Linux STIGs

CAT I 17

Any vulnerability, the exploitation of which will directly and immediately result in loss of confidentiality, availability or integrity.

1. UBTU-24-100030 CAT I V-270647 · SRG-OS-000074-GPOS-00042

   Ubuntu 24.04 LTS must not have the telnet package installed.

   Maps to IA-5(1) via CCI-000197
   Check

   Verify the telnet package is not installed on Ubuntu 24.04 LTS with the following command: $ dpkg -l | grep telnetd If the telnetd package is installed, this is a finding.

   Fix

   Remove the telnet package from Ubuntu 24.04 LTS with the following command: $ sudo apt remove telnetd

2. UBTU-24-100040 CAT I V-270648 · SRG-OS-000095-GPOS-00049

   Ubuntu 24.04 LTS must not have the rsh-server package installed.

   Maps to CM-7 via CCI-000381
   Check

   Verify the rsh-server package is installed with the following command: $ dpkg -l | grep rsh-server If the rsh-server package is installed, this is a finding.

   Fix

   Configure Ubuntu 24.04 LTS to disable nonessential capabilities by removing the rsh-server package from the system with the following command: $ sudo apt remove rsh-server

3. UBTU-24-100050 CAT I V-279938 · SRG-OS-000095-GPOS-00049

   Ubuntu 24.04 LTS must not have the nfs-kernel-server package installed.

   Maps to CM-7 via CCI-000381
   Check

   Note: If NFS mounts are authorized and in use on the system, this control is not applicable. Verify that Ubuntu 24.04 LTS does not have the nfs-kernel-server package installed. Determine if packages are installed: $ sudo dpkg -l | grep -E 'nfs-kernel-server' If the nfs-kernel-server package is installed, this is a finding.

   Fix

   Configure the Ubuntu 24.04 LTS operating system to disable nonessential capabilities by removing the nfs-kernel-server package from the system with the following commands: Remove packages if present: $ sudo apt purge --yes nfs-kernel-server Remove any unneeded dependencies: $ sudo apt autoremove --yes Verify that NFS services are gone: $ sudo systemctl list-units --type=service | grep nfs

4. UBTU-24-100800 CAT I V-270665 · SRG-OS-000423-GPOS-00187

   Ubuntu 24.04 LTS must have SSH installed.

   Maps to SC-8, SC-8(2) via CCI-002418, CCI-002420, CCI-002422
   Check

   Verify the SSH package is installed with the following command: $ dpkg -l | grep openssh ii openssh-client 1:9.6p1-3ubuntu13.5 amd64 secure shell (SSH) client, for secure access to remote machines ii openssh-server 1:9.6p1-3ubuntu13.5 amd64 secure shell (SSH) server, for secure access from remote machines ii openssh-sftp-server 1:9.6p1-3ubuntu13.5 amd64 secure shell (SSH) sftp server module, for SFTP access from remote machines If the "openssh" server package is not installed, this is a finding.

   Fix

   Install the "ssh" meta-package on the system with the following command: $ sudo apt install -y ssh

5. UBTU-24-100810 CAT I V-270666 · SRG-OS-000423-GPOS-00187

   Ubuntu 24.04 LTS must use SSH to protect the confidentiality and integrity of transmitted information.

   Maps to SC-8, SC-8(2) via CCI-002418, CCI-002420, CCI-002422
   Check

   Verify the "sshd.service" is enabled and active with the following commands: $ sudo systemctl is-enabled ssh enabled $ sudo systemctl is-active ssh active If "ssh.service" is not active or loaded, this is a finding.

   Fix

   Enable the "ssh" service to start automatically on reboot with the following command: $ sudo systemctl enable ssh.service ensure the "ssh" service is running $ sudo systemctl start ssh.service

6. UBTU-24-102000 CAT I V-270675 · SRG-OS-000080-GPOS-00048

   Ubuntu 24.04 LTS when booted must require authentication upon booting into single-user and maintenance modes.

   Maps to AC-3 via CCI-000213
   Check

   Verify Ubuntu 24.04 LTS requires a password for authentication upon booting into single-user and maintenance modes with the following command: $ sudo grep -i password /boot/grub/grub.cfg password_pbkdf2 root grub.pbkdf2.sha512.10000.MFU48934NJA87HF8NSD34493GDHF84NG If the root password entry does not begin with "password_pbkdf2", this is a finding.

   Fix

   Configure the system to require a password for authentication upon booting into single-user and maintenance modes. Generate an encrypted (grub) password for root with the following command: $ grub-mkpasswd-pbkdf2 Enter Password: Reenter Password: PBKDF2 hash of your password is grub.pbkdf2.sha512.10000.MFU48934NJD84NF8NSD39993JDHF84NG Using the hash from the output, modify the "/etc/grub.d/40_custom" file with the following command to add a boot password: $ sudo sed -i '$i set superusers=\"root\"\npassword_pbkdf2 root ' /etc/grub.d/40_custom where is the hash generated by grub-mkpasswd-pbkdf2 command. Generate an updated "grub.conf" file with the new password by using the following command: $ sudo update-grub

7. UBTU-24-300022 CAT I V-270708 · SRG-OS-000480-GPOS-00227

   Ubuntu 24.04 LTS must be configured so that remote X connections are disabled, unless to fulfill documented and validated mission requirements.

   Maps to CM-6 via CCI-000366
   Check

   Verify that X11Forwarding is disabled with the following command: $ sudo grep -ir x11forwarding /etc/ssh/sshd_config* | grep -v "^#" X11Forwarding no If the "X11Forwarding" keyword is set to "yes" and is not documented with the information system security officer (ISSO) as an operational requirement, is missing, or multiple conflicting results are returned, this is a finding.

   Fix

   Edit the "/etc/ssh/sshd_config" file to uncomment or add the line for the "X11Forwarding" keyword and set its value to "no" (this file may be named differently or be in a different location if using a version of SSH that is provided by a third-party vendor): X11Forwarding no Restart SSH for the changes to take effect: $ sudo systemctl restart ssh

8. UBTU-24-300025 CAT I V-270711 · SRG-OS-000480-GPOS-00227

   Ubuntu 24.04 LTS must disable the x86 Ctrl-Alt-Delete key sequence if a graphical user interface is installed.

   Maps to CM-6 via CCI-000366
   Check

   Verify Ubuntu 24.04 LTS is not configured to reboot the system when Ctrl-Alt-Delete is pressed when using a graphical user interface with the following command: $ gsettings get org.gnome.settings-daemon.plugins.media-keys logout @as [] If the "logout" key is bound to an action, is commented out, or is missing, this is a finding.

   Fix

   Configure Ubuntu 24.04 LTS to disable the Ctrl-Alt-Delete sequence when using a graphical user interface. Create or edit a file named /etc/dconf/db/local.d/00-mediakeys with the following contents: [org/gnome/settings-daemon/plugins/media-keys] logout=@as [] Update the dconf settings: $ sudo dconf update

9. UBTU-24-300026 CAT I V-270712 · SRG-OS-000480-GPOS-00227

   Ubuntu 24.04 LTS must disable the x86 Ctrl-Alt-Delete key sequence.

   Maps to CM-6 via CCI-000366
   Check

   Verify Ubuntu 24.04 LTS is not configured to reboot the system when Ctrl-Alt-Delete is pressed with the following command: $ systemctl status ctrl-alt-del.target o ctrl-alt-del.target Loaded: masked (Reason: Unit ctrl-alt-del.target is masked.) Active: inactive (dead) If the "ctrl-alt-del.target" is not masked, this is a finding.

   Fix

   Configure the system to disable the Ctrl-Alt-Delete sequence for the command line with the following commands: $ sudo systemctl disable ctrl-alt-del.target [...] $ sudo systemctl mask ctrl-alt-del.target Created symlink /etc/systemd/system/ctrl-alt-del.target ? /dev/null. Reload the daemon to take effect: $ sudo systemctl daemon-reload

10. UBTU-24-300027 CAT I V-270713 · SRG-OS-000480-GPOS-00227

    Ubuntu 24.04 LTS must not have accounts configured with blank or null passwords.

    Maps to CM-6 via CCI-000366
    Check

    Check the "/etc/shadow" file for blank passwords with the following command: $ sudo awk -F: '!$2 {print $1}' /etc/shadow If the command returns any results, this is a finding.

    Fix

    Configure all accounts on the system to have a password or lock the account with the following commands: Perform a password reset: $ sudo passwd [username] Lock an account: $ sudo passwd -l [username]

11. UBTU-24-300028 CAT I V-270714 · SRG-OS-000480-GPOS-00227

    Ubuntu 24.04 LTS must not allow accounts configured in Pluggable Authentication Modules (PAM) with blank or null passwords.

    Maps to CM-6 via CCI-000366
    Check

    To verify null passwords cannot be used, run the following command: $ grep nullok /etc/pam.d/common-password /etc/pam.d/common-auth If this produces any output, this is a finding.

    Fix

    If an account is configured for password authentication but does not have an assigned password, it is possible to log on to the account without authenticating. Remove any instances of the "nullok" option in "/etc/pam.d/common-password" and "/etc/pam.d/common-auth" to prevent logons with empty passwords.

12. UBTU-24-300031 CAT I V-270717 · SRG-OS-000480-GPOS-00229

    Ubuntu 24.04 LTS must not allow unattended or automatic login via SSH.

    Maps to CM-6 via CCI-000366
    Check

    Verify unattended or automatic login via SSH is disabled with the following command: $ egrep -r '(Permit(.*?)(Passwords|Environment))' /etc/ssh/sshd_config PermitEmptyPasswords no PermitUserEnvironment no If the "PermitEmptyPasswords" or "PermitUserEnvironment" keywords are set to a value other than "no", are commented out, are both missing, or conflicting results are returned, this is a finding.

    Fix

    Configure Ubuntu 24.04 LTS to allow the SSH daemon to not allow unattended or automatic login to the system. Add or edit the following lines in the "/etc/ssh/sshd_config" file: PermitEmptyPasswords no PermitUserEnvironment no Restart SSH for the changes to take effect: $ sudo systemctl restart ssh

13. UBTU-24-400370 CAT I V-270736 · SRG-OS-000068-GPOS-00036

    Ubuntu 24.04 LTS must map the authenticated identity to the user or group account for PKI-based authentication.

    Maps to IA-5(2) via CCI-000187
    Check

    Verify that authenticated certificates are mapped to the appropriate user group in the "/etc/sssd/sssd.conf" file with the following command: $ grep -i ldap_user_certificate /etc/sssd/sssd.conf ldap_user_certificate=userCertificate;binary

    Fix

    Configure sssd to map authenticated certificates to the appropriate user group by adding the following line to the "/etc/sssd/sssd.conf" file: ldap_user_certificate=userCertificate;binary

14. UBTU-24-600030 CAT I V-270744 · SRG-OS-000478-GPOS-00223

    Ubuntu 24.04 LTS must implement NIST FIPS-validated cryptography to protect classified information and for the following: To provision digital signatures, to generate cryptographic hashes, and to protect unclassified information requiring confidentiality and cryptographic protection in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.

    Maps to SC-13 via CCI-002450
    Check

    Verify the system is configured to run in FIPS mode with the following command: $ grep -i 1 /proc/sys/crypto/fips_enabled 1 If a value of "1" is not returned, this is a finding.

    Fix

    Configure the system to run in FIPS mode. Add "fips=1" to the kernel parameter during Ubuntu 24.04 LTSs install. Enabling a FIPS mode on a pre-existing system involves a number of modifications to Ubuntu 24.04 LTS. Refer to the Ubuntu Pro security certification documentation for instructions. A subscription to the "Ubuntu Pro" plan is required to obtain the FIPS Kernel cryptographic modules and enable FIPS. Note: Ubuntu Pro security certification instructions can be found at: https://ubuntu.com/security/certifications/docs/fips-enablement The basic steps use the following commands: $ sudo pro attach $ sudo pro enable fips-updates

15. UBTU-24-600090 CAT I V-270747 · SRG-OS-000185-GPOS-00079

    Ubuntu 24.04 LTS handling data requiring data-at-rest protections must employ cryptographic mechanisms to prevent unauthorized disclosure and modification of the information at rest.

    Maps to SC-28, SC-28(1), SC-28(3) via CCI-001199, CCI-002475, CCI-002476, CCI-004910
    Check

    Note: If there is a documented and approved mission requirement for data-at-rest to not be encrypted, this requirement is not applicable. Verify Ubuntu 24.04 LTS prevents unauthorized disclosure or modification of all information requiring at-rest protection by using disk encryption. Determine the partition layout for the system with the following command: $ sudo fdisk -l (..) Disk /dev/vda: 15 GiB, 16106127360 bytes, 31457280 sectors Units: sectors of 1 * 512 = 512 bytes Sector size (logical/physical): 512 bytes / 512 bytes I/O size (minimum/optimal): 512 bytes / 512 bytes Disklabel type: gpt Disk identifier: 83298450-B4E3-4B19-A9E4-7DF147A5FEFB Device Start End Sectors Size Type /dev/vda1 2048 4095 2048 1M BIOS boot /dev/vda2 4096 2101247 2097152 1G Linux filesystem /dev/vda3 2101248 31455231 29353984 14G Linux filesystem (...) Verify the system partitions are all encrypted with the following command: $ more /etc/crypttab Every persistent disk partition present must have an entry in the file. If any partitions other than the boot partition or pseudo file systems (such as /proc or /sys) are not listed, this is a finding.

    Fix

    To encrypt an entire partition, dedicate a partition for encryption in the partition layout. Note: Encrypting a partition in an already-installed system is more difficult because it will need to be resized and existing partitions changed.

16. UBTU-24-600130 CAT I V-270748 · SRG-OS-000134-GPOS-00068

    Ubuntu 24.04 LTS must ensure only users who need access to security functions are part of sudo group.

    Maps to SC-3 via CCI-001084
    Check

    Verify the sudo group has only members who require access to security functions with the following command: $ grep sudo /etc/group sudo:x:27:foo If the sudo group contains users not needing access to security functions, this is a finding.

    Fix

    Configure the sudo group with only members requiring access to security functions. To remove a user from the sudo group, run: $ sudo gpasswd -d sudo

17. UBTU-24-700400 CAT I V-278917 · SRG-OS-000480-GPOS-00227

    Ubuntu 24.04 LTS must be a vendor-supported release.

    Maps to CM-6 via CCI-000366
    Check

    Verify the version of Ubuntu 24.04 LTS is vendor supported with the following command: $ grep DISTRIB_DESCRIPTION /etc/lsb-release DISTRIB_DESCRIPTION="Ubuntu 24.04.3 LTS" Check the subscription status of the system with the following command: $ pro status If the installed version of Ubuntu 24.04 LTS is not supported, this is a finding.

    Fix

    Upgrade to a supported version of Ubuntu 24.04 LTS.