Linux STIGs

CAT III 5

Any vulnerability, the existence of which degrades measures to protect against loss of confidentiality, availability or integrity.

1. RHEL-10-000520 CAT III V-280936 · SRG-OS-000341-GPOS-00132

   RHEL 10 must use a separate file system for the system audit data path.

   Maps to AU-4 via CCI-001849
   Check

   Verify RHEL 10 uses a separate file system/partition for the system audit data path with the following command: Note: /var/log/audit is used as the example as it is a common location. $ mount | grep /var/log/audit /dev/mapper/rootvg-varlogaudit on /var/log/audit type xfs (rw,relatime,seclabel,attr2,inode64,logbufs=8,logbsize=32k,noquota) Note: Options displayed for mount may differ. If no line is returned, this is a finding.

   Fix

   Configure RHEL 10 to use a separate file system for the system audit data path by migrating "/var/log/audit" onto a separate file system.

2. RHEL-10-200662 CAT III V-280995 · SRG-OS-000342-GPOS-00133

   RHEL 10 must have the "audispd-plugins" package installed.

   Maps to AU-4(1) via CCI-001851
   Check

   Verify RHEL 10 has the "audispd-plugins" package installed with the following command: $ sudo dnf list --installed audispd-plugins Installed Packages audispd-plugins.x86_64 4.0.3-1.el10 @rhel-10-for-x86_64-baseos-rpms If the "audispd-plugins" package is not installed, this is a finding.

   Fix

   Configure RHEL 10 to have the "audispd-plugins" package installed with the following command: $ sudo dnf -y install audispd-plugins

3. RHEL-10-500100 CAT III V-281106 · SRG-OS-000341-GPOS-00132

   RHEL 10 must allocate audit record storage capacity to store at least one week's worth of audit records.

   Maps to AU-4, AU-4(1) via CCI-001849, CCI-001851
   Check

   Verify RHEL 10 allocates audit record storage capacity to store at least one week of audit records when audit records are not immediately sent to a central audit record storage facility. Note: The partition size needed to capture a week of audit records is based on the activity level of the system and the total storage capacity available. Typically 10GB of storage space for audit records should be sufficient. Determine which partition the audit records are being written to with the following command: $ sudo grep -w log_file /etc/audit/auditd.conf log_file = /var/log/audit/audit.log Check the size of the partition that audit records are written to with the following command and verify whether it is sufficiently large: $ df -h /var/log/audit/ Filesystem Size Used Avail Use% Mounted on /dev/mapper/luks-4e45e1ad-5337-42c4-a19f-ee12ccc1d502 10G 263M 9.7G 3% /var/log/audit If the audit record partition is not allocated for sufficient storage capacity, this is a finding.

   Fix

   Configure RHEL 10 to allocate enough storage capacity for at least one week of audit records when audit records are not immediately sent to a central audit record storage facility. If audit records are stored on a partition made specifically for audit records, resize the partition with sufficient space to contain one week of audit records. If audit records are not stored on a partition made specifically for audit records, a new partition with sufficient space must be created.

4. RHEL-10-600475 CAT III V-281203 · SRG-OS-000027-GPOS-00008

   RHEL 10 must limit the number of concurrent sessions to 10 for all accounts and/or account types.

   Maps to AC-10 via CCI-000054
   Check

   Verify RHEL 10 limits the number of concurrent sessions to "10" for all accounts and/or account types with the following command: $ sudo grep -rs maxlogins /etc/security/limits.conf /etc/security/limits.d/*.conf | grep -v '#' /etc/security/limits.d/maxlogins.conf:* hard maxlogins 10 This can be set as a global domain (with the * wildcard) but may be set differently for multiple domains. If the "maxlogins" item is missing or commented out, or the value is set greater than "10" and is not documented with the information system security officer as an operational requirement for all domains that have the "maxlogins" item assigned, this is a finding.

   Fix

   Configure RHEL 10 to limit the number of concurrent sessions to "10" for all accounts and/or account types. Add the following line to the top of "/etc/security/limits.conf" or in a ".conf" file defined in "/etc/security/limits.d/": * hard maxlogins 10

5. RHEL-10-700890 CAT III V-281292 · SRG-OS-000114-GPOS-00059

   RHEL 10 must disable the graphical user interface autorunner unless required.

   Maps to IA-3 via CCI-000778, CCI-001958
   Check

   Note: This requirement assumes the use of the RHEL 10 default graphical user interface, the GNOME desktop environment. If the system does not have any graphical user interface installed, this requirement is not applicable. Verify RHEL 10 disables the graphical user interface autorun function. Disable the setting with the following command: $ gsettings get org.gnome.desktop.media-handling autorun-never true If "autorun-never" is set to "false" and is not documented with the information system security officer as an operational requirement, this is a finding.

   Fix

   Configure RHEL 10 GNOME to disable autorunning of removable media. Note: The example below is using the database "local" for the system. If the system is using another database in "/etc/dconf/profile/user", the file should be created under the appropriate subdirectory. Update the "/etc/dconf/db/local.d/00-security-settings" database to disable the GUI autorun function: $ sudo vi /etc/dconf/db/local.d/00-security-settings [org/gnome/desktop/media-handling] autorun-never=true Update the dconf system databases: $ sudo dconf update