DISA STIG library V2R10
| Ref | Title | Text | |
|---|---|---|---|
| RHEL-09-211010 | RHEL 9 must be a vendor-supported release. | Verify the version or RHEL 9 is vendor supported with the following command: $ cat /etc/redhat-release Red Hat Enterprise Linux release 9.6 (Plow) If the installed version of RHEL 9 is not supported, this is a finding. | |
| RHEL-09-211045 | The systemd Ctrl-Alt-Delete burst key sequence in RHEL 9 must be disabled. | Verify RHEL 9 is configured to not reboot the system when Ctrl-Alt-Delete is pressed seven times within two seconds with the following command: $ sudo grep -iR CtrlAltDelBurstAction /etc/systemd/system* /etc/systemd/system.conf.d/55-CtrlAlt | |
| RHEL-09-211050 | The x86 Ctrl-Alt-Delete key sequence must be disabled on RHEL 9. | Verify RHEL 9 is not configured to reboot the system when Ctrl-Alt-Delete is pressed with the following command: $ sudo systemctl status ctrl-alt-del.target ctrl-alt-del.target Loaded: masked (Reason: Unit ctrl-alt-del.target is masked.) Ac | |
| RHEL-09-212020 | RHEL 9 must require a unique superusers name upon booting into single-user and maintenance modes. | Verify the RHEL 9 boot loader superuser account has been set with the following command: $ sudo grep -A1 "superusers" /etc/grub2.cfg set superusers="" export superusers password_pbkdf2 ${GRUB2_PASSWORD} Verify is not a common name such as r | |
| RHEL-09-214015 | RHEL 9 must check the GPG signature of software packages originating from external software repositories before installation. | Verify RHEL 9 dnf always checks the GPG signature of software packages originating from external software repositories before installation with the following command: $ sudo grep -w gpgcheck /etc/dnf/dnf.conf gpgcheck=1 If "gpgcheck" is not | |
| RHEL-09-214020 | RHEL 9 must check the GPG signature of locally installed software packages before installation. | Verify RHEL 9 dnf always checks the GPG signature of locally installed software packages before installation with the following command: $ sudo grep localpkg_gpgcheck /etc/dnf/dnf.conf localpkg_gpgcheck=1 If "localpkg_gpgcheck" is not set t | |
| RHEL-09-214025 | RHEL 9 must have GPG signature verification enabled for all software repositories. | Verify RHEL 9 software repositories defined in "/etc/yum.repos.d/" have been configured with "gpgcheck" enabled with the following command: $ sudo grep -w gpgcheck /etc/yum.repos.d/*.repo | more gpgcheck = 1 If "gpgcheck" for software packa | |
| RHEL-09-215015 | RHEL 9 must not have a File Transfer Protocol (FTP) server package installed. | Verify RHEL 9 does not have an FTP server package installed with the following command: $ sudo dnf list --installed | grep vsftpd If the "vsftpd" package is installed, this is a finding. | |
| RHEL-09-215060 | The Trivial File Transfer Protocol (TFTP) server must not be installed unless it is required, and if required, the RHEL 9 TFTP daemon must be configured to operate in secure mode. | Verify if TFTP is installed, it is configured to operate in secure mode. Note: If TFTP is not required, it must not be installed. If TFTP is not installed, this rule is not applicable. Check to see if TFTP server is installed with the follo | |
| RHEL-09-215100 | RHEL 9 must have the crypto-policies package installed. | Verify that the RHEL 9 crypto-policies package is installed with the following command: $ dnf list --installed crypto-policies Example output: crypto-policies.noarch 20240828-2.git626aa59.el9_5 If the crypto-policies package is not installe | |
| RHEL-09-215105 | RHEL 9 must implement a FIPS 140-3-compliant systemwide cryptographic policy. | Verify RHEL 9 is set to use a FIPS 140-3-compliant systemwide cryptographic policy. Verify the current systemwide crypto-policy with the following command: $ update-crypto-policies --show FIPS If the systemwide crypto-policy is not set to " | |
| RHEL-09-231190 | RHEL 9 local disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at rest protection. | Note: If there is a documented and approved reason for not having data-at-rest encryption at the operating system level, such as encryption provided by a hypervisor or a disk storage array in a virtualized environment, this requirement is N | |
| RHEL-09-252070 | There must be no shosts.equiv files on RHEL 9. | Verify there are no "shosts.equiv" files on RHEL 9 with the following command: $ sudo find / -name shosts.equiv If a "shosts.equiv" file is found, this is a finding. | |
| RHEL-09-252075 | There must be no .shosts files on RHEL 9. | Verify there are no ".shosts" files on RHEL 9 with the following command: $ sudo find / -name .shosts If a ".shosts" file is found, this is a finding. | |
| RHEL-09-255040 | RHEL 9 SSHD must not allow blank passwords. | Verify that RHEL 9 remote access using SSH prevents logging on with a blank password with the following command: $ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH '^\s*permitemptyp | |
| RHEL-09-255050 | RHEL 9 must enable the Pluggable Authentication Module (PAM) interface for SSHD. | Verify the RHEL 9 SSHD is configured to allow for the UsePAM interface with the following command: $ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH '^\s*usepam' UsePAM yes If the | |
| RHEL-09-255064 | The RHEL 9 SSH client must be configured to use only DoW-approved encryption ciphers employing FIPS 140-3 validated cryptographic hash algorithms to protect the confidentiality of SSH client connections. | Verify the SSH client is configured to use only ciphers employing FIPS 140-3 approved algorithms. To verify the ciphers in the systemwide SSH configuration file, use the following command: $ grep -i Ciphers /etc/crypto-policies/back-ends/op | |
| RHEL-09-255065 | The RHEL 9 SSH server must be configured to use only DoW-approved encryption ciphers employing FIPS 140-3 validated cryptographic hash algorithms to protect the confidentiality of SSH server connections. | Verify the SSH server is configured to use only ciphers employing FIPS 140-3 approved algorithms. To verify the ciphers in the systemwide SSH configuration file, use the following command: $ sudo grep -i Ciphers /etc/crypto-policies/back-en | |
| RHEL-09-255070 | The RHEL 9 SSH client must be configured to use only DoW-approved Message Authentication Codes (MACs) employing FIPS 140-3 validated cryptographic hash algorithms to protect the confidentiality of SSH client connections. | Verify the SSH client is configured to use only MACs employing FIPS 140-3 approved algorithms. To verify the MACs in the systemwide SSH configuration file, use the following command: $ grep -i MACs /etc/crypto-policies/back-ends/openssh.con | |
| RHEL-09-255075 | The RHEL 9 SSH server must be configured to use only Message Authentication Codes (MACs) employing FIPS 140-3 validated cryptographic hash algorithms to protect the confidentiality of SSH server connections. | Verify the SSH server is configured to use only MACs employing FIPS 140-3 approved algorithms. To verify the MACs in the systemwide SSH configuration file, use the following command: $ sudo grep -i MACs /etc/crypto-policies/back-ends/openss | |
| RHEL-09-271040 | RHEL 9 must not allow unattended or automatic logon via the graphical user interface. | Note: This requirement assumes the use of the RHEL 9 default graphical user interface, the GNOME desktop environment. If the system does not have any graphical user interface installed, this requirement is Not Applicable. Verify RHEL 9 does | |
| RHEL-09-411100 | The root account must be the only account having unrestricted access to RHEL 9 system. | Verify that only the "root" account has a UID "0" assignment with the following command: $ awk -F: '$3 == 0 {print $1}' /etc/passwd root If any accounts other than "root" have a UID of "0", this is a finding. | |
| RHEL-09-431010 | RHEL 9 must use a Linux Security Module configured to enforce limits on system services. | Ensure that RHEL 9 verifies correct operation of security functions through the use of SELinux with the following command: $ getenforce Enforcing If SELINUX is not set to "Enforcing", this is a finding. Verify that SELinux is configured to | |
| RHEL-09-611025 | RHEL 9 must not allow blank or null passwords. | Verify that null passwords cannot be used with the following command: $ sudo grep -i nullok /etc/pam.d/system-auth /etc/pam.d/password-auth If output is produced, this is a finding. If the system administrator (SA) can demonstrate that the | |
| RHEL-09-671010 | RHEL 9 must enable FIPS mode. | Verify RHEL 9 is in FIPS mode with the following command: $ cat /proc/sys/crypto/fips_enabled 1 If the command does not return "1", this is a finding. | |
| RHEL-09-671020 | RHEL 9 IP tunnels must use FIPS 140-3 approved cryptographic algorithms. | Verify that the IPsec service uses the system crypto policy with the following command: Note: If the ipsec service is not installed, this requirement is Not Applicable. $ sudo grep include /etc/ipsec.conf /etc/ipsec.d/*.conf /etc/ipsec.conf | |
| RHEL-09-672020 | RHEL 9 cryptographic policy must not be overridden. | Verify that RHEL 9 cryptographic policies are not overridden. Verify that the configured policy matches the generated policy with the following command: $ sudo update-crypto-policies --check The configured policy matches the generated polic | |
| RHEL-09-672050 | RHEL 9 must implement DoW-approved encryption in the bind package. | Verify that BIND uses the system crypto policy with the following command: Note: If the "bind" package is not installed, this requirement is Not Applicable. $ sudo grep include /etc/named.conf include "/etc/crypto-policies/back-ends/bind.co | |
| RHEL-09-672055 | RHEL 9 must implement DoW-approved encryption in the OpenSSL package. | Verify the RHEL 9 OpenSSL library is configured to use only ciphers employing FIPS 140-3-approved algorithms with the following command: $ grep -i opensslcnf.config /etc/pki/tls/openssl.cnf .include = /etc/crypto-policies/back-ends/opensslc |
29 of 445.