 9 local files and directories must have a valid owner. | Verify all local files and directories on RHEL 9 have a valid owner with the following command: $ df --local -P | awk {'if (NR!=1) print $6'} | sudo xargs -I '{}' find '{}' -xdev -nouser If any files on the system do not have an assigned ow | |
| RHEL-09-232260 | RHEL 9 must be configured so that all system device files are correctly labeled to prevent unauthorized modification. | Verify that all system device files are correctly labeled to prevent unauthorized modification. List all device files on the system that are incorrectly labeled with the following commands: Note: Device files are normally found under "/dev" | |
| RHEL-09-232270 | RHEL 9 /etc/shadow file must have mode 0000 to prevent unauthorized access. | Verify that the "/etc/shadow" file has mode "0000" with the following command: $ sudo stat -c "%a %n" /etc/shadow 0 /etc/shadow If a value of "0" is not returned, this is a finding. | |
| RHEL-09-251010 | RHEL 9 must have the firewalld package installed. | Run the following command to determine if the firewalld package is installed with the following command: $ dnf list --installed firewalld Example output: firewalld.noarch 1.0.0-4.el9 If the "firewall" package is not installed, this is a fin | |
| RHEL-09-251015 | The firewalld service on RHEL 9 must be active. | Verify that "firewalld" is active with the following command: $ systemctl is-active firewalld active If the firewalld service is not active, this is a finding. | |
| RHEL-09-251020 | The RHEL 9 firewall must employ a deny-all, allow-by-exception policy for allowing connections to other systems. | Verify the RHEL 9 firewalld is configured to employ a deny-all, allow-by-exception policy for allowing connections to other systems with the following commands: Ensure firewalld is running: $ sudo firewall-cmd --state running Identify activ | |
| RHEL-09-251030 | RHEL 9 must protect against or limit the effects of denial-of-service (DoS) attacks by ensuring rate-limiting measures on impacted network interfaces are implemented. | Verify "nftables" is configured to allow rate limits on any connection to the system with the following command: $ sudo grep -i firewallbackend /etc/firewalld/firewalld.conf # FirewallBackend FirewallBackend=nftables If the "nftables" is no | |
| RHEL-09-251035 | RHEL 9 must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services, as defined in the Ports, Protocols, and Services Management (PPSM) Category Assignments List (CAL) and vulnerability assessments. | Inspect the firewall configuration and running services to verify it is configured to prohibit or restrict the use of functions, ports, protocols, and/or services that are unnecessary or prohibited. Check which services are currently active | |
| RHEL-09-251040 | RHEL 9 network interfaces must not be in promiscuous mode. | Verify network interfaces are not in promiscuous mode with the following command: $ ip link | grep -i promisc If network interfaces are found on the system in promiscuous mode and their use has not been approved by the ISSO and documented, | |
| RHEL-09-251045 | RHEL 9 must enable hardening for the Berkeley Packet Filter just-in-time compiler. | Verify RHEL 9 enables hardening for the BPF JIT compiler. Check the status of the "net.core.bpf_jit_harden" parameter with the following command: $ sudo sysctl net.core.bpf_jit_harden net.core.bpf_jit_harden = 2 If "net.core.bpf_jit_harden" | |
| RHEL-09-252010 | RHEL 9 must have the chrony package installed. | Verify that RHEL 9 has the chrony package installed with the following command: $ dnf list --installed chrony Example output: chrony.x86_64 4.1-3.el9 If the "chrony" package is not installed, this is a finding. | |
| RHEL-09-252015 | RHEL 9 chronyd service must be enabled. | Verify the chronyd service is active with the following command: $ systemctl is-active chronyd active If the chronyd service is not active, this is a finding. | |
| RHEL-09-252020 | RHEL 9 must securely compare internal information system clocks at least every 24 hours. | Verify RHEL 9 is securely comparing internal information system clocks at least every 24 hours with an NTP server with the following commands: $ sudo grep maxpoll /etc/chrony.conf server 0.us.pool.ntp.mil iburst maxpoll 16 If the "maxpoll" | |
| RHEL-09-252025 | RHEL 9 must disable the chrony daemon from acting as a server. | Note: If the server is serving as an NTP server, this is not applicable. Verify RHEL 9 disables the chrony daemon from acting as a server with the following command: $ grep -w port /etc/chrony.conf port 0 If the "port" option is not set to | |
| RHEL-09-252030 | RHEL 9 must disable network management of the chrony daemon. | Verify RHEL 9 disables network management of the chrony daemon with the following command: $ grep -w cmdport /etc/chrony.conf cmdport 0 If the "cmdport" option is not set to "0", is commented out, or is missing, this is a finding. | |
| RHEL-09-252035 | RHEL 9 systems using Domain Name Servers (DNS) resolution must have at least two name servers configured. | Note: If the system is running in a cloud platform and the cloud provider gives a single, highly available IP address for DNS configuration, this control is Not Applicable. Verify the name servers used by the system with the following comma | |
| RHEL-09-252040 | RHEL 9 must configure a DNS processing mode in Network Manager. | Verify that RHEL 9 has a DNS mode configured in Network Manager. $ NetworkManager --print-config [main] dns=none If the dns key under main does not exist or is not set to "default", "none", or "systemd-resolved", this is a finding. Note: If | |
| RHEL-09-252045 | RHEL 9 must not have unauthorized IP tunnels configured. | Verify that RHEL 9 does not have unauthorized IP tunnels configured. Determine if the "IPsec" service is active with the following command: $ systemctl is-active ipsec Inactive If the "IPsec" service is active, check for configured IPsec co | |
| RHEL-09-252050 | RHEL 9 must be configured to prevent unrestricted mail relaying. | If postfix is not installed, this is Not Applicable. Verify RHEL 9 is configured to prevent unrestricted mail relaying with the following command: $ postconf -n smtpd_client_restrictions smtpd_client_restrictions = permit_mynetworks,reject | |
| RHEL-09-252060 | RHEL 9 must forward mail from postmaster to the root account using a postfix alias. | Verify that the administrators are notified in the event of an audit processing failure. Check that the "/etc/aliases" file has a defined value for "root". $ sudo grep "postmaster:\s*root$" /etc/aliases If the command does not return a line | |
| RHEL-09-252065 | RHEL 9 libreswan package must be installed. | Note: If there is no operational need for Libreswan to be installed, this rule is not applicable. Verify that RHEL 9 libreswan service package is installed. Check that the libreswan service package is installed with the following command: $ | |
| RHEL-09-252070 | There must be no shosts.equiv files on RHEL 9. | Verify there are no "shosts.equiv" files on RHEL 9 with the following command: $ sudo find / -name shosts.equiv If a "shosts.equiv" file is found, this is a finding. | |
| RHEL-09-252075 | There must be no .shosts files on RHEL 9. | Verify there are no ".shosts" files on RHEL 9 with the following command: $ sudo find / -name .shosts If a ".shosts" file is found, this is a finding. | |
| RHEL-09-253010 | RHEL 9 must be configured to use TCP syncookies. | Verify RHEL 9 is configured to use IPv4 TCP syncookies. Check the value of all "tcp_syncookies" variables with the following command: $ sudo sysctl net.ipv4.tcp_syncookies net.ipv4.tcp_syncookies = 1 If the network parameter "ipv4.tcp_synco | |
| RHEL-09-253015 | RHEL 9 must ignore Internet Protocol version 4 (IPv4) Internet Control Message Protocol (ICMP) redirect messages. | Verify RHEL 9 will not accept IPv4 ICMP redirect messages. Check the value of all "net.ipv4.conf.all.accept_redirects" variables with the following command: $ sudo sysctl net.ipv4.conf.all.accept_redirects net.ipv4.conf.all.accept_redirects | |
| RHEL-09-253020 | RHEL 9 must not forward Internet Protocol version 4 (IPv4) source-routed packets. | Verify RHEL 9 will not accept IPv4 source-routed packets. Check the value of the "accept_source_route" variable with the following command: $ sudo sysctl net.ipv4.conf.all.accept_source_route net.ipv4.conf.all.accept_source_route = 0 If "ne | |
| RHEL-09-253025 | RHEL 9 must log IPv4 packets with impossible addresses. | Verify RHEL 9 logs IPv4 martian packets. Check the value of the "log_martians" variable with the following command: $ sudo sysctl net.ipv4.conf.all.log_martians net.ipv4.conf.all.log_martians = 1 If "net.ipv4.conf.all.log_martians" is not s | |
| RHEL-09-253030 | RHEL 9 must log IPv4 packets with impossible addresses by default. | Verify RHEL 9 logs IPv4 martian packets by default. Check the value of the "default.log_martians" variable with the following command: $ sudo sysctl net.ipv4.conf.default.log_martians net.ipv4.conf.default.log_martians = 1 If "net.ipv4.conf | |
| RHEL-09-253035 | RHEL 9 must use reverse path filtering on all IPv4 interfaces. | Verify RHEL 9 uses reverse path filtering on all IPv4 interfaces. Check the value of the "rp_filter" variable with the following command: $ sudo sysctl net.ipv4.conf.all.rp_filter net.ipv4.conf.all.rp_filter = 1 If "net.ipv4.conf.all.rp_fil | |
| RHEL-09-253040 | RHEL 9 must prevent IPv4 Internet Control Message Protocol (ICMP) redirect messages from being accepted. | Verify RHEL 9 will not accept IPv4 ICMP redirect messages. Check the value of the default "accept_redirects" variable with the following command: $ sudo sysctl net.ipv4.conf.default.accept_redirects net.ipv4.conf.default.accept_redirects = | |
| RHEL-09-253045 | RHEL 9 must not forward IPv4 source-routed packets by default. | Verify RHEL 9 does not accept IPv4 source-routed packets by default. Check the value of the "accept source route" variable with the following command: $ sudo sysctl net.ipv4.conf.default.accept_source_route net.ipv4.conf.default.accept_sour | |
| RHEL-09-253050 | RHEL 9 must use a reverse-path filter for IPv4 network traffic when possible by default. | Verify RHEL 9 uses reverse path filtering on IPv4 interfaces. Check the value of the "net.ipv4.conf.default.rp_filter" with the following command: $ sudo sysctl net.ipv4.conf.default.rp_filter net.ipv4.conf.default.rp_filter = 1 If the retu | |
| RHEL-09-253055 | RHEL 9 must not respond to Internet Control Message Protocol (ICMP) echoes sent to a broadcast address. | Verify RHEL 9 ignores ICMP echoes sent to a broadcast address. Check the value of the "icmp_echo_ignore_broadcasts" variable with the following command: $ sudo sysctl net.ipv4.icmp_echo_ignore_broadcasts net.ipv4.icmp_echo_ignore_broadcasts | |
| RHEL-09-253060 | RHEL 9 must limit the number of bogus Internet Control Message Protocol (ICMP) response errors logs. | Verify RHEL 9 limits the number of bogus Internet Control Message Protocol (ICMP) response errors logs. Check the value of the "net.ipv4.icmp_ignore_bogus_error_response" variables with the following command: $ sudo sysctl net.ipv4.icmp_ign | |
| RHEL-09-253065 | RHEL 9 must not send Internet Control Message Protocol (ICMP) redirects. | Verify RHEL 9 does not IPv4 ICMP redirect messages. Check the value of the "all send_redirects" variables with the following command: $ sudo sysctl net.ipv4.conf.all.send_redirects net.ipv4.conf.all.send_redirects = 0 If "net.ipv4.conf.all. | |
| RHEL-09-253070 | RHEL 9 must not allow interfaces to perform Internet Control Message Protocol (ICMP) redirects by default. | Check the value of the "default send_redirects" variables with the following command: $ sudo sysctl net.ipv4.conf.default.send_redirects net.ipv4.conf.default.send_redirects=0 If "net.ipv4.conf.default.send_redirects" is not set to "0" and | |
| RHEL-09-253075 | RHEL 9 must not enable IPv4 packet forwarding unless the system is a router. | Verify RHEL 9 is not performing IPv4 packet forwarding unless the system is a router. Check that "net.ipv4.conf.all.forwarding" is disabled using the following command: $ sudo sysctl net.ipv4.conf.all.forwarding net.ipv4.conf.all.forwarding | |
| RHEL-09-254010 | RHEL 9 must not accept router advertisements on all IPv6 interfaces. | Verify RHEL 9 does not accept router advertisements on all IPv6 interfaces, unless the system is a router. Note: If IPv6 is disabled on the system, this requirement is Not Applicable. Check that "net.ipv6.conf.all.accept_ra" is set to not a | |
| RHEL-09-254015 | RHEL 9 must ignore IPv6 Internet Control Message Protocol (ICMP) redirect messages. | Verify RHEL 9 ignores IPv6 ICMP redirect messages. Note: If IPv6 is disabled on the system, this requirement is Not Applicable. Check the value of the "accept_redirects" variable with the following command: $ sysctl net.ipv6.conf.all.accept | |
| RHEL-09-254020 | RHEL 9 must not forward IPv6 source-routed packets. | Verify RHEL 9 does not accept IPv6 source-routed packets. Note: If IPv6 is disabled on the system, this requirement is Not Applicable. Check the value of the "net.ipv6.conf.all.accept_source_route" variable with the following command: $ sud | |
| RHEL-09-254025 | RHEL 9 must not enable IPv6 packet forwarding unless the system is a router. | Verify RHEL 9 is not performing IPv6 packet forwarding, unless the system is a router. Note: If IPv6 is disabled on the system, this requirement is Not Applicable. Check the value of the "net.ipv6.conf.all.forwarding" variable with the foll | |
| RHEL-09-254030 | RHEL 9 must not accept router advertisements on all IPv6 interfaces by default. | Verify RHEL 9 does not accept router advertisements on all IPv6 interfaces by default, unless the system is a router. Note: If IPv6 is disabled on the system, this requirement is Not Applicable. Check the value of the "net.ipv6.conf.default | |
| RHEL-09-254035 | RHEL 9 must prevent IPv6 Internet Control Message Protocol (ICMP) redirect messages from being accepted. | Verify RHEL 9 to prevent IPv6 ICMP redirect messages. Note: If IPv6 is disabled on the system, this requirement is Not Applicable. Check the value of the "net.ipv6.conf.default.accept_redirects" variables with the following command: $ sudo | |
| RHEL-09-254040 | RHEL 9 must not forward IPv6 source-routed packets by default. | Verify RHEL 9 does not accept IPv6 source-routed packets by default. Note: If IPv6 is disabled on the system, this requirement is Not Applicable. Check the value of the "net.ipv6.conf.default.accept_source_route" variables with the followin | |
| RHEL-09-255010 | All RHEL 9 networked systems must have SSH installed. | Verify that RHEL 9 has the openssh-server package installed with the following command: $ dnf list --installed openssh-server Example output: openssh-server.x86_64 8.7p1-8.el9 If the "openssh-server" package is not installed, this is a find | |
| RHEL-09-255015 | All RHEL 9 networked systems must have and implement SSH to protect the confidentiality and integrity of transmitted and received information, as well as information during preparation for transmission. | Verify that "sshd" is active with the following command: $ systemctl is-active sshd active If the "sshd" service is not active, this is a finding. | |
| RHEL-09-255020 | RHEL 9 must have the openssh-clients package installed. | Verify that RHEL 9 has the openssh-clients package installed with the following command: $ dnf list --installed openssh-clients Example output: openssh-clients.x86_64 8.7p1-8.el9 If the "openssh-clients" package is not installed, this is a | |
| RHEL-09-255025 | RHEL 9 must display the Standard Mandatory DoW Notice and Consent Banner before granting local or remote access to the system via a SSH logon. | Verify any SSH connection to RHEL 9 displays the Standard Mandatory DoW Notice and Consent Banner before granting access to the system. Check for the location of the banner file being used with the following command: $ sudo /usr/sbin/sshd - | |
| RHEL-09-255030 | RHEL 9 must log SSH connection attempts and failures to the server. | Verify that RHEL 9 logs SSH connection attempts and failures to the server. Check what the SSH daemon's "LogLevel" option is set to with the following command: $ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | tr -d '\r' | tr ' | |
| RHEL-09-255035 | RHEL 9 SSHD must accept public key authentication. | Note: If the system administrator demonstrates the use of an approved alternate multifactor authentication method, this requirement is Not Applicable. Verify that RHEL 9 SSH daemon accepts public key encryption with the following command: $ | |
| RHEL-09-255040 | RHEL 9 SSHD must not allow blank passwords. | Verify that RHEL 9 remote access using SSH prevents logging on with a blank password with the following command: $ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH '^\s*permitemptyp | |
| RHEL-09-255045 | RHEL 9 must not permit direct logons to the root account using remote access via SSH. | Verify RHEL 9 remote access using SSH prevents users from logging on directly as "root" with the following command: $ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH '^\s*permitroo | |
| RHEL-09-255050 | RHEL 9 must enable the Pluggable Authentication Module (PAM) interface for SSHD. | Verify the RHEL 9 SSHD is configured to allow for the UsePAM interface with the following command: $ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH '^\s*usepam' UsePAM yes If the | |
| RHEL-09-255064 | The RHEL 9 SSH client must be configured to use only DoW-approved encryption ciphers employing FIPS 140-3 validated cryptographic hash algorithms to protect the confidentiality of SSH client connections. | Verify the SSH client is configured to use only ciphers employing FIPS 140-3 approved algorithms. To verify the ciphers in the systemwide SSH configuration file, use the following command: $ grep -i Ciphers /etc/crypto-policies/back-ends/op | |
| RHEL-09-255065 | The RHEL 9 SSH server must be configured to use only DoW-approved encryption ciphers employing FIPS 140-3 validated cryptographic hash algorithms to protect the confidentiality of SSH server connections. | Verify the SSH server is configured to use only ciphers employing FIPS 140-3 approved algorithms. To verify the ciphers in the systemwide SSH configuration file, use the following command: $ sudo grep -i Ciphers /etc/crypto-policies/back-en | |
| RHEL-09-255070 | The RHEL 9 SSH client must be configured to use only DoW-approved Message Authentication Codes (MACs) employing FIPS 140-3 validated cryptographic hash algorithms to protect the confidentiality of SSH client connections. | Verify the SSH client is configured to use only MACs employing FIPS 140-3 approved algorithms. To verify the MACs in the systemwide SSH configuration file, use the following command: $ grep -i MACs /etc/crypto-policies/back-ends/openssh.con | |
| RHEL-09-255075 | The RHEL 9 SSH server must be configured to use only Message Authentication Codes (MACs) employing FIPS 140-3 validated cryptographic hash algorithms to protect the confidentiality of SSH server connections. | Verify the SSH server is configured to use only MACs employing FIPS 140-3 approved algorithms. To verify the MACs in the systemwide SSH configuration file, use the following command: $ sudo grep -i MACs /etc/crypto-policies/back-ends/openss | |
| RHEL-09-255080 | RHEL 9 must not allow a noncertificate trusted host SSH logon to the system. | Verify the operating system does not allow a noncertificate trusted host SSH logon to the system with the following command: $ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH '^\s* | |
| RHEL-09-255085 | RHEL 9 must not allow users to override SSH environment variables. | Verify that unattended or automatic logon via SSH is disabled with the following command: $ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH '^\s*permituserenvironment' PermitUserEn | |
| RHEL-09-255090 | RHEL 9 must force a frequent session key renegotiation for SSH connections to the server. | Verify the SSH server is configured to force frequent session key renegotiation with the following command: $ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH '^\s*rekeylimit' Rekey | |
| RHEL-09-255095 | RHEL 9 must be configured so that all network connections associated with SSH traffic terminate after becoming unresponsive. | Verify the "ClientAliveCountMax" is set to "1" by performing the following command: $ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH '^\s*clientalivecountmax' ClientAliveCountMax | |
| RHEL-09-255100 | RHEL 9 must be configured so that all network connections associated with SSH traffic are terminated after 10 minutes of becoming unresponsive. | Verify the "ClientAliveInterval" variable is set to a value of "600" or less by performing the following command: $ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH '^\s*clientalive | |
| RHEL-09-255105 | RHEL 9 SSH server configuration file must be group-owned by root. | Verify the group ownership of the "/etc/ssh/sshd_config" file and the contents of "/etc/ssh/sshd_config.d" with the following command: $ sudo find /etc/ssh/sshd_config /etc/ssh/sshd_config.d -exec stat -c "%G %n" {} \; root /etc/ssh/sshd_co | |
| RHEL-09-255110 | The RHEL 9 SSH server configuration file must be owned by root. | Verify the ownership of the "/etc/ssh/sshd_config" file and the contents of "/etc/ssh/sshd_config.d" with the following command: $ sudo find /etc/ssh/sshd_config /etc/ssh/sshd_config.d -exec stat -c "%U %n" {} \; root /etc/ssh/sshd_config r | |
| RHEL-09-255115 | RHEL 9 SSH server configuration files' permissions must not be modified. | Verify the permissions of the "/etc/ssh/sshd_config" file with the following command: $ sudo rpm --verify openssh-server | awk '! ($2 == "c" && $1 ~ /^.\..\.\.\.\..\./) {print $0}' If the command returns any output, this is a finding. | |
| RHEL-09-255120 | RHEL 9 SSH private host key files must have mode 0600 or less permissive. | Verify the SSH private host key files have a mode of "0600" or less permissive with the following command: $ stat -c "%a %n" /etc/ssh/*_key 600 /etc/ssh/ssh_host_dsa_key 600 /etc/ssh/ssh_host_ecdsa_key 600 /etc/ssh/ssh_host_ed25519_key 600 | |
| RHEL-09-255125 | RHEL 9 SSH public host key files must have mode 0644 or less permissive. | Verify the SSH public host key files have a mode of "0644" or less permissive with the following command: Note: SSH public key files may be found in other directories on the system depending on the installation. $ sudo stat -c "%a %n" /etc/ | |
| RHEL-09-255135 | RHEL 9 SSH daemon must not allow GSSAPI authentication. | Verify the SSH daemon does not allow GSSAPI authentication with the following command: $ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH '^\s*gssapiauthentication' GSSAPIAuthentica | |
| RHEL-09-255140 | RHEL 9 SSH daemon must not allow Kerberos authentication. | Verify the SSH daemon does not allow Kerberos authentication with the following command: $ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH '^\s*kerberosauthentication' KerberosAuth | |
| RHEL-09-255145 | RHEL 9 SSH daemon must not allow rhosts authentication. | Verify the SSH daemon does not allow rhosts authentication with the following command: $ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH '^\s*ignorerhosts' IgnoreRhosts yes If the | |
| RHEL-09-255150 | RHEL 9 SSH daemon must not allow known hosts authentication. | Verify the SSH daemon does not allow known hosts authentication with the following command: $ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH '^\s*ignoreuserknownhosts' IgnoreUserK | |
| RHEL-09-255155 | RHEL 9 SSH daemon must disable remote X connections for interactive users. | Verify the SSH daemon does not allow X11Forwarding with the following command: $ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH '^\s*x11forwarding' X11forwarding no If the value i | |
| RHEL-09-255160 | RHEL 9 SSH daemon must perform strict mode checking of home directory configuration files. | Verify the SSH daemon performs strict mode checking of home directory configuration files with the following command: $ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH '^\s*strictm | |
| RHEL-09-255165 | RHEL 9 SSH daemon must display the date and time of the last successful account logon upon an SSH logon. | Verify the SSH daemon provides users with feedback on when account accesses last occurred with the following command: $ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH '^\s*printla | |
| RHEL-09-255175 | RHEL 9 SSH daemon must prevent remote hosts from connecting to the proxy display. | Verify the SSH daemon prevents remote hosts from connecting to the proxy display with the following command: $ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH '^\s*x11uselocalhost' | |
| RHEL-09-271010 | RHEL 9 must enable the Standard Mandatory DoW Notice and Consent Banner before granting local or remote access to the system via a graphical user logon. | Verify RHEL 9 enables the Standard Mandatory DoW Notice and Consent Banner before granting access to the operating system via a graphical user logon. Note: This requirement assumes the use of the RHEL 9 default graphical user interface, the | |
| RHEL-09-271011 | RHEL 9 must display the Standard Mandatory DoW Notice and Consent Banner before granting local or remote access to the system via a graphical user logon. | Note: This requirement assumes the use of the RHEL 9 default graphical user interface, Gnome Shell. If the system does not have any graphical user interface installed, this requirement is Not Applicable. Verify RHEL 9 displays the Standard | |
| RHEL-09-271015 | RHEL 9 must prevent a user from overriding the banner-message-enable setting for the graphical user interface. | Note: This requirement assumes the use of the RHEL 9 default graphical user interface, the GNOME desktop environment. If the system does not have any graphical user interface installed, this requirement is Not Applicable. Verify RHEL 9 prev | |
| RHEL-09-271020 | RHEL 9 must disable the graphical user interface automount function unless required. | Note: This requirement assumes the use of the RHEL 9 default graphical user interface, the GNOME desktop environment. If the system does not have any graphical user interface installed, this requirement is Not Applicable. Verify RHEL 9 disa | |
| RHEL-09-271025 | RHEL 9 must prevent a user from overriding the disabling of the graphical user interface automount function. | Note: This requirement assumes the use of the RHEL 9 default graphical user interface, the GNOME desktop environment. If the system does not have any graphical user interface installed, this requirement is Not Applicable. Verify RHEL 9 disa | |
| RHEL-09-271030 | RHEL 9 must disable the graphical user interface autorun function unless required. | Verify RHEL 9 disables the graphical user interface autorun function with the following command: Note: This requirement assumes the use of the RHEL 9 default graphical user interface, the GNOME desktop environment. If the system does not ha | |
| RHEL-09-271035 | RHEL 9 must prevent a user from overriding the disabling of the graphical user interface autorun function. | Note: This requirement assumes the use of the RHEL 9 default graphical user interface, the GNOME desktop environment. If the system does not have any graphical user interface installed, this requirement is Not Applicable. Verify RHEL 9 disa | |
| RHEL-09-271040 | RHEL 9 must not allow unattended or automatic logon via the graphical user interface. | Note: This requirement assumes the use of the RHEL 9 default graphical user interface, the GNOME desktop environment. If the system does not have any graphical user interface installed, this requirement is Not Applicable. Verify RHEL 9 does | |
| RHEL-09-271045 | RHEL 9 must be able to initiate directly a session lock for all connection types using smart card when the smart card is removed. | Note: This requirement assumes the use of the RHEL 9 default graphical user interface, the GNOME desktop environment. If the system does not have any graphical user interface installed, this requirement is Not Applicable. Verify RHEL 9 enab | |
| RHEL-09-271050 | RHEL 9 must prevent a user from overriding the disabling of the graphical user smart card removal action. | Note: This requirement assumes the use of the RHEL 9 default graphical user interface, the GNOME desktop environment. If the system does not have any graphical user interface installed, this requirement is Not Applicable. Verify RHEL 9 disa | |
| RHEL-09-271055 | RHEL 9 must enable a user session lock until that user re-establishes access using established identification and authentication procedures for graphical user sessions. | Verify RHEL 9 enables a user's session lock until that user re-establishes access using established identification and authentication procedures with the following command: Note: This requirement assumes the use of the RHEL 9 default graphi | |
| RHEL-09-271060 | RHEL 9 must prevent a user from overriding the screensaver lock-enabled setting for the graphical user interface. | Note: This requirement assumes the use of the RHEL 9 default graphical user interface, Gnome Shell. If the system does not have any graphical user interface installed, this requirement is Not Applicable. Verify RHEL 9 prevents a user from o | |
| RHEL-09-271065 | RHEL 9 must automatically lock graphical user sessions after 10 minutes of inactivity. | Verify RHEL 9 initiates a session lock after a 10-minute period of inactivity for graphical user interfaces with the following command: Note: This requirement assumes the use of the RHEL 9 default graphical user interface, the GNOME desktop | |
| RHEL-09-271070 | RHEL 9 must prevent a user from overriding the session idle-delay setting for the graphical user interface. | Note: This requirement assumes the use of the RHEL 9 default graphical user interface, the GNOME desktop environment. If the system does not have any graphical user interface installed, this requirement is Not Applicable. Verify RHEL 9 prev | |
| RHEL-09-271075 | RHEL 9 must initiate a session lock for graphical user interfaces when the screensaver is activated. | Verify RHEL 9 initiates a session lock for graphical user interfaces when the screensaver is activated with the following command: Note: This requirement assumes the use of the RHEL 9 default graphical user interface, the GNOME desktop envi | |
| RHEL-09-271080 | RHEL 9 must prevent a user from overriding the session lock-delay setting for the graphical user interface. | Note: This requirement assumes the use of the RHEL 9 default graphical user interface, the GNOME desktop environment. If the system does not have any graphical user interface installed, this requirement is Not Applicable. Verify RHEL 9 prev | |
| RHEL-09-271085 | RHEL 9 must conceal, via the session lock, information previously visible on the display with a publicly viewable image. | Note: This requirement assumes the use of the RHEL 9 default graphical user interface, the GNOME desktop environment. If the system does not have any graphical user interface installed, this requirement is Not Applicable. To ensure the scre | |
| RHEL-09-271090 | RHEL 9 effective dconf policy must match the policy keyfiles. | Check the last modification time of the local databases, comparing it to the last modification time of the related keyfiles. The following command will check every dconf database and compare its modification time to the related system keyfi | |
| RHEL-09-271095 | RHEL 9 must disable the ability of a user to restart the system from the login screen. | Note: This requirement assumes the use of the RHEL 9 default graphical user interface, Gnome Shell. If the system does not have any graphical user interface installed, this requirement is Not Applicable. Verify RHEL 9 disables a user's abil | |
| RHEL-09-271100 | RHEL 9 must prevent a user from overriding the disable-restart-buttons setting for the graphical user interface. | Note: This requirement assumes the use of the RHEL 9 default graphical user interface, the GNOME desktop environment. If the system does not have any graphical user interface installed, this requirement is Not Applicable. Verify RHEL 9 prev | |
| RHEL-09-271105 | RHEL 9 must disable the ability of a user to accidentally press Ctrl-Alt-Del and cause a system to shut down or reboot. | Verify RHEL 9 is configured to ignore the Ctrl-Alt-Del sequence in the GNOME desktop with the following command: Note: This requirement assumes the use of the RHEL 9 default graphical user interface, the GNOME desktop environment. If the sy | |
| RHEL-09-271110 | RHEL 9 must prevent a user from overriding the Ctrl-Alt-Del sequence settings for the graphical user interface. | Note: This requirement assumes the use of the RHEL 9 default graphical user interface, the GNOME desktop environment. If the system does not have any graphical user interface installed, this requirement is Not Applicable. Verify that users | |
| RHEL-09-271115 | RHEL 9 must disable the user list at logon for graphical user interfaces. | Note: This requirement assumes the use of the RHEL 9 default graphical user interface, the GNOME desktop environment. If the system does not have any graphical user interface installed, this requirement is Not Applicable. Verify that RHEL 9 | |
| RHEL-09-291010 | RHEL 9 must be configured to disable USB mass storage. | Verify that RHEL 9 disables the ability to load the USB Storage kernel module with the following command: $ grep -r usb-storage /etc/modprobe.conf /etc/modprobe.d/* install usb-storage /bin/false blacklist usb-storage If the command does no | |
| RHEL-09-291015 | RHEL 9 must have the USBGuard package installed. | Verify USBGuard is installed on the operating system with the following command: $ sudo dnf list installed usbguard Example output: Installed Packages usbguard.x86_64 1.0.0-10.el9_1.2 @rhel-9-for-x86_64-appstream-rpms If the USBGuard packag | |
| RHEL-09-291020 | RHEL 9 must have the USBGuard package enabled. | Verify RHEL 9 has USBGuard enabled with the following command: $ systemctl is-active usbguard active If usbguard is not active, ask the SA to indicate how unauthorized peripherals are being blocked. If there is no evidence that unauthorized | |
| RHEL-09-291025 | RHEL 9 must enable Linux audit logging for the USBGuard daemon. | To verify that Linux Audit logging is enabled for the USBGuard daemon with the following command: $ sudo grep AuditBackend /etc/usbguard/usbguard-daemon.conf AuditBackend=LinuxAudit If "AuditBackend" is not set to "LinuxAudit", this is a fi | |
| RHEL-09-291030 | RHEL 9 must block unauthorized peripherals before establishing a connection. | Note: If the system is virtual machine with no virtual or physical USB peripherals attached, this is Not Applicable. Verify the USBGuard has a policy configured with the following command: $ sudo usbguard list-rules allow id 1d6b:0001 seria | |
| RHEL-09-291035 | RHEL 9 Bluetooth must be disabled. | Verify that RHEL 9 disables the ability to load the Bluetooth kernel module with the following command: $ sudo grep -r bluetooth /etc/modprobe.conf /etc/modprobe.d/* install bluetooth /bin/false blacklist bluetooth If the command does not r | |
| RHEL-09-291040 | RHEL 9 wireless network adapters must be disabled. | Verify there are no wireless interfaces configured on the system with the following command: Note: This requirement is Not Applicable for systems that do not have physical wireless network radios. $ nmcli device status DEVICE TYPE STATE CON | |
| RHEL-09-411010 | RHEL 9 user account passwords for new users or password changes must have a 180-day maximum password lifetime restriction in /etc/login.defs. | Verify that RHEL 9 enforces a 180-day maximum password lifetime for new user accounts by running the following command: $ sudo grep -i pass_max_days /etc/login.defs PASS_MAX_DAYS 180 If the "PASS_MAX_DAYS" parameter value is greater than "1 | |
| RHEL-09-411015 | RHEL 9 user account passwords must have a 180-day maximum password lifetime restriction. | Verify the maximum time period for existing passwords is restricted to 180 days with the following commands: $ sudo awk -F: '$5 > 180 {print $1 " " $5}' /etc/shadow $ sudo awk -F: '$5 <= 0 {print $1 " " $5}' /etc/shadow If any results are r | |
| RHEL-09-411020 | All RHEL 9 local interactive user accounts must be assigned a home directory upon creation. | Verify all local interactive users on RHEL 9 are assigned a home directory upon creation with the following command: $ grep -i create_home /etc/login.defs CREATE_HOME yes If the value for "CREATE_HOME" parameter is not set to "yes", the lin | |
| RHEL-09-411025 | RHEL 9 must set the umask value to 077 for all local interactive user accounts. | Verify that the default umask for all local interactive users is "077". Identify the locations of all local interactive user home directories by looking at the "/etc/passwd" file. Check all local interactive user initialization files for in | |
| RHEL-09-411030 | RHEL 9 duplicate User IDs (UIDs) must not exist for interactive users. | Verify that RHEL 9 contains no duplicate UIDs for interactive users with the following command: $ sudo awk -F ":" 'list[$3]++{print $1, $3}' /etc/passwd If output is produced and the accounts listed are interactive user accounts, this is a | |
| RHEL-09-411035 | RHEL 9 system accounts must not have an interactive login shell. | Verify that RHEL 9 system accounts do not have an interactive login shell. Run the following command to list any system account (UID 0 && $3 < 1000) && $1 !~ /^(halt|sync|shutdown)$/ && $7 !~ /(nologin|false)$/) {print $1 ":" $3 ":" $7}' /e | |
| RHEL-09-411040 | RHEL 9 must automatically expire temporary accounts within 72 hours. | Verify temporary accounts have been provisioned with an expiration date of 72 hours. For every existing temporary account, run the following command to obtain its account expiration information: $ sudo chage -l | grep -i "account expires" V | |
| RHEL-09-411045 | All RHEL 9 interactive users must have a primary group that exists. | Verify that all RHEL 9 interactive users have a valid GID. Check that the interactive users have a valid GID with the following command: $ sudo pwck -r If pwck reports "no group" for any interactive user, this is a finding. | |
| RHEL-09-411050 | RHEL 9 must disable account identifiers (individuals, groups, roles, and devices) after 35 days of inactivity. | Verify that RHEL 9 account identifiers (individuals, groups, roles, and devices) are disabled after 35 days of inactivity with the following command: Check the account inactivity value by performing the following command: $ sudo grep -i ina | |
| RHEL-09-411055 | Executable search paths within the initialization files of all local interactive RHEL 9 users must only contain paths that resolve to the system default or the users home directory. | Verify that all local interactive user initialization file executable search path statements do not contain statements that will reference a working directory other than user home directories with the following commands: $ sudo find /home - | |
| RHEL-09-411060 | All RHEL 9 local interactive users must have a home directory assigned in the /etc/passwd file. | Verify that interactive users on the system have a home directory assigned with the following command: $ sudo awk -F: '($3>=1000)&&($7 !~ /nologin/){print $1, $3, $6}' /etc/passwd smithk:x:1000:1000:smithk:/home/smithk:/bin/bash scsaustin:x | |
| RHEL-09-411065 | All RHEL 9 local interactive user home directories defined in the /etc/passwd file must exist. | Verify the assigned home directories of all interactive users on the system exist with the following command: $ sudo pwck -r The output should not return any interactive (human) users. Ask the system administrator (SA) if any users found wi | |
| RHEL-09-411070 | All RHEL 9 local interactive user home directories must be group-owned by the home directory owner's primary group. | Verify the assigned home directory of all local interactive users is group-owned by that user's primary GID with the following command: Note: This may miss local interactive users that have been assigned a privileged user identifier (UID). | |
| RHEL-09-411075 | RHEL 9 must automatically lock an account when three unsuccessful logon attempts occur. | Verify RHEL 9 is configured to lock an account after three unsuccessful logon attempts with the command: $ grep 'deny =' /etc/security/faillock.conf deny = 3 If the "deny" option is not set to "3" or less (but not "0"), is missing or commen | |
| RHEL-09-411080 | RHEL 9 must automatically lock the root account until the root account is released by an administrator when three unsuccessful logon attempts occur during a 15-minute time period. | Verify RHEL 9 is configured to lock the root account after three unsuccessful logon attempts with the command: $ sudo grep even_deny_root /etc/security/faillock.conf even_deny_root If the "even_deny_root" option is not set or is missing or | |
| RHEL-09-411085 | RHEL 9 must automatically lock an account when three unsuccessful logon attempts occur during a 15-minute time period. | Note: If the system administrator demonstrates the use of an approved centralized account management method that locks an account after three unsuccessful logon attempts within a period of 15 minutes, this requirement is Not Applicable. Ver | |
| RHEL-09-411090 | RHEL 9 must maintain an account lock until the locked account is released by an administrator. | Verify RHEL 9 is configured to lock an account until released by an administrator after three unsuccessful logon attempts with the command: $ sudo grep -w unlock_time /etc/security/faillock.conf unlock_time = 0 If the "unlock_time" option i | |
| RHEL-09-411095 | RHEL 9 must not have unauthorized accounts. | Verify that there are no unauthorized interactive user accounts with the following command: $ less /etc/passwd root:x:0:0:root:/root:/bin/bash ... games:x:12:100:games:/usr/games:/sbin/nologin scsaustin:x:1001:1001:scsaustin:/home/scsaustin | |
| RHEL-09-411100 | The root account must be the only account having unrestricted access to RHEL 9 system. | Verify that only the "root" account has a UID "0" assignment with the following command: $ awk -F: '$3 == 0 {print $1}' /etc/passwd root If any accounts other than "root" have a UID of "0", this is a finding. | |
| RHEL-09-411105 | RHEL 9 must ensure account lockouts persist. | Verify the "/etc/security/faillock.conf" file is configured to use a nondefault faillock directory to ensure contents persist after reboot with the following command: $ sudo grep -w dir /etc/security/faillock.conf dir = /var/log/faillock If | |
| RHEL-09-411110 | RHEL 9 groups must have unique Group ID (GID). | Verify that RHEL 9 contains no duplicate GIDs for interactive users with the following command: $ cut -d : -f 3 /etc/group | uniq -d If the system has duplicate GIDs, this is a finding. | |
| RHEL-09-412035 | RHEL 9 must automatically exit interactive command shell user sessions after 10 minutes of inactivity. | Verify RHEL 9 is configured to exit interactive command shell user sessions after 10 minutes of inactivity or less with the following command: $ sudo grep -i tmout /etc/profile /etc/profile.d/*.sh /etc/profile.d/tmout.sh:declare -xr TMOUT=6 | |
| RHEL-09-412040 | RHEL 9 must limit the number of concurrent sessions to ten for all accounts and/or account types. | Verify RHEL 9 limits the number of concurrent sessions to "10" for all accounts and/or account types with the following command: $ grep -r -s maxlogins /etc/security/limits.conf /etc/security/limits.d/*.conf /etc/security/limits.conf:* hard | |
| RHEL-09-412045 | RHEL 9 must log username information when unsuccessful logon attempts occur. | Verify the "/etc/security/faillock.conf" file is configured to log username information when unsuccessful logon attempts occur with the following command: $ sudo grep audit /etc/security/faillock.conf audit If the "audit" option is not set, | |
| RHEL-09-412050 | RHEL 9 must enforce a delay of at least four seconds between logon prompts following a failed logon attempt. | Verify RHEL 9 enforces a delay of at least four seconds between console logon prompts following a failed logon attempt with the following command: $ grep -i fail_delay /etc/login.defs FAIL_DELAY 4 If the value of "FAIL_DELAY" is not set to | |
| RHEL-09-412055 | RHEL 9 must define default permissions for the bash shell. | Verify the "umask" setting is configured correctly in the "/etc/bashrc" file with the following command: Note: If the value of the "umask" parameter is set to "000" in the "/etc/bashrc" file, the Severity is raised to a CAT I. $ grep umask | |
| RHEL-09-412060 | RHEL 9 must define default permissions for the c shell. | Verify the "umask" setting is configured correctly in the "/etc/csh.cshrc" file with the following command: Note: If the value of the "umask" parameter is set to "000" in the "/etc/csh.cshrc" file, the Severity is raised to a CAT I. $ grep | |
| RHEL-09-412065 | RHEL 9 must define default permissions for all authenticated users in such a way that the user can only read and modify their own files. | Verify RHEL 9 defines default permissions for all authenticated users in such a way that the user can only read and modify their own files with the following command: Note: If the value of the "UMASK" parameter is set to "000" in "/etc/logi | |
| RHEL-09-412070 | RHEL 9 must define default permissions for the system default profile. | Verify the "umask" setting is configured correctly in the "/etc/profile" file with the following command: Note: If the value of the "umask" parameter is set to "000" in the "/etc/profile" file, the Severity is raised to a CAT I. $ grep umas | |
| RHEL-09-412080 | RHEL 9 must terminate idle user sessions. | Note: For cloud-hosted systems where "ClientAliveInterval" (V-257996) is configured, this setting is not applicable. Verify RHEL 9 logs out sessions that are idle for 10 minutes with the following command: $ systemd-analyze cat-config syste | |
| RHEL-09-431010 | RHEL 9 must use a Linux Security Module configured to enforce limits on system services. | Ensure that RHEL 9 verifies correct operation of security functions through the use of SELinux with the following command: $ getenforce Enforcing If SELINUX is not set to "Enforcing", this is a finding. Verify that SELinux is configured to | |
| RHEL-09-431015 | RHEL 9 must enable the SELinux targeted policy. | Verify the SELINUX on RHEL 9 is using the targeted policy with the following command: $ sestatus | grep "policy name" Loaded policy name: targeted If the loaded policy name is not "targeted", this is a finding. | |
| RHEL-09-431016 | RHEL 9 must elevate the SELinux context when an administrator calls the sudo command. | Verify RHEL 9 elevates the SELinux context when an administrator calls the sudo command with the following command: This command must be run as root: # grep -r sysadm_r /etc/sudoers /etc/sudoers.d %{designated_group_or_user_name} ALL=(ALL) | |
| RHEL-09-431020 | RHEL 9 must configure SELinux context type to allow the use of a nondefault faillock tally directory. | Verify the location of the nondefault tally directory for the pam_faillock module with the following command: Note: If the system does not have SELinux enabled and enforcing a targeted policy, or if the pam_faillock module is not configured | |
| RHEL-09-431025 | RHEL 9 must have policycoreutils package installed. | Verify RHEL 9 has the policycoreutils package installed with the following command: $ dnf list --installed policycoreutils Example output: policycoreutils.x86_64 3.3-6.el9_0 If the "policycoreutils" package is not installed, this is a findi | |
| RHEL-09-431030 | RHEL 9 policycoreutils-python-utils package must be installed. | Verify that RHEL 9 policycoreutils-python-utils service package is installed with the following command: $ dnf list --installed policycoreutils-python-utils Example output: policycoreutils-python-utils.noarch 3.3-6.el9_0 If the "policycoreu | |
| RHEL-09-432010 | RHEL 9 must have the sudo package installed. | Verify that RHEL 9 sudo package is installed with the following command: $ dnf list --installed sudo Example output: sudo.x86_64 1.9.5p2-7.el9 If the "sudo" package is not installed, this is a finding. | |
| RHEL-09-432015 | RHEL 9 must require reauthentication when using the "sudo" command. | Verify RHEL 9 requires reauthentication when using the "sudo" command to elevate privileges with the following command: $ sudo grep -ir 'timestamp_timeout' /etc/sudoers /etc/sudoers.d/ /etc/sudoers:Defaults timestamp_timeout=0 If results ar | |
| RHEL-09-432020 | RHEL 9 must use the invoking user's password for privilege escalation when using "sudo". | Verify that the sudoers security policy is configured to use the invoking user's password for privilege escalation with the following command: $ sudo egrep -ir '(!rootpw|!targetpw|!runaspw)' /etc/sudoers /etc/sudoers.d/ | grep -v '#' /etc/s | |
| RHEL-09-432025 | RHEL 9 must require users to reauthenticate for privilege escalation. | Verify that "/etc/sudoers" has no occurrences of "!authenticate" with the following command: $ sudo egrep -iR '!authenticate' /etc/sudoers /etc/sudoers.d/ If any occurrences of "!authenticate" are returned, this is a finding. | |
| RHEL-09-432030 | RHEL 9 must restrict privilege elevation to authorized personnel. | Verify RHEL 9 restricts privilege elevation to authorized personnel with the following command: $ sudo grep -iwR 'ALL' /etc/sudoers /etc/sudoers.d/ | grep -v '#' If the either of the following entries are returned, this is a finding: ALL AL | |
| RHEL-09-432035 | RHEL 9 must restrict the use of the "su" command. | Verify RHEL 9 includes users who require privilege escalation to be members of the "wheel" group with the following command: $ sudo grep pam_wheel /etc/pam.d/su auth required pam_wheel.so use_uid If a line for "pam_wheel.so" does not exist, | |
| RHEL-09-433010 | RHEL 9 fapolicy module must be installed. | Verify that RHEL 9 fapolicyd package is installed with the following command: $ dnf list --installed fapolicyd Example output: fapolicyd.x86_64 1.1-103.el9_0 If the "fapolicyd" package is not installed, this is a finding. | |
| RHEL-09-433015 | RHEL 9 fapolicy module must be enabled. | Verify that RHEL 9 fapolicyd is active with the following command: $ systemctl is-active fapolicyd active If fapolicyd module is not active, this is a finding. | |
| RHEL-09-433016 | The RHEL 9 fapolicy module must be configured to employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs. | Verify the RHEL 9 "fapolicyd" employs a deny-all, permit-by-exception policy. Verify "fapolicyd" is in enforcement mode with the following command: $ sudo grep permissive /etc/fapolicyd/fapolicyd.conf permissive = 0 If "fapolicyd" is not ru | |
| RHEL-09-611010 | RHEL 9 must ensure the password complexity module in the system-auth file is configured for three retries or less. | Verify RHEL 9 is configured to limit the "pwquality" retry option to "3". Check for the use of the retry option in the security directory with the following command: $ grep -w retry /etc/security/pwquality.conf /etc/security/pwquality.conf. | |
| RHEL-09-611025 | RHEL 9 must not allow blank or null passwords. | Verify that null passwords cannot be used with the following command: $ sudo grep -i nullok /etc/pam.d/system-auth /etc/pam.d/password-auth If output is produced, this is a finding. If the system administrator (SA) can demonstrate that the | |
| RHEL-09-611030 | RHEL 9 must configure the use of the pam_faillock.so module in the /etc/pam.d/system-auth file. | Verify the pam_faillock.so module is present in the "/etc/pam.d/system-auth" file: $ grep pam_faillock.so /etc/pam.d/system-auth auth required pam_faillock.so preauth auth required pam_faillock.so authfail account required pam_faillock.so I | |
| RHEL-09-611035 | RHEL 9 must configure the use of the pam_faillock.so module in the /etc/pam.d/password-auth file. | Verify the pam_faillock.so module is present in the "/etc/pam.d/password-auth" file: $ grep pam_faillock.so /etc/pam.d/password-auth auth required pam_faillock.so preauth auth required pam_faillock.so authfail account required pam_faillock. | |
| RHEL-09-611040 | RHEL 9 must ensure the password complexity module is enabled in the password-auth file. | Verify RHEL 9 uses "pwquality" to enforce the password complexity rules in the password-auth file with the following command: $ grep pam_pwquality /etc/pam.d/password-auth password required pam_pwquality.so If the command does not return a | |
| RHEL-09-611045 | RHEL 9 must ensure the password complexity module is enabled in the system-auth file. | Verify RHEL 9 uses "pwquality" to enforce the password complexity rules in the system-auth file with the following command: $ grep pam_pwquality /etc/pam.d/system-auth password required pam_pwquality.so If the command does not return a line | |
| RHEL-09-611050 | RHEL 9 password-auth must be configured to use a sufficient number of hashing rounds. | Verify the number of rounds for the password hashing algorithm is configured with the following command: $ grep rounds /etc/pam.d/password-auth password sufficient pam_unix.so sha512 rounds=100000 If a matching line is not returned or "roun | |
| RHEL-09-611055 | RHEL 9 system-auth must be configured to use a sufficient number of hashing rounds. | Verify the number of rounds for the password hashing algorithm is configured with the following command: $ sudo grep rounds /etc/pam.d/system-auth password sufficient pam_unix.so sha512 rounds=100000 If a matching line is not returned or "r | |
| RHEL-09-611060 | RHEL 9 must enforce password complexity rules for the root account. | Verify that RHEL 9 enforces password complexity rules for the root account. Check if root user is required to use complex passwords with the following command: $ grep enforce_for_root /etc/security/pwquality.conf /etc/security/pwquality.con | |
| RHEL-09-611065 | RHEL 9 must enforce password complexity by requiring that at least one lowercase character be used. | Verify that RHEL 9 enforces password complexity by requiring at least one lowercase character. Check the value for "lcredit" with the following command: $ grep lcredit /etc/security/pwquality.conf /etc/security/pwquality.conf.d/*.conf /etc/ | |
| RHEL-09-611070 | RHEL 9 must enforce password complexity by requiring that at least one numeric character be used. | Verify that RHEL 9 enforces password complexity by requiring at least one numeric character. Check the value for "dcredit" with the following command: $ grep dcredit /etc/security/pwquality.conf /etc/security/pwquality.conf.d/*.conf /etc/se | |
| RHEL-09-611075 | RHEL 9 passwords for new users or password changes must have a 24 hours minimum password lifetime restriction in /etc/login.defs. | Verify RHEL 9 enforces 24 hours as the minimum password lifetime for new user accounts. Check for the value of "PASS_MIN_DAYS" in "/etc/login.defs" with the following command: $ grep -i pass_min_days /etc/login.defs PASS_MIN_DAYS 1 If the " | |
| RHEL-09-611080 | RHEL 9 passwords must have a 24 hours minimum password lifetime restriction in /etc/shadow. | Verify that RHEL 9 has configured the minimum time period between password changes for each user account as one day or greater with the following command: $ sudo awk -F: '$4 < 1 {printf "%s %d\n", $1, $4}' /etc/shadow If any results are ret | |
| RHEL-09-611085 | RHEL 9 must require users to provide a password for privilege escalation. | Verify that "/etc/sudoers" has no occurrences of "NOPASSWD" with the following command: $ sudo grep -iR 'NOPASSWD' /etc/sudoers /etc/sudoers.d/ If any occurrences of "NOPASSWD" are returned from the command and have not been documented with | |
| RHEL-09-611090 | RHEL 9 passwords must be created with a minimum of 15 characters. | Verify that RHEL 9 enforces a minimum 15-character password length with the following command: $ grep minlen /etc/security/pwquality.conf /etc/security/pwquality.conf.d/*.conf minlen = 15 If the command does not return a "minlen" value of " | |
| RHEL-09-611100 | RHEL 9 must enforce password complexity by requiring that at least one special character be used. | Verify that RHEL 9 enforces password complexity by requiring at least one special character with the following command: $ sudo grep ocredit /etc/security/pwquality.conf /etc/security/pwquality.conf.d/*.conf ocredit = -1 If the value of "ocr | |
| RHEL-09-611105 | RHEL 9 must prevent the use of dictionary words for passwords. | Verify RHEL 9 prevents the use of dictionary words for passwords with the following command: $ grep dictcheck /etc/security/pwquality.conf /etc/security/pwquality.conf.d/*.conf /etc/security/pwquality.conf:dictcheck = 1 If "dictcheck" does | |
| RHEL-09-611110 | RHEL 9 must enforce password complexity by requiring that at least one uppercase character be used. | Verify that RHEL 9 enforces password complexity by requiring that at least one uppercase character be used. Check the value for "ucredit" with the following command: $ grep ucredit /etc/security/pwquality.conf /etc/security/pwquality.conf.d | |
| RHEL-09-611115 | RHEL 9 must require the change of at least eight characters when passwords are changed. | Verify that RHEL 9 requires the change of at least eight of the total number of characters when passwords are changed. $ grep difok /etc/security/pwquality.conf /etc/security/pwquality.conf.d/*.conf difok = 8 If the value of "difok" is set | |
| RHEL-09-611120 | RHEL 9 must require the maximum number of repeating characters of the same character class be limited to four when passwords are changed. | Verify that RHEL 9 requires that passwords can have a maximum of four repeating characters of the same character class. $ grep maxclassrepeat /etc/security/pwquality.conf /etc/security/pwquality.conf.d/*.conf maxclassrepeat = 4 If the value | |
| RHEL-09-611125 | RHEL 9 must require the maximum number of repeating characters be limited to three when passwords are changed. | Verify that RHEL 9 requires that passwords can have a maximum of three of the same consecutive character. $ grep maxrepeat /etc/security/pwquality.conf /etc/security/pwquality.conf.d/*.conf maxrepeat = 3 If the value of "maxrepeat" is set t | |
| RHEL-09-611130 | RHEL 9 must require the change of at least four character classes when passwords are changed. | Verify that RHEL 9 requires passwords to contain at least four character classes. $ grep minclass /etc/security/pwquality.conf /etc/security/pwquality.conf.d/*.conf minclass = 4 If the value of "minclass" is set to less than "4", or is comm | |
| RHEL-09-611135 | RHEL 9 must be configured so that user and group account administration utilities are configured to store only encrypted representations of passwords. | Note: If the libuser package is not installed, this requirement is Not Applicable. Verify the user and group account administration utilities are configured to store only encrypted representations of passwords with the following command: $ | |
| RHEL-09-611140 | RHEL 9 must be configured to use the shadow file to store only encrypted representations of passwords. | Verify the system's shadow file is configured to store only encrypted representations of passwords with a hash value of SHA512 with the following command: # grep -i encrypt_method /etc/login.defs ENCRYPT_METHOD SHA512 If "ENCRYPT_METHOD" do | |
| RHEL-09-611145 | RHEL 9 must not be configured to bypass password requirements for privilege escalation. | Verify the operating system is not configured to bypass password requirements for privilege escalation with the following command: $ sudo grep pam_succeed_if /etc/pam.d/sudo If any occurrences of "pam_succeed_if" are returned, this is a fin | |
| RHEL-09-611155 | RHEL 9 must not have accounts configured with blank or null passwords. | Verify that null or blank passwords cannot be used with the following command: $ sudo awk -F: '!$2 {print $1}' /etc/shadow If the command returns any results, this is a finding. | |
| RHEL-09-611160 | RHEL 9 must use the common access card (CAC) smart card driver. | Verify RHEL loads the CAC driver with the following command: $ sudo opensc-tool --get-conf-entry app:default:card_drivers cac If "cac" is not listed as a card driver, or no line is returned for "card_drivers", this is a finding. | |
| RHEL-09-611165 | RHEL 9 must enable certificate based smart card authentication. | Note: If the system administrator (SA) demonstrates the use of an approved alternate multifactor authentication method, this requirement is Not Applicable. To verify that RHEL 9 has smart cards enabled in System Security Services Daemon (SS | |
| RHEL-09-611170 | RHEL 9 must implement certificate status checking for multifactor authentication. | Note: If the system administrator (SA) demonstrates the use of an approved alternate multifactor authentication method, this requirement is not applicable. Verify the operating system implements Online Certificate Status Protocol (OCSP) and | |
| RHEL-09-611175 | RHEL 9 must have the pcsc-lite package installed. | Note: If the system administrator (SA) demonstrates the use of an approved alternate multifactor authentication method, this requirement is Not Applicable. Verify that RHEL 9 has the pcsc-lite package installed with the following command: $ | |
| RHEL-09-611180 | The pcscd socket on RHEL 9 must be active. | Verify that the "pcscd" socket is active with the following command: $ systemctl is-active pcscd.socket active If the pcscd socket is not active, this is a finding. | |
| RHEL-09-611185 | RHEL 9 must have the opensc package installed. | Verify that RHEL 9 has the opensc package installed with the following command: $ dnf list --installed opensc Example output: opensc.x86_64 0.22.0-2.el9 If the "opensc" package is not installed, this is a finding. | |
| RHEL-09-611190 | RHEL 9, for PKI-based authentication, must enforce authorized access to the corresponding private key. | Note: If the system administrator demonstrates the use of an approved alternate multifactor authentication method, this requirement is not applicable. Verify the SSH private key files have a passcode. For each private key stored on the syst | |
| RHEL-09-611195 | RHEL 9 must require authentication to access emergency mode. | Verify RHEL 9 requires authentication for emergency mode with the following command: $ grep sulogin /usr/lib/systemd/system/emergency.service ExecStart=-/usr/lib/systemd/systemd-sulogin-shell emergency If the line is not returned from the d | |
| RHEL-09-611200 | RHEL 9 must require authentication to access single-user mode. | Verify RHEL 9 requires authentication for single-user mode with the following command: $ grep sulogin /usr/lib/systemd/system/rescue.service ExecStart=-/usr/lib/systemd/systemd-sulogin-shell rescue If the line is not returned from the defau | |
| RHEL-09-631010 | RHEL 9, for PKI-based authentication, must validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor. | Note: If the system administrator demonstrates the use of an approved alternate multifactor authentication method, this requirement is not applicable. Verify RHEL 9 for PKI-based authentication has valid certificates by constructing a certi | |
| RHEL-09-631015 | RHEL 9 must map the authenticated identity to the user or group account for PKI-based authentication. | Note: If the system administrator (SA) demonstrates the use of an approved alternate multifactor authentication method, this requirement is not applicable. Verify the certificate of the user or group is mapped to the corresponding user or g | |
| RHEL-09-631020 | RHEL 9 must prohibit the use of cached authenticators after one day. | Verify that the System Security Services Daemon (SSSD) prohibits the use of cached authentications after one day. Note: Cached authentication settings should be configured even if smart card authentication is not used on the system. Check t | |
| RHEL-09-651010 | RHEL 9 must have the AIDE package installed. | Verify the file integrity tool is configured to verify ACLs. Note: AIDE is highly configurable at install time. This requirement assumes the "aide.conf" file is under the "/etc" directory. Verify AIDE is installed with the following command | |
| RHEL-09-651015 | RHEL 9 must routinely check the baseline configuration for unauthorized changes and notify the system administrator when anomalies in the operation of any security functions are discovered. | Verify that RHEL 9 routinely executes a file integrity scan for changes to the system baseline. The command used in the example will use a daily occurrence. Check the cron directories for scripts controlling the execution and notification o | |
| RHEL-09-651020 | RHEL 9 must use a file integrity tool that is configured to use FIPS 140-3-approved cryptographic hashes for validating file contents and directories. | Verify that AIDE is configured to use FIPS 140-3 file hashing with the following command: $ sudo grep sha512 /etc/aide.conf All=p+i+n+u+g+s+m+S+sha512+acl+xattrs+selinux If the "sha512" rule is not being used on all uncommented selection li | |
| RHEL-09-651025 | RHEL 9 must use cryptographic mechanisms to protect the integrity of audit tools. | Check that AIDE is properly configured to protect the integrity of the audit tools with the following command: $ sudo grep /usr/sbin/au /etc/aide.conf /usr/sbin/auditctl p+i+n+u+g+s+b+acl+xattrs+sha512 /usr/sbin/auditd p+i+n+u+g+s+b+acl+xat | |
| RHEL-09-651030 | RHEL 9 must be configured so that the file integrity tool verifies Access Control Lists (ACLs). | Verify that AIDE is verifying ACLs with the following command: $ sudo grep acl /etc/aide.conf All= p+i+n+u+g+s+m+S+sha512+acl+xattrs+selinux If the "acl" rule is not being used on all uncommented selection lines in the "/etc/aide.conf" file | |
| RHEL-09-651035 | RHEL 9 must be configured so that the file integrity tool verifies extended attributes. | Verify that AIDE is configured to verify extended attributes with the following command: $ sudo grep xattrs /etc/aide.conf All= p+i+n+u+g+s+m+S+sha512+acl+xattrs+selinux If the "xattrs" rule is not being used on all uncommented selection li | |
| RHEL-09-652010 | RHEL 9 must have the rsyslog package installed. | Verify RHEL 9 has the rsyslog package installed with the following command: $ dnf list --installed rsyslog Example output: rsyslog.x86_64 8.2102.0-101.el9_0.1 If the "rsyslog" package is not installed, this is a finding. | |
| RHEL-09-652015 | RHEL 9 must have the packages required for encrypting offloaded audit logs installed. | Verify that RHEL 9 has the rsyslog-gnutls package installed with the following command: $ dnf list --installed rsyslog-gnutls Example output: rsyslog-gnutls.x86_64 8.2102.0-101.el9_0.1 If the "rsyslog-gnutls" package is not installed, this | |
| RHEL-09-652020 | The rsyslog service on RHEL 9 must be active. | Verify that "rsyslog" is active with the following command: $ systemctl is-active rsyslog active If the rsyslog service is not active, this is a finding. | |
| RHEL-09-652025 | RHEL 9 must be configured so that the rsyslog daemon does not accept log messages from other servers unless the server is being used for log aggregation. | Note: If the system administrator (SA) can demonstrate that another tool (e.g., SPLUNK) is being used to manage log off-load and aggregation in lieu of rsyslog, this is not applicable. Verify RHEL 9 is not configured to receive remote logs | |
| RHEL-09-652030 | All RHEL 9 remote access methods must be monitored. | Verify that RHEL 9 monitors all remote access methods. Check that remote access methods are being logged by running the following command: $ grep -rE '(auth.\*|authpriv.\*|daemon.\*)' /etc/rsyslog.conf /etc/rsyslog.d/ /etc/rsyslog.conf:auth | |
| RHEL-09-652040 | RHEL 9 must authenticate the remote logging server for offloading audit logs via rsyslog. | Verify RHEL 9 authenticates the remote logging server for offloading audit logs with the following command: $ grep -i 'StreamDriver[\.]*AuthMode' /etc/rsyslog.conf /etc/rsyslog.d/*.conf /etc/rsyslog.conf:$ActionSendStreamDriverAuthMode x509 | |
| RHEL-09-652045 | RHEL 9 must encrypt the transfer of audit records offloaded onto a different system or media from the system being audited via rsyslog. | Verify RHEL 9 encrypts audit records offloaded onto a different system or media from the system being audited via rsyslog with the following command: $ grep -i 'StreamDriver[\.]*Mode' /etc/rsyslog.conf /etc/rsyslog.d/*.conf /etc/rsyslog.con | |
| RHEL-09-652050 | RHEL 9 must encrypt via the gtls driver the transfer of audit records offloaded onto a different system or media from the system being audited via rsyslog. | Verify RHEL 9 uses the gtls driver to encrypt audit records offloaded onto a different system or media from the system being audited with the following command: $ grep -Ei 'DefaultNetStreamDriver\b|StreamDriver.Name' /etc/rsyslog.conf /etc/ | |
| RHEL-09-652055 | RHEL 9 must be configured to forward audit records via TCP to a different system or media from the system being audited via rsyslog. | Verify RHEL 9 audit system off-loads audit records onto a different system or media from the system being audited via rsyslog using TCP with the following commands: To check for legacy configuration syntax, perform the following: $ sudo gre | |
| RHEL-09-652060 | RHEL 9 must use cron logging. | Verify rsyslog is configured to log cron events with the following command: Note: If another logging package is used, substitute the utility configuration file for "/etc/rsyslog.conf" or "/etc/rsyslog.d/*.conf" files. $ grep -s "cron.\*" /e | |
| RHEL-09-653010 | RHEL 9 audit package must be installed. | Verify that the RHEL 9 audit service package is installed. Check that the audit service package is installed with the following command: $ dnf list --installed audit Example output: audit-3.0.7-101.el9_0.2.x86_64 If the "audit" package is n | |
| RHEL-09-653015 | RHEL 9 audit service must be enabled. | Verify the audit service is configured to produce audit records with the following command: $ systemctl status auditd.service auditd.service - Security Auditing Service Loaded:loaded (/usr/lib/systemd/system/auditd.service; enabled; vendor | |
| RHEL-09-653020 | RHEL 9 audit system must take appropriate action when an error writing to the audit storage volume occurs. | Verify RHEL 9 takes the appropriate action when an audit processing failure occurs. Check that RHEL 9 takes the appropriate action when an audit processing failure occurs with the following command: $ sudo grep disk_error_action /etc/audit/ | |
| RHEL-09-653025 | RHEL 9 audit system must take appropriate action when the audit storage volume is full. | Verify RHEL 9 takes the appropriate action when the audit storage volume is full. Check that RHEL 9 takes the appropriate action when the audit storage volume is full with the following command: $ sudo grep disk_full_action /etc/audit/audit | |
| RHEL-09-653030 | RHEL 9 must allocate audit record storage capacity to store at least one week's worth of audit records. | Verify RHEL 9 allocates audit record storage capacity to store at least one week of audit records when audit records are not immediately sent to a central audit record storage facility. Note: The partition size needed to capture a week of a | |
| RHEL-09-653035 | RHEL 9 must take action when allocated audit record storage volume reaches 75 percent of the repository maximum audit record storage capacity. | Verify RHEL 9 takes action when allocated audit record storage volume reaches 75 percent of the repository maximum audit record storage capacity with the following command: $ sudo grep -w space_left /etc/audit/auditd.conf space_left = 25% I | |
| RHEL-09-653040 | RHEL 9 must notify the system administrator (SA) and information system security officer (ISSO) (at a minimum) when allocated audit record storage volume reaches 75 percent utilization. | Verify RHEL 9 notifies the SA and ISSO (at a minimum) when allocated audit record storage volume reaches 75 percent of the repository maximum audit record storage capacity with the following command: $ sudo grep -w space_left_action /etc/au | |
| RHEL-09-653045 | RHEL 9 must take action when allocated audit record storage volume reaches 95 percent of the audit record storage capacity. | Verify RHEL 9 takes action when allocated audit record storage volume reaches 95 percent of the repository maximum audit record storage capacity with the following command: $ sudo grep -w admin_space_left /etc/audit/auditd.conf admin_space_ | |
| RHEL-09-653050 | RHEL 9 must take action when allocated audit record storage volume reaches 95 percent of the repository maximum audit record storage capacity. | Verify that RHEL 9 is configured to take action in the event of allocated audit record storage volume reaches 95 percent of the repository maximum audit record storage capacity with the following command: $ sudo grep admin_space_left_action | |
| RHEL-09-653055 | RHEL 9 audit system must take appropriate action when the audit files have reached maximum size. | Verify that RHEL 9 takes the appropriate action when the audit files have reached maximum size with the following command: $ sudo grep max_log_file_action /etc/audit/auditd.conf max_log_file_action = ROTATE If the value of the "max_log_file | |
| RHEL-09-653060 | RHEL 9 must label all offloaded audit logs before sending them to the central log server. | Verify that RHEL 9 Audit Daemon is configured to label all offloaded audit logs, with the following command: $ sudo grep name_format /etc/audit/auditd.conf name_format = hostname If the "name_format" option is not "hostname", "fqd", or "num | |
| RHEL-09-653065 | RHEL 9 must take appropriate action when the internal event queue is full. | Verify that RHEL 9 audit system is configured to take an appropriate action when the internal event queue is full: $ sudo grep -i overflow_action /etc/audit/auditd.conf overflow_action = syslog If the value of the "overflow_action" option i | |
| RHEL-09-653070 | RHEL 9 System Administrator (SA) and/or information system security officer (ISSO) (at a minimum) must be alerted of an audit processing failure event. | Verify that RHEL 9 is configured to notify the SA and/or ISSO (at a minimum) in the event of an audit processing failure with the following command: $ sudo grep action_mail_acct /etc/audit/auditd.conf action_mail_acct = root If the value of | |
| RHEL-09-653075 | RHEL 9 audit system must audit local events. | Verify that the RHEL 9 audit system is configured to audit local events with the following command: $ sudo grep local_events /etc/audit/auditd.conf local_events = yes If "local_events" isn't set to "yes", if the command does not return a li | |
| RHEL-09-653080 | RHEL 9 audit logs must be group-owned by root or by a restricted logging group to prevent unauthorized read access. | Verify the audit logs are group-owned by "root" or a restricted logging group. First determine if a group other than "root" has been assigned to the audit logs with the following command: $ sudo grep log_group /etc/audit/auditd.conf Then de | |
| RHEL-09-653085 | RHEL 9 audit log directory must be owned by root to prevent unauthorized read access. | Verify the audit logs directory is owned by "root". Determine where the audit logs are stored with the following command: $ sudo grep -iw log_file /etc/audit/auditd.conf log_file = /var/log/audit/audit.log Using the location of the audit lo | |
| RHEL-09-653090 | RHEL 9 audit logs file must have mode 0600 or less permissive to prevent unauthorized access to the audit log. | Verify the audit logs have a mode of "0600". Determine where the audit logs are stored with the following command: $ sudo grep "^log_file" /etc/audit/auditd.conf log_file = /var/log/audit/audit.log Using the location of the audit log file, | |
| RHEL-09-653095 | RHEL 9 must periodically flush audit records to disk to prevent the loss of audit records. | Verify that audit system is configured to flush to disk after every 100 records with the following command: $ sudo grep freq /etc/audit/auditd.conf freq = 100 If "freq" isn't set to a value between "1" and "100", the value is missing, or th | |
| RHEL-09-653100 | RHEL 9 must produce audit records containing information to establish the identity of any individual or process associated with the event. | Verify that RHEL 9 audit system is configured to resolve audit information before writing to disk, with the following command: $ sudo grep log_format /etc/audit/auditd.conf log_format = ENRICHED If the "log_format" option is not "ENRICHED", | |
| RHEL-09-653105 | RHEL 9 must write audit records to disk. | Verify that the audit system is configured to write logs to the disk with the following command: $ sudo grep write_logs /etc/audit/auditd.conf write_logs = yes If "write_logs" does not have a value of "yes", the line is commented out, or th | |
| RHEL-09-653110 | RHEL 9 must allow only the information system security manager (ISSM) (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited. | Verify that the files in the directory "/etc/audit/rules.d/" have a mode of "0600" or less permissive with the following command: $ sudo find /etc/audit/rules.d/ -type f -name "*.rules" -exec stat -c "%a %n" {} \; 600 /etc/audit/rules.d/aud | |
| RHEL-09-653120 | RHEL 9 must allocate an audit_backlog_limit of sufficient size to capture processes that start prior to the audit daemon. | Verify RHEL 9 allocates a sufficient audit_backlog_limit to capture processes that start prior to the audit daemon with the following command: $ sudo grubby --info=ALL | grep args | grep 'audit_backlog_limit' If the command returns any outp | |
| RHEL-09-653125 | RHEL 9 must have mail aliases to notify the information system security officer (ISSO) and system administrator (SA) (at a minimum) in the event of an audit processing failure. | Verify that RHEL 9 is configured to notify the appropriate interactive users in the event of an audit processing failure. Find the alias maps that are being used with the following command: $ postconf alias_maps alias_maps = hash:/etc/alias | |
| RHEL-09-653130 | RHEL 9 audispd-plugins package must be installed. | Verify that RHEL 9 has the audispd-plugins package installed with the following command: $ dnf list --installed audispd-plugins Example output: audispd-plugins.x86_64 3.0.7-101.el9_0.2 If the "audispd-plugins" package is not installed, this | |
| RHEL-09-654010 | RHEL 9 must audit uses of the "execve" system call. | Verify RHEL 9 is configured to audit the execution of the "execve" system call with the following command: $ sudo auditctl -l | grep execve -a always,exit -F arch=b32 -S execve -C uid!=euid -F euid=0 -k execpriv -a always,exit -F arch=b64 - | |
| RHEL-09-654015 | RHEL 9 must audit all uses of the chmod, fchmod, and fchmodat system calls. | Verify RHEL 9 is configured to audit the execution of the "chmod", "fchmod", and "fchmodat" system calls with the following command: $ sudo auditctl -l | grep chmod -a always,exit -F arch=b32 -S chmod,fchmod,fchmodat -F auid>=1000 -F auid!= | |
| RHEL-09-654020 | RHEL 9 must audit all uses of the chown, fchown, fchownat, and lchown system calls. | Verify RHEL 9 is configured to audit the execution of the "chown", "fchown", "fchownat", and "lchown" system calls with the following command: $ sudo auditctl -l | grep chown -a always,exit -F arch=b32 -S lchown,fchown,chown,fchownat -F aui | |
| RHEL-09-654025 | RHEL 9 must audit all uses of the setxattr, fsetxattr, lsetxattr, removexattr, fremovexattr, and lremovexattr system calls. | Verify RHEL 9 is configured to audit the execution of the "setxattr", "fsetxattr", "lsetxattr", "removexattr", "fremovexattr", and "lremovexattr" system calls with the following command: $ sudo auditctl -l | grep xattr -a always,exit -F arc | |
| RHEL-09-654030 | RHEL 9 must audit all uses of umount system calls. | Verify that RHEL 9 is configured to audit the execution of the "umount" command with the following command: $ sudo auditctl -l | grep /usr/bin/umount -a always,exit -S all -F path=/usr/bin/umount -F perm=x -F auid>=1000 -F auid!=-1 -F key=p | |
| RHEL-09-654035 | RHEL 9 must audit all uses of the chacl command. | Verify that RHEL 9 is configured to audit the execution of the "chacl" command with the following command: $ sudo auditctl -l | grep chacl -a always,exit -S all -F path=/usr/bin/chacl -F perm=x -F auid>=1000 -F auid!=-1 -F key=perm_mod If t | |
| RHEL-09-654040 | RHEL 9 must audit all uses of the setfacl command. | Verify that RHEL 9 is configured to audit the execution of the "setfacl" command with the following command: $ sudo auditctl -l | grep setfacl -a always,exit -S all -F path=/usr/bin/setfacl -F perm=x -F auid>=1000 -F auid!=-1 -F key=perm_mo | |
| RHEL-09-654045 | RHEL 9 must audit all uses of the chcon command. | Verify that RHEL 9 is configured to audit the execution of the "chcon" command with the following command: $ sudo auditctl -l | grep chcon -a always,exit -S all -F path=/usr/bin/chcon -F perm=x -F auid>=1000 -F auid!=-1 -F key=perm_mod If t | |
| RHEL-09-654050 | RHEL 9 must audit all uses of the semanage command. | Verify that RHEL 9 is configured to audit the execution of the "semanage" command with the following command: $ sudo auditctl -l | grep semanage -a always,exit -S all -F path=/usr/sbin/semanage -F perm=x -F auid>=1000 -F auid!=-1 -F key=pri | |
| RHEL-09-654055 | RHEL 9 must audit all uses of the setfiles command. | Verify that RHEL 9 is configured to audit the execution of the "setfiles" command with the following command: $ sudo auditctl -l | grep setfiles -a always,exit -S all -F path=/usr/sbin/setfiles -F perm=x -F auid>=1000 -F auid!=-1 -F key=pri | |
| RHEL-09-654060 | RHEL 9 must audit all uses of the setsebool command. | Verify that RHEL 9 is configured to audit the execution of the "setsebool" command with the following command: $ sudo auditctl -l | grep setsebool -a always,exit -S all -F path=/usr/sbin/setsebool -F perm=x -F auid>=1000 -F auid!=-1 -F key= | |
| RHEL-09-654065 | RHEL 9 must audit all uses of the rename, unlink, rmdir, renameat, and unlinkat system calls. | Verify RHEL 9 is configured to audit successful/unsuccessful attempts to use the "rename", "unlink", "rmdir", "renameat", and "unlinkat" system calls with the following command: $ sudo auditctl -l | grep 'rename\|unlink\|rmdir' -a always,ex | |
| RHEL-09-654070 | RHEL 9 must audit all uses of the truncate, ftruncate, creat, open, openat, and open_by_handle_at system calls. | Verify RHEL 9 is configured to audit successful/unsuccessful attempts to use the "truncate", "ftruncate", "creat", "open", "openat", and "open_by_handle_at" system calls with the following command: $ sudo auditctl -l | grep 'open\b\|openat\ | |
| RHEL-09-654075 | RHEL 9 must audit all uses of the delete_module system call. | Verify RHEL 9 is configured to audit the execution of the "delete_module" system call with the following command: $ sudo auditctl -l | grep delete_module -a always,exit -F arch=b32 -S delete_module -F auid>=1000 -F auid!=-1 -F key=module_ch | |
| RHEL-09-654080 | RHEL 9 must audit all uses of the init_module and finit_module system calls. | Verify RHEL 9 is configured to audit the execution of the "init_module" and "finit_module" system calls with the following command: $ sudo auditctl -l | grep init_module -a always,exit -F arch=b32 -S init_module,finit_module -F auid>=1000 - | |
| RHEL-09-654085 | RHEL 9 must audit all uses of the chage command. | Verify that RHEL 9 is configured to audit the execution of the "chage" command with the following command: $ sudo auditctl -l | grep chage -a always,exit -S all -F path=/usr/bin/chage -F perm=x -F auid>=1000 -F auid!=-1 -F key=privileged-ch | |
| RHEL-09-654090 | RHEL 9 must audit all uses of the chsh command. | Verify that RHEL 9 is configured to audit the execution of the "chsh" command with the following command: $ sudo auditctl -l | grep chsh -a always,exit -S all -F path=/usr/bin/chsh -F perm=x -F auid>=1000 -F auid!=-1 -F key=priv_cmd If the |
Showing 400 of 445; narrow with the search or a family.