Linux STIGs
CAT III 17
Any vulnerability, the existence of which degrades measures to protect against loss of confidentiality, availability or integrity.
-
Ubuntu 22.04 LTS must restrict access to the kernel message buffer.
Maps to SC-4 via CCI-001090Check
Verify Ubuntu 22.04 LTS is configured to restrict access to the kernel message buffer by using the following command: $ sysctl kernel.dmesg_restrict kernel.dmesg_restrict = 1 If "kernel.dmesg_restrict" is not set to "1" or is missing, this is a finding. Verify that there are no configurations that enable the kernel dmesg function: $ sudo grep -ir kernel.dmesg_restrict /run/sysctl.d/* /etc/sysctl.d/* /usr/local/lib/sysctl.d/* /usr/lib/sysctl.d/* /lib/sysctl.d/* /etc/sysctl.conf 2> /dev/null /etc/sysctl.d/10-kernel-hardening.conf:kernel.dmesg_restrict = 1 If "kernel.dmesg_restrict" is not set to "1", is commented out, is missing, or conflicting results are returned, this is a finding.
Fix
Configure Ubuntu 22.04 LTS to restrict access to the kernel message buffer. Add or modify the following line in the "/etc/sysctl.conf" file: kernel.dmesg_restrict = 1 Remove any configurations that conflict with the above from the following locations: /run/sysctl.d/ /etc/sysctl.d/ /usr/local/lib/sysctl.d/ /usr/lib/sysctl.d/ /lib/sysctl.d/ /etc/sysctl.conf Reload settings from all system configuration files by using the following command: $ sudo sysctl --system
-
Ubuntu 22.04 LTS must be configured so that the Advance Package Tool (APT) prevents the installation of patches, service packs, device drivers, or operating system components without verification they have been digitally signed using a certificate that is recognized and approved by the organization.
Check
Verify that APT is configured to prevent the installation of patches, service packs, device drivers, or Ubuntu operating system components without verification they have been digitally signed using a certificate that is recognized and approved by the organization by using the following command: $ grep -i allowunauthenticated /etc/apt/apt.conf.d/* /etc/apt/apt.conf.d/01-vendor-ubuntu:APT::Get::AllowUnauthenticated "false"; If "APT::Get::AllowUnauthenticated" is not set to "false", is commented out, or is missing, this is a finding.
Fix
Configure APT to prevent the installation of patches, service packs, device drivers, or Ubuntu operating system components without verification they have been digitally signed using a certificate that is recognized and approved by the organization. Add or modify the following line in any file under the "/etc/apt/apt.conf.d/" directory: APT::Get::AllowUnauthenticated "false";
-
Ubuntu 22.04 LTS must have the "chrony" package installed.
Maps to CM-6 via CCI-000366Check
Verify the "chrony" package is installed using the following command: $ dpkg -l | grep chrony ii chrony 4.2-2ubuntu2 amd64 Versatile implementation of the Network Time Protocol If the "chrony" package is not installed, this is a finding.
Fix
Install the "chrony" network time protocol package using the following command: $ sudo apt-get install chrony
-
Ubuntu 22.04 LTS must not have the "systemd-timesyncd" package installed.
Maps to CM-6 via CCI-000366Check
Verify that the "systemd-timesyncd" package is not installed by using the following command: $ dpkg -l | grep systemd-timesyncd If the "systemd-timesyncd" package is installed, this is a finding.
Fix
The "systemd-timesyncd" package will be uninstalled as part of the "chrony" package install. The remaining configuration files for "systemd-timesyncd" must be purged from the operating system: $ sudo dpkg -P --force-all systemd-timesyncd
-
Ubuntu 22.04 LTS must not have the "ntp" package installed.
Maps to CM-6 via CCI-000366Check
Verify that the "ntp" package is not installed by using the following command: $ dpkg -l | grep ntp If the "ntp" package is installed, this is a finding.
Fix
Uninstall the "ntp" package by using the following command: $ sudo dpkg -P --force-all ntp
-
Ubuntu 22.04 LTS must, for networked systems, compare internal information system clocks at least every 24 hours with a server synchronized to one of the redundant United States Naval Observatory (USNO) time servers, or a time server designated for the appropriate DoW network (NIPRNet/SIPRNet), and/or the Global Positioning System (GPS).
Check
Verify Ubuntu 22.04 LTS is configured to compare the system clock at least every 24 hours to the authoritative time source by using the following command: Note: If the system is not networked, this requirement is not applicable. $ sudo grep maxpoll -ir /etc/chrony* server tick.usno.navy.mil iburst maxpoll 16 If the "maxpoll" option is set to a number greater than 16, the line is commented out, or is missing, this is a finding. Verify that the "chrony.conf" file is configured to an authoritative DoW time source by using the following command: $ sudo grep -ir server /etc/chrony* server tick.usno.navy.mil iburst maxpoll 16 server tock.usno.navy.mil iburst maxpoll 16 server ntp2.usno.navy.mil iburst maxpoll 16 If "server" is not defined, is not set to an authoritative DoW time source, is commented out, or missing, this is a finding.
Fix
Configure Ubuntu 22.04 LTS to compare the system clock at least every 24 hours to the authoritative time source. Add or modify the following line in the "/etc/chrony/chrony.conf" file: server [source] iburst maxpoll = 16 Restart "chrony.service" for the changes to take effect by using the following command: $ sudo systemctl restart chrony.service
-
Ubuntu 22.04 LTS must synchronize internal information system clocks to the authoritative time source when the time difference is greater than one second.
Check
Verify Ubuntu 22.04 LTS synchronizes internal system clocks to the authoritative time source when the time difference is greater than one second. Note: If the system is not networked, this requirement is not applicable. Check the value of "makestep" by using the following command: $ grep -ir makestep /etc/chrony* makestep 1 -1 If "makestep" is not set to "1 -1", is commented out, or is missing, this is a finding. Verify the NTP service is active and the system clock is synchronized with the authoritative time source: $ timedatectl | grep -Ei '(synchronized|service)' System clock synchronized: yes NTP service: active If the NTP service is not active, this is a finding. If the system clock is not synchronized, this is a finding.
Fix
Configure chrony to synchronize the internal system clocks to the authoritative source when the time difference is greater than one second by doing the following: Edit the "/etc/chrony/chrony.conf" file and add: makestep 1 -1 Restart the chrony service: $ sudo systemctl restart chrony.service
-
Ubuntu 22.04 LTS must record time stamps for audit records that can be mapped to Coordinated Universal Time (UTC).
Maps to AU-8 via CCI-001890Check
Verify the time zone is configured to use UTC by using the following command: $ timedatectl status | grep -i "time zone" Time zone: Etc/UTC (UTC, +0000) If "Time zone" is not set to UTC, this is a finding.
Fix
To Configure Ubuntu 22.04 LTS time zone to use UTC, run the following command: $ sudo timedatectl set-timezone Etc/UTC
-
Ubuntu 22.04 LTS must automatically lock an account until the locked account is released by an administrator when three unsuccessful logon attempts have been made.
Maps to AC-7 via CCI-000044, CCI-002238Check
Verify that Ubuntu 22.04 LTS utilizes the "pam_faillock" module by using the following command: $ grep faillock /etc/pam.d/common-auth auth [default=die] pam_faillock.so authfail auth sufficient pam_faillock.so authsucc If the "pam_faillock.so" module is not present in the "/etc/pam.d/common-auth" file, this is a finding. Verify the "pam_faillock" module is configured to use the following options: $ sudo grep -Ew 'silent|audit|deny|fail_interval|unlock_time' /etc/security/faillock.conf audit silent deny = 3 fail_interval = 900 unlock_time = 0 If "audit" is commented out, or is missing, this is a finding. If "silent" is commented out, or is missing, this is a finding. If "deny" is set to a value greater than "3", is commented out, or is missing, this is a finding. If "fail_interval" is set to a value greater than "900", is commented out, or is missing, this is a finding. If "unlock_time" is not set to "0", is commented out, or is missing, this is a finding.
Fix
Configure Ubuntu 22.04 LTS to utilize the "pam_faillock" module. Add or modify the following lines in the "/etc/pam.d/common-auth" file, below the "auth" definition for "pam_unix.so": auth [default=die] pam_faillock.so authfail auth sufficient pam_faillock.so authsucc Configure the "pam_faillock" module to use the following options. Add or modify the following lines in the "/etc/security/faillock.conf" file: audit silent deny = 3 fail_interval = 900 unlock_time = 0
-
Ubuntu 22.04 LTS must enforce a delay of at least four seconds between logon prompts following a failed logon attempt.
Maps to CM-6 via CCI-000366Check
Verify Ubuntu 22.04 LTS enforces a delay of at least four seconds between logon prompts following a failed logon attempt by using the following command: $ grep pam_faildelay /etc/pam.d/common-auth auth required pam_faildelay.so delay=4000000 If "delay" is not set to "4000000" or greater, the line is commented out, or is missing, this is a finding.
Fix
Configure Ubuntu 22.04 LTS to enforce a delay of at least four seconds between logon prompts following a failed logon attempt. Add or modify the following line in the "/etc/pam.d/common-auth" file: auth required pam_faildelay.so delay=4000000
-
Ubuntu 22.04 LTS must limit the number of concurrent sessions to ten for all accounts and/or account types.
Maps to AC-10 via CCI-000054Check
Verify Ubuntu 22.04 LTS limits the number of concurrent sessions to 10 for all accounts and/or account types by using the following command: $ sudo grep -r -s '^[^#].*maxlogins' /etc/security/limits.conf /etc/security/limits.d/*.conf /etc/security/limits.conf:* hard maxlogins 10 If "maxlogins" does not have a value of "10" or less, is commented out, or is missing, this is a finding.
Fix
Configure Ubuntu 22.04 LTS to limit the number of concurrent sessions to 10 for all accounts and/or account types. Add or modify the following line at the top of the "/etc/security/limits.conf" file: * hard maxlogins 10
-
Ubuntu 22.04 LTS must be configured such that Pluggable Authentication Module (PAM) prohibits the use of cached authentications after one day.
Maps to IA-5(13) via CCI-002007Check
Verify that PAM prohibits the use of cached authentications after one day by using the following command: Note: If smart card authentication is not being used on the system, this requirement is not applicable. $ sudo grep -i '^\s*offline_credentials_expiration' /etc/sssd/sssd.conf /etc/sssd/conf.d/*.conf /etc/sssd/sssd.conf:offline_credentials_expiration = 1 If "offline_credentials_expiration" in "/etc/sssd/sssd.conf" or in a file with a name ending in .conf in the "/etc/sssd/conf.d/" directory, is not set to "1", is commented out, is missing, or conflicting results are returned, this is a finding.
Fix
Configure PAM to prohibit the use of cached authentications after one day. Add or modify the following line in the "/etc/sssd/sssd.conf" file, just below the line "[pam]": offline_credentials_expiration = 1 Note: It is valid for this configuration to be in a file with a name that ends with ".conf" and does not begin with a "." in the "/etc/sssd/conf.d/" directory instead of the "/etc/sssd/sssd.conf" file.
-
Ubuntu 22.04 LTS must have a crontab script running weekly to offload audit events of standalone systems.
Maps to AU-4(1) via CCI-001851Check
Verify there is a script that offloads audit data and that script runs weekly by using the following command: Note: If the system is not connected to a network, this requirement is not applicable. $ ls /etc/cron.weekly Check if the script inside the file does offloading of audit logs to external media. If the script file does not exist or does not offload audit logs, this is a finding.
Fix
Create a script that offloads audit logs to external media and runs weekly. The script must be located in the "/etc/cron.weekly" directory.
-
Ubuntu 22.04 LTS audit event multiplexor must be configured to offload audit logs onto a different system from the system being audited.
Maps to AU-4(1) via CCI-001851Check
Verify the audit event multiplexor is configured to offload audit records to a different system from the system being audited. Check if the "audispd-plugins" package is installed: $ dpkg -l | grep audispd-plugins ii audispd-plugins 1:3.0.7-1build1 amd64 Plugins for the audit event dispatcher If the "audispd-plugins" package is not installed, this is a finding. Check that the records are being offloaded to a remote server by using the following command: $ sudo grep -i active /etc/audit/plugins.d/au-remote.conf active = yes If "active" is not set to "yes", or the line is commented out, or is missing, this is a finding. Check that audisp-remote plugin is configured to send audit logs to a different system: $ sudo grep -i remote_server /etc/audit/audisp-remote.conf remote_server = 240.9.19.81 If the "remote_server" parameter is not set, is set with a local IP address, or is set with an invalid IP address, this is a finding.
Fix
Configure the audit event multiplexor to offload audit records to a different system from the system being audited. Install the "audispd-plugins" package by using the following command: $ sudo apt-get install audispd-plugins Set the audisp-remote plugin as active by editing the "/etc/audit/plugins.d/au-remote.conf" file: $ sudo sed -i -E 's/active\s*=\s*no/active = yes/' /etc/audit/plugins.d/au-remote.conf Set the IP address of the remote system by editing the "/etc/audit/audisp-remote.conf" file: $ sudo sed -i -E 's/(remote_server\s*=).*/\1 /' /etc/audit/audisp-remote.conf Restart the "auditd.service" for the changes to take effect: $ sudo systemctl restart auditd.service
-
Ubuntu 22.04 LTS must alert the information system security officer (ISSO) and system administrator (SA) in the event of an audit processing failure.
Maps to AU-5 via CCI-000139Check
Verify that the SA and ISSO are notified in the event of an audit processing failure by using the following command: Note: An email package must be installed on the system for email notifications to be sent. $ sudo grep -i action_mail_acct /etc/audit/auditd.conf action_mail_acct = If "action_mail_acct" is not set to the email address of the SA and/or ISSO, is commented out, or is missing, this is a finding.
Fix
Configure "auditd" service to notify the SA and ISSO in the event of an audit processing failure. Add or modify the following line in the "/etc/audit/auditd.conf " file: action_mail_acct = Note: Change "administrator_email_account" to the email address of the SA and/or ISSO. Restart the "auditd" service for the changes take effect: $ sudo systemctl restart auditd.service
-
Ubuntu 22.04 LTS must allocate audit record storage capacity to store at least one weeks' worth of audit records, when audit records are not immediately sent to a central audit record storage facility.
Maps to AU-4 via CCI-001849Check
Verify Ubuntu 22.04 LTS allocates audit record storage capacity to store at least one week's worth of audit records when audit records are not immediately sent to a central audit record storage facility. Determine which partition the audit records are being written to by using the following command: $ sudo grep -i log_file /etc/audit/auditd.conf log_file = /var/log/audit/audit.log Check the size of the partition that audit records are written to (with the example being "/var/log/audit/") by using the following command: $ sudo df -h /var/log/audit/ /dev/sda2 24G 10.4G 13.6G 43% /var/log/audit If the audit records are not written to a partition made specifically for audit records ("/var/log/audit" as a separate partition), determine the amount of space being used by other files in the partition by using the following command: $ sudo du -sh 1.8G /var/log/audit Note: The partition size needed to capture a week's worth of audit records is based on the activity level of the system and the total storage capacity available. If the audit record partition is not allocated for sufficient storage capacity, this is a finding.
Fix
Allocate enough storage capacity for at least one week's worth of audit records when audit records are not immediately sent to a central audit record storage facility. If audit records are stored on a partition made specifically for audit records, use the "parted" program to resize the partition with sufficient space to contain one week's worth of audit records. If audit records are not stored on a partition made specifically for audit records, a new partition with sufficient amount of space will need be to be created. Set the auditd server to point to the mount point where the audit records must be located: $ sudo sed -i -E 's@^(log_file\s*=\s*).*@\1 /audit.log@' /etc/audit/auditd.conf where is the aforementioned mount point.
-
Ubuntu 22.04 LTS must immediately notify the system administrator (SA) and information system security officer (ISSO) when the audit record storage volume reaches 25 percent remaining of the allocated capacity.
Maps to AU-5(1) via CCI-001855Check
Verify Ubuntu 22.04 LTS is configured to notify the SA and ISSO when the audit record storage volume reaches 25 percent remaining of the allocated capacity by using the following command: $ sudo grep -i space_left /etc/audit/auditd.conf space_left = 25% space_left_action = email If "space_left" is set to a value less than "25%", is commented out, or is missing, this is a finding. If "space_left_action" is not set to "email", is commented out, or is missing, this is a finding. Note: If the "space_left_action" is set to "exec", the system executes a designated script. If this script informs the SA of the event, this is not a finding.
Fix
Configure Ubuntu 22.04 LTS to notify the SA and ISSO when the audit record storage volume reaches 25 percent remaining of the allocated capacity. Add or modify the following lines in the "/etc/audit/auditd.conf " file: space_left = 25% space_left_action = email Restart the "auditd" service for the changes to take effect: $ sudo systemctl restart auditd.service Note: If the "space_left_action" parameter is set to "exec", ensure the command being executed notifies the SA and ISSO.