Linux STIGs

Verify the version of Ubuntu 22.04 LTS is vendor supported with the following command: $ grep DISTRIB_DESCRIPTION /etc/lsb-release DISTRIB_DESCRIPTION="Ubuntu 22.04.1 LTS" Check the subscription status of the system with the following command: $ pro status If the installed version of Ubuntu 22.04 LTS is not supported, this is a finding.

Upgrade to a supported version of Ubuntu 22.04 LTS.

Verify Ubuntu 22.04 LTS is not configured to reboot the system when Ctrl-Alt-Delete is pressed by using the following command: $ systemctl status ctrl-alt-del.target ctrl-alt-del.target Loaded: masked (Reason: Unit ctrl-alt-del.target is masked.) Active: inactive (dead) If the "ctrl-alt-del.target" is not masked, this is a finding.

Configure Ubuntu 22.04 LTS to disable the Ctrl-Alt-Delete sequence for the command line by using the following commands: $ sudo systemctl disable ctrl-alt-del.target $ sudo systemctl mask ctrl-alt-del.target Reload the daemon to take effect: $ sudo systemctl daemon-reload

Verify Ubuntu 22.04 LTS requires a password for authentication upon booting into single-user and maintenance modes by using the following command: $ sudo grep -i password /boot/grub/grub.cfg password_pbkdf2 root grub.pbkdf2.sha512.10000.03255F190F0E2F7B4F0D1C3216012309162F022A7A636771 If the root password entry does not begin with "password_pbkdf2", this is a finding.

Configure Ubuntu 22.04 LTS to require a password for authentication upon booting into single-user and maintenance modes. Generate an encrypted (grub) password for root by using the following command: $ grub-mkpasswd-pbkdf2 Enter Password: Reenter Password: PBKDF2 hash of your password is grub.pbkdf2.sha512.10000.03255F190F0E2F7B4F0D1C3216012309162F022A7A636771 Using the hash from the output, modify the "/etc/grub.d/40_custom" file by using the following command to add a boot password: $ sudo sed -i '$i set superusers=\"root\"\npassword_pbkdf2 root ' /etc/grub.d/40_custom where is the hash generated by grub-mkpasswd-pbkdf2 command. Generate an updated "grub.conf" file with the new password by using the following command: $ sudo update-grub

Verify the "rsh-server" package is not installed by using the following command: $ dpkg -l | grep rsh-server If the "rsh-server" package is installed, this is a finding.

Remove the "rsh-server" package by using the following command: $ sudo apt-get remove rsh-server

Verify that the "telnetd" package is not installed on Ubuntu 22.04 LTS by using the following command: $ dpkg -l | grep telnetd If the "telnetd" package is installed, this is a finding.

Remove the "telnetd" package by using the following command: $ sudo apt-get remove telnetd

Verify Ubuntu 22.04 LTS prevents unauthorized disclosure or modification of all information requiring at-rest protection by using disk encryption. Note: If there is a documented and approved reason for not having data-at-rest encryption, this requirement is not applicable. Determine the partition layout for the system by using the following command: $ sudo fdisk -l ... Device Start End Sectors Size Type /dev/sda1 2048 2203647 2201600 1G EFI System /dev/sda2 2203648 6397951 4194304 2G Linux filesystem /dev/sda3 6397952 536868863 530470912 252.9G Linux filesystem ... Verify the system partitions are all encrypted by using the following command: # more /etc/crypttab Every persistent disk partition present must have an entry in the file. If any partitions other than the boot partition or pseudo file systems (such as /proc or /sys) are not listed, this is a finding.

To encrypt an entire partition, dedicate a partition for encryption in the partition layout. Note: Encrypting a partition in an already-installed system is more difficult because it will need to be resized and existing partitions changed.

Verify the SSH package is installed by using the following command: $ sudo dpkg -l | grep openssh ii openssh-client 1:8.9p1-3ubuntu0.4 amd64 secure shell (SSH) client, for secure access to remote machines ii openssh-server 1:8.9p1-3ubuntu0.4 amd64 secure shell (SSH) server, for secure access from remote machines ii openssh-sftp-server 1:8.9p1-3ubuntu0.4 amd64 secure shell (SSH) sftp server module, for SFTP access from remote machines If the "openssh" server package is not installed, this is a finding.

Install the "ssh" meta-package by using the following command: $ sudo apt install ssh

Verify the "ssh.service" is enabled and active by using the following commands: $ sudo systemctl is-enabled ssh enabled $ sudo systemctl is-active ssh active If "ssh.service" is not enabled and active, this is a finding.

Enable and start the "ssh.service" by using the following command: $ sudo systemctl enable ssh.service --now

Verify that unattended or automatic login via SSH is disabled by using the following command: $ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iEH '(permit(.*?)(passwords|environment))' /etc/ssh/sshd_config:PermitEmptyPasswords no /etc/ssh/sshd_config:PermitUserEnvironment no If "PermitEmptyPasswords" and "PermitUserEnvironment" are not set to "no", are commented out, are missing, or conflicting results are returned, this is a finding.

Configure the SSH server to not allow unattended or automatic login to the system. Add or modify the following lines in the "/etc/ssh/sshd_config" file: PermitEmptyPasswords no PermitUserEnvironment no Restart SSH for the changes to take effect: $ sudo systemctl restart ssh

Verify that X11 forwarding is disabled by using the following command: $ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH 'x11forwarding' /etc/ssh/sshd_config:X11Forwarding no If "X11Forwarding" is set to "yes" and is not documented with the information system security officer (ISSO) as an operational requirement, is commented out, is missing, or conflicting results are returned, this is a finding.

Configure the SSH server to disable X11 forwarding. Add or modify the following line in the "/etc/ssh/sshd_config" file: X11Forwarding no Restart SSH for the changes to take effect: $ sudo systemctl restart ssh

Verify Ubuntu 22.04 LTS is not configured to reboot the system when Ctrl-Alt-Delete is pressed when using a graphical user interface by using the following command: Note: If no graphical user interface is installed, this requirement is not applicable. $ gsettings get org.gnome.settings-daemon.plugins.media-keys logout @as [] If the "logout" key is bound to an action, is commented out, or is missing, this is a finding.

Configure Ubuntu 22.04 LTS to disable the Ctrl-Alt-Delete sequence when using a graphical user interface. Create or edit a file named /etc/dconf/db/local.d/00-mediakeys with the following contents: [org/gnome/settings-daemon/plugins/media-keys] logout=@as [] Update the dconf settings: $ sudo dconf update

Verify the sudo group has only members who require access to security functions by using the following command: $ grep sudo /etc/group sudo:x:27: If the sudo group contains users not needing access to security functions, this is a finding.

Configure the sudo group with only members requiring access to security functions. To remove a user from the sudo group, run: $ sudo gpasswd -d sudo

Verify that null passwords cannot be used. Run the following command: $ grep nullok /etc/pam.d/common-auth /etc/pam.d/common-password If this produces any output, this is a finding.

Remove any instances of the "nullok" option in "/etc/pam.d/common-password" to prevent logons with empty passwords. Remove any instances of the "nullok" option in "/etc/pam.d/common-auth" and "/etc/pam.d/common-password".

Verify all accounts on the system to have a password by using the following command: $ sudo awk -F: '!$2 {print $1}' /etc/shadow If the command returns any results, this is a finding.

Configure all accounts on the system to have a password or lock the account by using the following commands: Set the account password: $ sudo passwd Or lock the account: $ sudo passwd -l

Verify that "use_mappers" is set to "pwent" in "/etc/pam_pkcs11/pam_pkcs11.conf" file by using the following command: $ grep -i use_mappers /etc/pam_pkcs11/pam_pkcs11.conf use_mappers = pwent If "use_mappers" does not contain "pwent", is commented out, or is missing, this is a finding.

Set "use_mappers=pwent" in "/etc/pam_pkcs11/pam_pkcs11.conf" or, if there is already a comma-separated list of mappers, add it to the list, separated by comma, and before the null mapper. If the system is missing an "/etc/pam_pkcs11/" directory and an "/etc/pam_pkcs11/pam_pkcs11.conf", find an example to copy into place and modify accordingly at "/usr/share/doc/libpam-pkcs11/examples/pam_pkcs11.conf.example.gz".

Verify the system is configured to run in FIPS mode by using the following command: $ grep -i 1 /proc/sys/crypto/fips_enabled 1 If a value of "1" is not returned, this is a finding.

Configure Ubuntu 22.04 LTS to run in FIPS mode. Add "fips=1" to the kernel parameter during Ubuntu 22.04 LTS install. Enabling a FIPS mode on a pre-existing system involves a number of modifications to Ubuntu 22.04 LTS. Refer to the Ubuntu Pro security certification documentation for instructions. A subscription to the "Ubuntu Pro" plan is required to obtain the FIPS Kernel cryptographic modules and enable FIPS. Note: Ubuntu Pro security certification instructions can be found at: https://ubuntu.com/security/certifications/docs/fips-enablement

Verify that Ubuntu 22.04 LTS enables auditing at system startup in GRUB. Check the main GRUB defaults to ensure auditing is enabled: $ sudo grep -ir GRUB_CMDLINE_LINUX /etc/default/grub /etc/default/grub:GRUB_CMDLINE_LINUX_DEFAULT="audit=1" /etc/default/grub:GRUB_CMDLINE_LINUX="audit=1" If any Linux lines do not contain "audit=1", this is a finding. Check the generated GRUB configuration to ensure the setting is propagated to the bootloader: $ sudo grep "^\s*linux" /boot/grub/grub.cfg linux /vmlinuz-6.8.0-31-generic root=UUID=c92a542f-aee4-4af9-94b2-203624ccb8e3 ro audit=1 quiet splash $vt_handoff linux /vmlinuz-6.8.0-31-generic root=UUID=c92a542f-aee4-4af9-94b2-203624ccb8e3 ro recovery nomodeset dis_ucode_ldr audit=1 If any Linux lines do not contain "audit=1", this is a finding. Note: Output details may vary by system.

Configure Ubuntu 22.04 LTS to produce audit records at system startup. Edit the "/etc/default/grub" file and add "audit=1" to the "GRUB_CMDLINE_LINUX" option and to the "GRUB_CMDLINE_LINUX_DEFAULT" option. GRUB_CMDLINE_LINUX_DEFAULT="audit=1" GRUB_CMDLINE_LINUX="audit=1" To update the grub config file, run: $ sudo update-grub

Verify that kernel core dumps are disabled unless needed by using the following command: $ systemctl status kdump-tools.service o kdump-tools.service Loaded: masked (Reason: Unit kdump-tools.service is masked.) Active: inactive (dead) If kdump-tools is not installed the output will be: Unit kdump-tools.service could not be found. If "kdump-tools.service" is not masked and inactive, ask the system administrator (SA) if the use of the service is required and documented with the information system security officer (ISSO). If the service is active and is not documented, this is a finding.

If kernel core dumps are not required, disable and mask "kdump-tools.service" by using the following command: $ sudo systemctl mask kdump-tools --now If kernel core dumps are required, document the need with the ISSO.

Verify Ubuntu 22.04 LTS implements address space layout randomization (ASLR) by using the following command: $ sysctl kernel.randomize_va_space kernel.randomize_va_space = 2 If no output is returned, verify the kernel parameter "randomize_va_space" is set to "2" by using the following command: $ cat /proc/sys/kernel/randomize_va_space 2 If "kernel.randomize_va_space" is not set to "2", this is a finding. Verify that a saved value of the "kernel.randomize_va_space" variable is not defined. $ sudo grep -ER "^kernel.randomize_va_space=[^2]" /etc/sysctl.conf /etc/sysctl.d If this returns a result, this is a finding.

Remove the "kernel.randomize_va_space" entry found in the "/etc/sysctl.conf" file or any file located in the "/etc/sysctl.d/" directory. Reload the system configuration files for the changes to take effect by using the following command: $ sudo sysctl --system

Verify the NX (no-execution) bit flag is set on the system by using the following command: $ sudo dmesg | grep -i "execute disable" [ 0.000000] NX (Execute Disable) protection: active If "dmesg" does not show "NX (Execute Disable) protection: active", check the hardware capabilities of the installed CPU by using the following command: $ grep flags /proc/cpuinfo | grep -o nx | sort -u nx If no output is returned, this is a finding.

Configure Ubuntu 22.04 LTS to enable NX. If the installed CPU is hardware capable of NX protection, check if the system's BIOS/UEFI setup configuration permits toggling the "NX bit" or "no execution bit", and set it to "enabled".

Verify APT is configured to remove all software components after updated versions have been installed by using the following command: $ grep -i remove-unused /etc/apt/apt.conf.d/50unattended-upgrades Unattended-Upgrade::Remove-Unused-Kernel-Packages "true"; Unattended-Upgrade::Remove-Unused-Dependencies "true"; If "Unattended-Upgrade::Remove-Unused-Kernel-Packages" and "Unattended-Upgrade::Remove-Unused-Dependencies" are not set to "true", are commented out, or are missing, this is a finding.

Configure APT to remove all software components after updated versions have been installed. Add or modify the following lines in the "/etc/apt/apt.conf.d/50unattended-upgrades" file: Unattended-Upgrade::Remove-Unused-Kernel-Packages "true"; Unattended-Upgrade::Remove-Unused-Dependencies "true";

Verify Ubuntu 22.04 LTS has the "libpam-pwquality" package installed with the following command: $ dpkg -l | grep libpam-pwquality ii libpam-pwquality:amd64 1.4.4-1build2 amd64 PAM module to check password strength If "libpam-pwquality" is not installed, this is a finding.

Install the "pam_pwquality" package by using the following command: $ sudo apt-get install libpam-pwquality

Note: If NFS mounts are authorized and in use on the system, this control is not applicable. Verify that Ubuntu does not have the nfs-kernel-server package installed. Determine if packages are installed: $ sudo dpkg -l | grep -E 'nfs-kernel-server' If the nfs-kernel-server package is installed, this is a finding.

Configure the Ubuntu operating system to disable nonessential capabilities by removing the nfs-kernel-server package from the system with the following commands: Remove packages if present: $ sudo apt purge --yes nfs-kernel-server Remove any unneeded dependencies: $ sudo apt autoremove --yes Verify that NFS services are gone: $ sudo systemctl list-units --type=service | grep nfs

Verify the system commands directories have mode "755" or less permissive by using the following command: $ find /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin -perm /022 -type d -exec stat -c "%n %a" '{}' \; If any directories are found to be group-writable or world-writable, this is a finding.

Configure Ubuntu 22.04 LTS commands directories to be protected from unauthorized access. Run the following command: $ sudo find /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin -perm /022 -type d -exec chmod -R 755 '{}' \;

Verify the system commands contained in the following directories have mode "755" or less permissive by using the following command: $ sudo find /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin -perm /022 -type f -exec stat -c "%n %a" '{}' \; If any files are found to be group-writable or world-writable, this is a finding.

Configure Ubuntu 22.04 LTS commands to be protected from unauthorized access. Run the following command: $ sudo find /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin -perm /022 -type f -exec chmod 755 '{}' \;

Verify the systemwide shared library files contained in the directories "/lib", "/lib64", "/usr/lib", and "/usr/lib64" have mode 0755 or less permissive. Check that the systemwide shared library files have mode 0755 or less permissive with the following command: $ sudo find /lib /lib64 /usr/lib /usr/lib64 -type f -name '*.so*' -perm /022 -exec stat -c "%n %a" {} + If any output is returned, this is a finding.

Configure the systemwide shared library files contained in the directories "/lib", "/lib64", "/usr/lib", and "/usr/lib64" to have mode 0755 or less permissive with the following command: $ sudo find /lib /lib64 /usr/lib /usr/lib64 -type f -name '*.so*' -perm /022 -exec chmod go-w {} +

Verify the "/var/log" directory has mode of "755" or less permissive by using the following command: Note: If rsyslog is active and enabled on the operating system, this requirement is not applicable. $ stat -c "%n %a" /var/log /var/log 755 If a value of "755" or less permissive is not returned, this is a finding.

Configure the "/var/log" directory to have permissions of "0755" by using the following command: $ sudo chmod 0755 /var/log

Verify Ubuntu 22.04 LTS has all system log files under the "/var/log" directory with a permission set to "640" or less permissive by using the following command: Note: The btmp, wtmp, and lastlog files are excluded. Refer to the Discussion for details. $ sudo find /var/log -perm /137 ! -name '*[bw]tmp' ! -name '*lastlog' -type f -exec stat -c "%n %a" {} \; If the command displays any output, this is a finding. Note: If output regarding history.log or eipp.log.xz is displayed, this is not a finding.

Configure Ubuntu 22.04 LTS to set permissions of all log files under the "/var/log" directory to "640" or more restricted by using the following command: Note: The btmp, wtmp, and lastlog files are excluded. Refer to the Discussion for details. $ sudo find /var/log -perm /137 ! -name '*[bw]tmp' ! -name '*lastlog' -type f -exec chmod 640 '{}' \;

Verify the /run/log/journal and /var/log/journal directories have permissions set to "2750" or less permissive by using the following command: $ sudo find /run/log/journal /var/log/journal -type d -exec stat -c "%n %a" {} \; /run/log/journal 2750 /var/log/journal 2750 /var/log/journal/3b018e681c904487b11671b9c1987cce 2750 If any output returned has a permission set greater than "2750", this is a finding. Verify all files in the /run/log/journal and /var/log/journal directories have permissions set to "640" or less permissive by using the following command: $ sudo find /run/log/journal /var/log/journal -type f -exec stat -c "%n %a" {} \; /var/log/journal/3b018e681c904487b11671b9c1987cce/system@99dcc72bb1134aaeae4bf157aa7606f4-0000000000003c7a-0006073f8d1c0fec.journal 640 /var/log/journal/3b018e681c904487b11671b9c1987cce/system.journal 640 /var/log/journal/3b018e681c904487b11671b9c1987cce/user-1000.journal 640 /var/log/journal/3b018e681c904487b11671b9c1987cce/user-1000@bdedf14602ff4081a77dc7a6debc8626-00000000000062a6-00060b4b414b617a.journal 640 /var/log/journal/3b018e681c904487b11671b9c1987cce If any output returned has a permission set greater than "640", this is a finding.

Configure Ubuntu 22.04 LTS to set the appropriate permissions to the files and directories used by the systemd journal: Add or modify the following lines in the "`/usr/lib/tmpfiles.d/systemd.conf" file: z /run/log/journal 2750 root systemd-journal - - Z /run/log/journal/%m ~2750 root systemd-journal - - z /var/log/journal 2750 root systemd-journal - - z /var/log/journal/%m 2750 root systemd-journal - - z /var/log/journal/%m/system.journal 0640 root systemd-journal - - Restart the system for the changes to take effect.

Verify that Ubuntu 22.04 LTS configures the "/var/log/syslog" file with mode "640" or less permissive by using the following command: $ stat -c "%n %a" /var/log/syslog /var/log/syslog 640 If a value of "640" or less permissive is not returned, this is a finding.

Configure Ubuntu 22.04 LTS to have permissions of "640" for the "/var/log/syslog" file by using the following command: $ sudo chmod 0640 /var/log/syslog

Verify Ubuntu 22.04 LTS configures the audit tools to have a file permission of "755" or less to prevent unauthorized access by using the following command: $ stat -c "%n %a" /sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/autrace /sbin/auditd /sbin/audispd* /sbin/augenrules /sbin/auditctl 755 /sbin/aureport 755 /sbin/ausearch 755 /sbin/autrace 755 /sbin/auditd 755 /sbin/audispd-zos-remote 755 /sbin/augenrules 755 If any of the audit tools have a mode more permissive than "0755", this is a finding.

Configure the audit tools on Ubuntu 22.04 LTS to be protected from unauthorized access by setting the correct permissive mode using the following command: $ sudo chmod 755 Replace "" with the audit tool that does not have the correct permissions.

Verify the system commands directories are owned by "root" by using the following command: $ sudo find /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin ! -user root -type d -exec stat -c "%n %U" '{}' \; If any system commands directories are returned, this is a finding.

Configure Ubuntu 22.04 LTS commands directories to be protected from unauthorized access. Run the following command: $ sudo find /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin ! -user root -type d -exec chown root '{}' \;

Verify the system commands directories are group-owned by "root" by using the following command: $ sudo find /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin ! -group root -type d -exec stat -c "%n %G" '{}' \; If any system commands directories are returned that are not Set Group ID up on execution (SGID) files and owned by a privileged account, this is a finding.

Configure Ubuntu 22.04 LTS commands directories to be protected from unauthorized access. Run the following command: $ sudo find /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin ! -group root -type d -exec chgrp root '{}' \;

Verify the system commands contained in the following directories are owned by "root", or a required system account, by using the following command: $ sudo find /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin ! -user root -type f -exec stat -c "%n %U" '{}' \; If any system commands are returned and are not owned by a required system account, this is a finding.

Configure Ubuntu 22.04 LTS commands and their respective parent directories to be protected from unauthorized access. Run the following command, replacing "" with any system command not owned by "root" or a required system account: $ sudo chown root

Verify the system commands contained in the following directories are group-owned by "root" or a required system account by using the following command: $ sudo find -L /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin ! -group root -type f ! -perm /2000 -exec stat -c "%n %G" '{}' \; If any system commands are returned that are not Set Group ID upon execution (SGID) files and group-owned by a required system account, this is a finding.

Configure Ubuntu 22.04 LTS commands to be protected from unauthorized access. Run the following command, replacing "" with any system command not group-owned by "root" or a required system account: $ sudo chgrp root

Verify the systemwide shared library directories "/lib", "/lib64", and "/usr/lib" are owned by "root" by using the following command: $ sudo find /lib /usr/lib /lib64 ! -user root -type d -exec stat -c "%n %U" '{}' \; If any systemwide library directory is returned, this is a finding.

Configure the library files and their respective parent directories to be protected from unauthorized access. Run the following command: $ sudo find /lib /usr/lib /lib64 ! -user root -type d -exec chown root '{}' \;

Verify the systemwide library directories "/lib", "/lib64", and "/usr/lib" are group-owned by "root" by using the following command: $ sudo find /lib /usr/lib /lib64 ! -group root -type d -exec stat -c "%n %G" '{}' \; If any systemwide shared library directory is returned, this is a finding.

Configure Ubuntu 22.04 LTS library directories to be protected from unauthorized access. Run the following command: $ sudo find /lib /usr/lib /lib64 ! -group root -type d -exec chgrp root '{}' \;

Verify the systemwide shared library files contained in the directories "/lib", "/lib64", "/usr/lib", and "/usr/lib64" are owned by root with the following command: $ sudo find /lib /lib64 /usr/lib /usr/lib64 -type f -name '*.so*' ! -user root -exec stat -c "%n %U" {} + If any output is returned, this is a finding.

Configure the systemwide shared library files contained in the directories "/lib", "/lib64", "/usr/lib", and "/usr/lib64" to be owned by root with the following command: $ sudo find /lib /lib64 /usr/lib /usr/lib64 -type f -name '*.so*' ! -user root -exec chown root {} +

Verify the systemwide shared library files contained in the directories "/lib", "/lib64", "/usr/lib", and "/usr/lib64" are group owned by root with the following command: $ sudo find /lib /lib64 /usr/lib /usr/lib64 -type f -name '*.so*' ! -group root -exec stat -c "%n %G" {} + If any output is returned, this is a finding.

Configure the systemwide shared library files contained in the directories "/lib", "/lib64", "/usr/lib", and "/usr/lib64" to be group owned by root with the following command: $ sudo find /lib /lib64 /usr/lib /usr/lib64 -type f -name '*.so*' ! -group root -exec chown :root {} +

Verify the /run/log/journal and /var/log/journal directories are owned by "root" by using the following command: $ sudo find /run/log/journal /var/log/journal -type d -exec stat -c "%n %U" {} \; /run/log/journal root /var/log/journal root /var/log/journal/3b018e681c904487b11671b9c1987cce root If any output returned is not owned by "root", this is a finding.

Configure Ubuntu 22.04 LTS to set the appropriate ownership to the directories used by the systemd journal. Create a drop-in file if it does not already exist with the following command: $ sudo vi /etc/tmpfiles.d/zzz-systemd-stig.conf Add or modify the following lines in the "/etc/tmpfiles.d/zzz-systemd-stig.conf" file: z /run/log/journal 2750 root systemd-journal - - z /var/log/journal 2750 root systemd-journal - - z /var/log/journal/%m 2750 root systemd-journal - - Restart the system for the changes to take effect.

Verify the /run/log/journal and /var/log/journal directories are group-owned by "systemd-journal" by using the following command: $ sudo find /run/log/journal /var/log/journal -type d -exec stat -c "%n %G" {} \; /run/log/journal systemd-journal /var/log/journal systemd-journal /var/log/journal/3b018e681c904487b11671b9c1987cce systemd-journal If any output returned is not group-owned by "systemd-journal", this is a finding.

Configure Ubuntu 22.04 LTS to set the appropriate group-ownership to the directories used by the systemd journal. Create a drop-in file if it does not already exist with the following command: $ sudo vi /etc/tmpfiles.d/zzz-systemd-stig.conf Add or modify the following lines in the "/etc/tmpfiles.d/zzz-systemd-stig.conf" file: z /run/log/journal 2750 root systemd-journal - - z /var/log/journal 2750 root systemd-journal - - z /var/log/journal/%m 2750 root systemd-journal - - Restart the system for the changes to take effect.

Verify the /run/log/journal and /var/log/journal files are owned by "root" by using the following command: $ sudo find /run/log/journal /var/log/journal -type f -exec stat -c "%n %U" {} \; /var/log/journal/3b018e681c904487b11671b9c1987cce/system@99dcc72bb1134aaeae4bf157aa7606f4-0000000000003c7a-0006073f8d1c0fec.journal root /var/log/journal/3b018e681c904487b11671b9c1987cce/system.journal root /var/log/journal/3b018e681c904487b11671b9c1987cce/user-1000.journal root /var/log/journal/3b018e681c904487b11671b9c1987cce/user-1000@bdedf14602ff4081a77dc7a6debc8626-00000000000062a6-00060b4b414b617a.journal root /var/log/journal/3b018e681c904487b11671b9c1987cce/system@99dcc72bb1134aaeae4bf157aa7606f4-0000000000005301-000609a409 593.journal root /var/log/journal/3b018e681c904487b11671b9c1987cce/system@99dcc72bb1134aaeae4bf157aa7606f4-0000000000000001-000604dae53225ee.journal root /var/log/journal/3b018e681c904487b11671b9c1987cce/user-1000@bdedf14602ff4081a77dc7a6debc8626-000000000000083b-000604dae72c7e3b.journal root If any output returned is not owned by "root", this is a finding.

Configure Ubuntu 22.04 LTS to set the appropriate ownership to the files used by the systemd journal. Create a drop-in file if it does not already exist with the following command: $ sudo vi /etc/tmpfiles.d/zzz-systemd-stig.conf Add or modify the following lines in the "/etc/tmpfiles.d/zzz-systemd-stig.conf" file: z /var/log/journal/%m/system.journal 0640 root systemd-journal - - Restart the system for the changes to take effect.

Verify the /run/log/journal and /var/log/journal files are group-owned by "systemd-journal" by using the following command: $ sudo find /run/log/journal /var/log/journal -type f -exec stat -c "%n %G" {} \; /var/log/journal/3b018e681c904487b11671b9c1987cce/system@99dcc72bb1134aaeae4bf157aa7606f4-0000000000003c7a-0006073f8d1c0fec.journal systemd-journal /var/log/journal/3b018e681c904487b11671b9c1987cce/system.journal systemd-journal /var/log/journal/3b018e681c904487b11671b9c1987cce/user-1000.journal systemd-journal /var/log/journal/3b018e681c904487b11671b9c1987cce/user-1000@bdedf14602ff4081a77dc7a6debc8626-00000000000062a6-00060b4b414b617a.journal systemd-journal /var/log/journal/3b018e681c904487b11671b9c1987cce/system@99dcc72bb1134aaeae4bf157aa7606f4-0000000000005301-000609a409 593.journal systemd-journal /var/log/journal/3b018e681c904487b11671b9c1987cce/system@99dcc72bb1134aaeae4bf157aa7606f4-0000000000000001-000604dae53225ee.journal systemd-journal /var/log/journal/3b018e681c904487b11671b9c1987cce/user-1000@bdedf14602ff4081a77dc7a6debc8626-000000000000083b-000604dae72c7e3b.journal systemd-journal If any output returned is not group-owned by "systemd-journal", this is a finding.

Configure Ubuntu 22.04 LTS to set the appropriate group-ownership to the files used by the systemd journal. Create a drop-in file if it does not already exist with the following command: $ sudo vi /etc/tmpfiles.d/zzz-systemd-stig.conf Add or modify the following lines in the "/usr/lib/tmpfiles.d/zzz-systemd-stig.conf" file: z /var/log/journal/%m/system.journal 0640 root systemd-journal - - Restart the system for the changes to take effect.

Verify that the "journalctl" command is owned by "root" by using the following command: $ sudo find /usr/bin/journalctl -exec stat -c "%n %U" {} \; /usr/bin/journalctl root If "journalctl" is not owned by "root", this is a finding.

Configure "journalctl" to be owned by "root": $ sudo chown root /usr/bin/journalctl

Verify that the "journalctl" command is group-owned by "root" by using the following command: $ sudo find /usr/bin/journalctl -exec stat -c "%n %G" {} \; /usr/bin/journalctl root If "journalctl" is not group-owned by "root", this is a finding.

Configure "journalctl" to be group-owned by "root": $ sudo chown :root /usr/bin/journalctl

Verify Ubuntu 22.04 LTS configures the audit tools to be owned by "root" to prevent any unauthorized access with the following command: $ stat -c "%n %U" /sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/autrace /sbin/auditd /sbin/audisp* /sbin/augenrules /sbin/auditctl root /sbin/aureport root /sbin/ausearch root /sbin/autrace root /sbin/auditd root /sbin/audispd-zos-remote root /sbin/augenrules root If any of the audit tools are not owned by "root", this is a finding.

Configure the audit tools on Ubuntu 22.04 LTS to be protected from unauthorized access by setting the file owner as root using the following command: $ sudo chown root Replace "" with each audit tool not owned by "root".

Verify Ubuntu 22.04 LTS configures the "/var/log" directory to be owned by "root" by using the following command: $ stat -c "%n %U" /var/log /var/log root If the "/var/log" directory is not owned by "root", this is a finding.

Configure Ubuntu 22.04 LTS to have root own the "/var/log" directory by using the following command: $ sudo chown root /var/log

Verify that Ubuntu 22.04 LTS configures the "/var/log" directory to be group-owned by "syslog" by using the following command: $ stat -c "%n %G" /var/log /var/log syslog If the "/var/log" directory is not group-owned by "syslog", this is a finding.

Configure Ubuntu 22.04 LTS to have syslog group-own the "/var/log" directory by using the following command: $ sudo chgrp syslog /var/log

Verify that Ubuntu 22.04 LTS configures the "/var/log/syslog" file to be owned by "syslog" by using the following command: $ stat -c "%n %U" /var/log/syslog /var/log/syslog If the "/var/log/syslog" file is not owned by "syslog", this is a finding.

Configure Ubuntu 22.04 LTS to have syslog own the "/var/log/syslog" file by using the following command: $ sudo chown syslog /var/log/syslog

Verify that Ubuntu 22.04 LTS configures the "/var/log/syslog" file to be group-owned by "adm" by using the following command: $ stat -c "%n %G" /var/log/syslog /var/log/syslog adm If the "/var/log/syslog" file is not group-owned by "adm", this is a finding.

Configure Ubuntu 22.04 LTS to have adm group-own the "/var/log/syslog" file by using the following command: $ sudo chgrp adm /var/log/syslog

Verify that the "journalctl" command has a permission set of "740" by using the following command: $ sudo find /usr/bin/journalctl -exec stat -c "%n %a" {} \; /usr/bin/journalctl 740 If "journalctl" is not set to "740", this is a finding.

Configure "journalctl" to have a permission set of "740": $ sudo chmod 740 /usr/bin/journalctl

Verify that all public directories have the public sticky bit set by using the following command: $ sudo find / -type d -perm -002 ! -perm -1000 If any public directories are found missing the sticky bit, this is a finding.

Configure all public directories to have the sticky bit set to prevent unauthorized and unintended information transferred via shared system resources. Set the sticky bit on all public directories using the following command, replacing " " with any directory path missing the sticky bit: $ sudo chmod +t

Verify that the Uncomplicated Firewall is installed by using the following command: $ dpkg -l | grep ufw ii ufw 0.36.1-4ubuntu0.1 all program for managing a Netfilter firewall If the "ufw" package is not installed, ask the system administrator if another application firewall is installed. If no application firewall is installed, this is a finding.

Install the Uncomplicated Firewall by using the following command: $ sudo apt-get install ufw

Verify the ufw is enabled on the system with the following command: $ sudo ufw status Status: active If the above command returns the status as "inactive" or any type of error, this is a finding.

Enable the ufw by using the following command: $ sudo ufw enable

Verify the ufw is enabled on the system with the following command: $ sudo ufw status Status: active If the above command returns the status as "inactive" or any type of error, this is a finding. If the ufw is not installed, ask the system administrator if another application firewall is installed. If a different firewall is active on the system, this is not a finding.

Enable the ufw by using the following command: $ sudo ufw enable Note: Enabling the firewall will potentially disrupt ssh sessions.

Verify an application firewall is configured to rate limit any connection to the system. Check all the services listening to the ports by using the following command: $ ss -l46ut Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port Process tcp LISTEN 0 511 *:http *:* tcp LISTEN 0 128 [::]:ssh [::]:* tcp LISTEN 0 128 [::]:ipp [::]:* tcp LISTEN 0 128 [::]:smtp [::]:* For each entry, verify that the ufw is configured to rate limit the service ports by using the following command: $ sudo ufw status Status: active To Action From -- ------ ---- 80/tcp LIMIT Anywhere 25/tcp LIMIT Anywhere Anywhere DENY 240.9.19.81 443 LIMIT Anywhere 22/tcp LIMIT Anywhere 80/tcp (v6) LIMIT Anywhere 25/tcp (v6) LIMIT Anywhere 22/tcp (v6) LIMIT Anywhere (v6) 25 DENY OUT Anywhere 25 (v6) DENY OUT Anywhere (v6) If any port with a state of "LISTEN" that does not have an action of "DENY", is not marked with the "LIMIT" action, this is a finding.

Configure the application firewall to protect against or limit the effects of DoS attacks by ensuring Ubuntu 22.04 LTS is implementing rate-limiting measures on impacted network interfaces. For each service with a port listening to connections, run the following command, replacing "" with the service that needs to be rate limited. $ sudo ufw limit Rate-limiting can also be done on an interface. An example of adding a rate limit on the "ens160" interface follows: $ sudo ufw limit in on ens160

Check the firewall configuration for any unnecessary or prohibited functions, ports, protocols, and/or services by using the following command: $ sudo ufw show raw Chain INPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination Ask the system administrator for the site or program PPSM CLSA. Verify the services allowed by the firewall match the PPSM CLSA. If there are any additional ports, protocols, or services that are not included in the PPSM CLSA, this is a finding. If there are any ports, protocols, or services that are prohibited by the PPSM CAL, this is a finding.

Add all ports, protocols, or services allowed by the PPSM CLSA by using the following command: $ sudo ufw allow Where the direction is "in" or "out" and the port is the one corresponding to the protocol or service allowed. To deny access to ports, protocols, or services, use: $ sudo ufw deny

Verify Ubuntu 22.04 LTS is configured to use TCP syncookies by using the following command: $ sysctl net.ipv4.tcp_syncookies net.ipv4.tcp_syncookies = 1 If the value is not "1", this is a finding. Check the saved value of TCP syncookies by using the following command: $ sudo grep -ir net.ipv4.tcp_syncookies /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf /usr/lib/sysctl.d/*.conf /lib/sysctl.d/*.conf /etc/sysctl.conf 2> /dev/null If the "net.ipv4.tcp_syncookies" option is not set to "1", is commented out, or is missing, this is a finding. If conflicting results are returned, this is a finding.

Configure Ubuntu 22.04 LTS to use TCP syncookies by using the following command: $ sudo sysctl -w net.ipv4.tcp_syncookies=1 If "1" is not the system's default value, add or update the following line in "/etc/sysctl.conf": net.ipv4.tcp_syncookies = 1

Verify Ubuntu 22.04 LTS has the packages required for multifactor authentication installed with the following command: $ dpkg -l | grep sssd ii sssd 2.9.4-1.1ubuntu6.1 amd64 System Security Services Daemon -- metapackage ii sssd-ad 2.9.4-1.1ubuntu6.1 amd64 System Security Services Daemon -- Active Directory back end ii sssd-ad-common 2.9.4-1.1ubuntu6.1 amd64 System Security Services Daemon -- PAC responder ii sssd-common 2.9.4-1.1ubuntu6.1 amd64 System Security Services Daemon -- common files ii sssd-ipa 2.9.4-1.1ubuntu6.1 amd64 System Security Services Daemon -- IPA back end ii sssd-krb5 2.9.4-1.1ubuntu6.1 amd64 System Security Services Daemon -- Kerberos back end ii sssd-krb5-common 2.9.4-1.1ubuntu6.1 amd64 System Security Services Daemon -- Kerberos helpers ii sssd-ldap 2.9.4-1.1ubuntu6.1 amd64 System Security Services Daemon -- LDAP back end ii sssd-proxy 2.9.4-1.1ubuntu6.1 amd64 System Security Services Daemon -- proxy back end If the "sssd" package is not installed, this is a finding. The additional sssd components listed by the command may differ from configuration to configuration. Verify that "libpam-sss" (the PAM integration module for SSSD) is installed with the following command: $ dpkg -l | grep libpam-sss i libpam-sss:amd64 2.9.4-1.1ubuntu6.1 amd64 Pam module for the System Security Services Daemon Verify that "libnss-sss" (the NSS module for retrieving user and group information) is installed with the following command: $ dpkg -l | grep libnss-sss ii libnss-sss:amd64 2.9.4-1.1ubuntu6.1 amd64 Nss library for the System Security Services Daemon If "libpam-sss" and "libnss-sss" are not installed, this is a finding.

Install the sssd.service and the required pam packages with the following commands: $ sudo apt install sssd $ sudo apt install libpam-sss $ sudo apt install libnss-sss

Verify the "sssd.service" is enabled and active with the following commands: $ sudo systemctl is-enabled sssd enabled $ sudo systemctl is-active sssd active If "sssd.service" is not active or enabled, this is a finding.

Enable the "sssd.service to start automatically on reboot with the following command: $ sudo systemctl enable sssd.service Ensure the "sssd" service is running: $ sudo systemctl start sssd.service

Verify Ubuntu 22.04 LTS, for PKI-based authentication, has valid certificates by constructing a certification path to an accepted trust anchor. Verify the pam service is listed under [sssd] with the following command: $ sudo grep -A 1 '^\[sssd\]' /etc/sssd/sssd.conf [sssd] services = nss,pam,ssh If "pam" is not listed in services, this is a finding. Verify the pam service is set to use pam for smart card authentication in the [pam] section of /etc/sssd/sssd.conf with the following command: $ sudo grep -A 1 '^\[pam]' /etc/sssd/sssd.conf [pam] pam_cert_auth = True If "pam_cert_auth = True" is not returned, this is a finding. Verify "ca" is enabled in "certificate_verification" with the following command: $ sudo grep certificate_verification /etc/sssd/sssd.conf certificate_verification = ca_cert,ocsp If "certificate_verification" is not set to "ca" or the line is commented out, this is a finding.

Configure Ubuntu 22.04 LTS, for PKI-based authentication, to validate certificates by constructing a certification path to an accepted trust anchor. Add or update the /etc/sssd/sssd.conf so that the following entries are in the correct sections of the file: $ sudo vi /etc/sssd/sssd.conf [sssd] services = nss,pam,ssh config_file_version = 2 [pam] pam_cert_auth = True [domain/example.com] ldap_user_certificate = usercertificate;binary certificate_verification = ca_cert,ocsp ca_cert = /etc/ssl/certs/ca-certificates.crt

Verify that authenticated certificates are mapped to the appropriate user group in the "/etc/sssd/sssd.conf" file with the following command: $ grep -i ldap_user_certificate /etc/sssd/sssd.conf ldap_user_certificate=userCertificate;binary

Configure sssd to map authenticated certificates to the appropriate user group by adding the following line to the "/etc/sssd/sssd.conf" file: ldap_user_certificate=userCertificate;binary

Verify Ubuntu 22.04 LTS displays the Standard Mandatory DoW Notice and Consent Banner before granting access to Ubuntu 22.04 LTS via an SSH logon by using the following command: $ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH 'banner' /etc/ssh/sshd_config:Banner /etc/issue.net The command will return the banner option along with the name of the file that contains the SSH banner. If the line is commented out, missing, or conflicting results are returned, this is a finding. Verify the specified banner file matches the Standard Mandatory DoW Notice and Consent Banner exactly: $ cat /etc/issue.net You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details. If the banner text does not match the Standard Mandatory DoW Notice and Consent Banner exactly, this is a finding.

Set the parameter banner in "/etc/ssh/sshd_config" to point to the "/etc/issue.net" file: $ sudo sed -i '/^Banner/d' /etc/ssh/sshd_config $ sudo sed -i '$aBanner /etc/issue.net' /etc/ssh/sshd_config Replace the text in "/etc/issue.net" with the Standard Mandatory DoW Notice and Consent Banner: You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details. Restart the SSH daemon for the changes to take effect and then signal the SSH server to reload the configuration file: $ sudo systemctl -s SIGHUP kill sshd

Verify the SSH server automatically terminates a user session after the SSH client has become unresponsive by using the following command: $ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH 'clientalivecountmax' /etc/ssh/sshd_config:ClientAliveCountMax 1 If "ClientAliveCountMax" is not set to "1", conflicting results are returned, or it is commented out or missing, this is a finding.

Configure the SSH server to terminate a user session automatically after the SSH client has become unresponsive. Note: This setting must be applied in conjunction with UBTU-22-255040 to function correctly. Add or modify the following line in the "/etc/ssh/sshd_config" file: ClientAliveCountMax 1 Restart SSH for the changes to take effect: $ sudo systemctl restart ssh

Verify the SSH server automatically terminates a user session after the SSH client has been unresponsive for 10 minutes by using the following command: $ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH 'clientaliveinterval' /etc/ssh/sshd_config:ClientAliveInterval 600 If "ClientAliveInterval" does not exist or is not set to a value of "600" or less, conflicting results are returned, or it is commented out or missing, this is a finding.

Configure the SSH server to terminate a user session automatically after the SSH client has been unresponsive for 10 minutes. Note: This setting must be applied in conjunction with UBTU-22-255040 to function correctly. Add or modify the following line in the "/etc/ssh/sshd_config" file: ClientAliveInterval 600 Restart SSH for the changes to take effect: $ sudo systemctl restart ssh

Verify the SSH server prevents remote hosts from connecting to the proxy display by using the following command: $ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH 'x11uselocalhost' /etc/ssh/sshd_config:X11UseLocalhost yes If "X11UseLocalhost" is set to "no", is commented out, is missing, or conflicting results are returned, this is a finding.

Configure the SSH server to prevent remote hosts from connecting to the proxy display. Add or modify the following line in the "/etc/ssh/sshd_config" file: X11UseLocalhost yes Restart SSH for the changes to take effect: $ sudo systemctl restart ssh

Verify the SSH server is configured to only implement FIPS-approved ciphers with the following command: $ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH 'ciphers' /etc/ssh/sshd_config:Ciphers aes256-ctr,[email protected],aes128-ctr,[email protected] If "Ciphers" does not contain only the ciphers "aes256-ctr,[email protected],aes128-ctr,[email protected]", is commented out, is missing, or conflicting results are returned, this is a finding.

Configure the SSH server to only implement FIPS-approved ciphers. Add or modify the following line in the "/etc/ssh/sshd_config" file: Ciphers aes256-ctr,[email protected],aes128-ctr,[email protected] Restart SSH for the changes to take effect: $ sudo systemctl restart ssh

Verify the SSH server is configured to only use MACs that employ FIPS 140-3 approved ciphers by using the following command: $ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH 'macs' /etc/ssh/sshd_config:MACs hmac-sha2-512,[email protected],hmac-sha2-256,[email protected] If "MACs" does not contain only the hashes "hmac-sha2-512,[email protected],hmac-sha2-256,[email protected]" in exact order, is commented out, is missing, or conflicting results are returned, this is a finding.

Configure the SSH server to only use MACs that employ FIPS 140-3 approved hashes. Add or modify the following line in the "/etc/ssh/sshd_config" file: MACs hmac-sha2-512,[email protected],hmac-sha2-256,[email protected] Restart the SSH server for the changes to take effect: $ sudo systemctl reload sshd.service

Verify that the SSH server is configured to use only FIPS-validated key exchange algorithms by using the following command: $ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH 'kexalgorithms' /etc/ssh/sshd_config:KexAlgorithms ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256 If "KexAlgorithms" does not contain only the algorithms "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256" in exact order, is commented out, is missing, or conflicting results are returned, this is a finding.

Configure the SSH server to use only FIPS-validated key exchange algorithms. Add or modify the following line in the "/etc/ssh/sshd_config" file: KexAlgorithms ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256 Restart SSH for the changes to take effect: $ sudo systemctl restart ssh

Verify Ubuntu 22.04 LTS is configured to use strong authenticators in the establishment of nonlocal maintenance and diagnostic maintenance by using the following command: $ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH 'usepam' /etc/ssh/sshd_config:UsePAM yes If "UsePAM" is not set to "yes", is commented out, is missing, or conflicting results are returned, this is a finding.

Configure Ubuntu 22.04 LTS to use strong authentication when establishing nonlocal maintenance and diagnostic sessions. Add or modify the following line to /etc/ssh/sshd_config: UsePAM yes Restart SSH for the changes to take effect: $ sudo systemctl restart ssh

Verify Ubuntu 22.04 LTS is configured to display the Standard Mandatory DoW Notice and Consent Banner before granting access to the operating system via a graphical user logon by using the following command: Note: If no graphical user interface is installed, this requirement is not applicable. $ grep -i banner-message-enable /etc/gdm3/greeter.dconf-defaults banner-message-enable=true If the value for "banner-message-enable" is set to "false", the line is commented out, or no value is returned, this is a finding.

Configure Ubuntu 22.04 LTS to display the Standard Mandatory DoW Notice and Consent Banner before granting access to the operating system via a graphical user logon. Add or modify the following line in the "/etc/gdm3/greeter.dconf-defaults" file: [org/gnome/login-screen] banner-message-enable=true Update GDM with the new configuration by using the following commands: $ sudo dconf update $ sudo systemctl restart gdm3

Verify Ubuntu 22.04 LTS displays the Standard Mandatory DoW Notice and Consent Banner before granting access to the operating system via a graphical user logon with the command: Note: If no graphical user interface is installed, this requirement is not applicable. $ grep -i banner-message-text /etc/gdm3/greeter.dconf-defaults banner-message-text="You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\n\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\n\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\n\n-At any time, the USG may inspect and seize data stored on this IS.\n\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\n\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\n\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." If the banner-message-text is missing, commented out, or does not match the Standard Mandatory DoW Notice and Consent Banner exactly, this is a finding.

Edit the "/etc/gdm3/greeter.dconf-defaults" file. Set the "banner-message-text" line to contain the appropriate banner message text as shown below: banner-message-text="You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\n\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\n\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\n\n-At any time, the USG may inspect and seize data stored on this IS.\n\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\n\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\n\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." Update GDM with the new configuration by using the following commands: $ sudo dconf update $ sudo systemctl restart gdm3

Verify Ubuntu 22.04 LTS has a graphical user interface session lock enabled by using the following command: Note: If no graphical user interface is installed, this requirement is not applicable. $ sudo gsettings get org.gnome.desktop.screensaver lock-enabled true If "lock-enabled" is not set to "true", is commented out, or is missing, this is a finding.

Configure Ubuntu 22.04 LTS to allow a user to lock the current graphical user interface session. Create or edit a file named /etc/dconf/db/local.d/00-screensaver with the following contents: [org/gnome/desktop/screensaver] lock-enabled=true

Note: If no graphical user interface is installed, this requirement is not applicable. Verify Ubuntu 22.04 LTS has a graphical user interface session lock configured to activate after 10 minutes of inactivity by using the following commands: Get the following settings to verify the graphical user interface session is configured to lock the graphical user session after 10 minutes of inactivity: $ gsettings get org.gnome.desktop.screensaver lock-enabled true $ gsettings get org.gnome.desktop.screensaver lock-delay uint32 0 $ gsettings get org.gnome.desktop.session idle-delay uint32 600 If "lock-enabled" is not set to "true", is commented out, or is missing, this is a finding. If "lock-delay" is set to a value greater than "0", or if "idle-delay" is set to a value greater than "600", is commented out, or is missing, this is a finding.

Configure Ubuntu 22.04 LTS to lock the current graphical user interface session after 10 minutes of inactivity. Create or edit a file named "/etc/dconf/db/local.d/00-screensaver" with the following contents: [org/gnome/desktop/screensaver] lock-enabled=true lock-delay=0 [org/gnome/desktop/session] idle-delay=600

Verify Ubuntu 22.04 LTS disables ability to load the USB storage kernel module by using the following command: $ grep usb-storage /etc/modprobe.d/* | grep "/bin/false" /etc/modprobe.d/stig.conf:install usb-storage /bin/false If the command does not return any output, or the line is commented out, this is a finding. Verify Ubuntu 22.04 LTS disables the ability to use USB mass storage device. $ grep usb-storage /etc/modprobe.d/* | grep -i "blacklist" /etc/modprobe.d/stig.conf:blacklist usb-storage If the command does not return any output, or the line is commented out, this is a finding.

Configure Ubuntu 22.04 LTS to disable using the USB storage kernel module. Create and/or append a custom file under "/etc/modprobe.d/" to contain the following: $ sudo su -c "echo install usb-storage /bin/false >> /etc/modprobe.d/stig.conf" Configure Ubuntu 22.04 LTS to disable the ability to use USB mass storage devices. $ sudo su -c "echo blacklist usb-storage >> /etc/modprobe.d/stig.conf"

Verify that there are no wireless interfaces configured on the system by using the following command: Note: If the system does not have any physical wireless network radios, this requirement is not applicable. $ cat /proc/net/wireless If any wireless interface names are listed under "Interface" and have not been documented and approved by the information system security officer (ISSO), this is a finding.

Disable all wireless network interfaces by using the following command: $ sudo ifdown For each interface listed, find their respective module by using the following command: $ basename $(readlink -f /sys/class/net//device/driver) where must be substituted by the actual interface name. Create and/or append a custom file under "/etc/modprobe.d/" by using the following command: $ sudo su -c "echo install /bin/false >> /etc/modprobe.d/stig.conf" where must be substituted by the actual module name. For each module from the system, execute the following command to remove it: $ sudo modprobe -r

Verify Ubuntu 22.04 LTS prevents direct logins to the root account by using the following command: $ sudo passwd -S root root L 08/09/2022 0 99999 7 -1 If the output does not contain "L" in the second field to indicate the account is locked, this is a finding.

Configure Ubuntu 22.04 LTS to prevent direct logins to the root account by using the following command: $ sudo passwd -l root

Verify Ubuntu 22.04 LTS contains no duplicate User IDs (UIDs) for interactive users by using the following command: $ awk -F ":" 'list[$3]++{print $1, $3}' /etc/passwd If output is produced and the accounts listed are interactive user accounts, this is a finding.

Edit the file "/etc/passwd" and provide each interactive user account that has a duplicate UID with a unique UID.

Verify Ubuntu 22.04 LTS enforces a 24 hours/one day minimum password lifetime for new user accounts by using the following command: $ grep -i pass_min_days /etc/login.defs PASS_MIN_DAYS 1 If "PASS_MIN_DAYS" is less than "1", is commented out, or is missing, this is a finding.

Configure Ubuntu 22.04 LTS to enforce a 24 hours/one day minimum password lifetime. Add or modify the following line in the "/etc/login.defs" file: PASS_MIN_DAYS 1

Verify Ubuntu 22.04 LTS enforces a 180-day maximum password lifetime for new user accounts by using the following command: $ grep -i pass_max_days /etc/login.defs PASS_MAX_DAYS 180 If "PASS_MAX_DAYS" is less than "180", is commented out, or is missing, this is a finding.

Configure Ubuntu 22.04 LTS to enforce a 180-day maximum password lifetime. Add or modify the following line in the "/etc/login.defs" file: PASS_MAX_DAYS 180

Verify the account identifiers (individuals, groups, roles, and devices) are disabled after 35 days of inactivity by using the following command: Check the account inactivity value by performing the following command: $ grep INACTIVE /etc/default/useradd INACTIVE=35 If "INACTIVE" is set to "-1" or is not set to "35", is commented out, or is missing, this is a finding.

Configure Ubuntu 22.04 LTS to disable account identifiers after 35 days of inactivity after the password expiration. Run the following command to change the configuration for adduser: $ sudo useradd -D -f 35 Note: DoW recommendation is 35 days, but a lower value is acceptable. The value "0" will disable the account immediately after the password expires.

Verify temporary accounts have been provisioned with an expiration date of 72 hours by using the following command: $ sudo chage -l | grep -E '(Password|Account) expires' Password expires : Apr 1, 2024 Account expires : Apr 1, 2024 Verify each of these accounts has an expiration date set within 72 hours. If any temporary accounts have no expiration date set or do not expire within 72 hours, this is a finding.

Configure Ubuntu 22.04 LTS to expire temporary accounts after 72 hours by using the following command: $ sudo chage -E $(date -d +3days +%Y-%m-%d)

Verify Ubuntu 22.04 LTS has the "vlock" package installed by using the following command: $ dpkg -l | grep vlock ii vlock 2.2.2-10 amd64 Virtual Console locking program If "vlock" is not installed, this is a finding.

Install the "vlock" package by using the following command: $ sudo apt-get install vlock

Verify Ubuntu 22.04 LTS is configured to automatically exit interactive command shell user sessions after 15 minutes of inactivity or less by using the following command: $ sudo grep -E "\bTMOUT=[0-9]+" /etc/bash.bashrc /etc/profile.d/* /etc/profile.d/99-terminal_tmout.sh:TMOUT=900 If "TMOUT" is not set to "900" or less, is set to "0", is commented out, or missing, this is a finding.

Configure Ubuntu 22.04 LTS to exit interactive command shell user sessions after 15 minutes of inactivity. Create and/or append a custom file under "/etc/profile.d/" by using the following command: $ sudo su -c "echo TMOUT=900 >> /etc/profile.d/99-terminal_tmout.sh" This will set a timeout value of 15 minutes for all future sessions. To set the timeout for the current sessions, execute the following command over the terminal session: $ export TMOUT=900

Verify Ubuntu 22.04 LTS defines default permissions for all authenticated users in such a way that the user can read and modify only their own files by using the following command: $ grep -i '^\s*umask' /etc/login.defs UMASK 077 If the "UMASK" variable is set to "000", this is a finding with the severity raised to a CAT I. If "UMASK" is not set to "077", is commented out, or is missing, this is a finding.

Configure Ubuntu 22.04 LTS to define the default permissions for all authenticated users in such a way that the user can read and modify only their own files. Add or modify the following line in the "/etc/login.defs" file: UMASK 077

Verify Ubuntu 22.04 LTS system accounts do not have an interactive login shell with the following command: Run the following command to list any system account (UID 0 && $3 < 1000) && $1 !~ /^(halt|sync|shutdown)$/ && $7 !~ /(nologin|false)$/) {print $1 ":" $3 ":" $7}' /etc/passwd If the command returns any output, this is a finding.

Configure Ubuntu 22.04 LTS so that all noninteractive accounts on the system do not have an interactive shell assigned to them. If the system account needs a shell assigned for mission operations, document the need with the information system security officer (ISSO). Run the following command to disable the interactive shell for a specific noninteractive user account: $ sudo usermod -s /usr/sbin/nologin

Verify Ubuntu 22.04 LTS has the "apparmor" package installed by using the following command: $ dpkg -l | grep apparmor ii apparmor 3.0.4-2ubuntu2.3 amd64 user-space parser utility for AppArmor If the "apparmor" package is not installed, this is a finding.

Install the "appArmor" package by using the following command: $ sudo apt-get install apparmor

Verify Ubuntu 22.04 LTS AppArmor is active by using the following commands: $ systemctl is-enabled apparmor.service enabled $ systemctl is-active apparmor.service active If "apparmor.service" is not enabled and active, this is a finding. Check if AppArmor profiles are loaded and enforced by using the following command: $ sudo apparmor_status | grep -i profile 32 profiles are loaded. 32 profiles are in enforce mode. 0 profiles are in complain mode. 0 profiles are in kill mode. 0 profiles are in unconfined mode. 2 processes have profiles defined. 0 processes are unconfined but have a profile defined. If no profiles are loaded and enforced, this is a finding.

Enable and start "apparmor.service" by using the following command: $ sudo systemctl enable apparmor.service --now Note: AppArmor must have properly configured profiles for applications and home directories. All configurations will be based on the actual system setup and organization and normally are on a per role basis. See the AppArmor documentation for more information on configuring profiles.

Verify the "/etc/sudoers" file has no occurrences of "!authenticate" with the following command: $ sudo egrep -iR '!authenticate' /etc/sudoers /etc/sudoers.d/ If any occurrences of "!authenticate" return from the command, this is a finding.

Remove any occurrence of "!authenticate" found in "/etc/sudoers" file or files in the "/etc/sudoers.d" directory.

Verify "/etc/sudoers" has no occurrences of "NOPASSWD" with the following command: $ sudo egrep -iR 'NOPASSWD' /etc/sudoers /etc/sudoers.d/ If any occurrences of "NOPASSWD" are returned from the command and have not been documented with the information system security officer (ISSO) as an organizationally defined administrative group using multifactor authentication (MFA), this is a finding.

Configure the operating system to not allow users to execute privileged actions without authenticating with a password. Remove any occurrence of "NOPASSWD" found in "/etc/sudoers" file or files in the "/etc/sudoers.d" directory. $ sudo find /etc/sudoers /etc/sudoers.d -type f -exec sed -i '/NOPASSWD/ s/^/# /g' {} \;

Verify Ubuntu 22.04 LTS enforces password complexity by requiring at least one uppercase character be used by using the following command: $ grep -i ucredit /etc/security/pwquality.conf ucredit = -1 If "ucredit" is greater than "-1", is commented out, or is missing, this is a finding.

Configure Ubuntu 22.04 LTS to enforce password complexity by requiring that at least one uppercase character be used. Add or modify the following line in the "/etc/security/pwquality.conf" file: ucredit = -1

Verify Ubuntu 22.04 LTS enforces password complexity by requiring that at least one lowercase character be used by using the following command: $ grep -i lcredit /etc/security/pwquality.conf lcredit = -1 If "lcredit" is greater than "-1", is commented out, or is missing, this is a finding.

Configure Ubuntu 22.04 LTS to enforce password complexity by requiring that at least one lowercase character be used. Add or modify the following line in the "/etc/security/pwquality.conf" file: lcredit = -1

Verify Ubuntu 22.04 LTS enforces password complexity by requiring that at least one numeric character be used by using the following command: $ grep -i dcredit /etc/security/pwquality.conf dcredit = -1 If "dcredit" is greater than "-1", is commented out, or is missing, this is a finding.

Configure Ubuntu 22.04 LTS to enforce password complexity by requiring that at least one numeric character be used. Add or modify the following line in the "/etc/security/pwquality.conf" file: dcredit = -1

Verify Ubuntu 22.04 LTS enforces password complexity by requiring that at least one special character be used by using the following command: $ grep -i ocredit /etc/security/pwquality.conf ocredit = -1 If "ocredit" is greater than "-1", is commented out, or is missing, this is a finding.

Configure Ubuntu 22.04 LTS to enforce password complexity by requiring that at least one special character be used. Add or modify the following line in the "/etc/security/pwquality.conf" file: ocredit = -1

Verify Ubuntu 22.04 LTS prevents the use of dictionary words for passwords by using the following command: $ grep -i dictcheck /etc/security/pwquality.conf dictcheck = 1 If "dictcheck" is not set to "1", is commented out, or is missing, this is a finding.

Configure Ubuntu 22.04 LTS to prevent the use of dictionary words for passwords. Add or modify the following line in the "/etc/security/pwquality.conf" file: dictcheck = 1

Verify the pwquality configuration file enforces a minimum 15-character password length by using the following command: $ grep -i minlen /etc/security/pwquality.conf minlen = 15 If "minlen" is not "15" or higher, is commented out, or is missing, this is a finding.

Configure Ubuntu 22.04 LTS to enforce a minimum 15-character password length. Add or modify the following line in the "/etc/security/pwquality.conf" file: minlen = 15

Verify Ubuntu 22.04 LTS requires the change of at least eight characters when passwords are changed by using the following command: $ grep -i difok /etc/security/pwquality.conf difok = 8 If "difok" is less than "8", is commented out, or is missing, this is a finding.

Configure Ubuntu 22.04 LTS to require the change of at least eight characters when passwords are changed. Add or modify the following line in the "/etc/security/pwquality.conf" file: difok = 8

Verify Ubuntu 22.04 LTS enforces password complexity rules by using the following command: $ grep -i enforcing /etc/security/pwquality.conf enforcing = 1 If "enforcing" is not "1", is commented out, or is missing, this is a finding. Check for the use of "pwquality" by using the following command: $ cat /etc/pam.d/common-password | grep requisite | grep pam_pwquality password requisite pam_pwquality.so retry=3 If "retry" is set to "0" or is greater than "3", or is missing, this is a finding.

Configure Ubuntu 22.04 LTS to enforce password complexity rules. Add or modify the following line in the "/etc/security/pwquality.conf" file: enforcing = 1 Add or modify the following line in the "/etc/pam.d/common-password" file: password requisite pam_pwquality.so retry=3 Note: The value of "retry" should be between "1" and "3".

Verify the Ubuntu operating stores only encrypted representations of passwords with the following command: $ grep pam_unix.so /etc/pam.d/common-password password [success=1 default=ignore] pam_unix.so obscure sha512 shadow rounds=100000 If "sha512" is missing from the "pam_unix.so" line, or if the "rounds" is set to less than 100000, this is a finding.

Configure Ubuntu 22.04 LTS to store encrypted representations of passwords. Add or modify the following line in the "/etc/pam.d/common-password" file: password [success=1 default=ignore] pam_unix.so obscure sha512 shadow rounds=100000

Verify that the shadow password suite configuration is set to encrypt passwords with a FIPS 140-3 approved cryptographic hashing algorithm by using the following command: $ grep -i '^\s*encrypt_method' /etc/login.defs ENCRYPT_METHOD SHA512 If "ENCRYPT_METHOD" does not equal SHA512 or greater, is commented out, or is missing, this is a finding.

Configure Ubuntu 22.04 LTS to encrypt all stored passwords. Add or modify the following line in the "/etc/login.defs" file: ENCRYPT_METHOD SHA512

Verify Ubuntu 22.04 LTS has the packages required for multifactor authentication installed by using the following command: $ dpkg -l | grep libpam-pkcs11 ii libpam-pkcs11 0.6.11-4build2 amd64 Fully featured PAM module for using PKCS#11 smart cards If the "libpam-pkcs11" package is not installed, this is a finding.

Install the "libpam-pkcs11" package by using the following command: $ sudo apt-get install libpam-pkcs11

Verify the "opensc-pcks11" package is installed on the system by using the following command: $ dpkg -l | grep opensc-pkcs11 ii opensc-pkcs11:amd64 0.22.0-1Ubuntu2 amd64 Smart card utilities with support for PKCS#15 compatible cards If the "opensc-pcks11" package is not installed, this is a finding.

Install the "opensc-pkcs11" package by using the following command: $ sudo apt-get install opensc-pkcs11

Verify that the "pam_pkcs11.so" module is configured by using the following command: $ grep -i pam_pkcs11.so /etc/pam.d/common-auth auth [success=3 default=ignore] pam_pkcs11.so If "pam_pkcs11.so" is commented out or is missing, this is a finding. Verify the sshd daemon allows public key authentication by using the following command: $ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH 'pubkeyauthentication' /etc/ssh/sshd_config:PubkeyAuthentication yes If "PubkeyAuthentication" is not set to "yes" or is commented out or missing, or if conflicting results are returned, this is a finding.

Configure Ubuntu 22.04 LTS to use multifactor authentication for access to accounts. Add or modify the following line in the "/etc/pam.d/common-auth" file: auth [success=3 default=ignore] pam_pkcs11.so Add or modify the following line in the "/etc/ssh/sshd_config" file: PubkeyAuthentication yes

Verify Ubuntu 22.04 LTS electronically verifies PIV credentials via certificate status checking by using the following command: $ sudo grep use_pkcs11_module /etc/pam_pkcs11/pam_pkcs11.conf | sudo awk '/pkcs11_module opensc {/,/}/' /etc/pam_pkcs11/pam_pkcs11.conf | grep cert_policy | grep ocsp_on cert_policy = ca,signature,ocsp_on; If every returned "cert_policy" line is not set to "ocsp_on", the line is commented out, or is missing, this is a finding.

Configure Ubuntu 22.04 LTS to do certificate status checking for multifactor authentication. Add or modify all "cert_policy" lines in the "/etc/pam_pkcs11/pam_pkcs11.conf" file with the following: ocsp_on

Verify Ubuntu 22.04 LTS, for PKI-based authentication, has valid certificates by constructing a certification path to an accepted trust anchor. Determine which pkcs11 module is being used via the "use_pkcs11_module" in "/etc/pam_pkcs11/pam_pkcs11.conf" and then ensure "ca" is enabled in "cert_policy" by using the following command: $ sudo grep use_pkcs11_module /etc/pam_pkcs11/pam_pkcs11.conf | sudo awk '/pkcs11_module opensc {/,/}/' /etc/pam_pkcs11/pam_pkcs11.conf | grep cert_policy | grep ca cert_policy = ca,signature,ocsp_on; If "cert_policy" is not set to "ca", the line is commented out, or is missing, this is a finding.

Configure Ubuntu 22.04 LTS, for PKI-based authentication, to validate certificates by constructing a certification path to an accepted trust anchor. Add or modify all "cert_policy" lines in the "/etc/pam_pkcs11/pam_pkcs11.conf" file with the following: cert_policy = ca,signature,ocsp_on; Note: If the system is missing an "/etc/pam_pkcs11/" directory and an "/etc/pam_pkcs11/pam_pkcs11.conf", find an example to copy into place and modify accordingly at "/usr/share/doc/libpam-pkcs11/examples/pam_pkcs11.conf.example.gz".

Verify Ubuntu 22.04 LTS, for PKI-based authentication, uses local revocation data when unable to access it from the network by using the following command: Note: If smart card authentication is not being used on the system, this is not applicable. $ grep cert_policy /etc/pam_pkcs11/pam_pkcs11.conf | grep -E -- 'crl_auto|crl_offline' cert_policy = ca,signature,ocsp_on,crl_auto; If "cert_policy" is not set to include "crl_auto" or "crl_offline", is commented out, or is missing, this is a finding.

Configure Ubuntu 22.04 LTS, for PKI-based authentication, to use local revocation data when unable to access the network to obtain it remotely. Add or update the "cert_policy" option in "/etc/pam_pkcs11/pam_pkcs11.conf" to include "crl_auto" or "crl_offline". cert_policy = ca,signature,ocsp_on, crl_auto; If the system is missing an "/etc/pam_pkcs11/" directory and an "/etc/pam_pkcs11/pam_pkcs11.conf", find an example to copy into place and modify accordingly at "/usr/share/doc/libpam-pkcs11/examples/pam_pkcs11.conf.example.gz".

Verify the directory containing the root certificates for Ubuntu 22.04 LTS contains certificate files for DoW PKI-established certificate authorities by iterating over all files in the "/etc/ssl/certs" directory and checking if, at least one, has the subject matching "DOD ROOT CA". $ ls /etc/ssl/certs | grep -i DoW DoW_PKE_CA_chain.pem If no DoW root certificate is found, this is a finding. Verify that all root certificates present on the system have been approved by the AO. $ ls /etc/ssl/certs If a certificate is present that is not approved by the AO, this is a finding.

Configure Ubuntu 22.04 LTS to use of DoW PKI-established certificate authorities for verification of the establishment of protected sessions. Add at least one DoW certificate authority to the "/usr/share/ca-certificates" directory in the CRT format. Update the "/etc/ssl/certs" directory by using the following command: $ sudo dpkg-reconfigure ca-certificates

Verify that Advanced Intrusion Detection Environment (AIDE) is installed by using the following command: $ dpkg -l | grep aide ii aide 0.17.4-1 amd64 Advanced Intrusion Detection Environment - dynamic binary If AIDE is not installed, ask the system administrator how file integrity checks are performed on the system. If there is no application installed to perform integrity checks, this is a finding.

Install the "aide" package: $ sudo apt install aide

Note: If a file integrity tool other than AIDE is employed, this requirement is not applicable. Verify AIDE is configured and operating correctly by using the following command (this will take a few minutes): $ sudo aide -c /etc/aide/aide.conf --check Example output: Start timestamp: 2024-04-01 04:20:00 +1300 (AIDE 0.17.4) AIDE found differences between database and filesystem!! Ignored e2fs attributes: EIh ... If AIDE is being used to perform file integrity checks but the command fails, this is a finding.

Initialize AIDE (this will take a few minutes): $ sudo aideinit Running aide --init... Example output: Start timestamp: 2024-04-01 04:20:00 +1300 (AIDE 0.17.4) AIDE initialized database at /var/lib/aide/aide.db.new Ignored e2fs attributes: EIh Number of entries: 146185 --------------------------------------------------- The attributes of the (uncompressed) database(s): --------------------------------------------------- /var/lib/aide/aide.db.new SHA256 : UrYbC/KBOJcs8zKcSlKoifnnoPK66DEC Aw6odu/BpgY= SHA512 : ezENbbuh937SPWvtsdjRzy3i47XjLg7j L3UGmr0EcgY6u8rczxgbn2RuwJfrIpef 0c1qMNobzrLXyDnnqEqAqw== RMD160 : yBq2xio+g5ne4kvZzzMZ2v+EO9w= TIGER : GkJ/xkzJGu/aSQqk9A5LN271IOAQC3d0 CRC32 : g/beXA== HAVAL : zZm220YZiGna2edJ6Gi0rPv16AlpqeHB y/XLB3hIPEY= WHIRLPOOL : k6veoXavJ/BH9L125pCYAfTB8w5ZJkdC DvVmYS0+cgmg7M0y/S2v42FNCEJ993mc 3kZMXJR/VVmwKg/7ntGixQ== GOST : psjiyix6mJlNsE984D0NwbfgBmB0ETGl /R4PNvm/wKg= End timestamp: 2024-04-01 04:29:16 +1300 (run time: 9m 16s)

Verify that Advanced Intrusion Detection Environment (AIDE) notifies the system administrator when anomalies in the operation of any security functions are discovered by using the following command: $ grep -i '^\s*silentreports' /etc/default/aide SILENTREPORTS=no If "SILENTREPORTS" is set to "yes", is commented out, or is missing, this is a finding.

Configure AIDE to notify designated personnel if baseline configurations are changed in an unauthorized manner. Add or modify the following line in the "/etc/default/aide" file: SILENTREPORTS=no

Verify that the Advanced Intrusion Detection Environment (AIDE) default script used to check file integrity each 30 days or less is unchanged. Download the original aide-common package in the /tmp directory: $ cd /tmp; apt download aide-common Fetch the SHA1 of the original script file: $ dpkg-deb --fsys-tarfile /tmp/aide-common_*.deb | tar -xO ./usr/share/aide/config/cron.daily/aide | sha1sum b71bb2cafaedf15ec3ac2f566f209d3260a37af0 - Compare with the SHA1 of the file in the daily or monthly cron directory: $ sha1sum /etc/cron.{daily,monthly}/aide 2>/dev/null b71bb2cafaedf15ec3ac2f566f209d3260a37af0 /etc/cron.daily/aide If there is no AIDE script file in the cron directories, or the SHA1 value of at least one file in the daily or monthly cron directory does not match the SHA1 of the original, this is a finding.

The cron file for AIDE is fairly complex as it creates the report. This file is installed with the "aide-common" package, and the default can be restored by copying it from the package: Extract the aide script from the "aide-common" package to its original place: $ dpkg-deb --fsys-tarfile /tmp/aide-common_*.deb | sudo tar -x ./usr/share/aide/config/cron.daily/aide -C / Copy it to the cron.daily directory: $ sudo cp -f /usr/share/aide/config/cron.daily/aide /etc/cron.daily/aide

Verify that Advanced Intrusion Detection Environment (AIDE) is properly configured to use cryptographic mechanisms to protect the integrity of audit tools by using the following command: $ grep -E '(\/sbin\/(audit|au))' /etc/aide/aide.conf /sbin/auditctl p+i+n+u+g+s+b+acl+xattrs+sha512 /sbin/auditd p+i+n+u+g+s+b+acl+xattrs+sha512 /sbin/ausearch p+i+n+u+g+s+b+acl+xattrs+sha512 /sbin/aureport p+i+n+u+g+s+b+acl+xattrs+sha512 /sbin/autrace p+i+n+u+g+s+b+acl+xattrs+sha512 /sbin/augenrules p+i+n+u+g+s+b+acl+xattrs+sha512 If any of the lines do not appear as shown, are commented out, or are missing, this is a finding.

Configure AIDE to protect the integrity of audit tools: Add or modify the following lines in the "/etc/aide/aide.conf" file: # Audit Tools /sbin/auditctl p+i+n+u+g+s+b+acl+xattrs+sha512 /sbin/auditd p+i+n+u+g+s+b+acl+xattrs+sha512 /sbin/ausearch p+i+n+u+g+s+b+acl+xattrs+sha512 /sbin/aureport p+i+n+u+g+s+b+acl+xattrs+sha512 /sbin/autrace p+i+n+u+g+s+b+acl+xattrs+sha512 /sbin/augenrules p+i+n+u+g+s+b+acl+xattrs+sha512

Verify the log service is installed properly by using the following command: $ dpkg -l | grep rsyslog ii rsyslog 8.2112.0-2ubuntu2.2 amd64 reliable system and kernel logging daemon If the "rsyslog" package is not installed, this is a finding. Check that the log service is enabled and active by using the following commands: $ systemctl is-enabled rsyslog.service enabled $ systemctl is-active rsyslog.service active If "rsyslog.service" is not enabled and active, this is a finding.

Install the log service by using the following command: $ sudo apt-get install rsyslog Enable and activate the log service by using the following command: $ sudo systemctl enable rsyslog.service --now

Verify that Ubuntu 22.04 LTS monitors all remote access methods by using the following command: $ grep -Er '^(auth\.\*,authpriv\.\*|daemon\.\*)' /etc/rsyslog.* /etc/rsyslog.d/50-default.conf:auth.*,authpriv.* /var/log/secure /etc/rsyslog.d/50-default.conf:daemon.* /var/log/messages If "auth.*", "authpriv.*", or "daemon.*" are not configured to be logged in at least one of the config files, this is a finding.

Configure Ubuntu 22.04 LTS to monitor all remote access methods. Add or modify the following line in the "/etc/rsyslog.d/50-default.conf" file: auth.*,authpriv.* /var/log/secure daemon.* /var/log/messages Restart "rsyslog.service" for the changes to take effect by using the following command: $ sudo systemctl restart rsyslog.service

Verify the "auditd" package is installed by using the following command: $ dpkg -l | grep auditd ii libauditd 1:3.0.7-1build1 amd64 User space tools for security auditing If the "auditd" package is not installed, this is a finding.

Install the "auditd" package by using the following command: $ sudo apt-get install auditd

Verify the "auditd.service" is enabled and active by using the following commands: $ systemctl is-enabled auditd.service enabled $ systemctl is-active auditd.service active If the "auditd.service" is not enabled and active, this is a finding.

Enable and start the "auditd.service" by using the following command: $ sudo systemctl enable auditd.service --now

Verify Ubuntu 22.04 LTS takes the appropriate action when the audit storage volume is full by using the following command: $ sudo grep -i disk_full_action /etc/audit/auditd.conf disk_full_action = HALT If "disk_full_action" is not set to "HALT", "SYSLOG", or "SINGLE", is commented out, or is missing, this is a finding.

Configure Ubuntu 22.04 LTS to shut down by default upon audit failure. Add or modify the following line in the "/etc/audit/auditd.conf " file: disk_full_action = HALT Restart the "auditd" service for the changes to take effect: $ sudo systemctl restart auditd.service Note: If system availability has been determined to be more important, and this decision is documented with the ISSO, configure Ubuntu 22.04 LTS to notify system administration staff and ISSO staff in the event of an audit processing failure by setting the "disk_full_action" to "SYSLOG" or "SINGLE".

Verify that the audit log files have a mode of "600" or less permissive. Determine where the audit logs are stored by using the following command: $ sudo grep -iw log_file /etc/audit/auditd.conf log_file = /var/log/audit/audit.log Using the path of the directory containing the audit logs, determine if the audit log files have a mode of "600" or less by using the following command: $ sudo stat -c "%n %a" /var/log/audit/* /var/log/audit/audit.log 600 If the audit log files have a mode more permissive than "600", this is a finding.

Configure the audit log files to have a mode of "600" or less permissive. Using the path of the directory containing the audit logs, configure the audit log files to have a mode of "600" or less permissive by using the following command: $ sudo chmod 600 /var/log/audit/*

Verify the audit log files are owned by "root" account. Determine where the audit logs are stored by using the following command: $ sudo grep -iw log_file /etc/audit/auditd.conf log_file = /var/log/audit/audit.log Using the path of the directory containing the audit logs, determine if the audit log files are owned by the "root" user by using the following command: $ sudo stat -c "%n %U" /var/log/audit/* /var/log/audit/audit.log root If the audit log files are owned by a user other than "root", this is a finding.

Configure the audit log directory and its underlying files to be owned by "root" user. Using the path of the directory containing the audit logs, configure the audit log files to be owned by "root" user by using the following command: $ sudo chown root /var/log/audit/*

Verify the group owner of newly created audit logs is "root" by using the following command: $ sudo grep -iw log_group /etc/audit/auditd.conf log_group = root If "log_group" is not set to "root", this is a finding.

Configure the group owner of newly created audit logs to be "root". Add or modify the following lines in the "/etc/audit/auditd.conf " file: log_group = root Reload the configuration file of the audit service to update the group ownership of existing files: $ sudo systemctl kill auditd -s SIGHUP

Verify that the audit log directory has a mode of "750" or less permissive. Determine where the audit logs are stored by using the following command: $ sudo grep -iw log_file /etc/audit/auditd.conf log_file = /var/log/audit/audit.log Using the path of the directory containing the audit logs, determine if the directory has a mode of "750" or less by using the following command: $ sudo stat -c "%n %a" /var/log/audit /var/log/audit 750 If the audit log directory has a mode more permissive than "750", this is a finding.

Configure the audit log directory to have a mode of "750" or less permissive. Using the path of the directory containing the audit logs, configure the audit log directory to have a mode of "750" or less permissive by using the following command: $ sudo chmod -R g-w,o-rwx /var/log/audit

Verify that "/etc/audit/audit.rules", "/etc/audit/auditd.conf", and "/etc/audit/rules.d/*" files have a mode of "640" or less permissive by using the following command: $ sudo ls -al /etc/audit/audit.rules /etc/audit/auditd.conf /etc/audit/rules.d/* | awk '{print $1, $9}' -rw-r----- /etc/audit/audit.rules -rw-r----- /etc/audit/auditd.conf -rw-r----- /etc/audit/rules.d/audit.rules If "/etc/audit/audit.rules", "/etc/audit/auditd.conf", or "/etc/audit/rules.d/*" files have a mode more permissive than "640", this is a finding.

Configure /etc/audit/audit.rules", "/etc/audit/auditd.conf", and "/etc/audit/rules.d/*" files to have a mode of "640" by using the following command: $ sudo chmod -R 640 /etc/audit/audit.rules /etc/audit/auditd.conf /etc/audit/rules.d/*

Verify that "/etc/audit/audit.rules", "/etc/audit/auditd.conf", and "/etc/audit/rules.d/*" files are owned by root account by using the following command: $ sudo ls -al /etc/audit/audit.rules /etc/audit/auditd.conf /etc/audit/rules.d/* | awk '{print $3, $9}' root /etc/audit/audit.rules root /etc/audit/auditd.conf root /etc/audit/rules.d/audit.rules If "/etc/audit/audit.rules", "/etc/audit/auditd.conf", or "/etc/audit/rules.d/*" files are owned by a user other than "root", this is a finding.

Configure "/etc/audit/audit.rules", "/etc/audit/rules.d/*", and "/etc/audit/auditd.conf" files to be owned by root by using the following command: $ sudo chown -R root /etc/audit/audit.rules /etc/audit/auditd.conf /etc/audit/rules.d/*

Verify that "/etc/audit/audit.rules", "/etc/audit/auditd.conf", and "/etc/audit/rules.d/*" files are owned by root group by using the following command: $ sudo ls -al /etc/audit/audit.rules /etc/audit/auditd.conf /etc/audit/rules.d/* | awk '{print $4, $9}' root /etc/audit/audit.rules root /etc/audit/auditd.conf root /etc/audit/rules.d/audit.rules If "/etc/audit/audit.rules", "/etc/audit/auditd.conf", or "/etc/audit/rules.d/*" files are owned by a group other than "root", this is a finding.

Configure "/etc/audit/audit.rules", "/etc/audit/rules.d/*", and "/etc/audit/auditd.conf" files to be owned by root group by using the following command: $ sudo chown -R :root /etc/audit/audit.rules /etc/audit/auditd.conf /etc/audit/rules.d/*

Verify Ubuntu 22.04 LTS generates an audit record upon successful/unsuccessful attempts to use the "apparmor_parser" command by using the following command: $ sudo auditctl -l | grep apparmor_parser -a always,exit -S all -F path=/sbin/apparmor_parser -F perm=x -F auid>=1000 -F auid!=-1 -F key=perm_chng If the command does not return a line that matches the example or the line is commented out, this is a finding. Note: The "key=" value is arbitrary and can be different from the example output above.

Configure the audit system to generate an audit event for any successful/unsuccessful use of the "apparmor_parser" command. Add or modify the following line in the "/etc/audit/rules.d/stig.rules" file: -a always,exit -F path=/sbin/apparmor_parser -F perm=x -F auid>=1000 -F auid!=unset -k perm_chng To reload the rules file, issue the following command: $ sudo augenrules --load Note: The "-k " at the end of the line gives the rule a unique meaning to help during an audit investigation. The does not need to match the example above.

Verify Ubuntu 22.04 LTS generates an audit record upon successful/unsuccessful attempts to use the "chacl" command by using the following command: $ sudo auditctl -l | grep chacl -a always,exit -S all -F path=/usr/bin/chacl -F perm=x -F auid>=1000 -F auid!=-1 -F key=perm_chng If the command does not return a line that matches the example or the line is commented out, this is a finding. Note: The "key=" value is arbitrary and can be different from the example output above.

Configure the audit system to generate an audit event for any successful/unsuccessful use of the "chacl" command. Add or modify the following line in the "/etc/audit/rules.d/stig.rules" file: -a always,exit -F path=/usr/bin/chacl -F perm=x -F auid>=1000 -F auid!=unset -k perm_chng To reload the rules file, issue the following command: $ sudo augenrules --load Note: The "-k " at the end of the line gives the rule a unique meaning to help during an audit investigation. The does not need to match the example above.

Verify that an audit event is generated for any successful/unsuccessful use of the "chage" command by using the following command: $ sudo auditctl -l | grep -w chage -a always,exit -S all -F path=/usr/bin/chage -F perm=x -F auid>=1000 -F auid!=-1 -F key=privileged-chage If the command does not return a line that matches the example or the line is commented out, this is a finding. Note: The "key=" value is arbitrary and can be different from the example output above.

Configure the audit system to generate an audit event for any successful/unsuccessful uses of the "chage" command. Add or modify the following line in the "/etc/audit/rules.d/stig.rules" file: -a always,exit -F path=/usr/bin/chage -F perm=x -F auid>=1000 -F auid!=unset -k privileged-chage To reload the rules file, issue the following command: $ sudo augenrules --load Note: The "-k " at the end of the line gives the rule a unique meaning to help during an audit investigation. The does not need to match the example above.

Verify Ubuntu 22.04 LTS generates an audit record upon successful/unsuccessful attempts to use the "chcon" command by using the following command: $ sudo auditctl -l | grep chcon -a always,exit -S all -F path=/usr/bin/chcon -F perm=x -F auid>=1000 -F auid!=-1 -F key=perm_chng If the command does not return a line that matches the example or the line is commented out, this is a finding. Note: The "key=" value is arbitrary and can be different from the example output above.

Configure the audit system to generate an audit event for any successful/unsuccessful use of the "chcon" command. Add or modify the following line in the "/etc/audit/rules.d/stig.rules" file: -a always,exit -F path=/usr/bin/chcon -F perm=x -F auid>=1000 -F auid!=unset -k perm_chng To reload the rules file, issue the following command: $ sudo augenrules --load Note: The "-k " at the end of the line gives the rule a unique meaning to help during an audit investigation. The does not need to match the example above.

Verify Ubuntu 22.04 LTS generates audit records upon successful/unsuccessful attempts to use the "chfn" command by using the following command: $ sudo auditctl -l | grep /usr/bin/chfn -a always,exit -S all -F path=/usr/bin/chfn -F perm=x -F auid>=1000 -F auid!=-1 -F key=privileged-chfn If the command does not return lines that match the example or the lines are commented out, this is a finding. Note: The "key=" value is arbitrary and can be different from the example output above.

Configure the audit system to generate an audit event for any successful/unsuccessful uses of the "chfn" command. Add or modify the following line in the "/etc/audit/rules.d/stig.rules" file: -a always,exit -F path=/usr/bin/chfn -F perm=x -F auid>=1000 -F auid!=unset -k privileged-chfn To reload the rules file, issue the following command: $ sudo augenrules --load Note: The "-k " at the end of the line gives the rule a unique meaning to help during an audit investigation. The does not need to match the example above.

Verify Ubuntu 22.04 LTS generates an audit record upon successful/unsuccessful attempts to use the "chsh" command by using the following command: $ sudo auditctl -l | grep chsh -a always,exit -S all -F path=/usr/bin/chsh -F perm=x -F auid>=1000 -F auid!=-1 -F key=priv_cmd If the command does not return a line that matches the example or the line is commented out, this is a finding. Notes: The "-k" allows for specifying an arbitrary identifier, and the string after it does not need to match the example output above.

Configure the audit system to generate an audit event for any successful/unsuccessful use of the "chsh" command. Add or modify the following line in the "/etc/audit/rules.d/stig.rules" file: -a always,exit -F path=/usr/bin/chsh -F perm=x -F auid>=1000 -F auid!=unset -k priv_cmd To reload the rules file, issue the following command: $ sudo augenrules --load Note: The "-k " at the end of the line gives the rule a unique meaning to help during an audit investigation. The does not need to match the example above.

Verify that an audit event is generated for any successful/unsuccessful use of the "crontab" command by using the following command: $ sudo auditctl -l | grep -w crontab -a always,exit -S all -F path=/usr/bin/crontab -F perm=x -F auid>=1000 -F auid!=-1 -F key=privileged-crontab If the command does not return a line that matches the example or the line is commented out, this is a finding. Note: The "key=" value is arbitrary and can be different from the example output above.

Configure the audit system to generate an audit event for any successful/unsuccessful uses of the "crontab" command. Add or modify the following line in the "/etc/audit/rules.d/stig.rules" file: -a always,exit -F path=/usr/bin/crontab -F perm=x -F auid>=1000 -F auid!=unset -k privileged-crontab To reload the rules file, issue the following command: $ sudo augenrules --load Note: The "-k " at the end of the line gives the rule a unique meaning to help during an audit investigation. The does not need to match the example above.

Verify Ubuntu 22.04 LTS is configured to audit the execution of any system call made by cron as root or as any privileged user. $ sudo auditctl -l | grep /etc/cron.d -w /etc/cron.d -p wa -k cronjobs $ sudo auditctl -l | grep /var/spool/cron -w /var/spool/cron -p wa -k cronjobs If either of these commands do not return the expected output, or the lines are commented out, this is a finding.

Configure Ubuntu 22.04 LTS to audit the execution of any system call made by cron as root or as any privileged user. Add or update the following file system rules to "/etc/audit/rules.d/stig.rules": -w /etc/cron.d/ -p wa -k cronjobs -w /var/spool/cron/ -p wa -k cronjobs To load the rules to the kernel immediately, use the following command: $ sudo augenrules --load

Verify Ubuntu 22.04 LTS is configured to audit the execution of the partition management program "fdisk" by using the following command: $ sudo auditctl -l | grep fdisk -w /usr/sbin/fdisk -p x -k fdisk If the command does not return a line, or the line is commented out, this is a finding. Note: The "-k" value is arbitrary and can be different from the example output above.

Configure Ubuntu 22.04 LTS to audit the execution of the partition management program "fdisk". Add or modify the following line in the "/etc/audit/rules.d/stig.rules" file: -w /usr/sbin/fdisk -p x -k fdisk To reload the rules file, issue the following command: $ sudo augenrules --load Note: The "-k " at the end of the line gives the rule a unique meaning to help during an audit investigation. The does not need to match the example above.

Verify that an audit event is generated for any successful/unsuccessful use of the "gpasswd" command by using the following command: $ sudo auditctl -l | grep -w gpasswd -a always,exit -S all -F path=/usr/bin/gpasswd -F perm=x -F auid>=1000 -F auid!=-1 -F key=privileged-gpasswd If the command does not return a line that matches the example or the line is commented out, this is a finding. Note: The "key=" value is arbitrary and can be different from the example output above.

Configure the audit system to generate an audit event for any successful/unsuccessful uses of the "gpasswd" command. Add or modify the following line in the "/etc/audit/rules.d/stig.rules" file: -a always,exit -F path=/usr/bin/gpasswd -F perm=x -F auid>=1000 -F auid!=unset -k privileged-gpasswd To reload the rules file, issue the following command: $ sudo augenrules --load Note: The "-k " at the end of the line gives the rule a unique meaning to help during an audit investigation. The does not need to match the example above.

Verify Ubuntu 22.04 LTS is configured to audit the execution of the module management program "kmod" by using the following command: $ sudo auditctl -l | grep kmod -w /bin/kmod -p x -k module If the command does not return a line, or the line is commented out, this is a finding. Note: The "-k" value is arbitrary and can be different from the example output above.

Configure Ubuntu 22.04 LTS to audit the execution of the module management program "kmod". Add or modify the following line in the "/etc/audit/rules.d/stig.rules" file: -w /bin/kmod -p x -k modules To reload the rules file, issue the following command: $ sudo augenrules --load Note: The "-k " at the end of the line gives the rule a unique meaning to help during an audit investigation. The does not need to match the example above.

Verify if Ubuntu 22.04 LTS is configured to audit the execution of the module management program "modprobe" with the following command: $ sudo auditctl -l | grep /sbin/modprobe -w /sbin/modprobe -p x -k modules If the command does not return a line, or the line is commented out, this is a finding. Note: The "-k" value is arbitrary and can be different from the example output above.

Configure Ubuntu 22.04 LTS to audit the execution of the module management program "modprobe". Add or modify the following line in the "/etc/audit/rules.d/stig.rules" file: -w /sbin/modprobe -p x -k modules To reload the rules file, issue the following command: $ sudo augenrules --load Note: The "-k " at the end of the line gives the rule a unique meaning to help during an audit investigation. The does not need to match the example above.

Verify Ubuntu 22.04 LTS generates audit records upon successful/unsuccessful attempts to use the "mount" command by using the following command: $ sudo auditctl -l | grep /usr/bin/mount -a always,exit -S all -F path=/usr/bin/mount -F perm=x -F auid>=1000 -F auid!=-1 -F key=privileged-mount If the command does not return lines that match the example or the lines are commented out, this is a finding. Note: The "key=" value is arbitrary and can be different from the example output above.

Configure the audit system to generate an audit event for any successful/unsuccessful use of the "mount" command. Add or modify the following line in the "/etc/audit/rules.d/stig.rules" file: -a always,exit -F path=/usr/bin/mount -F perm=x -F auid>=1000 -F auid!=unset -k privileged-mount To reload the rules file, issue the following command: $ sudo augenrules --load Note: The "-k " at the end of the line gives the rule a unique meaning to help during an audit investigation. The does not need to match the example above.

Verify Ubuntu 22.04 LTS generates an audit record upon successful/unsuccessful attempts to use the "newgrp" command by using the following command: $ sudo auditctl -l | grep newgrp -a always,exit -S all -F path=/usr/bin/newgrp -F perm=x -F auid>=1000 -F auid!=-1 -F key=priv_cmd If the command does not return a line that matches the example or the line is commented out, this is a finding. Note: The "key=" value is arbitrary and can be different from the example output above.

Configure the audit system to generate an audit event for any successful/unsuccessful use of the "newgrp" command. Add or modify the following line in the "/etc/audit/rules.d/stig.rules" file: -a always,exit -F path=/usr/bin/newgrp -F perm=x -F auid>=1000 -F auid!=unset -k priv_cmd To reload the rules file, issue the following command: $ sudo augenrules --load Note: The "-k " at the end of the line gives the rule a unique meaning to help during an audit investigation. The does not need to match the example above.

Verify that an audit event is generated for any successful/unsuccessful use of the "pam_timestamp_check" command by using the following command: $ sudo auditctl -l | grep -w pam_timestamp_check -a always,exit -S all -F path=/usr/sbin/pam_timestamp_check -F perm=x -F auid>=1000 -F auid!=-1 -F key=privileged-pam_timestamp_check If the command does not return a line that matches the example or the line is commented out, this is a finding. Note: The "key=" value is arbitrary and can be different from the example output above.

Configure the audit system to generate an audit event for any successful/unsuccessful uses of the "pam_timestamp_check" command. Add or modify the following line in the "/etc/audit/rules.d/stig.rules" file: -a always,exit -F path=/usr/sbin/pam_timestamp_check -F perm=x -F auid>=1000 -F auid!=unset -k privileged-pam_timestamp_check To reload the rules file, issue the following command: $ sudo augenrules --load Note: The "-k " at the end of the line gives the rule a unique meaning to help during an audit investigation. The does not need to match the example above.

Verify that an audit event is generated for any successful/unsuccessful use of the "passwd" command by using the following command: $ sudo auditctl -l | grep -w passwd -a always,exit -S all -F path=/usr/bin/passwd -F perm=x -F auid>=1000 -F auid!=-1 -F key=privileged-passwd If the command does not return a line that matches the example or the line is commented out, this is a finding. Note: The "key" allows for specifying an arbitrary identifier, and the string after it does not need to match the example output above.

Configure the audit system to generate an audit event for any successful/unsuccessful uses of the "passwd" command. Add or modify the following line in the "/etc/audit/rules.d/stig.rules" file: -a always,exit -F path=/usr/bin/passwd -F perm=x -F auid>=1000 -F auid!=unset -k privileged-passwd To reload the rules file, issue the following command: $ sudo augenrules --load Note: The "-k " at the end of the line gives the rule a unique meaning to help during an audit investigation. The does not need to match the example above.

Verify Ubuntu 22.04 LTS generates an audit record upon successful/unsuccessful attempts to use the "setfacl" command by using the following command: $ sudo auditctl -l | grep setfacl -a always,exit -S all -F path=/usr/bin/setfacl -F perm=x -F auid>=1000 -F auid!=-1 -F key=perm_chng If the command does not return a line that matches the example or the line is commented out, this is a finding. Note: The "key=" value is arbitrary and can be different from the example output above.

Configure the audit system to generate an audit event for any successful/unsuccessful use of the "setfacl" command. Add or modify the following line in the "/etc/audit/rules.d/stig.rules" file: -a always,exit -F path=/usr/bin/setfacl -F perm=x -F auid>=1000 -F auid!=unset -k perm_chng To reload the rules file, issue the following command: $ sudo augenrules --load Note: The "-k " at the end of the line gives the rule a unique meaning to help during an audit investigation. The does not need to match the example above.

Verify Ubuntu 22.04 LTS generates an audit record upon successful/unsuccessful attempts to use the "ssh-agent" command by using the following command: $ sudo auditctl -l | grep /usr/bin/ssh-agent -a always,exit -S all -F path=/usr/bin/ssh-agent -F perm=x -F auid>=1000 -F auid!=-1 -F key=privileged-ssh If the command does not return lines that match the example or the lines are commented out, this is a finding. Note: The "key=" value is arbitrary and can be different from the example output above.

Configure the audit system to generate an audit event for any successful/unsuccessful use of the "ssh-agent" command. Add or modify the following line in the "/etc/audit/rules.d/stig.rules" file: -a always,exit -F path=/usr/bin/ssh-agent -F perm=x -F auid>=1000 -F auid!=unset -k privileged-ssh To reload the rules file, issue the following command: $ sudo augenrules --load Note: The "-k " at the end of the line gives the rule a unique meaning to help during an audit investigation. The does not need to match the example above.

Verify Ubuntu 22.04 LTS generates an audit record upon successful/unsuccessful attempts to use the "ssh-keysign" command by using the following command: $ sudo auditctl -l | grep ssh-keysign -a always,exit -S all -F path=/usr/lib/openssh/ssh-keysign -F perm=x -F auid>=1000 -F auid!=-1 -F key=privileged-ssh If the command does not return lines that match the example or the lines are commented out, this is a finding. Note: The "key=" value is arbitrary and can be different from the example output above.

Configure the audit system to generate an audit event for any successful/unsuccessful use of the "ssh-keysign" command. Add or modify the following line in the "/etc/audit/rules.d/stig.rules" file: -a always,exit -F path=/usr/lib/openssh/ssh-keysign -F perm=x -F auid>=1000 -F auid!=unset -k privileged-ssh To reload the rules file, issue the following command: $ sudo augenrules --load Note: The "-k " at the end of the line gives the rule a unique meaning to help during an audit investigation. The does not need to match the example above.

Verify Ubuntu 22.04 LTS generates audit records upon successful/unsuccessful attempts to use the "su" command by using the following command: $ sudo auditctl -l | grep /bin/su -a always,exit -S all -F path=/bin/su -F perm=x -F auid>=1000 -F auid!=-1 -F key=privileged-priv_change If the command does not return lines that match the example or the lines are commented out, this is a finding. Note: The "key=" value is arbitrary and can be different from the example output above.

Configure Ubuntu 22.04 LTS to generate audit records when successful/unsuccessful attempts to use the "su" command occur. Add or modify the following line in the "/etc/audit/rules.d/stig.rules" file: -a always,exit -F path=/bin/su -F perm=x -F auid>=1000 -F auid!=unset -k privileged-priv_change To reload the rules file, issue the following command: $ sudo augenrules --load Note: The "-k " at the end of the line gives the rule a unique meaning to help during an audit investigation. The does not need to match the example above.

Verify that an audit event is generated for any successful/unsuccessful use of the "sudo" command by using the following command: $ sudo auditctl -l | grep /usr/bin/sudo -a always,exit -S all -F path=/usr/bin/sudo -F perm=x -F auid>=1000 -F auid!=-1 -F key=priv_cmd If the command does not return a line that matches the example or the line is commented out, this is a finding. Note: The "key=" value is arbitrary and can be different from the example output above.

Configure the audit system to generate an audit event for any successful/unsuccessful use of the "sudo" command. Add or modify the following line in the "/etc/audit/rules.d/stig.rules" file: -a always,exit -F path=/usr/bin/sudo -F perm=x -F auid>=1000 -F auid!=unset -k priv_cmd To reload the rules file, issue the following command: $ sudo augenrules --load Note: The "-k " at the end of the line gives the rule a unique meaning to help during an audit investigation. The does not need to match the example above.

Verify Ubuntu 22.04 LTS generates an audit record upon successful/unsuccessful attempts to use the "sudoedit" command by using the following command: $ sudo auditctl -l | grep /usr/bin/sudoedit -a always,exit -S all -F path=/usr/bin/sudoedit -F perm=x -F auid>=1000 -F auid!=-1 -F key=priv_cmd If the command does not return a line that matches the example or the line is commented out, this is a finding. Note: The "key=" value is arbitrary and can be different from the example output above.

Configure the audit system to generate an audit event for any successful/unsuccessful use of the "sudoedit" command. Add or modify the following line in the "/etc/audit/rules.d/stig.rules": -a always,exit -F path=/usr/bin/sudoedit -F perm=x -F auid>=1000 -F auid!=unset -k priv_cmd To reload the rules file, issue the following command: $ sudo augenrules --load Note: The "-k " at the end of the line gives the rule a unique meaning to help during an audit investigation. The does not need to match the example above.

Verify if Ubuntu 22.04 LTS generates audit records upon successful/unsuccessful attempts to use the "umount" command by using the following command: $ sudo auditctl -l | grep /usr/bin/umount -a always,exit -S all -F path=/usr/bin/umount -F perm=x -F auid>=1000 -F auid!=-1 -F key=privileged-umount If the command does not return lines that match the example or the lines are commented out, this is a finding. Note: The "key=" value is arbitrary and can be different from the example output above.

Configure the audit system to generate an audit event for any successful/unsuccessful use of the "umount" command. Add or modify the following line in the "/etc/audit/rules.d/stig.rules" file: -a always,exit -F path=/usr/bin/umount -F perm=x -F auid>=1000 -F auid!=unset -k privileged-umount To reload the rules file, issue the following command: $ sudo augenrules --load Note: The "-k " at the end of the line gives the rule a unique meaning to help during an audit investigation. The does not need to match the example above.

Verify that an audit event is generated for any successful/unsuccessful use of the "unix_update" command by using the following command: $ sudo auditctl -l | grep -w unix_update -a always,exit -S all -F path=/sbin/unix_update -F perm=x -F auid>=1000 -F auid!=-1 -F key=privileged-unix-update If the command does not return a line that matches the example or the line is commented out, this is a finding. Note: The "key=" value is arbitrary and can be different from the example output above.

Configure the audit system to generate an audit event for any successful/unsuccessful uses of the "unix_update" command. Add or modify the following line in the "/etc/audit/rules.d/stig.rules" file: -a always,exit -F path=/sbin/unix_update -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update To reload the rules file, issue the following command: $ sudo augenrules --load Note: The "-k " at the end of the line gives the rule a unique meaning to help during an audit investigation. The does not need to match the example above.

Verify that an audit event is generated for any successful/unsuccessful use of the "usermod" command by using the following command: $ sudo auditctl -l | grep -w usermod -a always,exit -S all -F path=/usr/sbin/usermod -F perm=x -F auid>=1000 -F auid!=-1 -F key=privileged-usermod If the command does not return a line that matches the example or the line is commented out, this is a finding. Note: The "key=" value is arbitrary and can be different from the example output above.

Configure the audit system to generate an audit event for any successful/unsuccessful uses of the "usermod" command. Add or modify the following line in the "/etc/audit/rules.d/stig.rules" file: -a always,exit -F path=/usr/sbin/usermod -F perm=x -F auid>=1000 -F auid!=unset -k privileged-usermod To reload the rules file, issue the following command: $ sudo augenrules --load Note: The "-k " at the end of the line gives the rule a unique meaning to help during an audit investigation. The does not need to match the example above.

Verify that an audit event is generated for any successful/unsuccessful use of the "useradd" command by using the following command: $ sudo auditctl -l | grep -w useradd -a always,exit -S all -F path=/usr/sbin/useradd -F perm=x -F auid>=1000 -F auid!=-1 -F key=privileged-useradd If the command does not return a line that matches the example or the line is commented out, this is a finding. Note: The "key=" value is arbitrary and can be different from the example output above.

Configure the audit system to generate an audit event for any successful/unsuccessful uses of the "useradd" command. Add or modify the following line in the "/etc/audit/rules.d/stig.rules" file: -a always,exit -F path=/usr/sbin/useradd -F perm=x -F auid>=1000 -F auid!=unset -k privileged-useradd To reload the rules file, issue the following command: $ sudo augenrules --load Note: The "-k " at the end of the line gives the rule a unique meaning to help during an audit investigation. The does not need to match the example above.

Verify Ubuntu 22.04 LTS generates audit records for all account creations, modifications, disabling, and termination events that affect "/etc/group" by using the following command: $ sudo auditctl -l | grep group -w /etc/group -p wa -k usergroup_modification If the command does not return a line that matches the example or the line is commented out, this is a finding. Note: The "-k" value is arbitrary and can be different from the example output above.

Configure Ubuntu 22.04 LTS to generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/group". Add or modify the following line to "/etc/audit/rules.d/stig.rules": -w /etc/group -p wa -k usergroup_modification To reload the rules file, issue the following command: $ sudo augenrules --load Note: The "-k " at the end of the line gives the rule a unique meaning to help during an audit investigation. The does not need to match the example above.

Verify Ubuntu 22.04 LTS generates audit records for all account creations, modifications, disabling, and termination events that affect "/etc/gshadow" by using the following command: $ sudo auditctl -l | grep gshadow -w /etc/gshadow -p wa -k usergroup_modification If the command does not return a line that matches the example or the line is commented out, this is a finding. Note: The "-k" value is arbitrary and can be different from the example output above.

Configure Ubuntu 22.04 LTS to generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/gshadow". Add or modify the following line to "/etc/audit/rules.d/stig.rules": -w /etc/gshadow -p wa -k usergroup_modification To reload the rules file, issue the following command: $ sudo augenrules --load Note: The "-k " at the end of the line gives the rule a unique meaning to help during an audit investigation. The does not need to match the example above.

Verify Ubuntu 22.04 LTS generates audit records for all account creations, modifications, disabling, and termination events that affect "/etc/security/opasswd" by using the following command: $ sudo auditctl -l | grep opasswd -w /etc/security/opasswd -p wa -k usergroup_modification If the command does not return a line that matches the example or the line is commented out, this is a finding. Note: The "-k" value is arbitrary and can be different from the example output above.

Configure Ubuntu 22.04 LTS to generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/security/opasswd". Add or modify the following line to "/etc/audit/rules.d/stig.rules": -w /etc/security/opasswd -p wa -k usergroup_modification To reload the rules file, issue the following command: $ sudo augenrules --load Note: The "-k " at the end of the line gives the rule a unique meaning to help during an audit investigation. The does not need to match the example above.

Verify Ubuntu 22.04 LTS generates audit records for all account creations, modifications, disabling, and termination events that affect "/etc/passwd" by using the following command: $ sudo auditctl -l | grep passwd -w /etc/passwd -p wa -k usergroup_modification If the command does not return a line that matches the example or the line is commented out, this is a finding. Note: The "-k" value is arbitrary and can be different from the example output above.

Configure Ubuntu 22.04 LTS to generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/passwd". Add or modify the following line to "/etc/audit/rules.d/stig.rules": -w /etc/passwd -p wa -k usergroup_modification To reload the rules file, issue the following command: $ sudo augenrules --load Note: The "-k " at the end of the line gives the rule a unique meaning to help during an audit investigation. The does not need to match the example above.

Verify Ubuntu 22.04 LTS generates audit records for all account creations, modifications, disabling, and termination events that affect "/etc/shadow" by using the following command: $ sudo auditctl -l | grep shadow -w /etc/shadow -p wa -k usergroup_modification If the command does not return a line that matches the example or the line is commented out, this is a finding. Note: The "-k" value is arbitrary and can be different from the example output above.

Configure Ubuntu 22.04 LTS to generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/shadow". Add or modify the following line to "/etc/audit/rules.d/stig.rules": -w /etc/shadow -p wa -k usergroup_modification To reload the rules file, issue the following command: $ sudo augenrules --load Note: The "-k " at the end of the line gives the rule a unique meaning to help during an audit investigation. The does not need to match the example above.

Verify Ubuntu 22.04 LTS generates an audit record upon successful/unsuccessful attempts to use the "chmod", "fchmod", and "fchmodat" system calls by using the following command: $ sudo auditctl -l | grep chmod -a always,exit -F arch=b32 -S chmod,fchmod,fchmodat -F auid>=1000 -F auid!=-1 -F key=perm_chng -a always,exit -F arch=b64 -S chmod,fchmod,fchmodat -F auid>=1000 -F auid!=-1 -F key=perm_chng If the command does not return audit rules for the "chmod", "fchmod" and "fchmodat" syscalls or the lines are commented out, this is a finding. Note: The "key=" value is arbitrary and can be different from the example output above.

Configure the audit system to generate an audit event for any successful/unsuccessful use of the "chmod", "fchmod", and "fchmodat" system calls. Add or modify the following lines in the "/etc/audit/rules.d/stig.rules": -a always,exit -F arch=b32 -S chmod,fchmod,fchmodat -F auid>=1000 -F auid!=unset -k perm_chng -a always,exit -F arch=b64 -S chmod,fchmod,fchmodat -F auid>=1000 -F auid!=unset -k perm_chng To reload the rules file, issue the following command: $ sudo augenrules --load Note: The "-k " at the end of the line gives the rule a unique meaning to help during an audit investigation. The does not need to match the example above.

Verify Ubuntu 22.04 LTS generates an audit record upon successful/unsuccessful attempts to use the "chown", "fchown", "fchownat", and "lchown" system calls by using the following command: $ sudo auditctl -l | grep chown -a always,exit -F arch=b32 -S chown,fchown,fchownat,lchown -F auid>=1000 -F auid!=-1 -F key=perm_chng -a always,exit -F arch=b64 -S chown,fchown,fchownat,lchown -F auid>=1000 -F auid!=-1 -F key=perm_chng If the command does not return audit rules for the "chown", "fchown", "fchownat", and "lchown" syscalls or the lines are commented out, this is a finding. Note: The "key=" value is arbitrary and can be different from the example output above.

Configure the audit system to generate an audit event for any successful/unsuccessful use of the "chown", "fchown", "fchownat", and "lchown" system calls. Add or modify the following lines in the "/etc/audit/rules.d/stig.rules": -a always,exit -F arch=b32 -S chown,fchown,fchownat,lchown -F auid>=1000 -F auid!=unset -k perm_chng -a always,exit -F arch=b64 -S chown,fchown,fchownat,lchown -F auid>=1000 -F auid!=unset -k perm_chng To reload the rules file, issue the following command: $ sudo augenrules --load Note: The "-k " at the end of the line gives the rule a unique meaning to help during an audit investigation. The does not need to match the example above.

Verify Ubuntu 22.04 LTS generates an audit record upon unsuccessful attempts to use the "creat", "open", "openat", "open_by_handle_at", "truncate", and "ftruncate" system calls by using the following command: $ sudo auditctl -l | grep 'open\|truncate\|creat' -a always,exit -F arch=b32 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=-1 -F key=perm_access -a always,exit -F arch=b32 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=-1 -F key=perm_access -a always,exit -F arch=b64 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=-1 -F key=perm_access -a always,exit -F arch=b64 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=-1 -F key=perm_access If the command does not return audit rules for the "creat", "open", "openat", "open_by_handle_at", "truncate", and "ftruncate" syscalls or the lines are commented out, this is a finding. Note: The "key=" value is arbitrary and can be different from the example output above.

Configure the audit system to generate an audit event for any unsuccessful use of the "creat", "open", "openat", "open_by_handle_at", "truncate", and "ftruncate" system calls. Add or modify the following lines in the "/etc/audit/rules.d/stig.rules" file: -a always,exit -F arch=b32 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -k perm_access -a always,exit -F arch=b32 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -k perm_access -a always,exit -F arch=b64 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -k perm_access -a always,exit -F arch=b64 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -k perm_access To reload the rules file, issue the following command: $ sudo augenrules --load Note: The "-k " at the end of the line gives the rule a unique meaning to help during an audit investigation. The does not need to match the example above.

Verify Ubuntu 22.04 LTS generates an audit record for any successful/unsuccessful attempts to use the "delete_module" syscall by using the following command: $ sudo auditctl -l | grep -w delete_module -a always,exit -F arch=b32 -S delete_module -F auid>=1000 -F auid!=-1 -F key=module_chng -a always,exit -F arch=b64 -S delete_module -F auid>=1000 -F auid!=-1 -F key=module_chng If the command does not return a line that matches the example or the line is commented out, this is a finding. Note: The "key=" value is arbitrary and can be different from the example output above.

Configure the audit system to generate an audit event for any successful/unsuccessful use of the "delete_module" syscall. Add or modify the following lines in the "/etc/audit/rules.d/stig.rules" file: -a always,exit -F arch=b32 -S delete_module -F auid>=1000 -F auid!=unset -k module_chng -a always,exit -F arch=b64 -S delete_module -F auid>=1000 -F auid!=unset -k module_chng To reload the rules file, issue the following command: $ sudo augenrules --load Note: The "-k " at the end of the line gives the rule a unique meaning to help during an audit investigation. The does not need to match the example above.

Verify Ubuntu 22.04 LTS generates an audit record for any successful/unsuccessful attempts to use the "init_module" and "finit_module" syscalls by using the following command: $ sudo auditctl -l | grep init_module -a always,exit -F arch=b32 -S init_module,finit_module -F auid>=1000 -F auid!=-1 -F key=module_chng -a always,exit -F arch=b64 -S init_module,finit_module -F auid>=1000 -F auid!=-1 -F key=module_chng If the command does not return audit rules for the "init_module" and "finit_module" syscalls or the lines are commented out, this is a finding. Note: The "key=" value is arbitrary and can be different from the example output above.

Configure the audit system to generate an audit event for any successful/unsuccessful use of the "init_module" and "finit_module" syscalls. Add or modify the following lines in the "/etc/audit/rules.d/stig.rules" file: -a always,exit -F arch=b32 -S init_module,finit_module -F auid>=1000 -F auid!=unset -k module_chng -a always,exit -F arch=b64 -S init_module,finit_module -F auid>=1000 -F auid!=unset -k module_chng To reload the rules file, issue the following command: $ sudo augenrules --load Note: The "-k " at the end of the line gives the rule a unique meaning to help during an audit investigation. The does not need to match the example above.

Verify Ubuntu 22.04 LTS generates an audit record upon successful/unsuccessful attempts to use the "setxattr", "fsetxattr", "lsetxattr", "removexattr", "fremovexattr", and "lremovexattr" system calls by using the following command: $ sudo auditctl -l | grep xattr -a always,exit -F arch=b32 -S setxattr,fsetxattr,lsetxattr,removexattr,fremovexattr,lremovexattr -F auid>=1000 -F auid!=-1 -F key=perm_mod -a always,exit -F arch=b32 -S setxattr,fsetxattr,lsetxattr,removexattr,fremovexattr,lremovexattr -F auid=0 -k perm_mod -a always,exit -F arch=b64 -S setxattr,fsetxattr,lsetxattr,removexattr,fremovexattr,lremovexattr -F auid>=1000 -F auid!=-1 -F key=perm_mod -a always,exit -F arch=b64 -S setxattr,fsetxattr,lsetxattr,removexattr,fremovexattr,lremovexattr -F auid=0 -k perm_mod If the command does not return audit rules for the "setxattr", "fsetxattr", "lsetxattr", "removexattr", "fremovexattr" and "lremovexattr" syscalls or the lines are commented out, this is a finding. Note: The "key=" value is arbitrary and can be different from the example output above.

Configure the audit system to generate an audit event for any successful/unsuccessful use of the "setxattr", "fsetxattr", "lsetxattr", "removexattr", "fremovexattr", and "lremovexattr" system calls. Add or modify the following lines in the "/etc/audit/rules.d/stig.rules" file: -a always,exit -F arch=b32 -S setxattr,fsetxattr,lsetxattr,removexattr,fremovexattr,lremovexattr -F auid>=1000 -F auid!=unset -k perm_mod -a always,exit -F arch=b32 -S setxattr,fsetxattr,lsetxattr,removexattr,fremovexattr,lremovexattr -F auid=0 -k perm_mod -a always,exit -F arch=b64 -S setxattr,fsetxattr,lsetxattr,removexattr,fremovexattr,lremovexattr -F auid>=1000 -F auid!=unset -k perm_mod -a always,exit -F arch=b64 -S setxattr,fsetxattr,lsetxattr,removexattr,fremovexattr,lremovexattr -F auid=0 -k perm_mod To reload the rules file, issue the following command: $ sudo augenrules --load Note: The "-k " at the end of the line gives the rule a unique meaning to help during an audit investigation. The does not need to match the example above.

Verify Ubuntu 22.04 LTS generates audit records for any successful/unsuccessful use of "unlink", "unlinkat", "rename", "renameat", and "rmdir" system calls by using the following command: $ sudo auditctl -l | grep 'unlink\|rename\|rmdir' -a always,exit -F arch=b64 -S unlink,unlinkat,rename,renameat,rmdir -F auid>=1000 -F auid!=-1 -F key=delete -a always,exit -F arch=b32 -S unlink,unlinkat,rename,renameat,rmdir -F auid>=1000 -F auid!=-1 -F key=delete If the command does not return audit rules for the "unlink", "unlinkat", "rename", "renameat", and "rmdir" syscalls or the lines are commented out, this is a finding. Note: The "key" allows for specifying an arbitrary identifier, and the string after it does not need to match the example output above.

Configure the audit system to generate audit events for any successful/unsuccessful use of "unlink", "unlinkat", "rename", "renameat", and "rmdir" system calls. Add or modify the following lines in the "/etc/audit/rules.d/stig.rules" file: -a always,exit -F arch=b64 -S unlink,unlinkat,rename,renameat,rmdir -F auid>=1000 -F auid!=unset -k delete -a always,exit -F arch=b32 -S unlink,unlinkat,rename,renameat,rmdir -F auid>=1000 -F auid!=unset -k delete To reload the rules file, issue the following command: $ sudo augenrules --load Note: The "-k " at the end of the line gives the rule a unique meaning to help during an audit investigation. The does not need to match the example above.

Verify Ubuntu 22.04 LTS generates audit records for all events that affect "/var/log/journal" by using the following command: $ sudo auditctl -l | grep journal -w /var/log/journal -p wa -k systemd_journal If the command does not return a line that matches the example or the line is commented out, this is a finding. Note: The "-k" value is arbitrary and can be different from the example output above.

Configure Ubuntu 22.04 LTS to generate audit records for events that affect "/var/log/journal". Add or modify the following line to "/etc/audit/rules.d/stig.rules": -w /var/log/journal -p wa -k systemd_journal To reload the rules file, issue the following command: $ sudo augenrules --load Note: The "-k " at the end of the line gives the rule a unique meaning to help during an audit investigation. The does not need to match the example above.

Verify Ubuntu 22.04 LTS generates audit records showing start and stop times for user access to the system via the "/var/log/btmp" file by using the following command: $ sudo auditctl -l | grep '/var/log/btmp' -w /var/log/btmp -p wa -k logins If the command does not return a line matching the example or the line is commented out, this is a finding. Note: The "-k" value is arbitrary and can be different from the example output above.

Configure the audit system to generate audit events showing start and stop times for user access via the "/var/log/btmp file". Add or modify the following line in the "/etc/audit/rules.d/stig.rules" file: -w /var/log/btmp -p wa -k logins To reload the rules file, issue the following command: $ sudo augenrules --load Note: The "-k " at the end of the line gives the rule a unique meaning to help during an audit investigation. The does not need to match the example above.

Verify Ubuntu 22.04 LTS generates audit records showing start and stop times for user access to the system via the "/var/log/wtmp" file by using the following command: $ sudo auditctl -l | grep '/var/log/wtmp' -w /var/log/wtmp -p wa -k logins If the command does not return a line matching the example or the line is commented out, this is a finding. Note: The "-k" value is arbitrary and can be different from the example output above.

Configure the audit system to generate audit events showing start and stop times for user access via the "/var/log/wtmp" file. Add or modify the following line in the "/etc/audit/rules.d/stig.rules" file: -w /var/log/wtmp -p wa -k logins To reload the rules file, issue the following command: $ sudo augenrules --load Note: The "-k " at the end of the line gives the rule a unique meaning to help during an audit investigation. The does not need to match the example above.

Verify Ubuntu 22.04 LTS generates audit records showing start and stop times for user access to the system via the "/var/run/utmp" file by using the following command: $ sudo auditctl -l | grep '/var/run/utmp' -w /var/run/utmp -p wa -k logins If the command does not return a line matching the example or the line is commented out, this is a finding. Note: The "-k" value is arbitrary and can be different from the example output above.

Configure the audit system to generate audit events showing start and stop times for user access via the "/var/run/utmp" file. Add or modify the following line in the "/etc/audit/rules.d/stig.rules" file: -w /var/run/utmp -p wa -k logins To reload the rules file, issue the following command: $ sudo augenrules --load Note: The "-k " at the end of the line gives the rule a unique meaning to help during an audit investigation. The does not need to match the example above.

Verify Ubuntu 22.04 LTS generates an audit record upon successful/unsuccessful modifications to the "faillog" file by using the following command: $ sudo auditctl -l | grep faillog -w /var/log/faillog -p wa -k logins If the command does not return a line that matches the example or the line is commented out, this is a finding. Note: The "-k" value is arbitrary and can be different from the example output above.

Configure the audit system to generate an audit event for any successful/unsuccessful modifications to the "faillog" file. Add or modify the following line in the "/etc/audit/rules.d/stig.rules" file: -w /var/log/faillog -p wa -k logins To reload the rules file, issue the following command: $ sudo augenrules --load Note: The "-k " at the end of the line gives the rule a unique meaning to help during an audit investigation. The does not need to match the example above.

Verify Ubuntu 22.04 LTS generates an audit record when successful/unsuccessful modifications to the "lastlog" file occur by using the following command: $ sudo auditctl -l | grep lastlog -w /var/log/lastlog -p wa -k logins If the command does not return a line that matches the example or the line is commented out, this is a finding. Note: The "-k" value is arbitrary and can be different from the example output above.

Configure the audit system to generate an audit event for any successful/unsuccessful modifications to the "lastlog" file. Add or modify the following line in the "/etc/audit/rules.d/stig.rules" file: -w /var/log/lastlog -p wa -k logins To reload the rules file, issue the following command: $ sudo augenrules --load Note: The "-k " at the end of the line gives the rule a unique meaning to help during an audit investigation. The does not need to match the example above.

Verify Ubuntu 22.04 LTS generates audit records for all modifications that affect "/etc/sudoers" by using the following command: $ sudo auditctl -l | grep sudoers -w /etc/sudoers -p wa -k privilege_modification If the command does not return a line that matches the example or the line is commented out, this is a finding. Note: The "-k" value is arbitrary and can be different from the example output above.

Configure Ubuntu 22.04 LTS to generate audit records for all modifications that affect "/etc/sudoers". Add or modify the following line to "/etc/audit/rules.d/stig.rules": -w /etc/sudoers -p wa -k privilege_modification To reload the rules file, issue the following command: $ sudo augenrules --load Note: The "-k " at the end of the line gives the rule a unique meaning to help during an audit investigation. The does not need to match the example above.

Verify the operating system restricts privilege elevation to authorized personnel with the following command: $ sudo grep -iwR 'ALL' /etc/sudoers /etc/sudoers.d/ | grep -v '#' If the either of the following entries are returned, this is a finding: ALL ALL=(ALL) ALL ALL ALL=(ALL:ALL) ALL

Configure the operating system to restrict privilege elevation to authorized personnel. Remove the following entries from the /etc/sudoers file or any configuration file under /etc/sudoers.d/: ALL ALL=(ALL) ALL ALL ALL=(ALL:ALL) ALL

Verify Ubuntu 22.04 LTS generates audit records for all modifications that affect "/etc/sudoers.d" directory by using the following command: $ sudo auditctl -l | grep sudoers.d -w /etc/sudoers.d -p wa -k privilege_modification If the command does not return a line that matches the example or the line is commented out, this is a finding. Note: The "-k" value is arbitrary and can be different from the example output above.

Configure Ubuntu 22.04 LTS to generate audit records for all modifications that affect "/etc/sudoers.d" directory. Add or modify the following line to "/etc/audit/rules.d/stig.rules": -w /etc/sudoers.d -p wa -k privilege_modification To reload the rules file, issue the following command: $ sudo augenrules --load Note: The "-k " at the end of the line gives the rule a unique meaning to help during an audit investigation. he does not need to match the example above.

Verify Ubuntu 22.04 LTS audits the execution of privilege functions by auditing the "execve" system call by using the following command: $ sudo auditctl -l | grep execve -a always,exit -F arch=b64 -S execve -C uid!=euid -F euid=0 -F key=execpriv -a always,exit -F arch=b64 -S execve -C gid!=egid -F egid=0 -F key=execpriv -a always,exit -F arch=b32 -S execve -C uid!=euid -F euid=0 -F key=execpriv -a always,exit -F arch=b32 -S execve -C gid!=egid -F egid=0 -F key=execpriv If the command does not return lines that match the example or the lines are commented out, this is a finding. Note: The "key=" value is arbitrary and can be different from the example output above.

Configure Ubuntu 22.04 LTS to audit the execution of all privileged functions. Add or modify the following lines in the "/etc/audit/rules.d/stig.rules" file: -a always,exit -F arch=b64 -S execve -C uid!=euid -F euid=0 -k execpriv -a always,exit -F arch=b64 -S execve -C gid!=egid -F egid=0 -k execpriv -a always,exit -F arch=b32 -S execve -C uid!=euid -F euid=0 -k execpriv -a always,exit -F arch=b32 -S execve -C gid!=egid -F egid=0 -k execpriv To reload the rules file, issue the following command: $ sudo augenrules --load Note: The "-k " at the end of the line gives the rule a unique meaning to help during an audit investigation. The does not need to match the example above.

Verify Ubuntu 22.04 LTS audits activities performed during nonlocal maintenance and diagnostic sessions by using the following command: $ sudo auditctl -l | grep sudo.log -w /var/log/sudo.log -p wa -k maintenance If the command does not return lines that match the example or the lines are commented out, this is a finding. Note: The "-k" value is arbitrary and can be different from the example output above.

Configure Ubuntu 22.04 LTS to audit activities performed during nonlocal maintenance and diagnostic sessions. Add or modify the following line in the "/etc/audit/rules.d/stig.rules" file: -w /var/log/sudo.log -p wa -k maintenance To reload the rules file, issue the following command: $ sudo augenrules --load Note: The "-k " at the end of the line gives the rule a unique meaning to help during an audit investigation. The does not need to match the example above.

Verify the running audit system prevents unauthorized changes (is immutable) with the following command: $ sudo auditctl -s | grep "enabled" enabled 2 If the "enabled" value returned is not "2", this is a finding. Verify that the audit system is configured to be immutable across reboots with the following command: $ grep -E '^-e 2' /etc/audit/rules.d/*.rules /etc/audit/rules.d/99-finalize.rules:-e 2 If the "-e 2" option is not configured in a rules file under "/etc/audit/rules.d/", this is a finding.

Configure the audit system to set the audit rules to be immutable by performing the following steps: Create or edit a finalized rules file (e.g., "/etc/audit/rules.d/99-finalize.rules") and append the following option as the absolute last line: -e 2 Compile and load the new rules into the active kernel: $ sudo augenrules --load Note: Once this rule is active, further changes to the audit configuration will be blocked. A system reboot will be required to apply any future audit rule modifications.

Verify Ubuntu 22.04 LTS is configured to restrict access to the kernel message buffer by using the following command: $ sysctl kernel.dmesg_restrict kernel.dmesg_restrict = 1 If "kernel.dmesg_restrict" is not set to "1" or is missing, this is a finding. Verify that there are no configurations that enable the kernel dmesg function: $ sudo grep -ir kernel.dmesg_restrict /run/sysctl.d/* /etc/sysctl.d/* /usr/local/lib/sysctl.d/* /usr/lib/sysctl.d/* /lib/sysctl.d/* /etc/sysctl.conf 2> /dev/null /etc/sysctl.d/10-kernel-hardening.conf:kernel.dmesg_restrict = 1 If "kernel.dmesg_restrict" is not set to "1", is commented out, is missing, or conflicting results are returned, this is a finding.

Configure Ubuntu 22.04 LTS to restrict access to the kernel message buffer. Add or modify the following line in the "/etc/sysctl.conf" file: kernel.dmesg_restrict = 1 Remove any configurations that conflict with the above from the following locations: /run/sysctl.d/ /etc/sysctl.d/ /usr/local/lib/sysctl.d/ /usr/lib/sysctl.d/ /lib/sysctl.d/ /etc/sysctl.conf Reload settings from all system configuration files by using the following command: $ sudo sysctl --system

Verify that APT is configured to prevent the installation of patches, service packs, device drivers, or Ubuntu operating system components without verification they have been digitally signed using a certificate that is recognized and approved by the organization by using the following command: $ grep -i allowunauthenticated /etc/apt/apt.conf.d/* /etc/apt/apt.conf.d/01-vendor-ubuntu:APT::Get::AllowUnauthenticated "false"; If "APT::Get::AllowUnauthenticated" is not set to "false", is commented out, or is missing, this is a finding.

Configure APT to prevent the installation of patches, service packs, device drivers, or Ubuntu operating system components without verification they have been digitally signed using a certificate that is recognized and approved by the organization. Add or modify the following line in any file under the "/etc/apt/apt.conf.d/" directory: APT::Get::AllowUnauthenticated "false";

Verify the "chrony" package is installed using the following command: $ dpkg -l | grep chrony ii chrony 4.2-2ubuntu2 amd64 Versatile implementation of the Network Time Protocol If the "chrony" package is not installed, this is a finding.

Install the "chrony" network time protocol package using the following command: $ sudo apt-get install chrony

Verify that the "systemd-timesyncd" package is not installed by using the following command: $ dpkg -l | grep systemd-timesyncd If the "systemd-timesyncd" package is installed, this is a finding.

The "systemd-timesyncd" package will be uninstalled as part of the "chrony" package install. The remaining configuration files for "systemd-timesyncd" must be purged from the operating system: $ sudo dpkg -P --force-all systemd-timesyncd

Verify that the "ntp" package is not installed by using the following command: $ dpkg -l | grep ntp If the "ntp" package is installed, this is a finding.

Uninstall the "ntp" package by using the following command: $ sudo dpkg -P --force-all ntp

Verify Ubuntu 22.04 LTS is configured to compare the system clock at least every 24 hours to the authoritative time source by using the following command: Note: If the system is not networked, this requirement is not applicable. $ sudo grep maxpoll -ir /etc/chrony* server tick.usno.navy.mil iburst maxpoll 16 If the "maxpoll" option is set to a number greater than 16, the line is commented out, or is missing, this is a finding. Verify that the "chrony.conf" file is configured to an authoritative DoW time source by using the following command: $ sudo grep -ir server /etc/chrony* server tick.usno.navy.mil iburst maxpoll 16 server tock.usno.navy.mil iburst maxpoll 16 server ntp2.usno.navy.mil iburst maxpoll 16 If "server" is not defined, is not set to an authoritative DoW time source, is commented out, or missing, this is a finding.

Configure Ubuntu 22.04 LTS to compare the system clock at least every 24 hours to the authoritative time source. Add or modify the following line in the "/etc/chrony/chrony.conf" file: server [source] iburst maxpoll = 16 Restart "chrony.service" for the changes to take effect by using the following command: $ sudo systemctl restart chrony.service

Verify Ubuntu 22.04 LTS synchronizes internal system clocks to the authoritative time source when the time difference is greater than one second. Note: If the system is not networked, this requirement is not applicable. Check the value of "makestep" by using the following command: $ grep -ir makestep /etc/chrony* makestep 1 -1 If "makestep" is not set to "1 -1", is commented out, or is missing, this is a finding. Verify the NTP service is active and the system clock is synchronized with the authoritative time source: $ timedatectl | grep -Ei '(synchronized|service)' System clock synchronized: yes NTP service: active If the NTP service is not active, this is a finding. If the system clock is not synchronized, this is a finding.

Configure chrony to synchronize the internal system clocks to the authoritative source when the time difference is greater than one second by doing the following: Edit the "/etc/chrony/chrony.conf" file and add: makestep 1 -1 Restart the chrony service: $ sudo systemctl restart chrony.service

Verify the time zone is configured to use UTC by using the following command: $ timedatectl status | grep -i "time zone" Time zone: Etc/UTC (UTC, +0000) If "Time zone" is not set to UTC, this is a finding.

To Configure Ubuntu 22.04 LTS time zone to use UTC, run the following command: $ sudo timedatectl set-timezone Etc/UTC

Verify that Ubuntu 22.04 LTS utilizes the "pam_faillock" module by using the following command: $ grep faillock /etc/pam.d/common-auth auth [default=die] pam_faillock.so authfail auth sufficient pam_faillock.so authsucc If the "pam_faillock.so" module is not present in the "/etc/pam.d/common-auth" file, this is a finding. Verify the "pam_faillock" module is configured to use the following options: $ sudo grep -Ew 'silent|audit|deny|fail_interval|unlock_time' /etc/security/faillock.conf audit silent deny = 3 fail_interval = 900 unlock_time = 0 If "audit" is commented out, or is missing, this is a finding. If "silent" is commented out, or is missing, this is a finding. If "deny" is set to a value greater than "3", is commented out, or is missing, this is a finding. If "fail_interval" is set to a value greater than "900", is commented out, or is missing, this is a finding. If "unlock_time" is not set to "0", is commented out, or is missing, this is a finding.

Configure Ubuntu 22.04 LTS to utilize the "pam_faillock" module. Add or modify the following lines in the "/etc/pam.d/common-auth" file, below the "auth" definition for "pam_unix.so": auth [default=die] pam_faillock.so authfail auth sufficient pam_faillock.so authsucc Configure the "pam_faillock" module to use the following options. Add or modify the following lines in the "/etc/security/faillock.conf" file: audit silent deny = 3 fail_interval = 900 unlock_time = 0

Verify Ubuntu 22.04 LTS enforces a delay of at least four seconds between logon prompts following a failed logon attempt by using the following command: $ grep pam_faildelay /etc/pam.d/common-auth auth required pam_faildelay.so delay=4000000 If "delay" is not set to "4000000" or greater, the line is commented out, or is missing, this is a finding.

Configure Ubuntu 22.04 LTS to enforce a delay of at least four seconds between logon prompts following a failed logon attempt. Add or modify the following line in the "/etc/pam.d/common-auth" file: auth required pam_faildelay.so delay=4000000

Verify Ubuntu 22.04 LTS limits the number of concurrent sessions to 10 for all accounts and/or account types by using the following command: $ sudo grep -r -s '^[^#].*maxlogins' /etc/security/limits.conf /etc/security/limits.d/*.conf /etc/security/limits.conf:* hard maxlogins 10 If "maxlogins" does not have a value of "10" or less, is commented out, or is missing, this is a finding.

Configure Ubuntu 22.04 LTS to limit the number of concurrent sessions to 10 for all accounts and/or account types. Add or modify the following line at the top of the "/etc/security/limits.conf" file: * hard maxlogins 10

Verify that PAM prohibits the use of cached authentications after one day by using the following command: Note: If smart card authentication is not being used on the system, this requirement is not applicable. $ sudo grep -i '^\s*offline_credentials_expiration' /etc/sssd/sssd.conf /etc/sssd/conf.d/*.conf /etc/sssd/sssd.conf:offline_credentials_expiration = 1 If "offline_credentials_expiration" in "/etc/sssd/sssd.conf" or in a file with a name ending in .conf in the "/etc/sssd/conf.d/" directory, is not set to "1", is commented out, is missing, or conflicting results are returned, this is a finding.

Configure PAM to prohibit the use of cached authentications after one day. Add or modify the following line in the "/etc/sssd/sssd.conf" file, just below the line "[pam]": offline_credentials_expiration = 1 Note: It is valid for this configuration to be in a file with a name that ends with ".conf" and does not begin with a "." in the "/etc/sssd/conf.d/" directory instead of the "/etc/sssd/sssd.conf" file.

Verify there is a script that offloads audit data and that script runs weekly by using the following command: Note: If the system is not connected to a network, this requirement is not applicable. $ ls /etc/cron.weekly Check if the script inside the file does offloading of audit logs to external media. If the script file does not exist or does not offload audit logs, this is a finding.

Create a script that offloads audit logs to external media and runs weekly. The script must be located in the "/etc/cron.weekly" directory.

Verify the audit event multiplexor is configured to offload audit records to a different system from the system being audited. Check if the "audispd-plugins" package is installed: $ dpkg -l | grep audispd-plugins ii audispd-plugins 1:3.0.7-1build1 amd64 Plugins for the audit event dispatcher If the "audispd-plugins" package is not installed, this is a finding. Check that the records are being offloaded to a remote server by using the following command: $ sudo grep -i active /etc/audit/plugins.d/au-remote.conf active = yes If "active" is not set to "yes", or the line is commented out, or is missing, this is a finding. Check that audisp-remote plugin is configured to send audit logs to a different system: $ sudo grep -i remote_server /etc/audit/audisp-remote.conf remote_server = 240.9.19.81 If the "remote_server" parameter is not set, is set with a local IP address, or is set with an invalid IP address, this is a finding.

Configure the audit event multiplexor to offload audit records to a different system from the system being audited. Install the "audispd-plugins" package by using the following command: $ sudo apt-get install audispd-plugins Set the audisp-remote plugin as active by editing the "/etc/audit/plugins.d/au-remote.conf" file: $ sudo sed -i -E 's/active\s*=\s*no/active = yes/' /etc/audit/plugins.d/au-remote.conf Set the IP address of the remote system by editing the "/etc/audit/audisp-remote.conf" file: $ sudo sed -i -E 's/(remote_server\s*=).*/\1 /' /etc/audit/audisp-remote.conf Restart the "auditd.service" for the changes to take effect: $ sudo systemctl restart auditd.service

Verify that the SA and ISSO are notified in the event of an audit processing failure by using the following command: Note: An email package must be installed on the system for email notifications to be sent. $ sudo grep -i action_mail_acct /etc/audit/auditd.conf action_mail_acct = If "action_mail_acct" is not set to the email address of the SA and/or ISSO, is commented out, or is missing, this is a finding.

Configure "auditd" service to notify the SA and ISSO in the event of an audit processing failure. Add or modify the following line in the "/etc/audit/auditd.conf " file: action_mail_acct = Note: Change "administrator_email_account" to the email address of the SA and/or ISSO. Restart the "auditd" service for the changes take effect: $ sudo systemctl restart auditd.service

Verify Ubuntu 22.04 LTS allocates audit record storage capacity to store at least one week's worth of audit records when audit records are not immediately sent to a central audit record storage facility. Determine which partition the audit records are being written to by using the following command: $ sudo grep -i log_file /etc/audit/auditd.conf log_file = /var/log/audit/audit.log Check the size of the partition that audit records are written to (with the example being "/var/log/audit/") by using the following command: $ sudo df -h /var/log/audit/ /dev/sda2 24G 10.4G 13.6G 43% /var/log/audit If the audit records are not written to a partition made specifically for audit records ("/var/log/audit" as a separate partition), determine the amount of space being used by other files in the partition by using the following command: $ sudo du -sh 1.8G /var/log/audit Note: The partition size needed to capture a week's worth of audit records is based on the activity level of the system and the total storage capacity available. If the audit record partition is not allocated for sufficient storage capacity, this is a finding.

Allocate enough storage capacity for at least one week's worth of audit records when audit records are not immediately sent to a central audit record storage facility. If audit records are stored on a partition made specifically for audit records, use the "parted" program to resize the partition with sufficient space to contain one week's worth of audit records. If audit records are not stored on a partition made specifically for audit records, a new partition with sufficient amount of space will need be to be created. Set the auditd server to point to the mount point where the audit records must be located: $ sudo sed -i -E 's@^(log_file\s*=\s*).*@\1 /audit.log@' /etc/audit/auditd.conf where is the aforementioned mount point.

Verify Ubuntu 22.04 LTS is configured to notify the SA and ISSO when the audit record storage volume reaches 25 percent remaining of the allocated capacity by using the following command: $ sudo grep -i space_left /etc/audit/auditd.conf space_left = 25% space_left_action = email If "space_left" is set to a value less than "25%", is commented out, or is missing, this is a finding. If "space_left_action" is not set to "email", is commented out, or is missing, this is a finding. Note: If the "space_left_action" is set to "exec", the system executes a designated script. If this script informs the SA of the event, this is not a finding.

Configure Ubuntu 22.04 LTS to notify the SA and ISSO when the audit record storage volume reaches 25 percent remaining of the allocated capacity. Add or modify the following lines in the "/etc/audit/auditd.conf " file: space_left = 25% space_left_action = email Restart the "auditd" service for the changes to take effect: $ sudo systemctl restart auditd.service Note: If the "space_left_action" parameter is set to "exec", ensure the command being executed notifies the SA and ISSO.