Linux STIGs

CAT I 16

Any vulnerability, the exploitation of which will directly and immediately result in loss of confidentiality, availability or integrity.

1. UBTU-22-211000 CAT I V-278951 · SRG-OS-000480-GPOS-00227

   Ubuntu 22.04 LTS must be a vendor-supported release.

   Maps to CM-6 via CCI-000366
   Check

   Verify the version of Ubuntu 22.04 LTS is vendor supported with the following command: $ grep DISTRIB_DESCRIPTION /etc/lsb-release DISTRIB_DESCRIPTION="Ubuntu 22.04.1 LTS" Check the subscription status of the system with the following command: $ pro status If the installed version of Ubuntu 22.04 LTS is not supported, this is a finding.

   Fix

   Upgrade to a supported version of Ubuntu 22.04 LTS.

2. UBTU-22-211015 CAT I V-260469 · SRG-OS-000480-GPOS-00227

   Ubuntu 22.04 LTS must disable the x86 Ctrl-Alt-Delete key sequence.

   Maps to CM-6 via CCI-000366
   Check

   Verify Ubuntu 22.04 LTS is not configured to reboot the system when Ctrl-Alt-Delete is pressed by using the following command: $ systemctl status ctrl-alt-del.target ctrl-alt-del.target Loaded: masked (Reason: Unit ctrl-alt-del.target is masked.) Active: inactive (dead) If the "ctrl-alt-del.target" is not masked, this is a finding.

   Fix

   Configure Ubuntu 22.04 LTS to disable the Ctrl-Alt-Delete sequence for the command line by using the following commands: $ sudo systemctl disable ctrl-alt-del.target $ sudo systemctl mask ctrl-alt-del.target Reload the daemon to take effect: $ sudo systemctl daemon-reload

3. UBTU-22-212010 CAT I V-260470 · SRG-OS-000080-GPOS-00048

   Ubuntu 22.04 LTS, when booted, must require authentication upon booting into single-user and maintenance modes.

   Maps to AC-3 via CCI-000213
   Check

   Verify Ubuntu 22.04 LTS requires a password for authentication upon booting into single-user and maintenance modes by using the following command: $ sudo grep -i password /boot/grub/grub.cfg password_pbkdf2 root grub.pbkdf2.sha512.10000.03255F190F0E2F7B4F0D1C3216012309162F022A7A636771 If the root password entry does not begin with "password_pbkdf2", this is a finding.

   Fix

   Configure Ubuntu 22.04 LTS to require a password for authentication upon booting into single-user and maintenance modes. Generate an encrypted (grub) password for root by using the following command: $ grub-mkpasswd-pbkdf2 Enter Password: Reenter Password: PBKDF2 hash of your password is grub.pbkdf2.sha512.10000.03255F190F0E2F7B4F0D1C3216012309162F022A7A636771 Using the hash from the output, modify the "/etc/grub.d/40_custom" file by using the following command to add a boot password: $ sudo sed -i '$i set superusers=\"root\"\npassword_pbkdf2 root ' /etc/grub.d/40_custom where is the hash generated by grub-mkpasswd-pbkdf2 command. Generate an updated "grub.conf" file with the new password by using the following command: $ sudo update-grub

4. UBTU-22-215030 CAT I V-260482 · SRG-OS-000095-GPOS-00049

   Ubuntu 22.04 LTS must not have the "rsh-server" package installed.

   Maps to CM-7 via CCI-000381
   Check

   Verify the "rsh-server" package is not installed by using the following command: $ dpkg -l | grep rsh-server If the "rsh-server" package is installed, this is a finding.

   Fix

   Remove the "rsh-server" package by using the following command: $ sudo apt-get remove rsh-server

5. UBTU-22-215035 CAT I V-260483 · SRG-OS-000074-GPOS-00042

   Ubuntu 22.04 LTS must not have the "telnet" package installed.

   Maps to IA-5(1) via CCI-000197
   Check

   Verify that the "telnetd" package is not installed on Ubuntu 22.04 LTS by using the following command: $ dpkg -l | grep telnetd If the "telnetd" package is installed, this is a finding.

   Fix

   Remove the "telnetd" package by using the following command: $ sudo apt-get remove telnetd

6. UBTU-22-231010 CAT I V-260484 · SRG-OS-000185-GPOS-00079

   Ubuntu 22.04 LTS must implement cryptographic mechanisms to prevent unauthorized disclosure and modification of all information that requires protection at rest.

   Maps to SC-28, SC-28(1) via CCI-001199, CCI-002475, CCI-002476
   Check

   Verify Ubuntu 22.04 LTS prevents unauthorized disclosure or modification of all information requiring at-rest protection by using disk encryption. Note: If there is a documented and approved reason for not having data-at-rest encryption, this requirement is not applicable. Determine the partition layout for the system by using the following command: $ sudo fdisk -l ... Device Start End Sectors Size Type /dev/sda1 2048 2203647 2201600 1G EFI System /dev/sda2 2203648 6397951 4194304 2G Linux filesystem /dev/sda3 6397952 536868863 530470912 252.9G Linux filesystem ... Verify the system partitions are all encrypted by using the following command: # more /etc/crypttab Every persistent disk partition present must have an entry in the file. If any partitions other than the boot partition or pseudo file systems (such as /proc or /sys) are not listed, this is a finding.

   Fix

   To encrypt an entire partition, dedicate a partition for encryption in the partition layout. Note: Encrypting a partition in an already-installed system is more difficult because it will need to be resized and existing partitions changed.

7. UBTU-22-255010 CAT I V-260523 · SRG-OS-000423-GPOS-00187

   Ubuntu 22.04 LTS must have SSH installed.

   Maps to SC-8, SC-8(2) via CCI-002418, CCI-002420, CCI-002422
   Check

   Verify the SSH package is installed by using the following command: $ sudo dpkg -l | grep openssh ii openssh-client 1:8.9p1-3ubuntu0.4 amd64 secure shell (SSH) client, for secure access to remote machines ii openssh-server 1:8.9p1-3ubuntu0.4 amd64 secure shell (SSH) server, for secure access from remote machines ii openssh-sftp-server 1:8.9p1-3ubuntu0.4 amd64 secure shell (SSH) sftp server module, for SFTP access from remote machines If the "openssh" server package is not installed, this is a finding.

   Fix

   Install the "ssh" meta-package by using the following command: $ sudo apt install ssh

8. UBTU-22-255015 CAT I V-260524 · SRG-OS-000423-GPOS-00187

   Ubuntu 22.04 LTS must use SSH to protect the confidentiality and integrity of transmitted information.

   Maps to SC-8, SC-8(2) via CCI-002418, CCI-002420, CCI-002422
   Check

   Verify the "ssh.service" is enabled and active by using the following commands: $ sudo systemctl is-enabled ssh enabled $ sudo systemctl is-active ssh active If "ssh.service" is not enabled and active, this is a finding.

   Fix

   Enable and start the "ssh.service" by using the following command: $ sudo systemctl enable ssh.service --now

9. UBTU-22-255025 CAT I V-260526 · SRG-OS-000480-GPOS-00229

   Ubuntu 22.04 LTS must not allow unattended or automatic login via SSH.

   Maps to CM-6 via CCI-000366
   Check

   Verify that unattended or automatic login via SSH is disabled by using the following command: $ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iEH '(permit(.*?)(passwords|environment))' /etc/ssh/sshd_config:PermitEmptyPasswords no /etc/ssh/sshd_config:PermitUserEnvironment no If "PermitEmptyPasswords" and "PermitUserEnvironment" are not set to "no", are commented out, are missing, or conflicting results are returned, this is a finding.

   Fix

   Configure the SSH server to not allow unattended or automatic login to the system. Add or modify the following lines in the "/etc/ssh/sshd_config" file: PermitEmptyPasswords no PermitUserEnvironment no Restart SSH for the changes to take effect: $ sudo systemctl restart ssh

10. UBTU-22-255040 CAT I V-260529 · SRG-OS-000480-GPOS-00227

    Ubuntu 22.04 LTS must be configured so that remote X connections are disabled, unless to fulfill documented and validated mission requirements.

    Maps to CM-6 via CCI-000366
    Check

    Verify that X11 forwarding is disabled by using the following command: $ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH 'x11forwarding' /etc/ssh/sshd_config:X11Forwarding no If "X11Forwarding" is set to "yes" and is not documented with the information system security officer (ISSO) as an operational requirement, is commented out, is missing, or conflicting results are returned, this is a finding.

    Fix

    Configure the SSH server to disable X11 forwarding. Add or modify the following line in the "/etc/ssh/sshd_config" file: X11Forwarding no Restart SSH for the changes to take effect: $ sudo systemctl restart ssh

11. UBTU-22-271030 CAT I V-260539 · SRG-OS-000480-GPOS-00227

    Ubuntu 22.04 LTS must disable the x86 Ctrl-Alt-Delete key sequence if a graphical user interface is installed.

    Maps to CM-6 via CCI-000366
    Check

    Verify Ubuntu 22.04 LTS is not configured to reboot the system when Ctrl-Alt-Delete is pressed when using a graphical user interface by using the following command: Note: If no graphical user interface is installed, this requirement is not applicable. $ gsettings get org.gnome.settings-daemon.plugins.media-keys logout @as [] If the "logout" key is bound to an action, is commented out, or is missing, this is a finding.

    Fix

    Configure Ubuntu 22.04 LTS to disable the Ctrl-Alt-Delete sequence when using a graphical user interface. Create or edit a file named /etc/dconf/db/local.d/00-mediakeys with the following contents: [org/gnome/settings-daemon/plugins/media-keys] logout=@as [] Update the dconf settings: $ sudo dconf update

12. UBTU-22-432015 CAT I V-260559 · SRG-OS-000134-GPOS-00068

    Ubuntu 22.04 LTS must ensure only users who need access to security functions are part of sudo group.

    Maps to SC-3 via CCI-001084
    Check

    Verify the sudo group has only members who require access to security functions by using the following command: $ grep sudo /etc/group sudo:x:27: If the sudo group contains users not needing access to security functions, this is a finding.

    Fix

    Configure the sudo group with only members requiring access to security functions. To remove a user from the sudo group, run: $ sudo gpasswd -d sudo

13. UBTU-22-611060 CAT I V-260570 · SRG-OS-000480-GPOS-00227

    Ubuntu 22.04 LTS must not allow accounts configured with blank or null passwords.

    Maps to CM-6 via CCI-000366
    Check

    Verify that null passwords cannot be used. Run the following command: $ grep nullok /etc/pam.d/common-auth /etc/pam.d/common-password If this produces any output, this is a finding.

    Fix

    Remove any instances of the "nullok" option in "/etc/pam.d/common-password" to prevent logons with empty passwords. Remove any instances of the "nullok" option in "/etc/pam.d/common-auth" and "/etc/pam.d/common-password".

14. UBTU-22-611065 CAT I V-260571 · SRG-OS-000480-GPOS-00227

    Ubuntu 22.04 LTS must not have accounts configured with blank or null passwords.

    Maps to CM-6 via CCI-000366
    Check

    Verify all accounts on the system to have a password by using the following command: $ sudo awk -F: '!$2 {print $1}' /etc/shadow If the command returns any results, this is a finding.

    Fix

    Configure all accounts on the system to have a password or lock the account by using the following commands: Set the account password: $ sudo passwd Or lock the account: $ sudo passwd -l

15. UBTU-22-612040 CAT I V-260579 · SRG-OS-000068-GPOS-00036

    Ubuntu 22.04 LTS must map the authenticated identity to the user or group account for PKI-based authentication.

    Maps to IA-5(2) via CCI-000187
    Check

    Verify that "use_mappers" is set to "pwent" in "/etc/pam_pkcs11/pam_pkcs11.conf" file by using the following command: $ grep -i use_mappers /etc/pam_pkcs11/pam_pkcs11.conf use_mappers = pwent If "use_mappers" does not contain "pwent", is commented out, or is missing, this is a finding.

    Fix

    Set "use_mappers=pwent" in "/etc/pam_pkcs11/pam_pkcs11.conf" or, if there is already a comma-separated list of mappers, add it to the list, separated by comma, and before the null mapper. If the system is missing an "/etc/pam_pkcs11/" directory and an "/etc/pam_pkcs11/pam_pkcs11.conf", find an example to copy into place and modify accordingly at "/usr/share/doc/libpam-pkcs11/examples/pam_pkcs11.conf.example.gz".

16. UBTU-22-671010 CAT I V-260650 · SRG-OS-000396-GPOS-00176

    Ubuntu 22.04 LTS must implement NIST FIPS-validated cryptography to protect classified information and for the following: To provision digital signatures, to generate cryptographic hashes, and to protect unclassified information requiring confidentiality and cryptographic protection in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.

    Maps to SC-13 via CCI-002450
    Check

    Verify the system is configured to run in FIPS mode by using the following command: $ grep -i 1 /proc/sys/crypto/fips_enabled 1 If a value of "1" is not returned, this is a finding.

    Fix

    Configure Ubuntu 22.04 LTS to run in FIPS mode. Add "fips=1" to the kernel parameter during Ubuntu 22.04 LTS install. Enabling a FIPS mode on a pre-existing system involves a number of modifications to Ubuntu 22.04 LTS. Refer to the Ubuntu Pro security certification documentation for instructions. A subscription to the "Ubuntu Pro" plan is required to obtain the FIPS Kernel cryptographic modules and enable FIPS. Note: Ubuntu Pro security certification instructions can be found at: https://ubuntu.com/security/certifications/docs/fips-enablement