Linux STIGs

CAT III 15

Any vulnerability, the existence of which degrades measures to protect against loss of confidentiality, availability or integrity.

1. RHEL-09-211035 CAT III V-257782 · SRG-OS-000480-GPOS-00227

   RHEL 9 must enable the hardware random number generator entropy gatherer service.

   Maps to CM-6 via CCI-000366
   Check

   Note: For RHEL 9 systems running with kernel FIPS mode enabled as specified by RHEL-09-671010, this requirement is Not Applicable. Verify that RHEL 9 has enabled the hardware random number generator entropy gatherer service with the following command: $ systemctl is-active rngd active If the "rngd" service is not active, this is a finding.

   Fix

   Install the rng-tools package with the following command: $ sudo dnf install rng-tools Then enable the rngd service run the following command: $ sudo systemctl enable --now rngd

2. RHEL-09-212050 CAT III V-257795 · SRG-OS-000433-GPOS-00193

   RHEL 9 must enable mitigations against processor-based vulnerabilities.

   Maps to CM-7, SI-16 via CCI-000381, CCI-002824
   Check

   Verify RHEL 9 enables kernel page-table isolation with the following command: $ sudo grubby --info=ALL | grep args | grep -v 'pti=on' If any output is returned, this is a finding. Check that kernel page-table isolation is enabled by default to persist in kernel updates: $ grep pti /etc/default/grub GRUB_CMDLINE_LINUX="pti=on" If "pti" is not set to "on", is missing or commented out, this is a finding.

   Fix

   Configure RHEL 9 to enable kernel page-table isolation with the following command: $ sudo grubby --update-kernel=ALL --args="pti=on" Add or modify the following line in "/etc/default/grub" to ensure the configuration survives kernel updates: GRUB_CMDLINE_LINUX="pti=on"

3. RHEL-09-212055 CAT III V-257796 · SRG-OS-000037-GPOS-00015

   RHEL 9 must enable auditing of processes that start prior to the audit daemon.

   Maps to AU-3, AU-3(1), AU-12, AU-14(1), MA-4(1) via CCI-000130, CCI-000135, CCI-000169, CCI-000172, CCI-001464, CCI-002884
   Check

   Verify that GRUB 2 is configured to enable auditing of processes that start prior to the audit daemon with the following commands: Check that the current GRUB 2 configuration enables auditing: $ sudo grubby --info=ALL | grep args | grep -v 'audit=1' If any output is returned, this is a finding. Check that auditing is enabled by default to persist in kernel updates: $ grep audit /etc/default/grub GRUB_CMDLINE_LINUX="audit=1" If "audit" is not set to "1", is missing, or is commented out, this is a finding.

   Fix

   Enable auditing of processes that start prior to the audit daemon with the following command: $ sudo grubby --update-kernel=ALL --args="audit=1" Add or modify the following line in "/etc/default/grub" to ensure the configuration survives kernel updates: GRUB_CMDLINE_LINUX="audit=1"

4. RHEL-09-214035 CAT III V-257824 · SRG-OS-000437-GPOS-00194

   RHEL 9 must remove all software components after updated versions have been installed.

   Maps to SI-2(6) via CCI-002617
   Check

   Verify RHEL 9 removes all software components after updated versions have been installed with the following command: $ sudo grep -i clean_requirements_on_remove /etc/dnf/dnf.conf clean_requirements_on_remove=True If "clean_requirements_on_remove" is not set to either "1", "true", or "yes" (keywords containing letters are case insensitive), this is a finding.

   Fix

   Configure RHEL 9 to remove all software components after updated versions have been installed. Edit the file "/etc/dnf/dnf.conf" by adding or editing the following line: clean_requirements_on_remove=True Note: Any of the following are acceptable: "1", "true", or "yes" (keywords containing letters are case insensitive).

5. RHEL-09-231020 CAT III V-257845 · SRG-OS-000480-GPOS-00227

   RHEL 9 must use a separate file system for /var.

   Maps to CM-6 via CCI-000366
   Check

   Verify that a separate file system/partition has been created for "/var" with the following command: $ mount | grep /var /dev/mapper/rootvg-varlv on /var type xfs (rw,relatime,seclabel,attr2,inode64,logbufs=8,logbsize=32k,noquota) Note: Options displayed for mount may differ. If a separate entry for "/var" is not in use, this is a finding.

   Fix

   Migrate the "/var" path onto a separate file system.

6. RHEL-09-231025 CAT III V-257846 · SRG-OS-000480-GPOS-00227

   RHEL 9 must use a separate file system for /var/log.

   Maps to CM-6 via CCI-000366
   Check

   Verify that a separate file system/partition has been created for "/var/log" with the following command: $ mount | grep /var/log /dev/mapper/rhel-var_log on /var/log type xfs (rw,nosuid,nodev,noexec,relatime,seclabel,attr2,inode64,logbufs=8,logbsize=32k) Note: Options displayed for mount may differ. If a separate entry for "/var/log" is not in use, this is a finding.

   Fix

   Migrate the "/var/log" path onto a separate file system.

7. RHEL-09-231030 CAT III V-257847 · SRG-OS-000341-GPOS-00132

   RHEL 9 must use a separate file system for the system audit data path.

   Maps to AU-4 via CCI-001849
   Check

   Verify that a separate file system/partition has been created for the system audit data path with the following command: Note: /var/log/audit is used as the example as it is a common location. $ mount | grep /var/log/audit /dev/mapper/rootvg-varlogaudit on /var/log/audit type xfs (rw,relatime,seclabel,attr2,inode64,logbufs=8,logbsize=32k,noquota) Note: Options displayed for mount may differ. If no line is returned, this is a finding.

   Fix

   Migrate the system audit data path onto a separate file system.

8. RHEL-09-231195 CAT III V-257880 · SRG-OS-000095-GPOS-00049

   RHEL 9 must disable mounting of cramfs.

   Maps to CM-7 via CCI-000381
   Check

   Verify that RHEL 9 disables the ability to load the cramfs kernel module with the following command: $ grep -r cramfs /etc/modprobe.conf /etc/modprobe.d/* install cramfs /bin/false blacklist cramfs If the command does not return any output or the lines are commented out, and use of cramfs is not documented with the information system security officer (ISSO) as an operational requirement, this is a finding.

   Fix

   To configure the system to prevent the cramfs kernel module from being loaded, add the following lines to the file /etc/modprobe.d/blacklist.conf (or create blacklist.conf if it does not exist): install cramfs /bin/false blacklist cramfs

9. RHEL-09-252025 CAT III V-257946 · SRG-OS-000096-GPOS-00050

   RHEL 9 must disable the chrony daemon from acting as a server.

   Maps to CM-7 via CCI-000381, CCI-000382
   Check

   Note: If the server is serving as an NTP server, this is not applicable. Verify RHEL 9 disables the chrony daemon from acting as a server with the following command: $ grep -w port /etc/chrony.conf port 0 If the "port" option is not set to "0", is commented out, or is missing, this is a finding.

   Fix

   Configure RHEL 9 to disable the chrony daemon from acting as a server by adding/modifying the following line in the /etc/chrony.conf file: port 0

10. RHEL-09-252030 CAT III V-257947 · SRG-OS-000096-GPOS-00050

    RHEL 9 must disable network management of the chrony daemon.

    Maps to CM-7 via CCI-000381, CCI-000382
    Check

    Verify RHEL 9 disables network management of the chrony daemon with the following command: $ grep -w cmdport /etc/chrony.conf cmdport 0 If the "cmdport" option is not set to "0", is commented out, or is missing, this is a finding.

    Fix

    Configure RHEL 9 to disable network management of the chrony daemon by adding/modifying the following line in the /etc/chrony.conf file: cmdport 0

11. RHEL-09-291025 CAT III V-258037 · SRG-OS-000062-GPOS-00031

    RHEL 9 must enable Linux audit logging for the USBGuard daemon.

    Maps to AU-12 via CCI-000169
    Check

    To verify that Linux Audit logging is enabled for the USBGuard daemon with the following command: $ sudo grep AuditBackend /etc/usbguard/usbguard-daemon.conf AuditBackend=LinuxAudit If "AuditBackend" is not set to "LinuxAudit", this is a finding. If the system is virtual machine with no virtual or physical USB peripherals attached, this is not a finding.

    Fix

    Configure RHEL 9 USBGuard AuditBackend to use the audit system. Add or edit the following line in /etc/usbguard/usbguard-daemon.conf AuditBackend=LinuxAudit

12. RHEL-09-412040 CAT III V-258069 · SRG-OS-000027-GPOS-00008

    RHEL 9 must limit the number of concurrent sessions to ten for all accounts and/or account types.

    Maps to AC-10 via CCI-000054
    Check

    Verify RHEL 9 limits the number of concurrent sessions to "10" for all accounts and/or account types with the following command: $ grep -r -s maxlogins /etc/security/limits.conf /etc/security/limits.d/*.conf /etc/security/limits.conf:* hard maxlogins 10 This can be set as a global domain (with the * wildcard) but may be set differently for multiple domains. If the "maxlogins" item is missing, commented out, or the value is set greater than "10" and is not documented with the information system security officer (ISSO) as an operational requirement for all domains that have the "maxlogins" item assigned, this is a finding.

    Fix

    Configure RHEL 9 to limit the number of concurrent sessions to "10" for all accounts and/or account types. Add the following line to the top of the /etc/security/limits.conf or in a ".conf" file defined in /etc/security/limits.d/: * hard maxlogins 10

13. RHEL-09-651030 CAT III V-258138 · SRG-OS-000480-GPOS-00227

    RHEL 9 must be configured so that the file integrity tool verifies Access Control Lists (ACLs).

    Maps to CM-6 via CCI-000366
    Check

    Verify that AIDE is verifying ACLs with the following command: $ sudo grep acl /etc/aide.conf All= p+i+n+u+g+s+m+S+sha512+acl+xattrs+selinux If the "acl" rule is not being used on all uncommented selection lines in the "/etc/aide.conf" file, or ACLs are not being checked by another file integrity tool, this is a finding.

    Fix

    Configure the file integrity tool to check file and directory ACLs. If AIDE is installed, ensure the "acl" rule is present on all uncommented file and directory selection lists.

14. RHEL-09-651035 CAT III V-258139 · SRG-OS-000480-GPOS-00227

    RHEL 9 must be configured so that the file integrity tool verifies extended attributes.

    Maps to CM-6 via CCI-000366
    Check

    Verify that AIDE is configured to verify extended attributes with the following command: $ sudo grep xattrs /etc/aide.conf All= p+i+n+u+g+s+m+S+sha512+acl+xattrs+selinux If the "xattrs" rule is not being used on all uncommented selection lines in the "/etc/aide.conf" file, or extended attributes are not being checked by another file integrity tool, this is a finding.

    Fix

    Configure the file integrity tool to check file and directory extended attributes. If AIDE is installed, ensure the "xattrs" rule is present on all uncommented file and directory selection lists.

15. RHEL-09-653120 CAT III V-258173 · SRG-OS-000254-GPOS-00095

    RHEL 9 must allocate an audit_backlog_limit of sufficient size to capture processes that start prior to the audit daemon.

    Maps to AU-4, AU-14(1) via CCI-001464, CCI-001849
    Check

    Verify RHEL 9 allocates a sufficient audit_backlog_limit to capture processes that start prior to the audit daemon with the following command: $ sudo grubby --info=ALL | grep args | grep 'audit_backlog_limit' If the command returns any outputs, and audit_backlog_limit is less than "8192", this is a finding.

    Fix

    Configure RHEL 9 to allocate sufficient audit_backlog_limit to capture processes that start prior to the audit daemon with the following command: $ sudo grubby --update-kernel=ALL --args=audit_backlog_limit=8192