Guide to the Secure Configuration of Red Hat Enterprise Linux 8
with profile Protection Profile for General Purpose Operating SystemsThis profile reflects mandatory configuration controls identified in the NIAP Configuration Annex to the Protection Profile for General Purpose Operating Systems (Protection Profile Version 4.2.1). This configuration profile is consistent with CNSSI-1253, which requires U.S. National Security Systems to adhere to certain configuration parameters. Accordingly, this configuration profile is suitable for use in U.S. National Security Systems.
https://www.open-scap.org/security-policies/scap-security-guide
scap-security-guide
package which is developed at
https://www.open-scap.org/security-policies/scap-security-guide.
Providing system administrators with such guidance informs them how to securely configure systems under their control in a variety of network roles. Policy makers and baseline creators can use this catalog of settings, with its associated references to higher-level security control catalogs, in order to assist them in security baseline creation. This guide is a catalog, not a checklist, and satisfaction of every item is not likely to be possible or sensible in many operational scenarios. However, the XCCDF format enables granular selection and adjustment of settings, and their association with OVAL and OCIL content provides an automated checking capability. Transformations of this document, and its associated automated checking content, are capable of providing baselines that meet a diverse set of policy objectives. Some example XCCDF Profiles, which are selections of items that form checklists and can be used as baselines, are available with this guide. They can be processed, in an automated fashion, with tools that support the Security Content Automation Protocol (SCAP). The DISA STIG, which provides required settings for US Department of Defense systems, is one example of a baseline created from this guidance.
Evaluation Characteristics
Evaluation target | myvm |
---|---|
Benchmark URL | #scap_org.open-scap_comp_ssg-rhel8-xccdf-1.2.xml |
Benchmark ID | xccdf_org.ssgproject.content_benchmark_RHEL-8 |
Benchmark version | 0.1.57 |
Profile ID | xccdf_org.ssgproject.content_profile_ospp |
Started at | 2022-02-10T22:29:26+00:00 |
Finished at | 2022-02-10T22:29:27+00:00 |
Performed by | vagrant |
Test system | cpe:/a:redhat:openscap:1.3.5 |
CPE Platforms
- cpe:/o:redhat:enterprise_linux:8
- cpe:/o:redhat:enterprise_linux:8.5
- cpe:/o:redhat:enterprise_linux:8.0
- cpe:/o:redhat:enterprise_linux:8.1
- cpe:/o:redhat:enterprise_linux:8.2
- cpe:/o:redhat:enterprise_linux:8.3
- cpe:/o:redhat:enterprise_linux:8.4
- cpe:/o:redhat:enterprise_linux:8.6
- cpe:/o:redhat:enterprise_linux:8.7
- cpe:/o:redhat:enterprise_linux:8.8
- cpe:/o:redhat:enterprise_linux:8.9
- cpe:/o:redhat:enterprise_linux:8.10
Addresses
- IPv4 127.0.0.1
- IPv4 10.0.2.15
- IPv4 192.168.56.135
- IPv6 0:0:0:0:0:0:0:1
- IPv6 fe80:0:0:0:a00:27ff:fe55:6bf0
- IPv6 fe80:0:0:0:f085:6b14:8446:142d
- MAC 00:00:00:00:00:00
- MAC 08:00:27:55:6B:F0
- MAC 08:00:27:4F:A6:9E
Compliance and Scoring
Rule results
Severity of failed rules
Score
Scoring system | Score | Maximum | Percent |
---|---|---|---|
urn:xccdf:scoring:default | 97.916664 | 100.000000 |
Rule Overview
Result Details
Install AIDE
Rule ID | xccdf_org.ssgproject.content_rule_package_aide_installed |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-package_aide_installed:def:1 |
Time | 2022-02-10T22:29:26+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-80844-4 References: BP28(R51), 1.4.1, 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, RHEL-08-010360, SV-230263r627750_rule |
Description | The aide package can be installed with the following command:
$ sudo yum install aide |
Rationale | The AIDE package must be installed if it is to be available for integrity checking. |
package aide is installed oval:ssg-test_package_aide_installed:tst:1 true
Following items have been found on the system:
Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
---|---|---|---|---|---|---|---|
aide | x86_64 | (none) | 14.el8 | 0.16 | 0:0.16-14.el8 | 199e2f91fd431d51 | aide-0:0.16-14.el8.x86_64 |
Enable Dracut FIPS Module
Rule ID | xccdf_org.ssgproject.content_rule_enable_dracut_fips_module |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-enable_dracut_fips_module:def:1 |
Time | 2022-02-10T22:29:26+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-82155-3 References: CCI-000068, CCI-000803, CCI-002450, 1446, CIP-003-3 R4.2, CIP-007-3 R5.1, SC-12(2), SC-12(3), IA-7, SC-13, CM-6(a), SC-12, SRG-OS-000478-GPOS-00223, SRG-OS-000120-VMM-000600, SRG-OS-000478-VMM-001980, SRG-OS-000396-VMM-001590 |
Description | To enable FIPS mode, run the following command:
fips-mode-setup --enableTo enable FIPS, the system requires that the fips module is added in
dracut configuration.
Check if /etc/dracut.conf.d/40-fips.conf contain add_dracutmodules+=" fips " |
Rationale | Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to
protect data. The operating system must implement cryptographic modules adhering to the higher
standards approved by the federal government since this provides assurance they have been tested
and validated. |
Warnings | warning
The system needs to be rebooted for these changes to take effect. warning
System Crypto Modules must be provided by a vendor that undergoes
FIPS-140 certifications.
FIPS-140 is applicable to all Federal agencies that use
cryptographic-based security systems to protect sensitive information
in computer and telecommunication systems (including voice systems) as
defined in Section 5131 of the Information Technology Management Reform
Act of 1996, Public Law 104-106. This standard shall be used in
designing and implementing cryptographic modules that Federal
departments and agencies operate or are operated for them under
contract. See https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf
To meet this, the system has to have cryptographic software provided by
a vendor that has undergone this certification. This means providing
documentation, test results, design information, and independent third
party review by an accredited lab. While open source software is
capable of meeting this, it does not meet FIPS-140 unless the vendor
submits to this process. |
add_dracutmodules contains fips oval:ssg-test_enable_dracut_fips_module:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/dracut.conf.d/40-fips.conf | add_dracutmodules+=" fips " |
Enable FIPS Mode
Rule ID | xccdf_org.ssgproject.content_rule_enable_fips_mode |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-enable_fips_mode:def:1 |
Time | 2022-02-10T22:29:26+00:00 |
Severity | high |
Identifiers and References | Identifiers: CCE-80942-6 References: CCI-000068, CCI-000803, CCI-002450, 1446, CIP-003-3 R4.2, CIP-007-3 R5.1, SC-12(2), SC-12(3), IA-7, SC-13, CM-6(a), SC-12, FCS_COP.1(1), FCS_COP.1(2), FCS_COP.1(3), FCS_COP.1(4), FCS_CKM.1, FCS_CKM.2, FCS_TLSC_EXT.1, SRG-OS-000478-GPOS-00223, SRG-OS-000396-GPOS-00176, RHEL-08-010020, SV-230223r627750_rule, SRG-OS-000120-VMM-000600, SRG-OS-000478-VMM-001980, SRG-OS-000396-VMM-001590 |
Description | To enable FIPS mode, run the following command:
fips-mode-setup --enable The fips-mode-setup command will configure the system in
FIPS mode by automatically configuring the following:
|
Rationale | Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to
protect data. The operating system must implement cryptographic modules adhering to the higher
standards approved by the federal government since this provides assurance they have been tested
and validated. |
Warnings | warning
The system needs to be rebooted for these changes to take effect. warning
System Crypto Modules must be provided by a vendor that undergoes
FIPS-140 certifications.
FIPS-140 is applicable to all Federal agencies that use
cryptographic-based security systems to protect sensitive information
in computer and telecommunication systems (including voice systems) as
defined in Section 5131 of the Information Technology Management Reform
Act of 1996, Public Law 104-106. This standard shall be used in
designing and implementing cryptographic modules that Federal
departments and agencies operate or are operated for them under
contract. See https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf
To meet this, the system has to have cryptographic software provided by
a vendor that has undergone this certification. This means providing
documentation, test results, design information, and independent third
party review by an accredited lab. While open source software is
capable of meeting this, it does not meet FIPS-140 unless the vendor
submits to this process. |
/etc/system-fips exists oval:ssg-test_etc_system_fips:tst:1 true
Following items have been found on the system:
Path | Type | UID | GID | Size (B) | Permissions |
---|---|---|---|---|---|
/etc/system-fips | regular | 0 | 0 | 36 | rw-r--r-- |
kernel runtime parameter crypto.fips_enabled set to 1 oval:ssg-test_sysctl_crypto_fips_enabled:tst:1 true
Following items have been found on the system:
Name | Value |
---|---|
crypto.fips_enabled | 1 |
add_dracutmodules contains fips oval:ssg-test_enable_dracut_fips_module:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/dracut.conf.d/40-fips.conf | add_dracutmodules+=" fips " |
check for crypto policy correctly configured in /etc/crypto-policies/config oval:ssg-test_configure_crypto_policy:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/crypto-policies/config | FIPS:OSPP |
check for crypto policy correctly configured in /etc/crypto-policies/state/current oval:ssg-test_configure_crypto_policy_current:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/crypto-policies/state/current | FIPS:OSPP |
Check if update-crypto-policies has been run oval:ssg-test_crypto_policies_updated:tst:1 true
Following items have been found on the system:
Var ref | Value |
---|---|
oval:ssg-variable_crypto_policies_config_file_timestamp:var:1 | 1644530616 |
Check if /etc/crypto-policies/back-ends/nss.config exists oval:ssg-test_crypto_policy_nss_config:tst:1 true
Following items have been found on the system:
Path | Type | UID | GID | Size (B) | Permissions |
---|---|---|---|---|---|
/etc/crypto-policies/back-ends/nss.config | regular | 0 | 0 | 397 | rw-r--r-- |
installed OS part of unix family oval:ssg-test_rhel7_unix_family:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-obj_rhel7_unix_family:obj:1 of type family_object
installed OS part of unix family oval:ssg-test_rhel7_unix_family:tst:1 true
Following items have been found on the system:
Family |
---|
unix |
redhat-release-client is version 7 oval:ssg-test_rhel7_client:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-obj_rhel7_client:obj:1 of type rpminfo_object
Name |
---|
redhat-release-client |
redhat-release-client is version 7 oval:ssg-test_rhel7_client:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_rhel7_client:obj:1 of type rpminfo_object
Name |
---|
redhat-release-client |
redhat-release-workstation is version 7 oval:ssg-test_rhel7_workstation:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-obj_rhel7_workstation:obj:1 of type rpminfo_object
Name |
---|
redhat-release-workstation |
redhat-release-workstation is version 7 oval:ssg-test_rhel7_workstation:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_rhel7_workstation:obj:1 of type rpminfo_object
Name |
---|
redhat-release-workstation |
redhat-release-server is version 7 oval:ssg-test_rhel7_server:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-obj_rhel7_server:obj:1 of type rpminfo_object
Name |
---|
redhat-release-server |
redhat-release-server is version 7 oval:ssg-test_rhel7_server:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_rhel7_server:obj:1 of type rpminfo_object
Name |
---|
redhat-release-server |
redhat-release-computenode is version 7 oval:ssg-test_rhel7_computenode:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-obj_rhel7_computenode:obj:1 of type rpminfo_object
Name |
---|
redhat-release-computenode |
redhat-release-computenode is version 7 oval:ssg-test_rhel7_computenode:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_rhel7_computenode:obj:1 of type rpminfo_object
Name |
---|
redhat-release-computenode |
redhat-release-virtualization-host RPM package is installed oval:ssg-test_rhvh4_version:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_rhvh4_version:obj:1 of type rpminfo_object
Name |
---|
redhat-release-virtualization-host |
redhat-release-virtualization-host RPM package is installed oval:ssg-test_rhvh4_version:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_rhvh4_version:obj:1 of type rpminfo_object
Name |
---|
redhat-release-virtualization-host |
RHEVH base RHEL is version 7 oval:ssg-test_rhevh_rhel7_version:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-obj_rhevh_rhel7_version:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
/etc/redhat-release | ^Red Hat Enterprise Linux release (\d)\.\d+$ | 1 |
RHEVH base RHEL is version 7 oval:ssg-test_rhevh_rhel7_version:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_rhevh_rhel7_version:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
/etc/redhat-release | ^Red Hat Enterprise Linux release (\d)\.\d+$ | 1 |
installed OS part of unix family oval:ssg-test_rhel7_unix_family:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-obj_rhel7_unix_family:obj:1 of type family_object
installed OS part of unix family oval:ssg-test_rhel7_unix_family:tst:1 true
Following items have been found on the system:
Family |
---|
unix |
redhat-release-client is version 7 oval:ssg-test_rhel7_client:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-obj_rhel7_client:obj:1 of type rpminfo_object
Name |
---|
redhat-release-client |
redhat-release-client is version 7 oval:ssg-test_rhel7_client:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_rhel7_client:obj:1 of type rpminfo_object
Name |
---|
redhat-release-client |
redhat-release-workstation is version 7 oval:ssg-test_rhel7_workstation:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-obj_rhel7_workstation:obj:1 of type rpminfo_object
Name |
---|
redhat-release-workstation |
redhat-release-workstation is version 7 oval:ssg-test_rhel7_workstation:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_rhel7_workstation:obj:1 of type rpminfo_object
Name |
---|
redhat-release-workstation |
redhat-release-server is version 7 oval:ssg-test_rhel7_server:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-obj_rhel7_server:obj:1 of type rpminfo_object
Name |
---|
redhat-release-server |
redhat-release-server is version 7 oval:ssg-test_rhel7_server:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_rhel7_server:obj:1 of type rpminfo_object
Name |
---|
redhat-release-server |
redhat-release-computenode is version 7 oval:ssg-test_rhel7_computenode:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-obj_rhel7_computenode:obj:1 of type rpminfo_object
Name |
---|
redhat-release-computenode |
redhat-release-computenode is version 7 oval:ssg-test_rhel7_computenode:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_rhel7_computenode:obj:1 of type rpminfo_object
Name |
---|
redhat-release-computenode |
redhat-release-virtualization-host RPM package is installed oval:ssg-test_rhvh4_version:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_rhvh4_version:obj:1 of type rpminfo_object
Name |
---|
redhat-release-virtualization-host |
redhat-release-virtualization-host RPM package is installed oval:ssg-test_rhvh4_version:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_rhvh4_version:obj:1 of type rpminfo_object
Name |
---|
redhat-release-virtualization-host |
RHEVH base RHEL is version 7 oval:ssg-test_rhevh_rhel7_version:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-obj_rhevh_rhel7_version:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
/etc/redhat-release | ^Red Hat Enterprise Linux release (\d)\.\d+$ | 1 |
RHEVH base RHEL is version 7 oval:ssg-test_rhevh_rhel7_version:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_rhevh_rhel7_version:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
/etc/redhat-release | ^Red Hat Enterprise Linux release (\d)\.\d+$ | 1 |
installed OS part of unix family oval:ssg-test_rhel8_unix_family:tst:1 true
Following items have been found on the system:
Family |
---|
unix |
installed OS part of unix family oval:ssg-test_rhel8_unix_family:tst:1 true
Following items have been found on the system:
Family |
---|
unix |
redhat-release is version 8 oval:ssg-test_rhel8:tst:1 true
Following items have been found on the system:
Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
---|---|---|---|---|---|---|---|
redhat-release | x86_64 | (none) | 0.8.el8 | 8.5 | 0:8.5-0.8.el8 | 199e2f91fd431d51 | redhat-release-0:8.5-0.8.el8.x86_64 |
redhat-release is version 8 oval:ssg-test_rhel8:tst:1 true
Following items have been found on the system:
Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
---|---|---|---|---|---|---|---|
redhat-release | x86_64 | (none) | 0.8.el8 | 8.5 | 0:8.5-0.8.el8 | 199e2f91fd431d51 | redhat-release-0:8.5-0.8.el8.x86_64 |
redhat-release-virtualization-host RPM package is installed oval:ssg-test_rhvh4_version:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_rhvh4_version:obj:1 of type rpminfo_object
Name |
---|
redhat-release-virtualization-host |
redhat-release-virtualization-host RPM package is installed oval:ssg-test_rhvh4_version:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_rhvh4_version:obj:1 of type rpminfo_object
Name |
---|
redhat-release-virtualization-host |
RHEVH base RHEL is version 8 oval:ssg-test_rhevh_rhel8_version:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_rhevh_rhel8_version:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
/etc/redhat-release | ^Red Hat Enterprise Linux release (\d)\.\d+$ | 1 |
RHEVH base RHEL is version 8 oval:ssg-test_rhevh_rhel8_version:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_rhevh_rhel8_version:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
/etc/redhat-release | ^Red Hat Enterprise Linux release (\d)\.\d+$ | 1 |
installed OS part of unix family oval:ssg-test_rhel8_unix_family:tst:1 true
Following items have been found on the system:
Family |
---|
unix |
installed OS part of unix family oval:ssg-test_rhel8_unix_family:tst:1 true
Following items have been found on the system:
Family |
---|
unix |
redhat-release is version 8 oval:ssg-test_rhel8:tst:1 true
Following items have been found on the system:
Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
---|---|---|---|---|---|---|---|
redhat-release | x86_64 | (none) | 0.8.el8 | 8.5 | 0:8.5-0.8.el8 | 199e2f91fd431d51 | redhat-release-0:8.5-0.8.el8.x86_64 |
redhat-release is version 8 oval:ssg-test_rhel8:tst:1 true
Following items have been found on the system:
Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
---|---|---|---|---|---|---|---|
redhat-release | x86_64 | (none) | 0.8.el8 | 8.5 | 0:8.5-0.8.el8 | 199e2f91fd431d51 | redhat-release-0:8.5-0.8.el8.x86_64 |
redhat-release-virtualization-host RPM package is installed oval:ssg-test_rhvh4_version:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_rhvh4_version:obj:1 of type rpminfo_object
Name |
---|
redhat-release-virtualization-host |
redhat-release-virtualization-host RPM package is installed oval:ssg-test_rhvh4_version:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_rhvh4_version:obj:1 of type rpminfo_object
Name |
---|
redhat-release-virtualization-host |
RHEVH base RHEL is version 8 oval:ssg-test_rhevh_rhel8_version:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_rhevh_rhel8_version:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
/etc/redhat-release | ^Red Hat Enterprise Linux release (\d)\.\d+$ | 1 |
RHEVH base RHEL is version 8 oval:ssg-test_rhevh_rhel8_version:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_rhevh_rhel8_version:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
/etc/redhat-release | ^Red Hat Enterprise Linux release (\d)\.\d+$ | 1 |
os-release is rhcos oval:ssg-test_rhcos:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-obj_rhcos:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
/etc/os-release | ^ID="(\w+)"$ | 1 |
os-release is rhcos oval:ssg-test_rhcos:tst:1 false
Following items have been found on the system:
Path | Content |
---|---|
/etc/os-release | ID="rhel" |
rhcoreos is version 4 oval:ssg-test_rhcos4:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-obj_rhcos4:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
/etc/os-release | ^VERSION_ID="(\d)\.\d+"$ | 1 |
rhcoreos is version 4 oval:ssg-test_rhcos4:tst:1 false
Following items have been found on the system:
Path | Content |
---|---|
/etc/os-release | VERSION_ID="8.5" |
os-release is rhcos oval:ssg-test_rhcos:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-obj_rhcos:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
/etc/os-release | ^ID="(\w+)"$ | 1 |
os-release is rhcos oval:ssg-test_rhcos:tst:1 false
Following items have been found on the system:
Path | Content |
---|---|
/etc/os-release | ID="rhel" |
rhcoreos is version 4 oval:ssg-test_rhcos4:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-obj_rhcos4:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
/etc/os-release | ^VERSION_ID="(\d)\.\d+"$ | 1 |
rhcoreos is version 4 oval:ssg-test_rhcos4:tst:1 false
Following items have been found on the system:
Path | Content |
---|---|
/etc/os-release | VERSION_ID="8.5" |
Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-object_unix_family:obj:1 of type family_object
Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 true
Following items have been found on the system:
Family |
---|
unix |
Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-object_unix_family:obj:1 of type family_object
Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 true
Following items have been found on the system:
Family |
---|
unix |
oraclelinux-release is version 7 oval:ssg-test_ol7_system:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-obj_ol7_system:obj:1 of type rpminfo_object
Name |
---|
oraclelinux-release |
oraclelinux-release is version 7 oval:ssg-test_ol7_system:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_ol7_system:obj:1 of type rpminfo_object
Name |
---|
oraclelinux-release |
Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-object_unix_family:obj:1 of type family_object
Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 true
Following items have been found on the system:
Family |
---|
unix |
Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-object_unix_family:obj:1 of type family_object
Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 true
Following items have been found on the system:
Family |
---|
unix |
oraclelinux-release is version 7 oval:ssg-test_ol7_system:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-obj_ol7_system:obj:1 of type rpminfo_object
Name |
---|
oraclelinux-release |
oraclelinux-release is version 7 oval:ssg-test_ol7_system:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_ol7_system:obj:1 of type rpminfo_object
Name |
---|
oraclelinux-release |
installed OS part of unix family oval:ssg-test_sle12_unix_family:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-obj_sle12_unix_family:obj:1 of type family_object
installed OS part of unix family oval:ssg-test_sle12_unix_family:tst:1 true
Following items have been found on the system:
Family |
---|
unix |
sled-release is version 6 oval:ssg-test_sle12_desktop:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-obj_sle12_desktop:obj:1 of type rpminfo_object
Name |
---|
sled-release |
sled-release is version 6 oval:ssg-test_sle12_desktop:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_sle12_desktop:obj:1 of type rpminfo_object
Name |
---|
sled-release |
sles-release is version 6 oval:ssg-test_sle12_server:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-obj_sle12_server:obj:1 of type rpminfo_object
Name |
---|
sles-release |
sles-release is version 6 oval:ssg-test_sle12_server:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_sle12_server:obj:1 of type rpminfo_object
Name |
---|
sles-release |
SLES_SAP-release is version 12 oval:ssg-test_sles_12_for_sap:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-obj_sles_12_for_sap:obj:1 of type rpminfo_object
Name |
---|
SLES_SAP-release |
SLES_SAP-release is version 12 oval:ssg-test_sles_12_for_sap:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_sles_12_for_sap:obj:1 of type rpminfo_object
Name |
---|
SLES_SAP-release |
installed OS part of unix family oval:ssg-test_sle12_unix_family:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-obj_sle12_unix_family:obj:1 of type family_object
installed OS part of unix family oval:ssg-test_sle12_unix_family:tst:1 true
Following items have been found on the system:
Family |
---|
unix |
sled-release is version 6 oval:ssg-test_sle12_desktop:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-obj_sle12_desktop:obj:1 of type rpminfo_object
Name |
---|
sled-release |
sled-release is version 6 oval:ssg-test_sle12_desktop:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_sle12_desktop:obj:1 of type rpminfo_object
Name |
---|
sled-release |
sles-release is version 6 oval:ssg-test_sle12_server:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-obj_sle12_server:obj:1 of type rpminfo_object
Name |
---|
sles-release |
sles-release is version 6 oval:ssg-test_sle12_server:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_sle12_server:obj:1 of type rpminfo_object
Name |
---|
sles-release |
SLES_SAP-release is version 12 oval:ssg-test_sles_12_for_sap:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-obj_sles_12_for_sap:obj:1 of type rpminfo_object
Name |
---|
SLES_SAP-release |
SLES_SAP-release is version 12 oval:ssg-test_sles_12_for_sap:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_sles_12_for_sap:obj:1 of type rpminfo_object
Name |
---|
SLES_SAP-release |
installed OS part of unix family oval:ssg-test_sle15_unix_family:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-obj_sle15_unix_family:obj:1 of type family_object
installed OS part of unix family oval:ssg-test_sle15_unix_family:tst:1 true
Following items have been found on the system:
Family |
---|
unix |
sled-release is version 15 oval:ssg-test_sle15_desktop:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-obj_sle15_desktop:obj:1 of type rpminfo_object
Name |
---|
sled-release |
sled-release is version 15 oval:ssg-test_sle15_desktop:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_sle15_desktop:obj:1 of type rpminfo_object
Name |
---|
sled-release |
sles-release is version 15 oval:ssg-test_sle15_server:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-obj_sle15_server:obj:1 of type rpminfo_object
Name |
---|
sles-release |
sles-release is version 15 oval:ssg-test_sle15_server:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_sle15_server:obj:1 of type rpminfo_object
Name |
---|
sles-release |
SLES_SAP-release is version 15 oval:ssg-test_sles_15_for_sap:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-obj_sles_15_for_sap:obj:1 of type rpminfo_object
Name |
---|
SLES_SAP-release |
SLES_SAP-release is version 15 oval:ssg-test_sles_15_for_sap:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_sles_15_for_sap:obj:1 of type rpminfo_object
Name |
---|
SLES_SAP-release |
installed OS part of unix family oval:ssg-test_sle15_unix_family:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-obj_sle15_unix_family:obj:1 of type family_object
installed OS part of unix family oval:ssg-test_sle15_unix_family:tst:1 true
Following items have been found on the system:
Family |
---|
unix |
sled-release is version 15 oval:ssg-test_sle15_desktop:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-obj_sle15_desktop:obj:1 of type rpminfo_object
Name |
---|
sled-release |
sled-release is version 15 oval:ssg-test_sle15_desktop:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_sle15_desktop:obj:1 of type rpminfo_object
Name |
---|
sled-release |
sles-release is version 15 oval:ssg-test_sle15_server:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-obj_sle15_server:obj:1 of type rpminfo_object
Name |
---|
sles-release |
sles-release is version 15 oval:ssg-test_sle15_server:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_sle15_server:obj:1 of type rpminfo_object
Name |
---|
sles-release |
SLES_SAP-release is version 15 oval:ssg-test_sles_15_for_sap:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-obj_sles_15_for_sap:obj:1 of type rpminfo_object
Name |
---|
SLES_SAP-release |
SLES_SAP-release is version 15 oval:ssg-test_sles_15_for_sap:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_sles_15_for_sap:obj:1 of type rpminfo_object
Name |
---|
SLES_SAP-release |
Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-object_unix_family:obj:1 of type family_object
Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 true
Following items have been found on the system:
Family |
---|
unix |
Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-object_unix_family:obj:1 of type family_object
Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 true
Following items have been found on the system:
Family |
---|
unix |
/etc/lsb-release exists oval:ssg-test_lsb:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-obj_lsb:obj:1 of type file_object
Filepath |
---|
/etc/lsb-release |
/etc/lsb-release exists oval:ssg-test_lsb:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_lsb:obj:1 of type file_object
Filepath |
---|
/etc/lsb-release |
Check Ubuntu oval:ssg-test_ubuntu:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-obj_ubuntu:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
/etc/lsb-release | ^DISTRIB_ID=Ubuntu$ | 1 |
Check Ubuntu oval:ssg-test_ubuntu:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_ubuntu:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
/etc/lsb-release | ^DISTRIB_ID=Ubuntu$ | 1 |
Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-object_unix_family:obj:1 of type family_object
Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 true
Following items have been found on the system:
Family |
---|
unix |
Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-object_unix_family:obj:1 of type family_object
Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 true
Following items have been found on the system:
Family |
---|
unix |
/etc/lsb-release exists oval:ssg-test_lsb:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-obj_lsb:obj:1 of type file_object
Filepath |
---|
/etc/lsb-release |
/etc/lsb-release exists oval:ssg-test_lsb:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_lsb:obj:1 of type file_object
Filepath |
---|
/etc/lsb-release |
Check Ubuntu oval:ssg-test_ubuntu:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-obj_ubuntu:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
/etc/lsb-release | ^DISTRIB_ID=Ubuntu$ | 1 |
Check Ubuntu oval:ssg-test_ubuntu:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_ubuntu:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
/etc/lsb-release | ^DISTRIB_ID=Ubuntu$ | 1 |
Check Ubuntu version oval:ssg-test_ubuntu_xenial:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-obj_ubuntu_xenial:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
/etc/lsb-release | ^DISTRIB_CODENAME=xenial$ | 1 |
Check Ubuntu version oval:ssg-test_ubuntu_xenial:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_ubuntu_xenial:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
/etc/lsb-release | ^DISTRIB_CODENAME=xenial$ | 1 |
Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-object_unix_family:obj:1 of type family_object
Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 true
Following items have been found on the system:
Family |
---|
unix |
Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-object_unix_family:obj:1 of type family_object
Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 true
Following items have been found on the system:
Family |
---|
unix |
/etc/lsb-release exists oval:ssg-test_lsb:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-obj_lsb:obj:1 of type file_object
Filepath |
---|
/etc/lsb-release |
/etc/lsb-release exists oval:ssg-test_lsb:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_lsb:obj:1 of type file_object
Filepath |
---|
/etc/lsb-release |
Check Ubuntu oval:ssg-test_ubuntu:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-obj_ubuntu:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
/etc/lsb-release | ^DISTRIB_ID=Ubuntu$ | 1 |
Check Ubuntu oval:ssg-test_ubuntu:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_ubuntu:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
/etc/lsb-release | ^DISTRIB_ID=Ubuntu$ | 1 |
Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-object_unix_family:obj:1 of type family_object
Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 true
Following items have been found on the system:
Family |
---|
unix |
Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-object_unix_family:obj:1 of type family_object
Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 true
Following items have been found on the system:
Family |
---|
unix |
/etc/lsb-release exists oval:ssg-test_lsb:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-obj_lsb:obj:1 of type file_object
Filepath |
---|
/etc/lsb-release |
/etc/lsb-release exists oval:ssg-test_lsb:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_lsb:obj:1 of type file_object
Filepath |
---|
/etc/lsb-release |
Check Ubuntu oval:ssg-test_ubuntu:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-obj_ubuntu:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
/etc/lsb-release | ^DISTRIB_ID=Ubuntu$ | 1 |
Check Ubuntu oval:ssg-test_ubuntu:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_ubuntu:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
/etc/lsb-release | ^DISTRIB_ID=Ubuntu$ | 1 |
Check Ubuntu version oval:ssg-test_ubuntu_xenial:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-obj_ubuntu_xenial:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
/etc/lsb-release | ^DISTRIB_CODENAME=xenial$ | 1 |
Check Ubuntu version oval:ssg-test_ubuntu_xenial:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_ubuntu_xenial:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
/etc/lsb-release | ^DISTRIB_CODENAME=xenial$ | 1 |
Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-object_unix_family:obj:1 of type family_object
Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 true
Following items have been found on the system:
Family |
---|
unix |
Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-object_unix_family:obj:1 of type family_object
Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 true
Following items have been found on the system:
Family |
---|
unix |
/etc/lsb-release exists oval:ssg-test_lsb:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-obj_lsb:obj:1 of type file_object
Filepath |
---|
/etc/lsb-release |
/etc/lsb-release exists oval:ssg-test_lsb:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_lsb:obj:1 of type file_object
Filepath |
---|
/etc/lsb-release |
Check Ubuntu oval:ssg-test_ubuntu:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-obj_ubuntu:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
/etc/lsb-release | ^DISTRIB_ID=Ubuntu$ | 1 |
Check Ubuntu oval:ssg-test_ubuntu:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_ubuntu:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
/etc/lsb-release | ^DISTRIB_ID=Ubuntu$ | 1 |
Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-object_unix_family:obj:1 of type family_object
Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 true
Following items have been found on the system:
Family |
---|
unix |
Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-object_unix_family:obj:1 of type family_object
Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 true
Following items have been found on the system:
Family |
---|
unix |
/etc/lsb-release exists oval:ssg-test_lsb:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-obj_lsb:obj:1 of type file_object
Filepath |
---|
/etc/lsb-release |
/etc/lsb-release exists oval:ssg-test_lsb:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_lsb:obj:1 of type file_object
Filepath |
---|
/etc/lsb-release |
Check Ubuntu oval:ssg-test_ubuntu:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-obj_ubuntu:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
/etc/lsb-release | ^DISTRIB_ID=Ubuntu$ | 1 |
Check Ubuntu oval:ssg-test_ubuntu:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_ubuntu:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
/etc/lsb-release | ^DISTRIB_ID=Ubuntu$ | 1 |
Check Ubuntu version oval:ssg-test_ubuntu_bionic:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-obj_ubuntu_bionic:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
/etc/lsb-release | ^DISTRIB_CODENAME=bionic$ | 1 |
Check Ubuntu version oval:ssg-test_ubuntu_bionic:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_ubuntu_bionic:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
/etc/lsb-release | ^DISTRIB_CODENAME=bionic$ | 1 |
Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-object_unix_family:obj:1 of type family_object
Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 true
Following items have been found on the system:
Family |
---|
unix |
Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-object_unix_family:obj:1 of type family_object
Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 true
Following items have been found on the system:
Family |
---|
unix |
/etc/lsb-release exists oval:ssg-test_lsb:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-obj_lsb:obj:1 of type file_object
Filepath |
---|
/etc/lsb-release |
/etc/lsb-release exists oval:ssg-test_lsb:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_lsb:obj:1 of type file_object
Filepath |
---|
/etc/lsb-release |
Check Ubuntu oval:ssg-test_ubuntu:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-obj_ubuntu:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
/etc/lsb-release | ^DISTRIB_ID=Ubuntu$ | 1 |
Check Ubuntu oval:ssg-test_ubuntu:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_ubuntu:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
/etc/lsb-release | ^DISTRIB_ID=Ubuntu$ | 1 |
Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-object_unix_family:obj:1 of type family_object
Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 true
Following items have been found on the system:
Family |
---|
unix |
Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-object_unix_family:obj:1 of type family_object
Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 true
Following items have been found on the system:
Family |
---|
unix |
/etc/lsb-release exists oval:ssg-test_lsb:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-obj_lsb:obj:1 of type file_object
Filepath |
---|
/etc/lsb-release |
/etc/lsb-release exists oval:ssg-test_lsb:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_lsb:obj:1 of type file_object
Filepath |
---|
/etc/lsb-release |
Check Ubuntu oval:ssg-test_ubuntu:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-obj_ubuntu:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
/etc/lsb-release | ^DISTRIB_ID=Ubuntu$ | 1 |
Check Ubuntu oval:ssg-test_ubuntu:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_ubuntu:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
/etc/lsb-release | ^DISTRIB_ID=Ubuntu$ | 1 |
Check Ubuntu version oval:ssg-test_ubuntu_bionic:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-obj_ubuntu_bionic:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
/etc/lsb-release | ^DISTRIB_CODENAME=bionic$ | 1 |
Check Ubuntu version oval:ssg-test_ubuntu_bionic:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_ubuntu_bionic:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
/etc/lsb-release | ^DISTRIB_CODENAME=bionic$ | 1 |
Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-object_unix_family:obj:1 of type family_object
Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 true
Following items have been found on the system:
Family |
---|
unix |
Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-object_unix_family:obj:1 of type family_object
Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 true
Following items have been found on the system:
Family |
---|
unix |
/etc/lsb-release exists oval:ssg-test_lsb:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-obj_lsb:obj:1 of type file_object
Filepath |
---|
/etc/lsb-release |
/etc/lsb-release exists oval:ssg-test_lsb:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_lsb:obj:1 of type file_object
Filepath |
---|
/etc/lsb-release |
Check Ubuntu oval:ssg-test_ubuntu:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-obj_ubuntu:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
/etc/lsb-release | ^DISTRIB_ID=Ubuntu$ | 1 |
Check Ubuntu oval:ssg-test_ubuntu:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_ubuntu:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
/etc/lsb-release | ^DISTRIB_ID=Ubuntu$ | 1 |
Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-object_unix_family:obj:1 of type family_object
Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 true
Following items have been found on the system:
Family |
---|
unix |
Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-object_unix_family:obj:1 of type family_object
Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 true
Following items have been found on the system:
Family |
---|
unix |
/etc/lsb-release exists oval:ssg-test_lsb:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-obj_lsb:obj:1 of type file_object
Filepath |
---|
/etc/lsb-release |
/etc/lsb-release exists oval:ssg-test_lsb:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_lsb:obj:1 of type file_object
Filepath |
---|
/etc/lsb-release |
Check Ubuntu oval:ssg-test_ubuntu:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-obj_ubuntu:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
/etc/lsb-release | ^DISTRIB_ID=Ubuntu$ | 1 |
Check Ubuntu oval:ssg-test_ubuntu:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_ubuntu:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
/etc/lsb-release | ^DISTRIB_ID=Ubuntu$ | 1 |
Check Ubuntu version oval:ssg-test_ubuntu_focal:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-obj_ubuntu_focal:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
/etc/lsb-release | ^DISTRIB_CODENAME=focal$ | 1 |
Check Ubuntu version oval:ssg-test_ubuntu_focal:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_ubuntu_focal:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
/etc/lsb-release | ^DISTRIB_CODENAME=focal$ | 1 |
Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-object_unix_family:obj:1 of type family_object
Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 true
Following items have been found on the system:
Family |
---|
unix |
Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-object_unix_family:obj:1 of type family_object
Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 true
Following items have been found on the system:
Family |
---|
unix |
/etc/lsb-release exists oval:ssg-test_lsb:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-obj_lsb:obj:1 of type file_object
Filepath |
---|
/etc/lsb-release |
/etc/lsb-release exists oval:ssg-test_lsb:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_lsb:obj:1 of type file_object
Filepath |
---|
/etc/lsb-release |
Check Ubuntu oval:ssg-test_ubuntu:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-obj_ubuntu:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
/etc/lsb-release | ^DISTRIB_ID=Ubuntu$ | 1 |
Check Ubuntu oval:ssg-test_ubuntu:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_ubuntu:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
/etc/lsb-release | ^DISTRIB_ID=Ubuntu$ | 1 |
Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-object_unix_family:obj:1 of type family_object
Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 true
Following items have been found on the system:
Family |
---|
unix |
Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-object_unix_family:obj:1 of type family_object
Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 true
Following items have been found on the system:
Family |
---|
unix |
/etc/lsb-release exists oval:ssg-test_lsb:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-obj_lsb:obj:1 of type file_object
Filepath |
---|
/etc/lsb-release |
/etc/lsb-release exists oval:ssg-test_lsb:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_lsb:obj:1 of type file_object
Filepath |
---|
/etc/lsb-release |
Check Ubuntu oval:ssg-test_ubuntu:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-obj_ubuntu:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
/etc/lsb-release | ^DISTRIB_ID=Ubuntu$ | 1 |
Check Ubuntu oval:ssg-test_ubuntu:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_ubuntu:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
/etc/lsb-release | ^DISTRIB_ID=Ubuntu$ | 1 |
Check Ubuntu version oval:ssg-test_ubuntu_focal:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-obj_ubuntu_focal:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
/etc/lsb-release | ^DISTRIB_CODENAME=focal$ | 1 |
Check Ubuntu version oval:ssg-test_ubuntu_focal:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_ubuntu_focal:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
/etc/lsb-release | ^DISTRIB_CODENAME=focal$ | 1 |
tests if var_system_crypto_policy is set to FIPS oval:ssg-test_system_crypto_policy_value:tst:1 true
Following items have been found on the system:
Var ref | Value |
---|---|
oval:ssg-var_system_crypto_policy:var:1 | FIPS:OSPP |
Install crypto-policies package
Rule ID | xccdf_org.ssgproject.content_rule_package_crypto-policies_installed |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-package_crypto-policies_installed:def:1 |
Time | 2022-02-10T22:29:26+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-82723-8 References: FCS_COP.1(1), FCS_COP.1(2), FCS_COP.1(3), FCS_COP.1(4), FCS_CKM.1, FCS_CKM.2, FCS_TLSC_EXT.1, SRG-OS-000396-GPOS-00176, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174 |
Description | The crypto-policies package can be installed with the following command:
$ sudo yum install crypto-policies |
Rationale | Centralized cryptographic policies simplify applying secure ciphers across an operating system and
the applications that run on that operating system. Use of weak or untested encryption algorithms
undermines the purposes of utilizing encryption to protect data. |
package crypto-policies is installed oval:ssg-test_package_crypto-policies_installed:tst:1 true
Following items have been found on the system:
Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
---|---|---|---|---|---|---|---|
crypto-policies | noarch | (none) | 1.gitc776d3e.el8 | 20210617 | 0:20210617-1.gitc776d3e.el8 | 199e2f91fd431d51 | crypto-policies-0:20210617-1.gitc776d3e.el8.noarch |
Configure BIND to use System Crypto Policy
Rule ID | xccdf_org.ssgproject.content_rule_configure_bind_crypto_policy |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-configure_bind_crypto_policy:def:1 |
Time | 2022-02-10T22:29:26+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-80934-3 References: CIP-003-3 R4.2, CIP-007-3 R5.1, SC-13, SC-12(2), SC-12(3), SRG-OS-000423-GPOS-00187, SRG-OS-000426-GPOS-00190 |
Description | Crypto Policies provide a centralized control over crypto algorithms usage of many packages.
BIND is supported by crypto policy, but the BIND configuration may be
set up to ignore it.
To check that Crypto Policies settings are configured correctly, ensure that the /etc/named.conf
includes the appropriate configuration:
In the options section of /etc/named.conf , make sure that the following line
is not commented out or superseded by later includes:
include "/etc/crypto-policies/back-ends/bind.config"; |
Rationale | Overriding the system crypto policy makes the behavior of the BIND service violate expectations,
and makes system configuration more fragmented. |
package bind is removed oval:ssg-test_package_bind_removed:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-obj_test_package_bind_removed:obj:1 of type rpminfo_object
Name |
---|
bind |
Check that the configuration includes the policy config file. oval:ssg-test_configure_bind_crypto_policy:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_configure_bind_crypto_policy:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
/etc/named.conf | ^\s*include\s+"/etc/crypto-policies/back-ends/bind.config"\s*;\s*$ | 1 |
Configure System Cryptography Policy
Rule ID | xccdf_org.ssgproject.content_rule_configure_crypto_policy |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-configure_crypto_policy:def:1 |
Time | 2022-02-10T22:29:26+00:00 |
Severity | high |
Identifiers and References | Identifiers: CCE-80935-0 References: 1.10, 1.11, 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.312(e)(1), 164.312(e)(2)(ii), 1446, CIP-003-3 R4.2, CIP-007-3 R5.1, CIP-007-3 R7.1, AC-17(a), AC-17(2), CM-6(a), MA-4(6), SC-13, SC-12(2), SC-12(3), FCS_COP.1(1), FCS_COP.1(2), FCS_COP.1(3), FCS_COP.1(4), FCS_CKM.1, FCS_CKM.2, FCS_TLSC_EXT.1, SRG-OS-000396-GPOS-00176, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174 |
Description | To configure the system cryptography policy to use ciphers only from the FIPS:OSPP
policy, run the following command:
$ sudo update-crypto-policies --set FIPS:OSPPThe rule checks if settings for selected crypto policy are configured as expected. Configuration files in the /etc/crypto-policies/back-ends are either symlinks to correct files provided by Crypto-policies package or they are regular files in case crypto policy customizations are applied.
Crypto policies may be customized by crypto policy modules, in which case it is delimited from the base policy using a colon. |
Rationale | Centralized cryptographic policies simplify applying secure ciphers across an operating system and
the applications that run on that operating system. Use of weak or untested encryption algorithms
undermines the purposes of utilizing encryption to protect data. |
Warnings | warning
The system needs to be rebooted for these changes to take effect. warning
System Crypto Modules must be provided by a vendor that undergoes
FIPS-140 certifications.
FIPS-140 is applicable to all Federal agencies that use
cryptographic-based security systems to protect sensitive information
in computer and telecommunication systems (including voice systems) as
defined in Section 5131 of the Information Technology Management Reform
Act of 1996, Public Law 104-106. This standard shall be used in
designing and implementing cryptographic modules that Federal
departments and agencies operate or are operated for them under
contract. See https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf
To meet this, the system has to have cryptographic software provided by
a vendor that has undergone this certification. This means providing
documentation, test results, design information, and independent third
party review by an accredited lab. While open source software is
capable of meeting this, it does not meet FIPS-140 unless the vendor
submits to this process. |
check for crypto policy correctly configured in /etc/crypto-policies/config oval:ssg-test_configure_crypto_policy:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/crypto-policies/config | FIPS:OSPP |
check for crypto policy correctly configured in /etc/crypto-policies/state/current oval:ssg-test_configure_crypto_policy_current:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/crypto-policies/state/current | FIPS:OSPP |
Check if update-crypto-policies has been run oval:ssg-test_crypto_policies_updated:tst:1 true
Following items have been found on the system:
Var ref | Value |
---|---|
oval:ssg-variable_crypto_policies_config_file_timestamp:var:1 | 1644530616 |
Check if /etc/crypto-policies/back-ends/nss.config exists oval:ssg-test_crypto_policy_nss_config:tst:1 true
Following items have been found on the system:
Path | Type | UID | GID | Size (B) | Permissions |
---|---|---|---|---|---|
/etc/crypto-policies/back-ends/nss.config | regular | 0 | 0 | 397 | rw-r--r-- |
Configure Kerberos to use System Crypto Policy
Rule ID | xccdf_org.ssgproject.content_rule_configure_kerberos_crypto_policy |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-configure_kerberos_crypto_policy:def:1 |
Time | 2022-02-10T22:29:26+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-80936-8 References: 0418, 1055, 1402, CIP-003-3 R4.2, CIP-007-3 R5.1, SC-13, SC-12(2), SC-12(3), SRG-OS-000120-GPOS-00061 |
Description | Crypto Policies provide a centralized control over crypto algorithms usage of many packages.
Kerberos is supported by crypto policy, but it's configuration may be
set up to ignore it.
To check that Crypto Policies settings for Kerberos are configured correctly, examine that there is a symlink at
/etc/krb5.conf.d/crypto-policies targeting /etc/cypto-policies/back-ends/krb5.config.
If the symlink exists, kerberos is configured to use the system-wide crypto policy settings. |
Rationale | Overriding the system crypto policy makes the behavior of Kerberos violate expectations,
and makes system configuration more fragmented. |
Check if kerberos configuration symlink and crypto policy kerberos backend symlink point to same file oval:ssg-test_configure_kerberos_crypto_policy_symlink:tst:1 error
Following items have been found on the system:
Var ref | Value |
---|---|
oval:ssg-var_symlink_kerberos_crypto_policy_configuration:var:1 | /etc/crypto-policies/back-ends/krb5.config |
Check if kerberos configuration symlink links to the crypto-policy backend file oval:ssg-test_configure_kerberos_crypto_policy_nosymlink:tst:1 true
Following items have been found on the system:
Var ref | Value |
---|---|
oval:ssg-var_symlink_kerberos_crypto_policy_configuration:var:1 | /etc/crypto-policies/back-ends/krb5.config |
Configure Libreswan to use System Crypto Policy
Rule ID | xccdf_org.ssgproject.content_rule_configure_libreswan_crypto_policy |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-configure_libreswan_crypto_policy:def:1 |
Time | 2022-02-10T22:29:26+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-80937-6 References: CIP-003-3 R4.2, CIP-007-3 R5.1, CM-6(a), MA-4(6), SC-13, SC-12(2), SC-12(3), FCS_IPSEC_EXT.1.4, FCS_IPSEC_EXT.1.6, SRG-OS-000033-GPOS-00014 |
Description | Crypto Policies provide a centralized control over crypto algorithms usage of many packages.
Libreswan is supported by system crypto policy, but the Libreswan configuration may be
set up to ignore it.
To check that Crypto Policies settings are configured correctly, ensure that the /etc/ipsec.conf
includes the appropriate configuration file.
In /etc/ipsec.conf , make sure that the following line
is not commented out or superseded by later includes:
include /etc/crypto-policies/back-ends/libreswan.config |
Rationale | Overriding the system crypto policy makes the behavior of the Libreswan
service violate expectations, and makes system configuration more
fragmented. |
package libreswan is installed oval:ssg-test_package_libreswan_installed:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_test_package_libreswan_installed:obj:1 of type rpminfo_object
Name |
---|
libreswan |
Check that the libreswan configuration includes the crypto policy config file oval:ssg-test_configure_libreswan_crypto_policy:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_configure_libreswan_crypto_policy:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
/etc/ipsec.conf | ^\s*include\s+/etc/crypto-policies/back-ends/libreswan.config\s*(?:#.*)?$ | 1 |
Configure OpenSSL library to use System Crypto Policy
Rule ID | xccdf_org.ssgproject.content_rule_configure_openssl_crypto_policy |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-configure_openssl_crypto_policy:def:1 |
Time | 2022-02-10T22:29:26+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-80938-4 References: CCI-001453, CIP-003-3 R4.2, CIP-007-3 R5.1, CIP-007-3 R7.1, AC-17(a), AC-17(2), CM-6(a), MA-4(6), SC-13, SC-12(2), SC-12(3), SRG-OS-000250-GPOS-00093, RHEL-08-010293, SV-230254r627750_rule |
Description | Crypto Policies provide a centralized control over crypto algorithms usage of many packages.
OpenSSL is supported by crypto policy, but the OpenSSL configuration may be
set up to ignore it.
To check that Crypto Policies settings are configured correctly, you have to examine the OpenSSL config file
available under /etc/pki/tls/openssl.cnf .
This file has the ini format, and it enables crypto policy support
if there is a [ crypto_policy ] section that contains the .include /etc/crypto-policies/back-ends/opensslcnf.config directive. |
Rationale | Overriding the system crypto policy makes the behavior of the Java runtime violates expectations,
and makes system configuration more fragmented. |
Check that the configuration mandates usage of system-wide crypto policies. oval:ssg-test_configure_openssl_crypto_policy:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/pki/tls/openssl.cnf | [ crypto_policy ] .include /etc/crypto-policies/back-ends/opensslcnf.config |
Configure SSH to use System Crypto Policy
Rule ID | xccdf_org.ssgproject.content_rule_configure_ssh_crypto_policy |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-configure_ssh_crypto_policy:def:1 |
Time | 2022-02-10T22:29:26+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-80939-2 References: 5.2.20, 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.312(e)(1), 164.312(e)(2)(ii), CIP-003-3 R4.2, CIP-007-3 R5.1, CIP-007-3 R7.1, AC-17(a), AC-17(2), CM-6(a), MA-4(6), SC-13, SRG-OS-000250-GPOS-00093 |
Description | Crypto Policies provide a centralized control over crypto algorithms usage of many packages.
SSH is supported by crypto policy, but the SSH configuration may be
set up to ignore it.
To check that Crypto Policies settings are configured correctly, ensure that
the CRYPTO_POLICY variable is either commented or not set at all
in the /etc/sysconfig/sshd . |
Rationale | Overriding the system crypto policy makes the behavior of the SSH service violate expectations,
and makes system configuration more fragmented. |
Check that the SSH configuration mandates usage of system-wide crypto policies. oval:ssg-test_configure_ssh_crypto_policy:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_configure_ssh_crypto_policy:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
/etc/sysconfig/sshd | ^\s*CRYPTO_POLICY\s*=.*$ | 1 |
OpenSSL uses strong entropy source
Rule ID | xccdf_org.ssgproject.content_rule_openssl_use_strong_entropy |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-openssl_use_strong_entropy:def:1 |
Time | 2022-02-10T22:29:26+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-82721-2 References: 1277, 1552, FCS_RBG_EXT.1.2, SRG-OS-000480-GPOS-00227 |
Description | By default, OpenSSL doesn't always use a SP800-90A compliant random number generator.
A way to configure OpenSSL to always use a strong source is to setup a wrapper that
defines a shell function that shadows the actual openssl binary,
and that ensures that the -rand /dev/random option is added to every openssl invocation.
To do so, place the following shell snippet exactly as-is to /etc/profile.d/openssl-rand.sh :
# provide a default -rand /dev/random option to openssl commands that # support it # written inefficiently for maximum shell compatibility openssl() ( openssl_bin=/usr/bin/openssl case "$*" in # if user specified -rand, honor it *\ -rand\ *|*\ -help*) exec $openssl_bin "$@" ;; esac cmds=`$openssl_bin list -digest-commands -cipher-commands | tr '\n' ' '` for i in `$openssl_bin list -commands`; do if $openssl_bin list -options "$i" | grep -q '^rand '; then cmds=" $i $cmds" fi done case "$cmds" in *\ "$1"\ *) cmd="$1"; shift exec $openssl_bin "$cmd" -rand /dev/random "$@" ;; esac exec $openssl_bin "$@" ) |
Rationale | This rule ensures that openssl invocations always uses SP800-90A compliant random number generator as a default behavior. |
Warnings | warning
This setting can cause problems on computers without the hardware random generator, because insufficient entropy blocks the program until enough entropy is available. |
Test if openssl is configured to generate random data with strong entropy oval:ssg-test_openssl_strong_entropy:tst:1 true
Following items have been found on the system:
Filepath | Path | Filename | Hash type | Hash |
---|---|---|---|---|
/etc/profile.d/openssl-rand.sh | /etc/profile.d | openssl-rand.sh | SHA-256 | 6488c757642cd493da09dd78ee27f039711a1ad79039900970553772fd2106af |
Ensure /home Located On Separate Partition
Rule ID | xccdf_org.ssgproject.content_rule_partition_for_home |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-partition_for_home:def:1 |
Time | 2022-02-10T22:29:26+00:00 |
Severity | low |
Identifiers and References | Identifiers: CCE-81044-0 References: BP28(R12), 1.1.13, 12, 15, 8, APO13.01, DSS05.02, CCI-000366, CCI-001208, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, A.13.1.1, A.13.2.1, A.14.1.3, CM-6(a), SC-5(2), PR.PT-4, SRG-OS-000480-GPOS-00227, RHEL-08-010800, SV-230328r627750_rule |
Description | If user home directories will be stored locally, create a separate partition
for /home at installation time (or migrate it later using LVM). If
/home will be mounted from another system such as an NFS server, then
creating a separate partition is not necessary at installation time, and the
mountpoint can instead be configured later. |
Rationale | Ensuring that /home is mounted on its own partition enables the
setting of more restrictive mount options, and also helps ensure that
users cannot trivially fill partitions used for log or audit data storage. |
/home on own partition oval:ssg-testhome_partition:tst:1 true
Following items have been found on the system:
Mount point | Device | Uuid | Fs type | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Total space | Space used | Space left |
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
/home | /dev/mapper/VolGroup-home | 81520328-5db1-4cce-8fbe-c0877f522a72 | xfs | rw | seclabel | nosuid | nodev | relatime | attr2 | inode64 | logbufs=8 | logbsize=32k | noquota | bind | 1046016 | 15648 | 1030368 |
Ensure /var Located On Separate Partition
Rule ID | xccdf_org.ssgproject.content_rule_partition_for_var |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-partition_for_var:def:1 |
Time | 2022-02-10T22:29:26+00:00 |
Severity | low |
Identifiers and References | Identifiers: CCE-80852-7 References: BP28(R12), 1.1.6, 12, 15, 8, APO13.01, DSS05.02, CCI-000366, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, A.13.1.1, A.13.2.1, A.14.1.3, CM-6(a), SC-5(2), PR.PT-4, SRG-OS-000480-GPOS-00227, RHEL-08-010540, SV-230292r627750_rule, SRG-OS-000341-VMM-001220 |
Description | The /var directory is used by daemons and other system
services to store frequently-changing data. Ensure that /var has its own partition
or logical volume at installation time, or migrate it using LVM. |
Rationale | Ensuring that /var is mounted on its own partition enables the
setting of more restrictive mount options. This helps protect
system services such as daemons or other programs which use it.
It is not uncommon for the /var directory to contain
world-writable directories installed by other software packages. |
/var on own partition oval:ssg-testvar_partition:tst:1 true
Following items have been found on the system:
Mount point | Device | Uuid | Fs type | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Total space | Space used | Space left |
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
/var | /dev/mapper/VolGroup-var | 5d6ea26d-5887-49fa-ad24-3b1ad6033d70 | xfs | rw | seclabel | nodev | relatime | attr2 | inode64 | logbufs=8 | logbsize=32k | noquota | bind | 783872 | 61187 | 722685 |
Ensure /var/log Located On Separate Partition
Rule ID | xccdf_org.ssgproject.content_rule_partition_for_var_log |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-partition_for_var_log:def:1 |
Time | 2022-02-10T22:29:26+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-80853-5 References: BP28(R12), BP28(R47), 1.1.11, 1, 12, 14, 15, 16, 3, 5, 6, 8, APO11.04, APO13.01, BAI03.05, DSS05.02, DSS05.04, DSS05.07, MEA02.01, CCI-000366, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, CIP-007-3 R6.5, CM-6(a), AU-4, SC-5(2), PR.PT-1, PR.PT-4, SRG-OS-000480-GPOS-00227, RHEL-08-010541, SV-230293r627750_rule |
Description | System logs are stored in the /var/log directory.
Ensure that it has its own partition or logical
volume at installation time, or migrate it using LVM. |
Rationale | Placing /var/log in its own partition
enables better separation between log files
and other files in /var/ . |
/var/log on own partition oval:ssg-testvar_log_partition:tst:1 true
Following items have been found on the system:
Mount point | Device | Uuid | Fs type | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Total space | Space used | Space left |
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
/var/log | /dev/mapper/VolGroup-log | b0748915-6fad-4cd6-ae14-779ea6301807 | xfs | rw | seclabel | nosuid | nodev | noexec | relatime | attr2 | inode64 | logbufs=8 | logbsize=32k | noquota | bind | 259584 | 11681 | 247903 |
Ensure /var/log/audit Located On Separate Partition
Rule ID | xccdf_org.ssgproject.content_rule_partition_for_var_log_audit |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-partition_for_var_log_audit:def:1 |
Time | 2022-02-10T22:29:26+00:00 |
Severity | low |
Identifiers and References | Identifiers: CCE-80854-3 References: BP28(R43), 1.1.12, 1, 12, 13, 14, 15, 16, 2, 3, 5, 6, 8, APO11.04, APO13.01, BAI03.05, BAI04.04, DSS05.02, DSS05.04, DSS05.07, MEA02.01, CCI-000366, CCI-001849, 164.312(a)(2)(ii), 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.2, SR 7.6, A.12.1.3, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.17.2.1, CIP-007-3 R6.5, CM-6(a), AU-4, SC-5(2), PR.DS-4, PR.PT-1, PR.PT-4, SRG-OS-000341-GPOS-00132, SRG-OS-000480-GPOS-00227, RHEL-08-010542, SV-230294r627750_rule, SRG-OS-000341-VMM-001220 |
Description | Audit logs are stored in the /var/log/audit directory. Ensure that it
has its own partition or logical volume at installation time, or migrate it
later using LVM. Make absolutely certain that it is large enough to store all
audit logs that will be created by the auditing daemon. |
Rationale | Placing /var/log/audit in its own partition
enables better separation between audit files
and other files, and helps ensure that
auditing cannot be halted due to the partition running out
of space. |
/var/log/audit on own partition oval:ssg-testvar_log_audit_partition:tst:1 true
Following items have been found on the system:
Mount point | Device | Uuid | Fs type | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Total space | Space used | Space left |
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
/var/log/audit | /dev/mapper/VolGroup-audit | f4bb8355-95bf-43b9-8095-f70b08b2f896 | xfs | rw | seclabel | nosuid | nodev | noexec | relatime | attr2 | inode64 | logbufs=8 | logbsize=32k | noquota | bind | 521728 | 21094 | 500634 |
Ensure /var/tmp Located On Separate Partition
Rule ID | xccdf_org.ssgproject.content_rule_partition_for_var_tmp |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-partition_for_var_tmp:def:1 |
Time | 2022-02-10T22:29:26+00:00 |
Severity | low |
Identifiers and References | Identifiers: CCE-82730-3 References: BP28(R12), 1.1.7, SRG-OS-000480-GPOS-00227, RHEL-08-010544, SV-244529r743836_rule |
Description | The /var/tmp directory is a world-writable directory used
for temporary file storage. Ensure it has its own partition or
logical volume at installation time, or migrate it using LVM. |
Rationale | The /var/tmp partition is used as temporary storage by many programs.
Placing /var/tmp in its own partition enables the setting of more
restrictive mount options, which can help protect programs which use it. |
/var/tmp on own partition oval:ssg-testvar_tmp_partition:tst:1 true
Following items have been found on the system:
Mount point | Device | Uuid | Fs type | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Total space | Space used | Space left |
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
/var/tmp | /dev/mapper/VolGroup-vartmp | 45b37d67-9a15-46da-8775-734e79e9dc2f | xfs | rw | seclabel | nosuid | nodev | noexec | relatime | attr2 | inode64 | logbufs=8 | logbsize=32k | noquota | bind | 259584 | 10097 | 249487 |
Install sudo Package
Rule ID | xccdf_org.ssgproject.content_rule_package_sudo_installed |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-package_sudo_installed:def:1 |
Time | 2022-02-10T22:29:26+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-82214-8 References: BP28(R19), 1.3.1, 1382, 1384, 1386, CM-6(a), SRG-OS-000324-GPOS-00125 |
Description | The sudo package can be installed with the following command:
$ sudo yum install sudo |
Rationale | sudo is a program designed to allow a system administrator to give
limited root privileges to users and log root activity. The basic philosophy
is to give as few privileges as possible but still allow system users to
get their work done. |
package sudo is installed oval:ssg-test_package_sudo_installed:tst:1 true
Following items have been found on the system:
Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
---|---|---|---|---|---|---|---|
sudo | x86_64 | (none) | 7.el8 | 1.8.29 | 0:1.8.29-7.el8 | 199e2f91fd431d51 | sudo-0:1.8.29-7.el8.x86_64 |
Install dnf-plugin-subscription-manager Package
Rule ID | xccdf_org.ssgproject.content_rule_package_dnf-plugin-subscription-manager_installed |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-package_dnf-plugin-subscription-manager_installed:def:1 |
Time | 2022-02-10T22:29:26+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-82315-3 References: 0940, 1144, 1467, 1472, 1483, 1493, 1494, 1495, FPT_TUD_EXT.1, FPT_TUD_EXT.2, SRG-OS-000366-GPOS-00153 |
Description | The dnf-plugin-subscription-manager package can be installed with the following command:
$ sudo yum install dnf-plugin-subscription-manager |
Rationale | This package provides plugins to interact with repositories and subscriptions
from the Red Hat entitlement platform; contains subscription-manager and
product-id plugins. |
package dnf-plugin-subscription-manager is installed oval:ssg-test_package_dnf-plugin-subscription-manager_installed:tst:1 true
Following items have been found on the system:
Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
---|---|---|---|---|---|---|---|
dnf-plugin-subscription-manager | x86_64 | (none) | 3.el8 | 1.28.21 | 0:1.28.21-3.el8 | 199e2f91fd431d51 | dnf-plugin-subscription-manager-0:1.28.21-3.el8.x86_64 |
Ensure gnutls-utils is installed
Rule ID | xccdf_org.ssgproject.content_rule_package_gnutls-utils_installed |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-package_gnutls-utils_installed:def:1 |
Time | 2022-02-10T22:29:26+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-82395-5 References: FIA_X509_EXT, SRG-OS-000480-GPOS-00227 |
Description | The gnutls-utils package can be installed with the following command:
$ sudo yum install gnutls-utils |
Rationale | GnuTLS is a secure communications library implementing the SSL, TLS and DTLS
protocols and technologies around them. It provides a simple C language
application programming interface (API) to access the secure communications
protocols as well as APIs to parse and write X.509, PKCS #12, OpenPGP and
other required structures.
This package contains command line TLS client and server and certificate
manipulation tools. |
package gnutls-utils is installed oval:ssg-test_package_gnutls-utils_installed:tst:1 true
Following items have been found on the system:
Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
---|---|---|---|---|---|---|---|
gnutls-utils | x86_64 | (none) | 4.el8 | 3.6.16 | 0:3.6.16-4.el8 | 199e2f91fd431d51 | gnutls-utils-0:3.6.16-4.el8.x86_64 |
Install openscap-scanner Package
Rule ID | xccdf_org.ssgproject.content_rule_package_openscap-scanner_installed |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-package_openscap-scanner_installed:def:1 |
Time | 2022-02-10T22:29:26+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-82220-5 References: SRG-OS-000480-GPOS-00227, SRG-OS-000191-GPOS-00080 |
Description | The openscap-scanner package can be installed with the following command:
$ sudo yum install openscap-scanner |
Rationale | openscap-scanner contains the oscap command line tool. This tool is a
configuration and vulnerability scanner, capable of performing compliance checking using
SCAP content. |
package openscap-scanner is installed oval:ssg-test_package_openscap-scanner_installed:tst:1 true
Following items have been found on the system:
Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
---|---|---|---|---|---|---|---|
openscap-scanner | x86_64 | (none) | 6.el8 | 1.3.5 | 0:1.3.5-6.el8 | 199e2f91fd431d51 | openscap-scanner-0:1.3.5-6.el8.x86_64 |
Install scap-security-guide Package
Rule ID | xccdf_org.ssgproject.content_rule_package_scap-security-guide_installed |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-package_scap-security-guide_installed:def:1 |
Time | 2022-02-10T22:29:26+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-82949-9 References: SRG-OS-000480-GPOS-00227 |
Description | The scap-security-guide package can be installed with the following command:
$ sudo yum install scap-security-guide |
Rationale | The scap-security-guide package provides a guide for configuration of the system
from the final system's security point of view. The guidance is specified in the Security
Content Automation Protocol (SCAP) format and constitutes a catalog of practical hardening
advice, linked to government requirements where applicable. The SCAP Security Guide project
bridges the gap between generalized policy requirements and specific implementation guidelines.
A system administrator can use the oscap CLI tool from the openscap-scanner
package, or the SCAP Workbench GUI tool from the scap-workbench package, to verify
that the system conforms to provided guidelines. Refer to the scap-security-guide(8) manual
page for futher information. |
package scap-security-guide is installed oval:ssg-test_package_scap-security-guide_installed:tst:1 true
Following items have been found on the system:
Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
---|---|---|---|---|---|---|---|
scap-security-guide | noarch | (none) | 5.el8 | 0.1.57 | 0:0.1.57-5.el8 | 199e2f91fd431d51 | scap-security-guide-0:0.1.57-5.el8.noarch |
Install subscription-manager Package
Rule ID | xccdf_org.ssgproject.content_rule_package_subscription-manager_installed |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-package_subscription-manager_installed:def:1 |
Time | 2022-02-10T22:29:26+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-82316-1 References: 0940, 1144, 1467, 1472, 1483, 1493, 1494, 1495, FPT_TUD_EXT.1, FPT_TUD_EXT.2, SRG-OS-000366-GPOS-00153 |
Description | The subscription-manager package can be installed with the following command:
$ sudo yum install subscription-manager |
Rationale | Red Hat Subscription Manager is a local service which tracks installed products
and subscriptions on a local system to help manage subscription assignments.
It communicates with the backend subscription service (the Customer Portal
or an on-premise server such as Subscription Asset Manager) and works with
content management tools such as yum. |
package subscription-manager is installed oval:ssg-test_package_subscription-manager_installed:tst:1 true
Following items have been found on the system:
Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
---|---|---|---|---|---|---|---|
subscription-manager | x86_64 | (none) | 3.el8 | 1.28.21 | 0:1.28.21-3.el8 | 199e2f91fd431d51 | subscription-manager-0:1.28.21-3.el8.x86_64 |
Uninstall abrt-addon-ccpp Package
Rule ID | xccdf_org.ssgproject.content_rule_package_abrt-addon-ccpp_removed |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-package_abrt-addon-ccpp_removed:def:1 |
Time | 2022-02-10T22:29:26+00:00 |
Severity | low |
Identifiers and References | Identifiers: CCE-82919-2 References: CCI-000381, SRG-OS-000095-GPOS-00049, RHEL-08-040001, SV-230488r627750_rule |
Description | The abrt-addon-ccpp package can be removed with the following command:
$ sudo yum erase abrt-addon-ccpp |
Rationale | abrt-addon-ccpp contains hooks for C/C++ crashed programs and abrt 's
C/C++ analyzer plugin. |
package abrt-addon-ccpp is removed oval:ssg-test_package_abrt-addon-ccpp_removed:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-obj_test_package_abrt-addon-ccpp_removed:obj:1 of type rpminfo_object
Name |
---|
abrt-addon-ccpp |
Uninstall abrt-addon-kerneloops Package
Rule ID | xccdf_org.ssgproject.content_rule_package_abrt-addon-kerneloops_removed |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-package_abrt-addon-kerneloops_removed:def:1 |
Time | 2022-02-10T22:29:26+00:00 |
Severity | low |
Identifiers and References | Identifiers: CCE-82926-7 References: CCI-000381, SRG-OS-000095-GPOS-00049, RHEL-08-040001, SV-230488r627750_rule |
Description | The abrt-addon-kerneloops package can be removed with the following command:
$ sudo yum erase abrt-addon-kerneloops |
Rationale | abrt-addon-kerneloops contains plugins for collecting kernel crash information and
reporter plugin which sends this information to a specified server, usually to kerneloops.org. |
package abrt-addon-kerneloops is removed oval:ssg-test_package_abrt-addon-kerneloops_removed:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-obj_test_package_abrt-addon-kerneloops_removed:obj:1 of type rpminfo_object
Name |
---|
abrt-addon-kerneloops |
Uninstall abrt-addon-python Package
Rule ID | xccdf_org.ssgproject.content_rule_package_abrt-addon-python_removed |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-package_abrt-addon-python_removed:def:1 |
Time | 2022-02-10T22:29:26+00:00 |
Severity | low |
Identifiers and References | Identifiers: CCE-82923-4 References: CCI-000381, SRG-OS-000095-GPOS-00049, RHEL-08-040001, SV-230488r627750_rule |
Description | The abrt-addon-python package can be removed with the following command:
$ sudo yum erase abrt-addon-python |
Rationale | abrt-addon-python contains python hook and python analyzer
plugin for handling uncaught exceptions in python programs. |
package abrt-addon-python is removed oval:ssg-test_package_abrt-addon-python_removed:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-obj_test_package_abrt-addon-python_removed:obj:1 of type rpminfo_object
Name |
---|
abrt-addon-python |
Uninstall abrt-cli Package
Rule ID | xccdf_org.ssgproject.content_rule_package_abrt-cli_removed |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-package_abrt-cli_removed:def:1 |
Time | 2022-02-10T22:29:26+00:00 |
Severity | low |
Identifiers and References | Identifiers: CCE-82907-7 References: CCI-000381, SRG-OS-000095-GPOS-00049, RHEL-08-040001, SV-230488r627750_rule |
Description | The abrt-cli package can be removed with the following command:
$ sudo yum erase abrt-cli |
Rationale | abrt-cli contains a command line client for controlling abrt daemon
over sockets. |
package abrt-cli is removed oval:ssg-test_package_abrt-cli_removed:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-obj_test_package_abrt-cli_removed:obj:1 of type rpminfo_object
Name |
---|
abrt-cli |
Uninstall abrt-plugin-logger Package
Rule ID | xccdf_org.ssgproject.content_rule_package_abrt-plugin-logger_removed |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-package_abrt-plugin-logger_removed:def:1 |
Time | 2022-02-10T22:29:26+00:00 |
Severity | low |
Identifiers and References | Identifiers: CCE-82913-5 References: CCI-000381, SRG-OS-000095-GPOS-00049, RHEL-08-040001, SV-230488r627750_rule |
Description | The abrt-plugin-logger package can be removed with the following command:
$ sudo yum erase abrt-plugin-logger |
Rationale | abrt-plugin-logger is an ABRT plugin which writes a report
to a specified file. |
package abrt-plugin-logger is removed oval:ssg-test_package_abrt-plugin-logger_removed:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-obj_test_package_abrt-plugin-logger_removed:obj:1 of type rpminfo_object
Name |
---|
abrt-plugin-logger |
Uninstall abrt-plugin-rhtsupport Package
Rule ID | xccdf_org.ssgproject.content_rule_package_abrt-plugin-rhtsupport_removed |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-package_abrt-plugin-rhtsupport_removed:def:1 |
Time | 2022-02-10T22:29:26+00:00 |
Severity | low |
Identifiers and References | Identifiers: CCE-82916-8 References: CCI-000381, SRG-OS-000095-GPOS-00049, RHEL-08-040001, SV-230488r627750_rule |
Description | The abrt-plugin-rhtsupport package can be removed with the following command:
$ sudo yum erase abrt-plugin-rhtsupport |
Rationale | abrt-plugin-rhtsupport is a ABRT plugin to report bugs into the
Red Hat Support system. |
package abrt-plugin-rhtsupport is removed oval:ssg-test_package_abrt-plugin-rhtsupport_removed:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-obj_test_package_abrt-plugin-rhtsupport_removed:obj:1 of type rpminfo_object
Name |
---|
abrt-plugin-rhtsupport |
Uninstall abrt-plugin-sosreport Package
Rule ID | xccdf_org.ssgproject.content_rule_package_abrt-plugin-sosreport_removed |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-package_abrt-plugin-sosreport_removed:def:1 |
Time | 2022-02-10T22:29:26+00:00 |
Severity | low |
Identifiers and References | Identifiers: CCE-82910-1 References: CCI-000381, SRG-OS-000095-GPOS-00049, RHEL-08-040001, SV-230488r627750_rule |
Description | The abrt-plugin-sosreport package can be removed with the following command:
$ sudo yum erase abrt-plugin-sosreport |
Rationale | abrt-plugin-sosreport provides a plugin to include an sosreport in an ABRT report. |
package abrt-plugin-sosreport is removed oval:ssg-test_package_abrt-plugin-sosreport_removed:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-obj_test_package_abrt-plugin-sosreport_removed:obj:1 of type rpminfo_object
Name |
---|
abrt-plugin-sosreport |
Uninstall gssproxy Package
Rule ID | xccdf_org.ssgproject.content_rule_package_gssproxy_removed |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-package_gssproxy_removed:def:1 |
Time | 2022-02-10T22:29:26+00:00 |
Severity | low |
Identifiers and References | Identifiers: CCE-82943-2 References: CCI-000381, CCI-000366, SRG-OS-000095-GPOS-00049, SRG-OS-000480-GPOS-00227, RHEL-08-040370, SV-230559r646887_rule |
Description | The gssproxy package can be removed with the following command:
$ sudo yum erase gssproxy |
Rationale | gssproxy is a proxy for GSS API credential handling. |
package gssproxy is removed oval:ssg-test_package_gssproxy_removed:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-obj_test_package_gssproxy_removed:obj:1 of type rpminfo_object
Name |
---|
gssproxy |
Uninstall iprutils Package
Rule ID | xccdf_org.ssgproject.content_rule_package_iprutils_removed |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-package_iprutils_removed:def:1 |
Time | 2022-02-10T22:29:26+00:00 |
Severity | low |
Identifiers and References | Identifiers: CCE-82946-5 References: CCI-000366, SRG-OS-000095-GPOS-00049, SRG-OS-000480-GPOS-00227, RHEL-08-040380, SV-230560r627750_rule |
Description | The iprutils package can be removed with the following command:
$ sudo yum erase iprutils |
Rationale | iprutils provides a suite of utlilities to manage and configure SCSI devices
supported by the ipr SCSI storage device driver. |
package iprutils is removed oval:ssg-test_package_iprutils_removed:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-obj_test_package_iprutils_removed:obj:1 of type rpminfo_object
Name |
---|
iprutils |
Uninstall krb5-workstation Package
Rule ID | xccdf_org.ssgproject.content_rule_package_krb5-workstation_removed |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-package_krb5-workstation_removed:def:1 |
Time | 2022-02-10T22:29:26+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-82931-7 References: CCI-000803, SRG-OS-000095-GPOS-00049, SRG-OS-000120-GPOS-00061, RHEL-08-010162, SV-230239r646864_rule |
Description | The krb5-workstation package can be removed with the following command:
$ sudo yum erase krb5-workstation |
Rationale | Kerberos is a network authentication system. The krb5-workstation package contains the basic
Kerberos programs (kinit , klist , kdestroy , kpasswd ).
Currently, Kerberos does not utilize FIPS 140-2 cryptography and is not permitted on Government networks,
nor is it permitted in many regulatory environments such as HIPAA. |
package krb5-workstation is removed oval:ssg-test_package_krb5-workstation_removed:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-obj_test_package_krb5-workstation_removed:obj:1 of type rpminfo_object
Name |
---|
krb5-workstation |
Install dnf-automatic Package
Rule ID | xccdf_org.ssgproject.content_rule_package_dnf-automatic_installed |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-package_dnf-automatic_installed:def:1 |
Time | 2022-02-10T22:29:26+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-82985-3 References: BP28(R8), SRG-OS-000191-GPOS-00080 |
Description | The dnf-automatic package can be installed with the following command:
$ sudo yum install dnf-automatic |
Rationale | dnf-automatic is an alternative command line interface (CLI)
to dnf upgrade suitable for automatic, regular execution. |
package dnf-automatic is installed oval:ssg-test_package_dnf-automatic_installed:tst:1 true
Following items have been found on the system:
Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
---|---|---|---|---|---|---|---|
dnf-automatic | noarch | (none) | 4.el8 | 4.7.0 | 0:4.7.0-4.el8 | 199e2f91fd431d51 | dnf-automatic-0:4.7.0-4.el8.noarch |
Configure dnf-automatic to Install Available Updates Automatically
Rule ID | xccdf_org.ssgproject.content_rule_dnf-automatic_apply_updates |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-dnf-automatic_apply_updates:def:1 |
Time | 2022-02-10T22:29:26+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-82494-6 References: BP28(R8), 0940, 1144, 1467, 1472, 1483, 1493, 1494, 1495, SI-2(5), CM-6(a), SI-2(c), FMT_SMF_EXT.1, SRG-OS-000191-GPOS-00080 |
Description | To ensure that the packages comprising the available updates will be automatically installed by dnf-automatic , set apply_updates to yes under [commands] section in /etc/dnf/automatic.conf . |
Rationale | Installing software updates is a fundamental mitigation against
the exploitation of publicly-known vulnerabilities. If the most
recent security patches and updates are not installed, unauthorized
users may take advantage of weaknesses in the unpatched software. The
lack of prompt attention to patching could result in a system compromise.
The automated installation of updates ensures that recent security patches
are applied in a timely manner. |
tests the value of apply_updates setting in the /etc/dnf/automatic.conf file oval:ssg-test_dnf-automatic_apply_updates:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/dnf/automatic.conf | [commands] # What kind of upgrade to perform: # default = all available upgrades # security = only the security upgrades upgrade_type = security random_sleep = 0 # Maximum time in seconds to wait until the system is on-line and able to # connect to remote repositories. network_online_timeout = 60 # To just receive updates use dnf-automatic-notifyonly.timer # Whether updates should be downloaded when they are available, by # dnf-automatic.timer. notifyonly.timer, download.timer and # install.timer override this setting. download_updates = yes # Whether updates should be applied when they are available, by # dnf-automatic.timer. notifyonly.timer, download.timer and # install.timer override this setting. apply_updates = yes |
The configuration file /etc/dnf/automatic.conf exists for dnf-automatic_apply_updates oval:ssg-test_dnf-automatic_apply_updates_config_file_exists:tst:1 true
Following items have been found on the system:
Path | Type | UID | GID | Size (B) | Permissions |
---|---|---|---|---|---|
/etc/dnf/automatic.conf | regular | 0 | 0 | 2719 | rw-r--r-- |
Configure dnf-automatic to Install Only Security Updates
Rule ID | xccdf_org.ssgproject.content_rule_dnf-automatic_security_updates_only |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-dnf-automatic_security_updates_only:def:1 |
Time | 2022-02-10T22:29:26+00:00 |
Severity | low |
Identifiers and References | Identifiers: CCE-82267-6 References: BP28(R8), SI-2(5), CM-6(a), SI-2(c), FMT_SMF_EXT.1, SRG-OS-000191-GPOS-00080 |
Description | To configure dnf-automatic to install only security updates
automatically, set upgrade_type to security under
[commands] section in /etc/dnf/automatic.conf . |
Rationale | By default, dnf-automatic installs all available updates.
Reducing the amount of updated packages only to updates that were
issued as a part of a security advisory increases the system stability. |
tests the value of upgrade_type setting in the /etc/dnf/automatic.conf file oval:ssg-test_dnf-automatic_security_updates_only:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/dnf/automatic.conf | [commands] # What kind of upgrade to perform: # default = all available upgrades # security = only the security upgrades upgrade_type = security |
The configuration file /etc/dnf/automatic.conf exists for dnf-automatic_security_updates_only oval:ssg-test_dnf-automatic_security_updates_only_config_file_exists:tst:1 true
Following items have been found on the system:
Path | Type | UID | GID | Size (B) | Permissions |
---|---|---|---|---|---|
/etc/dnf/automatic.conf | regular | 0 | 0 | 2719 | rw-r--r-- |
Ensure gpgcheck Enabled In Main yum Configuration
Rule ID | xccdf_org.ssgproject.content_rule_ensure_gpgcheck_globally_activated |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-ensure_gpgcheck_globally_activated:def:1 |
Time | 2022-02-10T22:29:26+00:00 |
Severity | high |
Identifiers and References | Identifiers: CCE-80790-9 References: BP28(R15), 1.2.4, 11, 2, 3, 9, 5.10.4.1, APO01.06, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS06.02, 3.4.8, CCI-001749, 164.308(a)(1)(ii)(D), 164.312(b), 164.312(c)(1), 164.312(c)(2), 164.312(e)(2)(i), 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 7.6, A.11.2.4, A.12.1.2, A.12.2.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, CM-5(3), SI-7, SC-12, SC-12(3), CM-6(a), SA-12, SA-12(10), CM-11(a), CM-11(b), PR.DS-6, PR.DS-8, PR.IP-1, FPT_TUD_EXT.1, FPT_TUD_EXT.2, Req-6.2, SRG-OS-000366-GPOS-00153, RHEL-08-010370, SV-230264r627750_rule, SRG-OS-000366-VMM-001430, SRG-OS-000370-VMM-001460, SRG-OS-000404-VMM-001650 |
Description | The gpgcheck option controls whether
RPM packages' signatures are always checked prior to installation.
To configure yum to check package signatures before installing
them, ensure the following line appears in /etc/yum.conf in
the [main] section:
gpgcheck=1 |
Rationale | Changes to any software components can have significant effects on the
overall security of the operating system. This requirement ensures the
software has not been tampered with and that it has been provided by a
trusted vendor.
Accordingly, patches, service packs, device drivers, or operating system components must be signed with a certificate recognized and approved by the organization. Verifying the authenticity of the software prior to installation validates the integrity of the patch or upgrade received from a vendor. This ensures the software has not been tampered with and that it has been provided by a trusted vendor. Self-signed certificates are disallowed by this requirement. Certificates used to verify the software must be from an approved Certificate Authority (CA). |
check value of gpgcheck in /etc/yum.conf oval:ssg-test_ensure_gpgcheck_globally_activated:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/yum.conf | gpgcheck=1 |
Ensure gpgcheck Enabled for Local Packages
Rule ID | xccdf_org.ssgproject.content_rule_ensure_gpgcheck_local_packages |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-ensure_gpgcheck_local_packages:def:1 |
Time | 2022-02-10T22:29:26+00:00 |
Severity | high |
Identifiers and References | Identifiers: CCE-80791-7 References: BP28(R15), 11, 3, 9, BAI10.01, BAI10.02, BAI10.03, BAI10.05, 3.4.8, CCI-001749, 164.308(a)(1)(ii)(D), 164.312(b), 164.312(c)(1), 164.312(c)(2), 164.312(e)(2)(i), 4.3.4.3.2, 4.3.4.3.3, SR 7.6, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, CM-11(a), CM-11(b), CM-6(a), CM-5(3), SA-12, SA-12(10), PR.IP-1, FPT_TUD_EXT.1, FPT_TUD_EXT.2, SRG-OS-000366-GPOS-00153, RHEL-08-010371, SV-230265r627750_rule, SRG-OS-000366-VMM-001430, SRG-OS-000370-VMM-001460, SRG-OS-000404-VMM-001650 |
Description | yum should be configured to verify the signature(s) of local packages
prior to installation. To configure yum to verify signatures of local
packages, set the localpkg_gpgcheck to 1 in /etc/yum.conf . |
Rationale | Changes to any software components can have significant effects to the overall security
of the operating system. This requirement ensures the software has not been tampered and
has been provided by a trusted vendor.
Accordingly, patches, service packs, device drivers, or operating system components must be signed with a certificate recognized and approved by the organization. |
check value of localpkg_gpgcheck in /etc/yum.conf oval:ssg-test_yum_ensure_gpgcheck_local_packages:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/yum.conf | localpkg_gpgcheck = 1 |
Ensure gpgcheck Enabled for All yum Package Repositories
Rule ID | xccdf_org.ssgproject.content_rule_ensure_gpgcheck_never_disabled |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-ensure_gpgcheck_never_disabled:def:1 |
Time | 2022-02-10T22:29:26+00:00 |
Severity | high |
Identifiers and References | Identifiers: CCE-80792-5 References: BP28(R15), 11, 2, 3, 9, 5.10.4.1, APO01.06, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS06.02, 3.4.8, CCI-001749, 164.308(a)(1)(ii)(D), 164.312(b), 164.312(c)(1), 164.312(c)(2), 164.312(e)(2)(i), 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 7.6, A.11.2.4, A.12.1.2, A.12.2.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, CM-5(3), SI-7, SC-12, SC-12(3), CM-6(a), SA-12, SA-12(10), CM-11(a), CM-11(b), PR.DS-6, PR.DS-8, PR.IP-1, FPT_TUD_EXT.1, FPT_TUD_EXT.2, Req-6.2, SRG-OS-000366-GPOS-00153, SRG-OS-000366-VMM-001430, SRG-OS-000370-VMM-001460, SRG-OS-000404-VMM-001650 |
Description | To ensure signature checking is not disabled for
any repos, remove any lines from files in /etc/yum.repos.d of the form:
gpgcheck=0 |
Rationale | Verifying the authenticity of the software prior to installation validates
the integrity of the patch or upgrade received from a vendor. This ensures
the software has not been tampered with and that it has been provided by a
trusted vendor. Self-signed certificates are disallowed by this
requirement. Certificates used to verify the software must be from an
approved Certificate Authority (CA)." |
check for existence of gpgcheck=0 in /etc/yum.repos.d/ files oval:ssg-test_ensure_gpgcheck_never_disabled:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-obj_ensure_gpgcheck_never_disabled:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/etc/yum.repos.d | .* | ^\s*gpgcheck\s*=\s*0\s*$ | 1 |
Ensure Red Hat GPG Key Installed
Rule ID | xccdf_org.ssgproject.content_rule_ensure_redhat_gpgkey_installed |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-ensure_redhat_gpgkey_installed:def:1 |
Time | 2022-02-10T22:29:26+00:00 |
Severity | high |
Identifiers and References | Identifiers: CCE-80795-8 References: BP28(R15), 1.2.3, 11, 2, 3, 9, 5.10.4.1, APO01.06, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS06.02, 3.4.8, CCI-001749, 164.308(a)(1)(ii)(D), 164.312(b), 164.312(c)(1), 164.312(c)(2), 164.312(e)(2)(i), 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 7.6, A.11.2.4, A.12.1.2, A.12.2.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, CIP-003-3 R4.2, CIP-003-3 R6, CIP-007-3 R4, CIP-007-3 R4.1, CIP-007-3 R4.2, CIP-007-3 R5.1, CM-5(3), SI-7, SC-12, SC-12(3), CM-6(a), PR.DS-6, PR.DS-8, PR.IP-1, FPT_TUD_EXT.1, FPT_TUD_EXT.2, Req-6.2, SRG-OS-000366-GPOS-00153, SRG-OS-000366-VMM-001430, SRG-OS-000370-VMM-001460, SRG-OS-000404-VMM-001650 |
Description | To ensure the system can cryptographically verify base software packages
come from Red Hat (and to connect to the Red Hat Network to receive them),
the Red Hat GPG key must properly be installed. To install the Red Hat GPG
key, run:
$ sudo subscription-manager registerIf the system is not connected to the Internet or an RHN Satellite, then install the Red Hat GPG key from trusted media such as the Red Hat installation CD-ROM or DVD. Assuming the disc is mounted in /media/cdrom , use the following command as the root user to import
it into the keyring:
$ sudo rpm --import /media/cdrom/RPM-GPG-KEYAlternatively, the key may be pre-loaded during the RHEL installation. In such cases, the key can be installed by running the following command: sudo rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release |
Rationale | Changes to software components can have significant effects on the overall
security of the operating system. This requirement ensures the software has
not been tampered with and that it has been provided by a trusted vendor.
The Red Hat GPG key is necessary to cryptographically verify packages are
from Red Hat. |
installed OS part of unix family oval:ssg-test_rhel8_unix_family:tst:1 true
Following items have been found on the system:
Family |
---|
unix |
installed OS part of unix family oval:ssg-test_rhel8_unix_family:tst:1 true
Following items have been found on the system:
Family |
---|
unix |
redhat-release is version 8 oval:ssg-test_rhel8:tst:1 true
Following items have been found on the system:
Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
---|---|---|---|---|---|---|---|
redhat-release | x86_64 | (none) | 0.8.el8 | 8.5 | 0:8.5-0.8.el8 | 199e2f91fd431d51 | redhat-release-0:8.5-0.8.el8.x86_64 |
redhat-release is version 8 oval:ssg-test_rhel8:tst:1 true
Following items have been found on the system:
Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
---|---|---|---|---|---|---|---|
redhat-release | x86_64 | (none) | 0.8.el8 | 8.5 | 0:8.5-0.8.el8 | 199e2f91fd431d51 | redhat-release-0:8.5-0.8.el8.x86_64 |
redhat-release-virtualization-host RPM package is installed oval:ssg-test_rhvh4_version:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_rhvh4_version:obj:1 of type rpminfo_object
Name |
---|
redhat-release-virtualization-host |
redhat-release-virtualization-host RPM package is installed oval:ssg-test_rhvh4_version:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_rhvh4_version:obj:1 of type rpminfo_object
Name |
---|
redhat-release-virtualization-host |
RHEVH base RHEL is version 8 oval:ssg-test_rhevh_rhel8_version:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_rhevh_rhel8_version:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
/etc/redhat-release | ^Red Hat Enterprise Linux release (\d)\.\d+$ | 1 |
RHEVH base RHEL is version 8 oval:ssg-test_rhevh_rhel8_version:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_rhevh_rhel8_version:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
/etc/redhat-release | ^Red Hat Enterprise Linux release (\d)\.\d+$ | 1 |
installed OS part of unix family oval:ssg-test_rhel8_unix_family:tst:1 true
Following items have been found on the system:
Family |
---|
unix |
installed OS part of unix family oval:ssg-test_rhel8_unix_family:tst:1 true
Following items have been found on the system:
Family |
---|
unix |
redhat-release is version 8 oval:ssg-test_rhel8:tst:1 true
Following items have been found on the system:
Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
---|---|---|---|---|---|---|---|
redhat-release | x86_64 | (none) | 0.8.el8 | 8.5 | 0:8.5-0.8.el8 | 199e2f91fd431d51 | redhat-release-0:8.5-0.8.el8.x86_64 |
redhat-release is version 8 oval:ssg-test_rhel8:tst:1 true
Following items have been found on the system:
Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
---|---|---|---|---|---|---|---|
redhat-release | x86_64 | (none) | 0.8.el8 | 8.5 | 0:8.5-0.8.el8 | 199e2f91fd431d51 | redhat-release-0:8.5-0.8.el8.x86_64 |
redhat-release-virtualization-host RPM package is installed oval:ssg-test_rhvh4_version:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_rhvh4_version:obj:1 of type rpminfo_object
Name |
---|
redhat-release-virtualization-host |
redhat-release-virtualization-host RPM package is installed oval:ssg-test_rhvh4_version:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_rhvh4_version:obj:1 of type rpminfo_object
Name |
---|
redhat-release-virtualization-host |
RHEVH base RHEL is version 8 oval:ssg-test_rhevh_rhel8_version:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_rhevh_rhel8_version:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
/etc/redhat-release | ^Red Hat Enterprise Linux release (\d)\.\d+$ | 1 |
RHEVH base RHEL is version 8 oval:ssg-test_rhevh_rhel8_version:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_rhevh_rhel8_version:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
/etc/redhat-release | ^Red Hat Enterprise Linux release (\d)\.\d+$ | 1 |
Red Hat release key package is installed oval:ssg-test_package_gpgkey-fd431d51-4ae0493b_installed:tst:1 true
Following items have been found on the system:
Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
---|---|---|---|---|---|---|---|
gpg-pubkey | (none) | (none) | 4ae0493b | fd431d51 | 0:fd431d51-4ae0493b | 0 | gpg-pubkey-0:fd431d51-4ae0493b.(none) |
gpg-pubkey | (none) | (none) | 5b32db75 | d4082792 | 0:d4082792-5b32db75 | 0 | gpg-pubkey-0:d4082792-5b32db75.(none) |
Red Hat auxiliary key package is installed oval:ssg-test_package_gpgkey-d4082792-5b32db75_installed:tst:1 true
Following items have been found on the system:
Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
---|---|---|---|---|---|---|---|
gpg-pubkey | (none) | (none) | 4ae0493b | fd431d51 | 0:fd431d51-4ae0493b | 0 | gpg-pubkey-0:fd431d51-4ae0493b.(none) |
gpg-pubkey | (none) | (none) | 5b32db75 | d4082792 | 0:d4082792-5b32db75 | 0 | gpg-pubkey-0:d4082792-5b32db75.(none) |
Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-object_unix_family:obj:1 of type family_object
Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 true
Following items have been found on the system:
Family |
---|
unix |
Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-object_unix_family:obj:1 of type family_object
Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 true
Following items have been found on the system:
Family |
---|
unix |
Check os-release ID oval:ssg-test_centos8_name:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-obj_name_centos8:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
/etc/os-release | ^ID="(\w+)"$ | 1 |
Check os-release ID oval:ssg-test_centos8_name:tst:1 false
Following items have been found on the system:
Path | Content |
---|---|
/etc/os-release | ID="rhel" |
Check os-release VERSION_ID oval:ssg-test_centos8_version:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-obj_version_centos8:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
/etc/os-release | ^VERSION_ID="(\d)"$ | 1 |
Check os-release VERSION_ID oval:ssg-test_centos8_version:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_version_centos8:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
/etc/os-release | ^VERSION_ID="(\d)"$ | 1 |
Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-object_unix_family:obj:1 of type family_object
Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 true
Following items have been found on the system:
Family |
---|
unix |
Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-object_unix_family:obj:1 of type family_object
Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 true
Following items have been found on the system:
Family |
---|
unix |
Check os-release ID oval:ssg-test_centos8_name:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-obj_name_centos8:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
/etc/os-release | ^ID="(\w+)"$ | 1 |
Check os-release ID oval:ssg-test_centos8_name:tst:1 false
Following items have been found on the system:
Path | Content |
---|---|
/etc/os-release | ID="rhel" |
Check os-release VERSION_ID oval:ssg-test_centos8_version:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-obj_version_centos8:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
/etc/os-release | ^VERSION_ID="(\d)"$ | 1 |
Check os-release VERSION_ID oval:ssg-test_centos8_version:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_version_centos8:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
/etc/os-release | ^VERSION_ID="(\d)"$ | 1 |
CentOS8 key package is installed oval:ssg-test_package_gpgkey-8483c65d-5ccc5b19_installed:tst:1 false
Following items have been found on the system:
Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
---|---|---|---|---|---|---|---|
gpg-pubkey | (none) | (none) | 4ae0493b | fd431d51 | 0:fd431d51-4ae0493b | 0 | gpg-pubkey-0:fd431d51-4ae0493b.(none) |
gpg-pubkey | (none) | (none) | 5b32db75 | d4082792 | 0:d4082792-5b32db75 | 0 | gpg-pubkey-0:d4082792-5b32db75.(none) |
Enable dnf-automatic Timer
Rule ID | xccdf_org.ssgproject.content_rule_timer_dnf-automatic_enabled |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-timer_dnf-automatic_enabled:def:1 |
Time | 2022-02-10T22:29:26+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-82360-9 References: BP28(R8), SI-2(5), CM-6(a), SI-2(c), FMT_SMF_EXT.1, SRG-OS-000191-GPOS-00080 |
Description |
The dnf-automatic timer can be enabled with the following command:
$ sudo systemctl enable dnf-automatic.timer |
Rationale | The dnf-automatic is an alternative command line interface (CLI) to dnf upgrade with specific facilities to make it suitable to be executed automatically and regularly from systemd timers, cron jobs and similar.
The tool is controlled by dnf-automatic.timer SystemD timer. |
package dnf-automatic is installed oval:ssg-test_package_dnf-automatic_installed:tst:1 true
Following items have been found on the system:
Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
---|---|---|---|---|---|---|---|
dnf-automatic | noarch | (none) | 4.el8 | 4.7.0 | 0:4.7.0-4.el8 | 199e2f91fd431d51 | dnf-automatic-0:4.7.0-4.el8.noarch |
Test that the dnf-automatic timer is running oval:ssg-test_timer_running_dnf-automatic:tst:1 true
Following items have been found on the system:
Unit | Property | Value |
---|---|---|
dnf-automatic.timer | ActiveState | active |
systemd test oval:ssg-test_multi_user_wants_dnf-automatic:tst:1 true
Following items have been found on the system:
Unit | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency |
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
multi-user.target | basic.target | sysinit.target | systemd-udev-trigger.service | systemd-firstboot.service | systemd-journald.service | systemd-tmpfiles-setup.service | systemd-journal-flush.service | systemd-sysctl.service | dev-mqueue.mount | systemd-udevd.service | swap.target | dev-disk-by\x2duuid-1e5c0ff6\x2dd83c\x2d4f59\x2db028\x2d3cdb40431877.swap | dev-mapper-VolGroup\x2dswap.swap | systemd-machine-id-commit.service | systemd-update-done.service | systemd-sysusers.service | dracut-shutdown.service | multipathd.service | cryptsetup.target | import-state.service | lvm2-monitor.service | plymouth-read-write.service | proc-sys-fs-binfmt_misc.automount | plymouth-start.service | systemd-tmpfiles-setup-dev.service | systemd-binfmt.service | systemd-journal-catalog-update.service | local-fs.target | var-log.mount | var-log-audit.mount | boot-efi.mount | var-tmp.mount | boot.mount | home.mount | var.mount | -.mount | tmp.mount | systemd-remount-fs.service | ostree-remount.service | kmod-static-nodes.service | ldconfig.service | systemd-ask-password-console.path | sys-fs-fuse-connections.mount | nis-domainname.service | dev-hugepages.mount | systemd-hwdb-update.service | systemd-random-seed.service | sys-kernel-debug.mount | loadmodules.service | lvm2-lvmpolld.socket | sys-kernel-config.mount | selinux-autorelabel-mark.service | systemd-modules-load.service | systemd-update-utmp.service | usbguard.service | paths.target | slices.target | system.slice | -.slice | microcode.service | timers.target | systemd-tmpfiles-clean.timer | dnf-automatic.timer | dnf-makecache.timer | unbound-anchor.timer | sockets.target | systemd-coredump.socket | systemd-udevd-control.socket | systemd-udevd-kernel.socket | systemd-initctl.socket | dbus.socket | systemd-journald.socket | dm-event.socket | multipathd.socket | systemd-journald-dev-log.socket | sssd-kcm.socket | chronyd.service | plymouth-quit.service | systemd-update-utmp-runlevel.service | systemd-user-sessions.service | crond.service | remote-fs.target | dbus.service | firewalld.service | rhsmcertd.service | mdmonitor.service | NetworkManager.service | plymouth-quit-wait.service | sshd.service | fapolicyd.service | rsyslog.service | systemd-ask-password-wall.path | systemd-logind.service | irqbalance.service | getty.target | getty@tty1.service | tuned.service | auditd.service | sssd.service |
Limit Password Reuse
Rule ID | xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_remember |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-accounts_password_pam_unix_remember:def:1 |
Time | 2022-02-10T22:29:26+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-80666-1 References: BP28(R18), 5.4.3, 1, 12, 15, 16, 5, 5.6.2.1.1, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10, 3.5.8, CCI-000200, 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, A.18.1.4, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, IA-5(f), IA-5(1)(e), PR.AC-1, PR.AC-6, PR.AC-7, Req-8.2.5, SRG-OS-000077-GPOS-00045, SRG-OS-000077-VMM-000440 |
Description | Do not allow users to reuse recent passwords. This can be
accomplished by using the remember option for the pam_unix
or pam_pwhistory PAM modules.
In the file /etc/pam.d/system-auth , append remember=5
to the line which refers to the pam_unix.so or pam_pwhistory.so module, as shown below:
|
Rationale | Preventing re-use of previous passwords helps ensure that a compromised password is not re-used by a user. |
Test if remember attribute of pam_unix.so is set correctly in /etc/pam.d/system-auth oval:ssg-test_accounts_password_pam_unix_remember:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/pam.d/system-auth | password sufficient pam_unix.so try_first_pass use_authtok sha512 shadow remember=5 |
Test if remember attribute of pam_pwhistory.so is set correctly in /etc/pam.d/system-auth oval:ssg-test_accounts_password_pam_pwhistory_remember:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_accounts_password_pam_pwhistory_remember:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
/etc/pam.d/system-auth | ^\s*password\s+(?:(?:requisite)|(?:required))\s+pam_pwhistory\.so.*remember=([0-9]*).*$ | 1 |
Set Deny For Failed Password Attempts
Rule ID | xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_deny |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-accounts_passwords_pam_faillock_deny:def:1 |
Time | 2022-02-10T22:29:26+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-80667-9 References: BP28(R18), 5.4.2, 1, 12, 15, 16, 5.5.3, DSS05.04, DSS05.10, DSS06.10, 3.1.8, CCI-000044, CCI-002236, CCI-002237, CCI-002238, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, SR 1.1, SR 1.10, SR 1.2, SR 1.5, SR 1.7, SR 1.8, SR 1.9, 0421, 0422, 0431, 0974, 1173, 1401, 1504, 1505, 1546, 1557, 1558, 1559, 1560, 1561, A.18.1.4, A.9.2.1, A.9.2.4, A.9.3.1, A.9.4.2, A.9.4.3, CM-6(a), AC-7(a), PR.AC-7, FIA_AFL.1, Req-8.1.6, SRG-OS-000329-GPOS-00128, SRG-OS-000021-GPOS-00005, RHEL-08-020010, SV-230332r627750_rule, SRG-OS-000021-VMM-000050 |
Description | To configure the system to lock out accounts after a number of incorrect login
attempts using pam_faillock.so , modify the content of both
/etc/pam.d/system-auth and /etc/pam.d/password-auth as follows:
|
Rationale | Locking out user accounts after a number of incorrect attempts
prevents direct password guessing attacks. |
Check pam_faillock.so preauth silent present, with correct deny value, and is followed by pam_unix. oval:ssg-test_accounts_passwords_pam_faillock_preauth_silent_system-auth:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/pam.d/system-auth | auth required pam_faillock.so preauth silent deny=3 fail_interval=900 unlock_time=0 auth sufficient pam_unix.so try_first_pass |
Check if pam_faillock.so is called in account phase before pam_unix oval:ssg-test_accounts_passwords_pam_faillock_account_phase_system-auth:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/pam.d/system-auth | account required pam_faillock.so account required pam_unix.so |
Check pam_faillock.so preauth silent present in /etc/pam.d/password-auth, has correct deny value, and is followed by pam_unix oval:ssg-test_accounts_passwords_pam_faillock_preauth_silent_password-auth:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/pam.d/password-auth | auth required pam_faillock.so preauth silent deny=3 fail_interval=900 unlock_time=0 auth sufficient pam_unix.so try_first_pass |
Check if pam_faillock_so is called in account phase before pam_unix. oval:ssg-test_accounts_passwords_pam_faillock_account_phase_password-auth:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/pam.d/password-auth | account required pam_faillock.so account required pam_unix.so |
Checks if pam_faillock authfail is hit even if pam_unix skips lines by defaulting, and also authfail deny value oval:ssg-test_accounts_passwords_pam_faillock_numeric_default_check_system-auth:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_accounts_passwords_pam_faillock_when_lines_skipped_system-auth:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
3Referenced variable has no values (oval:ssg-var_accounts_passwords_pam_faillock_preauth_default_lin | /etc/pam.d/system-auth | 1 |
Check control values of pam_unix, that it is followed by pam_faillock.so authfail and deny value of pam_faillock.so authfail oval:ssg-test_accounts_passwords_pam_faillock_authfail_deny_system-auth:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/pam.d/system-auth | auth sufficient pam_unix.so try_first_pass auth [default=die] pam_faillock.so authfail deny=3 |
Checks if pam_faillock authfail is hit even if pam_unix skips lines by defaulting, and also authfail deny value oval:ssg-test_accounts_passwords_pam_faillock_numeric_default_check_password-auth:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_accounts_passwords_pam_faillock_when_lines_skipped_password-auth:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
3Referenced variable has no values (oval:ssg-var_accounts_passwords_pam_faillock_preauth_default_lin | /etc/pam.d/password-auth | 1 |
Check pam_faillock authfail is present after pam_unix, check pam_unix has proper control values, and authfail deny value is correct. oval:ssg-test_accounts_passwords_pam_faillock_authfail_deny_password-auth:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/pam.d/password-auth | auth sufficient pam_unix.so try_first_pass auth [default=die] pam_faillock.so authfail deny=3 |
Set Interval For Counting Failed Password Attempts
Rule ID | xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_interval |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-accounts_passwords_pam_faillock_interval:def:1 |
Time | 2022-02-10T22:29:26+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-80669-5 References: BP28(R18), 1, 12, 15, 16, DSS05.04, DSS05.10, DSS06.10, CCI-000044, CCI-002236, CCI-002237, CCI-002238, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, SR 1.1, SR 1.10, SR 1.2, SR 1.5, SR 1.7, SR 1.8, SR 1.9, 0421, 0422, 0431, 0974, 1173, 1401, 1504, 1505, 1546, 1557, 1558, 1559, 1560, 1561, A.18.1.4, A.9.2.1, A.9.2.4, A.9.3.1, A.9.4.2, A.9.4.3, CM-6(a), AC-7(a), PR.AC-7, FIA_AFL.1, SRG-OS-000329-GPOS-00128, SRG-OS-000021-GPOS-00005, RHEL-08-020012, SV-230334r627750_rule, SRG-OS-000021-VMM-000050 |
Description | Utilizing pam_faillock.so , the fail_interval directive
configures the system to lock out an account after a number of incorrect
login attempts within a specified time period. Modify the content of both
/etc/pam.d/system-auth and /etc/pam.d/password-auth
as follows:
|
Rationale | By limiting the number of failed logon attempts the risk of unauthorized system
access via user password guessing, otherwise known as brute-forcing, is reduced.
Limits are imposed by locking the account. |
check maximum preauth fail_interval allowed in /etc/pam.d/system-auth oval:ssg-test_accounts_passwords_pam_faillock_fail_interval_system-auth:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/pam.d/system-auth | auth required pam_faillock.so preauth silent deny=3 fail_interval=900 unlock_time=0 |
check maximum authfail fail_interval allowed in /etc/pam.d/system-auth oval:ssg-test_accounts_passwords_pam_faillock_authfail_fail_interval_system-auth:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/pam.d/system-auth | auth [default=die] pam_faillock.so authfail deny=3 fail_interval=900 unlock_time=0 |
check maximum authfail fail_interval allowed in /etc/pam.d/password-auth oval:ssg-test_accounts_passwords_pam_faillock_fail_interval_password-auth:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/pam.d/password-auth | auth [default=die] pam_faillock.so authfail deny=3 fail_interval=900 unlock_time=0 |
check maximum preauth fail_interval allowed in /etc/pam.d/password-auth oval:ssg-test_accounts_passwords_pam_faillock_preauth_fail_interval_password-auth:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/pam.d/password-auth | auth required pam_faillock.so preauth silent deny=3 fail_interval=900 unlock_time=0 |
check if pam_faillock.so is required in account section in /etc/pam.d/password-auth oval:ssg-test_accounts_passwords_pam_faillock_account_requires_password-auth:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/pam.d/password-auth | account required pam_faillock.so |
check if pam_faillock.so is required in account section in /etc/pam.d/system-auth oval:ssg-test_accounts_passwords_pam_faillock_account_requires_system-auth:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/pam.d/system-auth | account required pam_faillock.so |
Set Lockout Time for Failed Password Attempts
Rule ID | xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_unlock_time |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-accounts_passwords_pam_faillock_unlock_time:def:1 |
Time | 2022-02-10T22:29:26+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-80670-3 References: BP28(R18), 5.4.2, 1, 12, 15, 16, 5.5.3, DSS05.04, DSS05.10, DSS06.10, 3.1.8, CCI-000044, CCI-002236, CCI-002237, CCI-002238, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, SR 1.1, SR 1.10, SR 1.2, SR 1.5, SR 1.7, SR 1.8, SR 1.9, 0421, 0422, 0431, 0974, 1173, 1401, 1504, 1505, 1546, 1557, 1558, 1559, 1560, 1561, A.18.1.4, A.9.2.1, A.9.2.4, A.9.3.1, A.9.4.2, A.9.4.3, CM-6(a), AC-7(b), PR.AC-7, FIA_AFL.1, Req-8.1.7, SRG-OS-000329-GPOS-00128, SRG-OS-000021-GPOS-00005, RHEL-08-020014, SV-230336r627750_rule, SRG-OS-000329-VMM-001180 |
Description | To configure the system to lock out accounts after a number of incorrect login
attempts and require an administrator to unlock the account using pam_faillock.so ,
modify the content of both /etc/pam.d/system-auth and /etc/pam.d/password-auth as follows:
unlock_time is set to 0 , manual intervention by an administrator is required to unlock a user. |
Rationale | Locking out user accounts after a number of incorrect attempts
prevents direct password guessing attacks. Ensuring that an administrator is
involved in unlocking locked accounts draws appropriate attention to such
situations. |
Check if external variable unlock time is never oval:ssg-test_var_faillock_unlock_time_is_never:tst:1 true
Following items have been found on the system:
Var ref | Value |
---|---|
oval:ssg-var_accounts_passwords_pam_faillock_unlock_time:var:1 | 0 |
Check if unlock time is never oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_is_never:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/pam.d/system-auth | auth required pam_faillock.so preauth silent deny=3 fail_interval=900 unlock_time=0 |
/etc/pam.d/system-auth | auth [default=die] pam_faillock.so authfail deny=3 fail_interval=900 unlock_time=0 |
/etc/pam.d/password-auth | auth required pam_faillock.so preauth silent deny=3 fail_interval=900 unlock_time=0 |
/etc/pam.d/password-auth | auth [default=die] pam_faillock.so authfail deny=3 fail_interval=900 unlock_time=0 |
Check if external variable unlock time is never oval:ssg-test_var_faillock_unlock_time_is_never:tst:1 true
Following items have been found on the system:
Var ref | Value |
---|---|
oval:ssg-var_accounts_passwords_pam_faillock_unlock_time:var:1 | 0 |
Check if unlock time is never, or greater than or equal external variable oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_greater_or_equal_ext_var:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/pam.d/system-auth | auth required pam_faillock.so preauth silent deny=3 fail_interval=900 unlock_time=0 |
/etc/pam.d/system-auth | auth [default=die] pam_faillock.so authfail deny=3 fail_interval=900 unlock_time=0 |
/etc/pam.d/password-auth | auth required pam_faillock.so preauth silent deny=3 fail_interval=900 unlock_time=0 |
/etc/pam.d/password-auth | auth [default=die] pam_faillock.so authfail deny=3 fail_interval=900 unlock_time=0 |
Ensure PAM Enforces Password Requirements - Minimum Digit Characters
Rule ID | xccdf_org.ssgproject.content_rule_accounts_password_pam_dcredit |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-accounts_password_pam_dcredit:def:1 |
Time | 2022-02-10T22:29:26+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-80653-9 References: BP28(R18), 1, 12, 15, 16, 5, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10, CCI-000194, 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, 0421, 0422, 0431, 0974, 1173, 1401, 1504, 1505, 1546, 1557, 1558, 1559, 1560, 1561, A.18.1.4, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, IA-5(c), IA-5(1)(a), CM-6(a), IA-5(4), PR.AC-1, PR.AC-6, PR.AC-7, FMT_MOF_EXT.1, Req-8.2.3, SRG-OS-000071-GPOS-00039, RHEL-08-020130, SV-230359r627750_rule, SRG-OS-000071-VMM-000380 |
Description | The pam_pwquality module's dcredit parameter controls requirements for
usage of digits in a password. When set to a negative number, any password will be required to
contain that many digits. When set to a positive number, pam_pwquality will grant +1 additional
length credit for each digit. Modify the dcredit setting in
/etc/security/pwquality.conf to require the use of a digit in passwords. |
Rationale | Use of a complex password helps to increase the time and resources required
to compromise the password. Password complexity, or strength, is a measure of
the effectiveness of a password in resisting attempts at guessing and brute-force
attacks.
Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised. Requiring digits makes password guessing attacks more difficult by ensuring a larger search space. |
check the configuration of /etc/pam.d/system-auth oval:ssg-test_password_pam_pwquality:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/pam.d/system-auth | password requisite pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type= |
check the configuration of /etc/security/pwquality.conf oval:ssg-test_password_pam_pwquality_dcredit:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/security/pwquality.conf | dcredit = -1 |
Ensure PAM Enforces Password Requirements - Minimum Different Characters
Rule ID | xccdf_org.ssgproject.content_rule_accounts_password_pam_difok |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-accounts_password_pam_difok:def:1 |
Time | 2022-02-10T22:29:26+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-80654-7 References: 1, 12, 15, 16, 5, 5.6.2.1.1, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10, CCI-000195, 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, A.18.1.4, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, IA-5(c), IA-5(1)(b), CM-6(a), IA-5(4), PR.AC-1, PR.AC-6, PR.AC-7, SRG-OS-000072-GPOS-00040, RHEL-08-020170, SV-230363r627750_rule, SRG-OS-000072-VMM-000390 |
Description | The pam_pwquality module's difok parameter sets the number of characters
in a password that must not be present in and old password during a password change.
Modify the difok setting in /etc/security/pwquality.conf
to equal 4 to require differing characters
when changing passwords. |
Rationale | Use of a complex password helps to increase the time and resources
required to compromise the password. Password complexity, or strength,
is a measure of the effectiveness of a password in resisting attempts
at guessing and brute–force attacks.
Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised. Requiring a minimum number of different characters during password changes ensures that newly changed passwords should not resemble previously compromised ones. Note that passwords which are changed on compromised systems will still be compromised, however. |
check the configuration of /etc/pam.d/system-auth oval:ssg-test_password_pam_pwquality:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/pam.d/system-auth | password requisite pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type= |
check the configuration of /etc/security/pwquality.conf oval:ssg-test_password_pam_pwquality_difok:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/security/pwquality.conf | difok = 4 |
Ensure PAM Enforces Password Requirements - Minimum Lowercase Characters
Rule ID | xccdf_org.ssgproject.content_rule_accounts_password_pam_lcredit |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-accounts_password_pam_lcredit:def:1 |
Time | 2022-02-10T22:29:26+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-80655-4 References: BP28(R18), 1, 12, 15, 16, 5, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10, CCI-000193, 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, 0421, 0422, 0431, 0974, 1173, 1401, 1504, 1505, 1546, 1557, 1558, 1559, 1560, 1561, A.18.1.4, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, IA-5(c), IA-5(1)(a), CM-6(a), IA-5(4), PR.AC-1, PR.AC-6, PR.AC-7, FMT_MOF_EXT.1, Req-8.2.3, SRG-OS-000070-GPOS-00038, RHEL-08-020120, SV-230358r627750_rule, SRG-OS-000070-VMM-000370 |
Description | The pam_pwquality module's lcredit parameter controls requirements for
usage of lowercase letters in a password. When set to a negative number, any password will be required to
contain that many lowercase characters. When set to a positive number, pam_pwquality will grant +1 additional
length credit for each lowercase character. Modify the lcredit setting in
/etc/security/pwquality.conf to require the use of a lowercase character in passwords. |
Rationale | Use of a complex password helps to increase the time and resources required
to compromise the password. Password complexity, or strength, is a measure of
the effectiveness of a password in resisting attempts at guessing and brute-force
attacks.
Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possble combinations that need to be tested before the password is compromised. Requiring a minimum number of lowercase characters makes password guessing attacks more difficult by ensuring a larger search space. |
check the configuration of /etc/pam.d/system-auth oval:ssg-test_password_pam_pwquality:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/pam.d/system-auth | password requisite pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type= |
check the configuration of /etc/security/pwquality.conf oval:ssg-test_password_pam_pwquality_lcredit:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/security/pwquality.conf | lcredit = -1 |
Ensure PAM Enforces Password Requirements - Maximum Consecutive Repeating Characters from Same Character Class
Rule ID | xccdf_org.ssgproject.content_rule_accounts_password_pam_maxclassrepeat |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-accounts_password_pam_maxclassrepeat:def:1 |
Time | 2022-02-10T22:29:26+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-81034-1 References: 1, 12, 15, 16, 5, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10, CCI-000195, 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, A.18.1.4, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, IA-5(c), IA-5(1)(a), CM-6(a), IA-5(4), PR.AC-1, PR.AC-6, PR.AC-7, SRG-OS-000072-GPOS-00040, RHEL-08-020140, SV-230360r627750_rule |
Description | The pam_pwquality module's maxclassrepeat parameter controls requirements for
consecutive repeating characters from the same character class. When set to a positive number, it will reject passwords
which contain more than that number of consecutive characters from the same character class. Modify the
maxclassrepeat setting in /etc/security/pwquality.conf to equal 4
to prevent a run of (4 + 1) or more identical characters. |
Rationale | Use of a complex password helps to increase the time and resources required to comrpomise the password.
Password complexity, or strength, is a measure of the effectiveness of a password in resisting
attempts at guessing and brute-force attacks.
Password complexity is one factor of several that determines how long it takes to crack a password. The more complex a password, the greater the number of possible combinations that need to be tested before the password is compromised. |
check the configuration of /etc/pam.d/system-auth oval:ssg-test_password_pam_pwquality:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/pam.d/system-auth | password requisite pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type= |
check the configuration of /etc/security/pwquality.conf oval:ssg-test_password_pam_pwquality_maxclassrepeat:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/security/pwquality.conf | maxclassrepeat = 4 |
Set Password Maximum Consecutive Repeating Characters
Rule ID | xccdf_org.ssgproject.content_rule_accounts_password_pam_maxrepeat |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-accounts_password_pam_maxrepeat:def:1 |
Time | 2022-02-10T22:29:26+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-82066-2 References: 1, 12, 15, 16, 5, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10, CCI-000195, 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, A.18.1.4, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, IA-5(c), CM-6(a), IA-5(4), PR.AC-1, PR.AC-6, PR.AC-7, SRG-OS-000072-GPOS-00040, RHEL-08-020150, SV-230361r627750_rule |
Description | The pam_pwquality module's maxrepeat parameter controls requirements for
consecutive repeating characters. When set to a positive number, it will reject passwords
which contain more than that number of consecutive characters. Modify the maxrepeat setting
in /etc/security/pwquality.conf to equal 3 to prevent a
run of (3 + 1) or more identical characters. |
Rationale | Use of a complex password helps to increase the time and resources required to compromise the password.
Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at
guessing and brute-force attacks.
Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised. Passwords with excessive repeating characters may be more vulnerable to password-guessing attacks. |
check the configuration of /etc/pam.d/system-auth oval:ssg-test_password_pam_pwquality:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/pam.d/system-auth | password requisite pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type= |
check the configuration of /etc/security/pwquality.conf oval:ssg-test_password_pam_pwquality_maxrepeat:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/security/pwquality.conf | maxrepeat = 3 |
Ensure PAM Enforces Password Requirements - Minimum Length
Rule ID | xccdf_org.ssgproject.content_rule_accounts_password_pam_minlen |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-accounts_password_pam_minlen:def:1 |
Time | 2022-02-10T22:29:26+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-80656-2 References: BP28(R18), 5.4.1, 1, 12, 15, 16, 5, 5.6.2.1.1, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10, CCI-000205, 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, 0421, 0422, 0431, 0974, 1173, 1401, 1504, 1505, 1546, 1557, 1558, 1559, 1560, 1561, A.18.1.4, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, IA-5(c), IA-5(1)(a), CM-6(a), IA-5(4), PR.AC-1, PR.AC-6, PR.AC-7, FMT_MOF_EXT.1, Req-8.2.3, SRG-OS-000078-GPOS-00046, RHEL-08-020230, SV-230369r627750_rule, SRG-OS-000072-VMM-000390, SRG-OS-000078-VMM-000450 |
Description | The pam_pwquality module's minlen parameter controls requirements for
minimum characters required in a password. Add minlen=12
after pam_pwquality to set minimum password length requirements. |
Rationale | The shorter the password, the lower the number of possible combinations
that need to be tested before the password is compromised.
Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password length is one factor of several that helps to determine strength and how long it takes to crack a password. Use of more characters in a password helps to exponentially increase the time and/or resources required to compromose the password. |
check the configuration of /etc/pam.d/system-auth oval:ssg-test_password_pam_pwquality:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/pam.d/system-auth | password requisite pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type= |
check the configuration of /etc/security/pwquality.conf oval:ssg-test_password_pam_pwquality_minlen:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/security/pwquality.conf | minlen = 12 |
Ensure PAM Enforces Password Requirements - Minimum Special Characters
Rule ID | xccdf_org.ssgproject.content_rule_accounts_password_pam_ocredit |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-accounts_password_pam_ocredit:def:1 |
Time | 2022-02-10T22:29:26+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-80663-8 References: BP28(R18), 1, 12, 15, 16, 5, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10, CCI-001619, 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, 0421, 0422, 0431, 0974, 1173, 1401, 1504, 1505, 1546, 1557, 1558, 1559, 1560, 1561, A.18.1.4, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, IA-5(c), IA-5(1)(a), CM-6(a), IA-5(4), PR.AC-1, PR.AC-6, PR.AC-7, FMT_MOF_EXT.1, SRG-OS-000266-GPOS-00101, RHEL-08-020280, SV-230375r627750_rule, SRG-OS-000266-VMM-000940 |
Description | The pam_pwquality module's ocredit= parameter controls requirements for
usage of special (or "other") characters in a password. When set to a negative number,
any password will be required to contain that many special characters.
When set to a positive number, pam_pwquality will grant +1
additional length credit for each special character. Modify the ocredit setting
in /etc/security/pwquality.conf to equal -1
to require use of a special character in passwords. |
Rationale | Use of a complex password helps to increase the time and resources required
to compromise the password. Password complexity, or strength, is a measure of
the effectiveness of a password in resisting attempts at guessing and brute-force
attacks.
Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possble combinations that need to be tested before the password is compromised. Requiring a minimum number of special characters makes password guessing attacks more difficult by ensuring a larger search space. |
check the configuration of /etc/pam.d/system-auth oval:ssg-test_password_pam_pwquality:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/pam.d/system-auth | password requisite pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type= |
check the configuration of /etc/security/pwquality.conf oval:ssg-test_password_pam_pwquality_ocredit:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/security/pwquality.conf | ocredit = -1 |
Ensure PAM Enforces Password Requirements - Minimum Uppercase Characters
Rule ID | xccdf_org.ssgproject.content_rule_accounts_password_pam_ucredit |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-accounts_password_pam_ucredit:def:1 |
Time | 2022-02-10T22:29:26+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-80665-3 References: BP28(R18), 1, 12, 15, 16, 5, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10, CCI-000192, 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, 0421, 0422, 0431, 0974, 1173, 1401, 1504, 1505, 1546, 1557, 1558, 1559, 1560, 1561, A.18.1.4, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, IA-5(c), IA-5(1)(a), CM-6(a), IA-5(4), PR.AC-1, PR.AC-6, PR.AC-7, FMT_MOF_EXT.1, Req-8.2.3, SRG-OS-000069-GPOS-00037, RHEL-08-020110, SV-230357r627750_rule, SRG-OS-000069-VMM-000360 |
Description | The pam_pwquality module's ucredit= parameter controls requirements for
usage of uppercase letters in a password. When set to a negative number, any password will be required to
contain that many uppercase characters. When set to a positive number, pam_pwquality will grant +1 additional
length credit for each uppercase character. Modify the ucredit setting in
/etc/security/pwquality.conf to require the use of an uppercase character in passwords. |
Rationale | Use of a complex password helps to increase the time and resources reuiqred to compromise the password.
Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts
at guessing and brute-force attacks.
Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised. |
check the configuration of /etc/pam.d/system-auth oval:ssg-test_password_pam_pwquality:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/pam.d/system-auth | password requisite pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type= |
check the configuration of /etc/security/pwquality.conf oval:ssg-test_password_pam_pwquality_ucredit:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/security/pwquality.conf | ucredit = -1 |
Install the tmux Package
Rule ID | xccdf_org.ssgproject.content_rule_package_tmux_installed |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-package_tmux_installed:def:1 |
Time | 2022-02-10T22:29:26+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-80644-8 References: 1, 12, 15, 16, DSS05.04, DSS05.10, DSS06.10, 3.1.10, CCI-000058, CCI-000056, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, SR 1.1, SR 1.10, SR 1.2, SR 1.5, SR 1.7, SR 1.8, SR 1.9, A.18.1.4, A.9.2.1, A.9.2.4, A.9.3.1, A.9.4.2, A.9.4.3, CM-6(a), PR.AC-7, FMT_MOF_EXT.1, SRG-OS-000030-GPOS-00011, SRG-OS-000028-GPOS-00009, RHEL-08-020039, SV-244537r743860_rule, SRG-OS-000030-VMM-000110 |
Description | To enable console screen locking, install the tmux package.
The tmux package can be installed with the following command:
$ sudo yum install tmuxInstruct users to begin new terminal sessions with the following command: $ tmuxThe console can now be locked with the following key combination: ctrl+b :lock-session |
Rationale | A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate
physical vicinity of the information system but does not logout because of the temporary nature of the absence.
Rather than relying on the user to manually lock their operation system session prior to vacating the vicinity,
operating systems need to be able to identify when a user's session has idled and take action to initiate the
session lock.
The tmux package allows for a session lock to be implemented and configured. |
package tmux is installed oval:ssg-test_package_tmux_installed:tst:1 true
Following items have been found on the system:
Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
---|---|---|---|---|---|---|---|
tmux | x86_64 | (none) | 1.el8 | 2.7 | 0:2.7-1.el8 | 199e2f91fd431d51 | tmux-0:2.7-1.el8.x86_64 |
Support session locking with tmux
Rule ID | xccdf_org.ssgproject.content_rule_configure_bashrc_exec_tmux |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-configure_bashrc_exec_tmux:def:1 |
Time | 2022-02-10T22:29:26+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-82266-8 References: CCI-000056, FMT_SMF_EXT.1, SRG-OS-000031-GPOS-00012, SRG-OS-000028-GPOS-00009, RHEL-08-020041, SV-230349r627750_rule |
Description | The tmux terminal multiplexer is used to implement
automatic session locking. It should be started from
/etc/bashrc . |
Rationale | Unlike bash itself, the tmux terminal multiplexer
provides a mechanism to lock sessions after period of inactivity. |
check tmux is configured to exec on the last line of /etc/bashrc oval:ssg-test_configure_bashrc_exec_tmux:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/bashrc | # /etc/bashrc # System wide functions and aliases # Environment stuff goes in /etc/profile # It's NOT a good idea to change this file unless you know what you # are doing. It's much better to create a custom.sh shell script in # /etc/profile.d/ to make custom changes to your environment, as this # will prevent the need for merging in future updates. # Prevent doublesourcing if [ -z "$BASHRCSOURCED" ]; then BASHRCSOURCED="Y" # are we an interactive shell? if [ "$PS1" ]; then if [ -z "$PROMPT_COMMAND" ]; then case $TERM in xterm*|vte*) if [ -e /etc/sysconfig/bash-prompt-xterm ]; then PROMPT_COMMAND=/etc/sysconfig/bash-prompt-xterm elif [ "${VTE_VERSION:-0}" -ge 3405 ]; then PROMPT_COMMAND="__vte_prompt_command" else PROMPT_COMMAND='printf "\033]0;%s@%s:%s\007" "${USER}" "${HOSTNAME%%.*}" "${PWD/#$HOME/\~}"' fi ;; screen*) if [ -e /etc/sysconfig/bash-prompt-screen ]; then PROMPT_COMMAND=/etc/sysconfig/bash-prompt-screen else PROMPT_COMMAND='printf "\033k%s@%s:%s\033\\" "${USER}" "${HOSTNAME%%.*}" "${PWD/#$HOME/\~}"' fi ;; *) [ -e /etc/sysconfig/bash-prompt-default ] && PROMPT_COMMAND=/etc/sysconfig/bash-prompt-default ;; esac fi # Turn on parallel history shopt -s histappend history -a # Turn on checkwinsize shopt -s checkwinsize [ "$PS1" = "\\s-\\v\\\$ " ] && PS1="[\u@\h \W]\\$ " # You might want to have e.g. tty in prompt (e.g. more virtual machines) # and console windows # If you want to do so, just add e.g. # if [ "$PS1" ]; then # PS1="[\u@\h:\l \W]\\$ " # fi # to your custom modification shell script in /etc/profile.d/ directory fi if ! shopt -q login_shell ; then # We're not a login shell # Need to redefine pathmunge, it gets undefined at the end of /etc/profile pathmunge () { case ":${PATH}:" in *:"$1":*) ;; *) if [ "$2" = "after" ] ; then PATH=$PATH:$1 else PATH=$1:$PATH fi esac } # By default, we want umask 027 # Current threshold for system reserved uid/gids is 200 # You could check uidgid reservation validity in # /usr/share/doc/setup-*/uidgid file if [ $UID -gt 199 ] && [ "`/usr/bin/id -gn`" = "`/usr/bin/id -un`" ]; then umask 027 else umask 027 fi SHELL=/bin/bash # Only display echos from profile.d scripts if we are no login shell # and interactive - otherwise just process them to set envvars for i in /etc/profile.d/*.sh; do if [ -r "$i" ]; then if [ "$PS1" ]; then . "$i" else . "$i" >/dev/null fi fi done unset i unset -f pathmunge fi fi # vim:ts=4:sw=4 if [ "$PS1" ]; then parent=$(ps -o ppid= -p $$) name=$(ps -o comm= -p $parent) case "$name" in sshd|login) exec tmux ;; esac fi |
Configure tmux to lock session after inactivity
Rule ID | xccdf_org.ssgproject.content_rule_configure_tmux_lock_after_time |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-configure_tmux_lock_after_time:def:1 |
Time | 2022-02-10T22:29:26+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-82199-1 References: CCI-000057, FMT_SMF_EXT.1, SRG-OS-000029-GPOS-00010, RHEL-08-020070, SV-230353r627750_rule |
Description | To enable console screen locking in tmux terminal multiplexer
after a period of inactivity,
the lock-after-time option has to be set to nonzero value in
/etc/tmux.conf . |
Rationale | Locking the session after a period of inactivity limits the
potential exposure if the session is left unattended. |
check lock-after-time is set to 900 in /etc/tmux.conf oval:ssg-test_configure_tmux_lock_after_time:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/tmux.conf | set -g lock-after-time 900 |
Configure the tmux Lock Command
Rule ID | xccdf_org.ssgproject.content_rule_configure_tmux_lock_command |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-configure_tmux_lock_command:def:1 |
Time | 2022-02-10T22:29:26+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-80940-0 References: CCI-000056, CCI-000058, AC-11(a), AC-11(b), CM-6(a), SRG-OS-000028-GPOS-00009, RHEL-08-020040, SV-230348r743987_rule, SRG-OS-000028-VMM-000090, SRG-OS-000030-VMM-000110 |
Description | To enable console screen locking in tmux terminal multiplexer,
the vlock command must be configured to be used as a locking
mechanism.
Add the following line to /etc/tmux.conf :
set -g lock-command vlock. The console can now be locked with the following key combination: ctrl+b :lock-session |
Rationale | The tmux package allows for a session lock to be implemented and configured.
However, the session lock is implemented by an external command. The tmux
default configuration does not contain an effective session lock. |
check lock-command is set to vlock in /etc/tmux.conf oval:ssg-test_configure_tmux_lock_command:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/tmux.conf | set -g lock-command vlock |
Prevent user from disabling the screen lock
Rule ID | xccdf_org.ssgproject.content_rule_no_tmux_in_shells |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-no_tmux_in_shells:def:1 |
Time | 2022-02-10T22:29:26+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-82361-7 References: CCI-000056, FMT_SMF_EXT.1, SRG-OS-000324-GPOS-00125, SRG-OS-000028-GPOS-00009, RHEL-08-020042, SV-230350r627750_rule |
Description | The tmux terminal multiplexer is used to implement
automatic session locking. It should not be listed in
/etc/shells . |
Rationale | Not listing tmux among permitted shells
prevents malicious program running as user
from lowering security by disabling the screen lock. |
check that tmux is not listed in /etc/shells oval:ssg-test_no_tmux_in_shells:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-obj_no_tmux_in_shells:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
/etc/shells | tmux$ | 1 |
Disable debug-shell SystemD Service
Rule ID | xccdf_org.ssgproject.content_rule_service_debug-shell_disabled |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-service_debug-shell_disabled:def:1 |
Time | 2022-02-10T22:29:26+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-80876-6 References: 3.4.5, CCI-000366, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), FIA_UAU.1, SRG-OS-000324-GPOS-00125, SRG-OS-000480-GPOS-00227, RHEL-08-040180, SV-230532r627750_rule |
Description | SystemD's debug-shell service is intended to
diagnose SystemD related boot issues with various systemctl
commands. Once enabled and following a system reboot, the root shell
will be available on tty9 which is access by pressing
CTRL-ALT-F9 . The debug-shell service should only be used
for SystemD related issues and should otherwise be disabled.
By default, the debug-shell SystemD service is already disabled.
The debug-shell service can be disabled with the following command:
$ sudo systemctl mask --now debug-shell.service |
Rationale | This prevents attackers with physical access from trivially bypassing security
on the machine through valid troubleshooting configurations and gaining root
access when the system is rebooted. |
package systemd is removed oval:ssg-test_service_debug-shell_package_systemd_removed:tst:1 false
Following items have been found on the system:
Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
---|---|---|---|---|---|---|---|
systemd | x86_64 | (none) | 51.el8 | 239 | 0:239-51.el8 | 199e2f91fd431d51 | systemd-0:239-51.el8.x86_64 |
Test that the debug-shell service is not running oval:ssg-test_service_not_running_debug-shell:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-obj_service_not_running_debug-shell:obj:1 of type systemdunitproperty_object
Unit | Property |
---|---|
^debug-shell\.(service|socket)$ | ActiveState |
Test that the property LoadState from the service debug-shell is masked oval:ssg-test_service_loadstate_is_masked_debug-shell:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-obj_service_loadstate_is_masked_debug-shell:obj:1 of type systemdunitproperty_object
Unit | Property |
---|---|
^debug-shell\.(service|socket)$ | LoadState |
Test that the property FragmentPath from the service debug-shell is set to /dev/null oval:ssg-test_service_fragmentpath_is_dev_null_debug-shell:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-obj_service_fragmentpath_is_dev_null_debug-shell:obj:1 of type systemdunitproperty_object
Unit | Property |
---|---|
^debug-shell\.(service|socket)$ | FragmentPath |
Disable Ctrl-Alt-Del Burst Action
Rule ID | xccdf_org.ssgproject.content_rule_disable_ctrlaltdel_burstaction |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-disable_ctrlaltdel_burstaction:def:1 |
Time | 2022-02-10T22:29:26+00:00 |
Severity | high |
Identifiers and References | Identifiers: CCE-80784-2 References: 12, 13, 14, 15, 16, 18, 3, 5, APO01.06, DSS05.04, DSS05.07, DSS06.02, 3.4.5, CCI-000366, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), 4.3.3.7.3, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CIP-003-3 R5.1.1, CIP-003-3 R5.3, CIP-004-3 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2, CM-6(a), AC-6(1), CM-6(a), PR.AC-4, PR.DS-5, SRG-OS-000324-GPOS-00125, SRG-OS-000480-GPOS-00227, RHEL-08-040172, SV-230531r627750_rule |
Description | By default, SystemD will reboot the system if the Ctrl-Alt-Del
key sequence is pressed Ctrl-Alt-Delete more than 7 times in 2 seconds.
To configure the system to ignore the CtrlAltDelBurstAction
setting, add or modify the following to /etc/systemd/system.conf :
CtrlAltDelBurstAction=none |
Rationale | A locally logged-in user who presses Ctrl-Alt-Del, when at the console,
can reboot the system. If accidentally pressed, as could happen in
the case of mixed OS environment, this can create the risk of short-term
loss of availability of systems due to unintentional reboot. |
Warnings | warning
Disabling the Ctrl-Alt-Del key sequence
in /etc/init/control-alt-delete.conf DOES NOT disable the Ctrl-Alt-Del
key sequence if running in runlevel 6 (e.g. in GNOME, KDE, etc.)! The
Ctrl-Alt-Del key sequence will only be disabled if running in
the non-graphical runlevel 3 . |
check if CtrlAltDelBurstAction is set to none oval:ssg-test_disable_ctrlaltdel_burstaction:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/systemd/system.conf | CtrlAltDelBurstAction=none |
Disable Ctrl-Alt-Del Reboot Activation
Rule ID | xccdf_org.ssgproject.content_rule_disable_ctrlaltdel_reboot |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-disable_ctrlaltdel_reboot:def:1 |
Time | 2022-02-10T22:29:26+00:00 |
Severity | high |
Identifiers and References | Identifiers: CCE-80785-9 References: 12, 13, 14, 15, 16, 18, 3, 5, APO01.06, DSS05.04, DSS05.07, DSS06.02, 3.4.5, CCI-000366, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), 4.3.3.7.3, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CIP-003-3 R5.1.1, CIP-003-3 R5.3, CIP-004-3 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2, CM-6(a), AC-6(1), PR.AC-4, PR.DS-5, SRG-OS-000324-GPOS-00125, SRG-OS-000480-GPOS-00227, RHEL-08-040170, SV-230529r627750_rule |
Description | By default, SystemD will reboot the system if the Ctrl-Alt-Del
key sequence is pressed.
To configure the system to ignore the Ctrl-Alt-Del key sequence from the
command line instead of rebooting the system, do either of the following:
ln -sf /dev/null /etc/systemd/system/ctrl-alt-del.targetor systemctl mask ctrl-alt-del.target Do not simply delete the /usr/lib/systemd/system/ctrl-alt-del.service file,
as this file may be restored during future system updates. |
Rationale | A locally logged-in user who presses Ctrl-Alt-Del, when at the console,
can reboot the system. If accidentally pressed, as could happen in
the case of mixed OS environment, this can create the risk of short-term
loss of availability of systems due to unintentional reboot. |
Disable Ctrl-Alt-Del key sequence override exists oval:ssg-test_disable_ctrlaltdel_exists:tst:1 true
Following items have been found on the system:
Filepath | Canonical path |
---|---|
/etc/systemd/system/ctrl-alt-del.target | /dev/null |
Verify that Interactive Boot is Disabled
Rule ID | xccdf_org.ssgproject.content_rule_grub2_disable_interactive_boot |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-grub2_disable_interactive_boot:def:1 |
Time | 2022-02-10T22:29:26+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-80826-1 References: 11, 12, 14, 15, 16, 18, 3, 5, DSS05.02, DSS05.04, DSS05.05, DSS05.07, DSS06.03, DSS06.06, 3.1.2, 3.4.5, CCI-000213, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, A.6.1.2, A.7.1.1, A.9.1.2, A.9.2.1, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, SC-2(1), CM-6(a), PR.AC-4, PR.AC-6, PR.PT-3, FIA_UAU.1, SRG-OS-000480-GPOS-00227 |
Description | Red Hat Enterprise Linux 8 systems support an "interactive boot" option that can
be used to prevent services from being started. On a Red Hat Enterprise Linux 8
system, interactive boot can be enabled by providing a 1 ,
yes , true , or on value to the
systemd.confirm_spawn kernel argument in /etc/default/grub .
Remove any instance of systemd.confirm_spawn=(1|yes|true|on)from the kernel arguments in that file to disable interactive boot. It is also required to change the runtime configuration, run: /sbin/grubby --update-kernel=ALL --remove-args="systemd.confirm_spawn" |
Rationale | Using interactive boot, the console user could disable auditing, firewalls,
or other services, weakening system security. |
Check systemd.confirm_spawn=(1|true|yes|on) not in GRUB_CMDLINE_LINUX oval:ssg-test_grub2_disable_interactive_boot_grub_cmdline_linux:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_grub2_disable_interactive_boot_grub_cmdline_linux:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
/etc/default/grub | ^\s*GRUB_CMDLINE_LINUX=".*systemd.confirm_spawn=(?:1|yes|true|on).*$ | 1 |
Check systemd.confirm_spawn=(1|true|yes|on) not in GRUB_CMDLINE_LINUX_DEFAULT oval:ssg-test_grub2_disable_interactive_boot_grub_cmdline_linux_default:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_grub2_disable_interactive_boot_grub_cmdline_linux_default:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
/etc/default/grub | ^\s*GRUB_CMDLINE_LINUX_DEFAULT=".*systemd.confirm_spawn=(?:1|yes|true|on).*$ | 1 |
Check for GRUB_DISABLE_RECOVERY=true in /etc/default/grub oval:ssg-test_bootloader_disable_recovery_set_to_true:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/default/grub | GRUB_DISABLE_RECOVERY="true" |
Require Authentication for Single User Mode
Rule ID | xccdf_org.ssgproject.content_rule_require_singleuser_auth |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-require_singleuser_auth:def:1 |
Time | 2022-02-10T22:29:26+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-80855-0 References: 1.5.3, 1, 11, 12, 14, 15, 16, 18, 3, 5, DSS05.02, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.06, DSS06.10, 3.1.1, 3.4.5, CCI-000213, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, 0421, 0422, 0431, 0974, 1173, 1401, 1504, 1505, 1546, 1557, 1558, 1559, 1560, 1561, A.18.1.4, A.6.1.2, A.7.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5, CIP-003-3 R5.1.1, CIP-003-3 R5.3, CIP-004-3 R2.2.3, CIP-004-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.2, CIP-007-3 R5.2, CIP-007-3 R5.3.1, CIP-007-3 R5.3.2, CIP-007-3 R5.3.3, IA-2, AC-3, CM-6(a), PR.AC-1, PR.AC-4, PR.AC-6, PR.AC-7, PR.PT-3, FIA_UAU.1, SRG-OS-000080-GPOS-00048, RHEL-08-010151, SV-230236r743928_rule |
Description | Single-user mode is intended as a system recovery
method, providing a single user root access to the system by
providing a boot option at startup. By default, no authentication
is performed if single-user mode is selected.
By default, single-user mode is protected by requiring a password and is set in /usr/lib/systemd/system/rescue.service . |
Rationale | This prevents attackers with physical access from trivially bypassing security
on the machine and gaining root access. Such accesses are further prevented
by configuring the bootloader password. |
Tests that /usr/lib/systemd/systemd-sulogin-shell was not removed from the default systemd rescue.service to ensure that a password must be entered to access single user mode oval:ssg-test_require_rescue_service:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/usr/lib/systemd/system/rescue.service | ExecStart=-/usr/lib/systemd/systemd-sulogin-shell rescue |
Tests that the systemd rescue.service is in the runlevel1.target oval:ssg-test_require_rescue_service_runlevel1:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/usr/lib/systemd/system/runlevel1.target | Requires=sysinit.target rescue.service |
look for runlevel1.target in /etc/systemd/system oval:ssg-test_no_custom_runlevel1_target:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_no_custom_runlevel1_target:obj:1 of type file_object
Behaviors | Path | Filename |
---|---|---|
no value | /etc/systemd/system | ^runlevel1.target$ |
look for rescue.service in /etc/systemd/system oval:ssg-test_no_custom_rescue_service:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_no_custom_rescue_service:obj:1 of type file_object
Behaviors | Path | Filename |
---|---|---|
no value | /etc/systemd/system | ^rescue.service$ |
Set Password Minimum Length in login.defs
Rule ID | xccdf_org.ssgproject.content_rule_accounts_password_minlen_login_defs |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-accounts_password_minlen_login_defs:def:1 |
Time | 2022-02-10T22:29:26+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-80652-1 References: BP28(R18), 1, 12, 15, 16, 5, 5.6.2.1, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10, 3.5.7, CCI-000205, 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, 0421, 0422, 0431, 0974, 1173, 1401, 1504, 1505, 1546, 1557, 1558, 1559, 1560, 1561, A.18.1.4, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, IA-5(f), IA-5(1)(a), CM-6(a), PR.AC-1, PR.AC-6, PR.AC-7, FMT_MOF_EXT.1, SRG-OS-000078-GPOS-00046, RHEL-08-020231, SV-230370r627750_rule |
Description | To specify password length requirements for new accounts, edit the file
/etc/login.defs and add or correct the following line:
PASS_MIN_LEN 12 The DoD requirement is 15 .
The FISMA requirement is 12 .
The profile requirement is
12 .
If a program consults /etc/login.defs and also another PAM module
(such as pam_pwquality ) during a password change operation, then
the most restrictive must be satisfied. See PAM section for more
information about enforcing password quality requirements. |
Rationale | Requiring a minimum password length makes password
cracking attacks more difficult by ensuring a larger
search space. However, any security benefit from an onerous requirement
must be carefully weighed against usability problems, support costs, or counterproductive
behavior that may result. |
The value of PASS_MIN_LEN should be set appropriately in /etc/login.defs oval:ssg-test_pass_min_len:tst:1 true
Following items have been found on the system:
Var ref | Value |
---|---|
oval:ssg-variable_last_pass_min_len_instance_value:var:1 | 12 |
Prevent Login to Accounts With Empty Password
Rule ID | xccdf_org.ssgproject.content_rule_no_empty_passwords |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-no_empty_passwords:def:1 |
Time | 2022-02-10T22:29:26+00:00 |
Severity | high |
Identifiers and References | Identifiers: CCE-80841-0 References: 1, 12, 13, 14, 15, 16, 18, 3, 5, 5.5.2, APO01.06, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.02, DSS06.03, DSS06.10, 3.1.1, 3.1.5, CCI-000366, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.18.1.4, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5, IA-5(1)(a), IA-5(c), CM-6(a), PR.AC-1, PR.AC-4, PR.AC-6, PR.AC-7, PR.DS-5, FIA_UAU.1, Req-8.2.3, SRG-OS-000480-GPOS-00227, RHEL-08-020331, SV-244540r743869_rule |
Description | If an account is configured for password authentication
but does not have an assigned password, it may be possible to log
into the account without authentication. Remove any instances of the
nullok in
/etc/pam.d/system-auth
to prevent logins with empty passwords.
Note that this rule is not applicable for systems running within a
container. Having user with empty password within a container is not
considered a risk, because it should not be possible to directly login into
a container anyway. |
Rationale | If an account has an empty password, anyone could log in and
run commands with the privileges of that account. Accounts with
empty passwords should never be used in operational environments. |
make sure nullok is not used in /etc/pam.d/system-auth oval:ssg-test_no_empty_passwords:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_no_empty_passwords:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
/etc/pam.d/system-auth | ^[^#]*\bnullok\b.*$ | 1 |
Restrict Virtual Console Root Logins
Rule ID | xccdf_org.ssgproject.content_rule_securetty_root_login_console_only |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-securetty_root_login_console_only:def:1 |
Time | 2022-02-10T22:29:26+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-80864-2 References: 5.6, 12, 13, 14, 15, 16, 18, 3, 5, APO01.06, DSS05.04, DSS05.07, DSS06.02, 3.1.1, 3.1.5, CCI-000770, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), 4.3.3.7.3, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CIP-003-3 R5.1.1, CIP-003-3 R5.3, CIP-004-3 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2, AC-6, CM-6(a), PR.AC-4, PR.DS-5, SRG-OS-000324-GPOS-00125 |
Description | To restrict root logins through the (deprecated) virtual console devices,
ensure lines of this form do not appear in /etc/securetty :
vc/1 vc/2 vc/3 vc/4 |
Rationale | Preventing direct root login to virtual console devices
helps ensure accountability for actions taken on the system
using the root account. |
virtual consoles /etc/securetty oval:ssg-test_virtual_consoles_etc_securetty:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_virtual_consoles_etc_securetty:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
/etc/securetty | ^vc/[0-9]+$ | 1 |
Enforce usage of pam_wheel for su authentication
Rule ID | xccdf_org.ssgproject.content_rule_use_pam_wheel_for_su |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-use_pam_wheel_for_su:def:1 |
Time | 2022-02-10T22:29:26+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-83318-6 References: 5.7, FMT_SMF_EXT.1.1, SRG-OS-000373-GPOS-00156, SRG-OS-000312-GPOS-00123 |
Description | To ensure that only users who are members of the wheel group can
run commands with altered privileges through the su command, make
sure that the following line exists in the file /etc/pam.d/su :
auth required pam_wheel.so use_uid |
Rationale | The su program allows to run commands with a substitute user and
group ID. It is commonly used to run commands as the root user. Limiting
access to such command is considered a good security practice. |
check /etc/pam.d/su for correct setting oval:ssg-test_use_pam_wheel_for_su:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/pam.d/su | auth required pam_wheel.so use_uid |
Ensure the Default Bash Umask is Set Correctly
Rule ID | xccdf_org.ssgproject.content_rule_accounts_umask_etc_bashrc |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-accounts_umask_etc_bashrc:def:1 |
Time | 2022-02-10T22:29:26+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-81036-6 References: BP28(R35), 5.5.4, 18, APO13.01, BAI03.01, BAI03.02, BAI03.03, CCI-000366, 4.3.4.3.3, A.14.1.1, A.14.2.1, A.14.2.5, A.6.1.5, CIP-003-3 R5.1.1, CIP-003-3 R5.3, CIP-004-3 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2, AC-6(1), CM-6(a), PR.IP-2, SRG-OS-000480-GPOS-00228, SRG-OS-000480-GPOS-00227, RHEL-08-020353, SV-230385r627750_rule |
Description | To ensure the default umask for users of the Bash shell is set properly,
add or correct the umask setting in /etc/bashrc to read
as follows:
umask 027 |
Rationale | The umask value influences the permissions assigned to files when they are created.
A misconfigured umask value could result in files with excessive permissions that can be read or
written to by unauthorized users. |
Verify the existence of var_accounts_user_umask_as_number variable oval:ssg-test_existence_of_var_accounts_user_umask_as_number_variable:tst:1 true
Following items have been found on the system:
Var ref | Value |
---|---|
oval:ssg-var_accounts_user_umask_umask_as_number:var:1 | 23 |
Test the retrieved /etc/bashrc umask value(s) match the var_accounts_user_umask requirement oval:ssg-tst_accounts_umask_etc_bashrc:tst:1 true
Following items have been found on the system:
Var ref | Value | Value | Value | Value | Value | Value | Value | Value |
---|---|---|---|---|---|---|---|---|
oval:ssg-var_etc_bashrc_umask_as_number:var:1 | 23 | 23 | 23 | 23 | 23 | 23 | 23 | 23 |
Ensure the Default C Shell Umask is Set Correctly
Rule ID | xccdf_org.ssgproject.content_rule_accounts_umask_etc_csh_cshrc |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-accounts_umask_etc_csh_cshrc:def:1 |
Time | 2022-02-10T22:29:26+00:00 |
Severity | unknown |
Identifiers and References | Identifiers: CCE-81037-4 References: 18, APO13.01, BAI03.01, BAI03.02, BAI03.03, CCI-000366, 4.3.4.3.3, A.14.1.1, A.14.2.1, A.14.2.5, A.6.1.5, CIP-003-3 R5.1.1, CIP-003-3 R5.3, CIP-004-3 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2, AC-6(1), CM-6(a), PR.IP-2, SRG-OS-000480-GPOS-00228 |
Description | To ensure the default umask for users of the C shell is set properly,
add or correct the umask setting in /etc/csh.cshrc to read as follows:
umask 027 |
Rationale | The umask value influences the permissions assigned to files when they are created.
A misconfigured umask value could result in files with excessive permissions that can be read or
written to by unauthorized users. |
Verify the existence of var_accounts_user_umask_as_number variable oval:ssg-test_existence_of_var_accounts_user_umask_as_number_variable:tst:1 true
Following items have been found on the system:
Var ref | Value |
---|---|
oval:ssg-var_accounts_user_umask_umask_as_number:var:1 | 23 |
Test the retrieved /etc/csh.cshrc umask value(s) match the var_accounts_user_umask requirement oval:ssg-tst_accounts_umask_etc_csh_cshrc:tst:1 true
Following items have been found on the system:
Var ref | Value | Value | Value | Value | Value | Value | Value | Value |
---|---|---|---|---|---|---|---|---|
oval:ssg-var_etc_csh_cshrc_umask_as_number:var:1 | 23 | 23 | 23 | 23 | 23 | 23 | 23 | 23 |
Ensure the Default Umask is Set Correctly in /etc/profile
Rule ID | xccdf_org.ssgproject.content_rule_accounts_umask_etc_profile |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-accounts_umask_etc_profile:def:1 |
Time | 2022-02-10T22:29:26+00:00 |
Severity | unknown |
Identifiers and References | Identifiers: CCE-81035-8 References: BP28(R35), 5.5.4, 18, APO13.01, BAI03.01, BAI03.02, BAI03.03, CCI-000366, 4.3.4.3.3, A.14.1.1, A.14.2.1, A.14.2.5, A.6.1.5, CIP-003-3 R5.1.1, CIP-003-3 R5.3, CIP-004-3 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2, AC-6(1), CM-6(a), PR.IP-2, SRG-OS-000480-GPOS-00228 |
Description | To ensure the default umask controlled by /etc/profile is set properly,
add or correct the umask setting in /etc/profile to read as follows:
umask 027 |
Rationale | The umask value influences the permissions assigned to files when they are created.
A misconfigured umask value could result in files with excessive permissions that can be read or
written to by unauthorized users. |
Verify the existence of var_accounts_user_umask_as_number variable oval:ssg-test_existence_of_var_accounts_user_umask_as_number_variable:tst:1 true
Following items have been found on the system:
Var ref | Value |
---|---|
oval:ssg-var_accounts_user_umask_umask_as_number:var:1 | 23 |
Test the retrieved /etc/profile umask value(s) match the var_accounts_user_umask requirement oval:ssg-tst_accounts_umask_etc_profile:tst:1 true
Following items have been found on the system:
Var ref | Value | Value | Value | Value | Value | Value | Value | Value |
---|---|---|---|---|---|---|---|---|
oval:ssg-var_etc_profile_umask_as_number:var:1 | 23 | 23 | 23 | 23 | 23 | 23 | 23 | 23 |
Limit the Number of Concurrent Login Sessions Allowed Per User
Rule ID | xccdf_org.ssgproject.content_rule_accounts_max_concurrent_login_sessions |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-accounts_max_concurrent_login_sessions:def:1 |
Time | 2022-02-10T22:29:26+00:00 |
Severity | low |
Identifiers and References | Identifiers: CCE-80955-8 References: 14, 15, 18, 9, 5.5.2.2, DSS01.05, DSS05.02, CCI-000054, 4.3.3.4, SR 3.1, SR 3.8, A.13.1.1, A.13.1.3, A.13.2.1, A.14.1.2, A.14.1.3, CIP-007-3 R5.1, CIP-007-3 R5.1.2, AC-10, CM-6(a), PR.AC-5, SRG-OS-000027-GPOS-00008, RHEL-08-020024, SV-230346r627750_rule, SRG-OS-000027-VMM-000080 |
Description | Limiting the number of allowed users and sessions per user can limit risks related to Denial of
Service attacks. This addresses concurrent sessions for a single account and does not address
concurrent sessions by a single user via multiple accounts. To set the number of concurrent
sessions per user add the following line in /etc/security/limits.conf or
a file under /etc/security/limits.d/ :
* hard maxlogins 10 |
Rationale | Limiting simultaneous user logins can insulate the system from denial of service
problems caused by excessive logins. Automated login processes operating improperly or
maliciously may result in an exceptional number of simultaneous login sessions. |
the value maxlogins should be set appropriately in /etc/security/limits.d/*.conf oval:ssg-test_limitsd_maxlogins:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_etc_security_limitsd_conf_maxlogins:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/etc/security/limits.d | ^.*\.conf$ | ^[\s]*\*[\s]+(?:(?:hard)|(?:-))[\s]+maxlogins[\s]+(\d+)\s*$ | 1 |
the value maxlogins should be set appropriately in /etc/security/limits.d/*.conf oval:ssg-test_limitsd_maxlogins_exists:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_etc_security_limitsd_conf_maxlogins_exists:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/etc/security/limits.d | ^.*\.conf$ | ^[\s]*\*[\s]+(?:(?:hard)|(?:-))[\s]+maxlogins | 1 |
the value maxlogins should be set appropriately in /etc/security/limits.conf oval:ssg-test_maxlogins:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/security/limits.conf | * hard maxlogins 10 |
Configure auditd flush priority
Rule ID | xccdf_org.ssgproject.content_rule_auditd_data_retention_flush |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-auditd_data_retention_flush:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-80680-2 References: 1, 12, 13, 14, 15, 16, 2, 3, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, BAI03.05, DSS01.03, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.3.1, CCI-001576, 164.308(a)(1)(ii)(D), 164.308(a)(3)(ii)(A), 164.308(a)(5)(ii)(C), 164.312(a)(2)(i), 164.312(b), 164.312(d), 164.312(e), 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 6.2, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.14.2.7, A.15.2.1, A.15.2.2, CIP-004-3 R2.2.3, CIP-004-3 R3.3, CIP-007-3 R5.2, CIP-007-3 R5.3.1, CIP-007-3 R5.3.2, CIP-007-3 R5.3.3, CIP-007-3 R6.5, AU-11, CM-6(a), DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.PT-1, SRG-OS-000480-GPOS-00227 |
Description | The auditd service can be configured to
synchronously write audit event data to disk. Add or correct the following
line in /etc/audit/auditd.conf to ensure that audit event data is
fully synchronized with the log files on the disk:
flush = incremental_async |
Rationale | Audit data should be synchronously written to disk to ensure
log integrity. These parameters assure that all audit event data is fully
synchronized with the log files on the disk. |
test the value of flush parameter in /etc/audit/auditd.conf oval:ssg-test_auditd_data_retention_flush:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/audit/auditd.conf | flush = INCREMENTAL_ASYNC |
Set number of records to cause an explicit flush to audit logs
Rule ID | xccdf_org.ssgproject.content_rule_auditd_freq |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-auditd_freq:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-82258-5 References: FAU_GEN.1, SRG-OS-000051-GPOS-00024 |
Description | To configure Audit daemon to issue an explicit flush to disk command
after writing 50 records, set freq to 50
in /etc/audit/auditd.conf . |
Rationale | If option freq isn't set to 50 , the flush to disk
may happen after higher number of records, increasing the danger
of audit loss. |
tests the value of freq setting in the /etc/audit/auditd.conf file oval:ssg-test_auditd_freq:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/audit/auditd.conf | freq = 50 |
Include Local Events in Audit Logs
Rule ID | xccdf_org.ssgproject.content_rule_auditd_local_events |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-auditd_local_events:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-82233-8 References: CCI-000366, FAU_GEN.1.1.c, SRG-OS-000062-GPOS-00031, SRG-OS-000480-GPOS-00227, RHEL-08-030061, SV-230393r627750_rule |
Description | To configure Audit daemon to include local events in Audit logs, set
local_events to yes in /etc/audit/auditd.conf .
This is the default setting. |
Rationale | If option local_events isn't set to yes only events from
network will be aggregated. |
tests the value of local_events setting in the /etc/audit/auditd.conf file oval:ssg-test_auditd_local_events:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/audit/auditd.conf | local_events = yes |
tests the absence of local_events setting in the /etc/audit/auditd.conf file oval:ssg-test_auditd_local_events_default_not_overriden:tst:1 false
Following items have been found on the system:
Path | Content |
---|---|
/etc/audit/auditd.conf | local_events = |
Resolve information before writing to audit logs
Rule ID | xccdf_org.ssgproject.content_rule_auditd_log_format |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-auditd_log_format:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-82201-5 References: CCI-000366, FAU_GEN.1, SRG-OS-000255-GPOS-00096, SRG-OS-000480-GPOS-00227, RHEL-08-030063, SV-230395r627750_rule |
Description | To configure Audit daemon to resolve all uid, gid, syscall,
architecture, and socket address information before writing the
events to disk, set log_format to ENRICHED
in /etc/audit/auditd.conf . |
Rationale | If option log_format isn't set to ENRICHED , the
audit records will be stored in a format exactly as the kernel sends them. |
tests the value of log_format setting in the /etc/audit/auditd.conf file oval:ssg-test_auditd_log_format:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/audit/auditd.conf | log_format = ENRICHED |
Set hostname as computer node name in audit logs
Rule ID | xccdf_org.ssgproject.content_rule_auditd_name_format |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-auditd_name_format:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-82897-0 References: CCI-001851, FAU_GEN.1, SRG-OS-000039-GPOS-00017, SRG-OS-000342-GPOS-00133, SRG-OS-000479-GPOS-00224, RHEL-08-030062, SV-230394r627750_rule |
Description | To configure Audit daemon to use value returned by gethostname
syscall as computer node name in the audit events,
set name_format to hostname
in /etc/audit/auditd.conf . |
Rationale | If option name_format is left at its default value of
none , audit events from different computers may be hard
to distinguish. |
tests the value of name_format setting in the /etc/audit/auditd.conf file oval:ssg-test_auditd_name_format:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/audit/auditd.conf | name_format = hostname |
Write Audit Logs to the Disk
Rule ID | xccdf_org.ssgproject.content_rule_auditd_write_logs |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-auditd_write_logs:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-82366-6 References: FAU_GEN.1.1.c, SRG-OS-000480-GPOS-00227 |
Description | To configure Audit daemon to write Audit logs to the disk, set
write_logs to yes in /etc/audit/auditd.conf .
This is the default setting. |
Rationale | If write_logs isn't set to yes , the Audit logs will
not be written to the disk. |
tests the value of write_logs setting in the /etc/audit/auditd.conf file oval:ssg-test_auditd_write_logs:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/audit/auditd.conf | write_logs = yes |
tests the absence of write_logs setting in the /etc/audit/auditd.conf file oval:ssg-test_auditd_write_logs_default_not_overriden:tst:1 false
Following items have been found on the system:
Path | Content |
---|---|
/etc/audit/auditd.conf | write_logs = |
Configure auditing of unsuccessful file accesses
Rule ID | xccdf_org.ssgproject.content_rule_audit_access_failed |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-audit_access_failed:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-82833-5 References: 0582, 0584, 05885, 0586, 0846, 0957, AU-2(a), FAU_GEN.1.1.c, SRG-OS-000458-GPOS-00203, SRG-OS-000474-GPOS-00219, SRG-OS-000475-GPOS-00220, SRG-OS-000463-GPOS-00207, SRG-OS-000465-GPOS-00209, SRG-OS-000461-GPOS-00205 |
Description | Ensure that unsuccessful attempts to access a file are audited.
The following rules configure audit as described above:
## Unsuccessful file access (any other opens) This has to go last. -a always,exit -F arch=b32 -S open,openat,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-access -a always,exit -F arch=b64 -S open,openat,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-access -a always,exit -F arch=b32 -S open,openat,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-access -a always,exit -F arch=b64 -S open,openat,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-accessLoad new Audit rules into kernel by running: augenrules --loadNote: This rule utilizes a file provided by Audit package to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are alligned with your needs. |
Rationale | Unsuccessful attempts to access a file might be signs of malicious activity happening within the system. Auditing of such activities helps in their monitoring and investigation. |
Tests if contents of /etc/audit/rules.d/30-ospp-v42-3-access-failed.rules is exactly what is defined in rule description oval:ssg-test_whole_file_contents_tc_audit_rules_d_30_ospp_v42_3_access_failed_rules:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/audit/rules.d/30-ospp-v42-3-access-failed.rules | ## Unsuccessful file access (any other opens) This has to go last. -a always,exit -F arch=b32 -S open,openat,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-access -a always,exit -F arch=b64 -S open,openat,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-access -a always,exit -F arch=b32 -S open,openat,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-access -a always,exit -F arch=b64 -S open,openat,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-access |
Configure auditing of successful file accesses
Rule ID | xccdf_org.ssgproject.content_rule_audit_access_success |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-audit_access_success:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-82834-3 References: 0582, 0584, 05885, 0586, 0846, 0957, AU-2(a), FAU_GEN.1.1.c, SRG-OS-000458-GPOS-00203, SRG-OS-000474-GPOS-00219, SRG-OS-000475-GPOS-00220, SRG-OS-000463-GPOS-00207, SRG-OS-000465-GPOS-00209, SRG-OS-000461-GPOS-00205 |
Description | Ensure that successful attempts to access a file are audited.
The following rules configure audit as described above:
## Successful file access (any other opens) This has to go last. ## These next two are likely to result in a whole lot of events -a always,exit -F arch=b32 -S open,openat,open_by_handle_at -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-access -a always,exit -F arch=b64 -S open,openat,open_by_handle_at -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-accessThe Audit package provides pre-configured rules in /usr/share/audit/sample-rules . The above content can be found in /usr/share/audit/sample-rules/30-ospp-v42-3-access-success.rules .
To deploy this configuration, it is recommended to copy it over to the /etc/audit/rules.d/ directory:
cp /usr/share/audit/sample-rules/30-ospp-v42-3-access-success.rules /etc/audit/rules.d/Load new Audit rules into kernel by running: augenrules --loadNote: This rule utilizes a file provided by Audit package to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are alligned with your needs. |
Rationale | Auditing of successful attempts to access a file helps in investigation of activities performed on the system. |
Tests if contents of /etc/audit/rules.d/30-ospp-v42-3-access-success.rules is exactly what is defined in rule description oval:ssg-test_whole_file_contents_tc_audit_rules_d_30_ospp_v42_3_access_success_rules:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/audit/rules.d/30-ospp-v42-3-access-success.rules | ## Successful file access (any other opens) This has to go last. ## These next two are likely to result in a whole lot of events -a always,exit -F arch=b32 -S open,openat,open_by_handle_at -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-access -a always,exit -F arch=b64 -S open,openat,open_by_handle_at -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-access |
Configure basic parameters of Audit system
Rule ID | xccdf_org.ssgproject.content_rule_audit_basic_configuration |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-audit_basic_configuration:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-82827-7 References: AU-2(a), FAU_GEN.1.1.c, SRG-OS-000365-GPOS-00152, SRG-OS-000475-GPOS-00220 |
Description | Perform basic configuration of Audit system.
Make sure that any previously defined rules are cleared, the auditing system is configured to handle sudden bursts of events, and in cases of failure, messages are configured to be directed to system log.
The following rules configure audit as described above:
## First rule - delete all -D ## Increase the buffers to survive stress events. ## Make this bigger for busy systems -b 8192 ## This determine how long to wait in burst of events --backlog_wait_time 60000 ## Set failure mode to syslog -f 1The Audit package provides pre-configured rules in /usr/share/audit/sample-rules . The above content can be found in /usr/share/audit/sample-rules/10-base-config.rules .
To deploy this configuration, it is recommended to copy it over to the /etc/audit/rules.d/ directory:
cp /usr/share/audit/sample-rules/10-base-config.rules /etc/audit/rules.d/Load new Audit rules into kernel by running: augenrules --load |
Rationale | Without basic configurations, audit may not perform as expected. It may not be able to correctly handle events under stressful conditions, or log events in case of failure. |
Tests if contents of /etc/audit/rules.d/10-base-config.rules is exactly what is defined in rule description oval:ssg-test_whole_file_contents_tc_audit_rules_d_10_base_config_rules:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/audit/rules.d/10-base-config.rules | ## First rule - delete all -D ## Increase the buffers to survive stress events. ## Make this bigger for busy systems -b 8192 ## This determine how long to wait in burst of events --backlog_wait_time 60000 ## Set failure mode to syslog -f 1 |
Configure auditing of unsuccessful file creations
Rule ID | xccdf_org.ssgproject.content_rule_audit_create_failed |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-audit_create_failed:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-82374-0 References: AU-2(a), FAU_GEN.1.1.c, SRG-OS-000458-GPOS-00203, SRG-OS-000474-GPOS-00219, SRG-OS-000475-GPOS-00220, SRG-OS-000463-GPOS-00207, SRG-OS-000465-GPOS-00209, SRG-OS-000461-GPOS-00205 |
Description | Ensure that unsuccessful attempts to create a file are audited.
The following rules configure audit as described above:
## Unsuccessful file creation (open with O_CREAT) -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-create -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-create -a always,exit -F arch=b32 -S open -F a1&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-create -a always,exit -F arch=b64 -S open -F a1&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-create -a always,exit -F arch=b32 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-create -a always,exit -F arch=b64 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-create -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-create -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-create -a always,exit -F arch=b32 -S open -F a1&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-create -a always,exit -F arch=b64 -S open -F a1&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-create -a always,exit -F arch=b32 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-create -a always,exit -F arch=b64 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-createThe Audit package provides pre-configured rules in /usr/share/audit/sample-rules . The above content can be found in /usr/share/audit/sample-rules/30-ospp-v42-1-create-failed.rules .
To deploy this configuration, it is recommended to copy it over to the /etc/audit/rules.d/ directory:
cp /usr/share/audit/sample-rules/30-ospp-v42-1-create-failed.rules /etc/audit/rules.d/Load new Audit rules into kernel by running: augenrules --loadNote: This rule utilizes a file provided by Audit package to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are alligned with your needs. |
Rationale | Unsuccessful file creations might be a sign of a malicious action being performed on the system. Keeping log of such events helps in monitoring and investigation of such actions. |
Tests if contents of /etc/audit/rules.d/30-ospp-v42-1-create-failed.rules is exactly what is defined in rule description oval:ssg-test_whole_file_contents_tc_audit_rules_d_30_ospp_v42_1_create_failed_rules:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/audit/rules.d/30-ospp-v42-1-create-failed.rules | ## Unsuccessful file creation (open with O_CREAT) -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-create -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-create -a always,exit -F arch=b32 -S open -F a1&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-create -a always,exit -F arch=b64 -S open -F a1&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-create -a always,exit -F arch=b32 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-create -a always,exit -F arch=b64 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-create -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-create -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-create -a always,exit -F arch=b32 -S open -F a1&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-create -a always,exit -F arch=b64 -S open -F a1&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-create -a always,exit -F arch=b32 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-create -a always,exit -F arch=b64 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-create |
Configure auditing of successful file creations
Rule ID | xccdf_org.ssgproject.content_rule_audit_create_success |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-audit_create_success:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-82829-3 References: AU-2(a), FAU_GEN.1.1.c, SRG-OS-000458-GPOS-00203, SRG-OS-000474-GPOS-00219, SRG-OS-000475-GPOS-00220, SRG-OS-000463-GPOS-00207, SRG-OS-000465-GPOS-00209, SRG-OS-000461-GPOS-00205 |
Description | Ensure that successful attempts to create a file are audited.
The following rules configure audit as described above:
## Successful file creation (open with O_CREAT) -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&0100 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-create -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&0100 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-create -a always,exit -F arch=b32 -S open -F a1&0100 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-create -a always,exit -F arch=b64 -S open -F a1&0100 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-create -a always,exit -F arch=b32 -S creat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-create -a always,exit -F arch=b64 -S creat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-createThe Audit package provides pre-configured rules in /usr/share/audit/sample-rules . The above content can be found in /usr/share/audit/sample-rules/30-ospp-v42-1-create-success.rules .
To deploy this configuration, it is recommended to copy it over to the /etc/audit/rules.d/ directory:
cp /usr/share/audit/sample-rules/30-ospp-v42-1-create-success.rules /etc/audit/rules.d/Load new Audit rules into kernel by running: augenrules --load |
Rationale | Auditing of successful attempts to create a file helps in investigation of actions which happened on the system. |
Tests if contents of /etc/audit/rules.d/30-ospp-v42-1-create-success.rules is exactly what is defined in rule description oval:ssg-test_whole_file_contents_tc_audit_rules_d_30_ospp_v42_1_create_success_rules:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/audit/rules.d/30-ospp-v42-1-create-success.rules | ## Successful file creation (open with O_CREAT) -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&0100 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-create -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&0100 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-create -a always,exit -F arch=b32 -S open -F a1&0100 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-create -a always,exit -F arch=b64 -S open -F a1&0100 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-create -a always,exit -F arch=b32 -S creat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-create -a always,exit -F arch=b64 -S creat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-create |
Configure auditing of unsuccessful file deletions
Rule ID | xccdf_org.ssgproject.content_rule_audit_delete_failed |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-audit_delete_failed:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-82835-0 References: AU-2(a), FAU_GEN.1.1.c, SRG-OS-000458-GPOS-00203, SRG-OS-000474-GPOS-00219, SRG-OS-000475-GPOS-00220, SRG-OS-000463-GPOS-00207, SRG-OS-000465-GPOS-00209, SRG-OS-000461-GPOS-00205, SRG-OS-000468-GPOS-00212, SRG-OS-000467-GPOS-00211 |
Description | Ensure that unsuccessful attempts to delete a file are audited.
The following rules configure audit as described above:
## Unsuccessful file delete -a always,exit -F arch=b32 -S unlink,unlinkat,rename,renameat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete -a always,exit -F arch=b64 -S unlink,unlinkat,rename,renameat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete -a always,exit -F arch=b32 -S unlink,unlinkat,rename,renameat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete -a always,exit -F arch=b64 -S unlink,unlinkat,rename,renameat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-deleteThe Audit package provides pre-configured rules in /usr/share/audit/sample-rules . The above content can be found in /usr/share/audit/sample-rules/30-ospp-v42-4-delete-failed.rules .
To deploy this configuration, it is recommended to copy it over to the /etc/audit/rules.d/ directory:
cp /usr/share/audit/sample-rules/30-ospp-v42-4-delete-failed.rules /etc/audit/rules.d/Load new Audit rules into kernel by running: augenrules --loadNote: This rule utilizes a file provided by Audit package to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are alligned with your needs. |
Rationale | Unsuccessful attempts to delete a file might be signs of malicious activities. Auditing of such events help in monitoring and investigating of such activities. |
Tests if contents of /etc/audit/rules.d/30-ospp-v42-4-delete-failed.rules is exactly what is defined in rule description oval:ssg-test_whole_file_contents_tc_audit_rules_d_30_ospp_v42_4_delete_failed_rules:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/audit/rules.d/30-ospp-v42-4-delete-failed.rules | ## Unsuccessful file delete -a always,exit -F arch=b32 -S unlink,unlinkat,rename,renameat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete -a always,exit -F arch=b64 -S unlink,unlinkat,rename,renameat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete -a always,exit -F arch=b32 -S unlink,unlinkat,rename,renameat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete -a always,exit -F arch=b64 -S unlink,unlinkat,rename,renameat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete |
Configure auditing of successful file deletions
Rule ID | xccdf_org.ssgproject.content_rule_audit_delete_success |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-audit_delete_success:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-82836-8 References: AU-2(a), FAU_GEN.1.1.c, SRG-OS-000458-GPOS-00203, SRG-OS-000474-GPOS-00219, SRG-OS-000475-GPOS-00220, SRG-OS-000463-GPOS-00207, SRG-OS-000465-GPOS-00209, SRG-OS-000461-GPOS-00205, SRG-OS-000468-GPOS-00212, SRG-OS-000467-GPOS-00211 |
Description | Ensure that successful attempts to delete a file are audited.
The following rules configure audit as described above:
## Successful file delete -a always,exit -F arch=b32 -S unlink,unlinkat,rename,renameat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-delete -a always,exit -F arch=b64 -S unlink,unlinkat,rename,renameat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-deleteThe Audit package provides pre-configured rules in /usr/share/audit/sample-rules . The above content can be found in /usr/share/audit/sample-rules/30-ospp-v42-4-delete-success.rules .
To deploy this configuration, it is recommended to copy it over to the /etc/audit/rules.d/ directory:
cp /usr/share/audit/sample-rules/30-ospp-v42-4-delete-success.rules /etc/audit/rules.d/Load new Audit rules into kernel by running: augenrules --loadNote: This rule utilizes a file provided by Audit package to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are alligned with your needs. |
Rationale | Auditing of successful attempts to delete a file may help in monitoring and investigation of activities performed on the system. |
Tests if contents of /etc/audit/rules.d/30-ospp-v42-4-delete-success.rules is exactly what is defined in rule description oval:ssg-test_whole_file_contents_tc_audit_rules_d_30_ospp_v42_4_delete_success_rules:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/audit/rules.d/30-ospp-v42-4-delete-success.rules | ## Successful file delete -a always,exit -F arch=b32 -S unlink,unlinkat,rename,renameat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-delete -a always,exit -F arch=b64 -S unlink,unlinkat,rename,renameat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-delete |
Configure immutable Audit login UIDs
Rule ID | xccdf_org.ssgproject.content_rule_audit_immutable_login_uids |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-audit_immutable_login_uids:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-82828-5 References: CCI-000162, AU-2(a), FAU_GEN.1.1.c, SRG-OS-000462-GPOS-00206, SRG-OS-000475-GPOS-00220, SRG-OS-000057-GPOS-00027, SRG-OS-000058-GPOS-00028, SRG-OS-000059-GPOS-00029, RHEL-08-030122, SV-230403r627750_rule |
Description | Configure kernel to prevent modification of login UIDs once they are set. Changing login UUIDs while this configuration is enforced requires special capabilities which are not available to unprivileged users.
The following rules configure audit as described above:
## Make the loginuid immutable. This prevents tampering with the auid. --loginuid-immutableThe Audit provides pre-configured rules in /usr/share/audit/sample-rules . The above content can be found in /usr/share/audit/sample-rules/11-loginuid.rules .
To deploy this configuration, it is recommended to copy it over to the /etc/audit/rules.d/ directory:
cp /usr/share/audit/sample-rules/11-loginuid.rules /etc/audit/rules.d/Load new Audit rules into kernel by running: augenrules --load |
Rationale | If modification of login UIDs is not prevented, they can be changed by unprivileged users and make auditing complicated or impossible. |
Tests if contents of /etc/audit/rules.d/11-loginuid.rules is exactly what is defined in rule description oval:ssg-test_whole_file_contents_tc_audit_rules_d_11_loginuid_rules:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/audit/rules.d/11-loginuid.rules | ## Make the loginuid immutable. This prevents tampering with the auid. --loginuid-immutable |
Configure auditing of unsuccessful file modifications
Rule ID | xccdf_org.ssgproject.content_rule_audit_modify_failed |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-audit_modify_failed:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-82830-1 References: AU-2(a), FAU_GEN.1.1.c, SRG-OS-000458-GPOS-00203, SRG-OS-000474-GPOS-00219, SRG-OS-000475-GPOS-00220, SRG-OS-000463-GPOS-00207, SRG-OS-000465-GPOS-00209, SRG-OS-000461-GPOS-00205 |
Description | Ensure that unsuccessful attempts to modify a file are audited.
The following rules configure audit as described above:
## Unsuccessful file modifications (open for write or truncate) -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification -a always,exit -F arch=b32 -S open -F a1&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification -a always,exit -F arch=b64 -S open -F a1&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification -a always,exit -F arch=b32 -S truncate,ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification -a always,exit -F arch=b64 -S truncate,ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification -a always,exit -F arch=b32 -S open -F a1&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification -a always,exit -F arch=b64 -S open -F a1&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification -a always,exit -F arch=b32 -S truncate,ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification -a always,exit -F arch=b64 -S truncate,ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-modificationThe Audit package provides pre-configured rules in /usr/share/audit/sample-rules . The above content can be found in /usr/share/audit/sample-rules/30-ospp-v42-2-modify-failed.rules .
To deploy this configuration, it is recommended to copy it over to the /etc/audit/rules.d/ directory:
cp /usr/share/audit/sample-rules/30-ospp-v42-2-modify-failed.rules /etc/audit/rules.d/Load new Audit rules into kernel by running: augenrules --loadNote: This rule utilizes a file provided by Audit package to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are alligned with your needs. |
Rationale | Unsuccessful file modifications might be a sign of a malicious action being performed on the system. Auditing of such events helps in detection and investigation of such actions. |
Tests if contents of /etc/audit/rules.d/30-ospp-v42-2-modify-failed.rules is exactly what is defined in rule description oval:ssg-test_whole_file_contents_tc_audit_rules_d_30_ospp_v42_2_modify_failed_rules:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/audit/rules.d/30-ospp-v42-2-modify-failed.rules | ## Unsuccessful file modifications (open for write or truncate) -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification -a always,exit -F arch=b32 -S open -F a1&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification -a always,exit -F arch=b64 -S open -F a1&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification -a always,exit -F arch=b32 -S truncate,ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification -a always,exit -F arch=b64 -S truncate,ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification -a always,exit -F arch=b32 -S open -F a1&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification -a always,exit -F arch=b64 -S open -F a1&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification -a always,exit -F arch=b32 -S truncate,ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification -a always,exit -F arch=b64 -S truncate,ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification |
Configure auditing of successful file modifications
Rule ID | xccdf_org.ssgproject.content_rule_audit_modify_success |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-audit_modify_success:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-82832-7 References: AU-2(a), FAU_GEN.1.1.c, SRG-OS-000458-GPOS-00203, SRG-OS-000474-GPOS-00219, SRG-OS-000475-GPOS-00220, SRG-OS-000463-GPOS-00207, SRG-OS-000465-GPOS-00209, SRG-OS-000461-GPOS-00205 |
Description | Ensure that successful attempts to modify a file are audited.
The following rules configure audit as described above:
## Successful file modifications (open for write or truncate) -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&01003 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-modification -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&01003 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-modification -a always,exit -F arch=b32 -S open -F a1&01003 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-modification -a always,exit -F arch=b64 -S open -F a1&01003 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-modification -a always,exit -F arch=b32 -S truncate,ftruncate -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-modification -a always,exit -F arch=b64 -S truncate,ftruncate -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-modificationThe Audit package provides pre-configured rules in /usr/share/audit/sample-rules . The above content can be found in /usr/share/audit/sample-rules/30-ospp-v42-2-modify-success.rules .
To deploy this configuration, it is recommended to copy it over to the /etc/audit/rules.d/ directory:
cp /usr/share/audit/sample-rules/30-ospp-v42-2-modify-success.rules /etc/audit/rules.d/Load new Audit rules into kernel by running: augenrules --loadNote: This rule utilizes a file provided by Audit package to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are alligned with your needs. |
Rationale | Auditing of successful attempts to modify a file helps in investigation of actions which happened on the system. |
Tests if contents of /etc/audit/rules.d/30-ospp-v42-2-modify-success.rules is exactly what is defined in rule description oval:ssg-test_whole_file_contents_tc_audit_rules_d_30_ospp_v42_2_modify_success_rules:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/audit/rules.d/30-ospp-v42-2-modify-success.rules | ## Successful file modifications (open for write or truncate) -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&01003 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-modification -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&01003 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-modification -a always,exit -F arch=b32 -S open -F a1&01003 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-modification -a always,exit -F arch=b64 -S open -F a1&01003 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-modification -a always,exit -F arch=b32 -S truncate,ftruncate -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-modification -a always,exit -F arch=b64 -S truncate,ftruncate -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-modification |
Configure auditing of loading and unloading of kernel modules
Rule ID | xccdf_org.ssgproject.content_rule_audit_module_load |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-audit_module_load:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-82838-4 References: AU-2(a), FAU_GEN.1.1.c, SRG-OS-000471-GPOS-00216, SRG-OS-000477-GPOS-00222, SRG-OS-000475-GPOS-00220 |
Description | Ensure that loading and unloading of kernel modules is audited.
The following rules configure audit as described above:
## These rules watch for kernel module insertion. By monitoring ## the syscall, we do not need any watches on programs. -a always,exit -F arch=b32 -S init_module,finit_module -F key=module-load -a always,exit -F arch=b64 -S init_module,finit_module -F key=module-load -a always,exit -F arch=b32 -S delete_module -F key=module-unload -a always,exit -F arch=b64 -S delete_module -F key=module-unloadThe Audit package provides pre-configured rules in /usr/share/audit/sample-rules . The above content can be found in /usr/share/audit/sample-rules/43-module-load.rules .
To deploy this configuration, it is recommended to copy it over to the /etc/audit/rules.d/ directory:
cp /usr/share/audit/sample-rules/43-module-load.rules /etc/audit/rules.d/Load new Audit rules into kernel by running: augenrules --load |
Rationale | Loading of a malicious kernel module introduces a risk to the system, as the module has access to sensitive data and perform actions at the operating system kernel level. Having such events audited helps in monitoring and investigating of malicious activities. |
Tests if contents of /etc/audit/rules.d/43-module-load.rules is exactly what is defined in rule description oval:ssg-test_whole_file_contents_tc_audit_rules_d_43_module_load_rules:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/audit/rules.d/43-module-load.rules | ## These rules watch for kernel module insertion. By monitoring ## the syscall, we do not need any watches on programs. -a always,exit -F arch=b32 -S init_module,finit_module -F key=module-load -a always,exit -F arch=b64 -S init_module,finit_module -F key=module-load -a always,exit -F arch=b32 -S delete_module -F key=module-unload -a always,exit -F arch=b64 -S delete_module -F key=module-unload |
Perform general configuration of Audit for OSPP
Rule ID | xccdf_org.ssgproject.content_rule_audit_ospp_general |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-audit_ospp_general:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-82373-2 References: AU-2(a), FAU_GEN.1.1.c, SRG-OS-000004-GPOS-00004, SRG-OS-000241-GPOS-00091, SRG-OS-000476-GPOS-00221, SRG-OS-000327-GPOS-00127, SRG-OS-000475-GPOS-00220, SRG-OS-000239-GPOS-00089, SRG-OS-000274-GPOS-00104, SRG-OS-000275-GPOS-00105, SRG-OS-000303-GPOS-00120, SRG-OS-000304-GPOS-00121 |
Description | Configure some basic Audit parameters specific for OSPP profile.
In particular, configure Audit to watch for direct modification of files storing system user and group information, and usage of applications with special rights which can change system configuration.
Further audited events include access to audit log it self, attempts to Alter Process and Session Initiation Information, and attempts to modify MAC controls.
The following rules configure audit as described above:
## The purpose of these rules is to meet the requirements for Operating ## System Protection Profile (OSPP)v4.2. These rules depends on having ## the following rule files copied to /etc/audit/rules.d: ## ## 10-base-config.rules, 11-loginuid.rules, ## 30-ospp-v42-1-create-failed.rules, 30-ospp-v42-1-create-success.rules, ## 30-ospp-v42-2-modify-failed.rules, 30-ospp-v42-2-modify-success.rules, ## 30-ospp-v42-3-access-failed.rules, 30-ospp-v42-3-access-success.rules, ## 30-ospp-v42-4-delete-failed.rules, 30-ospp-v42-4-delete-success.rules, ## 30-ospp-v42-5-perm-change-failed.rules, ## 30-ospp-v42-5-perm-change-success.rules, ## 30-ospp-v42-6-owner-change-failed.rules, ## 30-ospp-v42-6-owner-change-success.rules ## ## original copies may be found in /usr/share/audit/sample-rules/ ## User add delete modify. This is covered by pam. However, someone could ## open a file and directly create or modify a user, so we'll watch passwd and ## shadow for writes -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=user-modify -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=user-modify -a always,exit -F arch=b32 -S open -F a1&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=user-modify -a always,exit -F arch=b64 -S open -F a1&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=user-modify -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify -a always,exit -F arch=b32 -S open -F a1&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify -a always,exit -F arch=b64 -S open -F a1&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify ## User enable and disable. This is entirely handled by pam. ## Group add delete modify. This is covered by pam. However, someone could ## open a file and directly create or modify a user, so we'll watch group and ## gshadow for writes -a always,exit -F path=/etc/passwd -F perm=wa -F auid>=1000 -F auid!=unset -F key=user-modify -a always,exit -F path=/etc/shadow -F perm=wa -F auid>=1000 -F auid!=unset -F key=user-modify -a always,exit -F path=/etc/group -F perm=wa -F auid>=1000 -F auid!=unset -F key=group-modify -a always,exit -F path=/etc/gshadow -F perm=wa -F auid>=1000 -F auid!=unset -F key=group-modify ## Use of special rights for config changes. This would be use of setuid ## programs that relate to user accts. This is not all setuid apps because ## requirements are only for ones that affect system configuration. -a always,exit -F path=/usr/sbin/unix_chkpwd -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F path=/usr/sbin/usernetctl -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F path=/usr/sbin/userhelper -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F path=/usr/sbin/seunshare -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F path=/usr/bin/mount -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F path=/usr/bin/newgrp -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F path=/usr/bin/newuidmap -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F path=/usr/bin/gpasswd -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F path=/usr/bin/newgidmap -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F path=/usr/bin/umount -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F path=/usr/bin/passwd -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F path=/usr/bin/crontab -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F path=/usr/bin/at -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes ## Privilege escalation via su or sudo. This is entirely handled by pam. ## Audit log access -a always,exit -F dir=/var/log/audit/ -F perm=r -F auid>=1000 -F auid!=unset -F key=access-audit-trail ## Attempts to Alter Process and Session Initiation Information -a always,exit -F path=/var/run/utmp -F perm=wa -F auid>=1000 -F auid!=unset -F key=session -a always,exit -F path=/var/log/btmp -F perm=wa -F auid>=1000 -F auid!=unset -F key=session -a always,exit -F path=/var/log/wtmp -F perm=wa -F auid>=1000 -F auid!=unset -F key=session ## Attempts to modify MAC controls -a always,exit -F dir=/etc/selinux/ -F perm=wa -F auid>=1000 -F auid!=unset -F key=MAC-policy ## Software updates. This is entirely handled by rpm. ## System start and shutdown. This is entirely handled by systemd ## Kernel Module loading. This is handled in 43-module-load.rules ## Application invocation. The requirements list an optional requirement ## FPT_SRP_EXT.1 Software Restriction Policies. This event is intended to ## state results from that policy. This would be handled entirely by ## that daemon.The Audit package provides pre-configured rules in /usr/share/audit/sample-rules . The above content can be found in /usr/share/audit/sample-rules/30-ospp-v42.rules .
To deploy this configuration, it is recommended to copy it over to the /etc/audit/rules.d/ directory:
cp /usr/share/audit/sample-rules/30-ospp-v42.rules /etc/audit/rules.d/Load new Audit rules into kernel by running: augenrules --loadNote: This rule utilizes a file provided by Audit package to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are alligned with your needs. |
Rationale | Auditing of events listed in the description provides data for monitoring and investigation of potentially malicious events e.g. tampering with Audit logs, malicious access to files storing information about system users and groups etc. |
Tests if contents of /etc/audit/rules.d/30-ospp-v42.rules is exactly what is defined in rule description oval:ssg-test_whole_file_contents_tc_audit_rules_d_30_ospp_v42_rules:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/audit/rules.d/30-ospp-v42.rules | ## The purpose of these rules is to meet the requirements for Operating ## System Protection Profile (OSPP)v4.2. These rules depends on having ## the following rule files copied to /etc/audit/rules.d: ## ## 10-base-config.rules, 11-loginuid.rules, ## 30-ospp-v42-1-create-failed.rules, 30-ospp-v42-1-create-success.rules, ## 30-ospp-v42-2-modify-failed.rules, 30-ospp-v42-2-modify-success.rules, ## 30-ospp-v42-3-access-failed.rules, 30-ospp-v42-3-access-success.rules, ## 30-ospp-v42-4-delete-failed.rules, 30-ospp-v42-4-delete-success.rules, ## 30-ospp-v42-5-perm-change-failed.rules, ## 30-ospp-v42-5-perm-change-success.rules, ## 30-ospp-v42-6-owner-change-failed.rules, ## 30-ospp-v42-6-owner-change-success.rules ## ## original copies may be found in /usr/share/audit/sample-rules/ ## User add delete modify. This is covered by pam. However, someone could ## open a file and directly create or modify a user, so we'll watch passwd and ## shadow for writes -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=user-modify -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=user-modify -a always,exit -F arch=b32 -S open -F a1&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=user-modify -a always,exit -F arch=b64 -S open -F a1&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=user-modify -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify -a always,exit -F arch=b32 -S open -F a1&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify -a always,exit -F arch=b64 -S open -F a1&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify ## User enable and disable. This is entirely handled by pam. ## Group add delete modify. This is covered by pam. However, someone could ## open a file and directly create or modify a user, so we'll watch group and ## gshadow for writes -a always,exit -F path=/etc/passwd -F perm=wa -F auid>=1000 -F auid!=unset -F key=user-modify -a always,exit -F path=/etc/shadow -F perm=wa -F auid>=1000 -F auid!=unset -F key=user-modify -a always,exit -F path=/etc/group -F perm=wa -F auid>=1000 -F auid!=unset -F key=group-modify -a always,exit -F path=/etc/gshadow -F perm=wa -F auid>=1000 -F auid!=unset -F key=group-modify ## Use of special rights for config changes. This would be use of setuid ## programs that relate to user accts. This is not all setuid apps because ## requirements are only for ones that affect system configuration. -a always,exit -F path=/usr/sbin/unix_chkpwd -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F path=/usr/sbin/usernetctl -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F path=/usr/sbin/userhelper -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F path=/usr/sbin/seunshare -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F path=/usr/bin/mount -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F path=/usr/bin/newgrp -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F path=/usr/bin/newuidmap -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F path=/usr/bin/gpasswd -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F path=/usr/bin/newgidmap -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F path=/usr/bin/umount -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F path=/usr/bin/passwd -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F path=/usr/bin/crontab -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F path=/usr/bin/at -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes ## Privilege escalation via su or sudo. This is entirely handled by pam. ## Audit log access -a always,exit -F dir=/var/log/audit/ -F perm=r -F auid>=1000 -F auid!=unset -F key=access-audit-trail ## Attempts to Alter Process and Session Initiation Information -a always,exit -F path=/var/run/utmp -F perm=wa -F auid>=1000 -F auid!=unset -F key=session -a always,exit -F path=/var/log/btmp -F perm=wa -F auid>=1000 -F auid!=unset -F key=session -a always,exit -F path=/var/log/wtmp -F perm=wa -F auid>=1000 -F auid!=unset -F key=session ## Attempts to modify MAC controls -a always,exit -F dir=/etc/selinux/ -F perm=wa -F auid>=1000 -F auid!=unset -F key=MAC-policy ## Software updates. This is entirely handled by rpm. ## System start and shutdown. This is entirely handled by systemd ## Kernel Module loading. This is handled in 43-module-load.rules ## Application invocation. The requirements list an optional requirement ## FPT_SRP_EXT.1 Software Restriction Policies. This event is intended to ## state results from that policy. This would be handled entirely by ## that daemon. |
Configure auditing of unsuccessful ownership changes
Rule ID | xccdf_org.ssgproject.content_rule_audit_owner_change_failed |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-audit_owner_change_failed:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-82384-9 References: AU-2(a), FAU_GEN.1.1.c, SRG-OS-000462-GPOS-00206, SRG-OS-000463-GPOS-00207, SRG-OS-000465-GPOS-00209, SRG-OS-000474-GPOS-00219, SRG-OS-000475-GPOS-00220, SRG-OS-000466-GPOS-00210, SRG-OS-000064-GPOS-00033 |
Description | Ensure that unsuccessful attempts to change an ownership of files or directories are audited.
The following rules configure audit as described above:
## Unsuccessful ownership change -a always,exit -F arch=b32 -S lchown,fchown,chown,fchownat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-owner-change -a always,exit -F arch=b64 -S lchown,fchown,chown,fchownat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-owner-change -a always,exit -F arch=b32 -S lchown,fchown,chown,fchownat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-owner-change -a always,exit -F arch=b64 -S lchown,fchown,chown,fchownat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-owner-changeThe Audit package provides pre-configured rules in /usr/share/audit/sample-rules . The above content can be found in /usr/share/audit/sample-rules/30-ospp-v42-6-owner-change-failed.rules .
To deploy this configuration, it is recommended to copy it over to the /etc/audit/rules.d/ directory:
cp /usr/share/audit/sample-rules/30-ospp-v42-6-owner-change-failed.rules /etc/audit/rules.d/Load new Audit rules into kernel by running: augenrules --loadNote: This rule utilizes a file provided by Audit package to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are alligned with your needs. |
Rationale | Unsuccessful attempts to change an ownership of files or directories might be signs of a malicious activity. Having such events audited helps in monitoring and investigation of such activities. |
Tests if contents of /etc/audit/rules.d/30-ospp-v42-6-owner-change-failed.rules is exactly what is defined in rule description oval:ssg-test_whole_file_contents_tc_audit_rules_d_30_ospp_v42_6_owner_change_failed_rules:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/audit/rules.d/30-ospp-v42-6-owner-change-failed.rules | ## Unsuccessful ownership change -a always,exit -F arch=b32 -S lchown,fchown,chown,fchownat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-owner-change -a always,exit -F arch=b64 -S lchown,fchown,chown,fchownat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-owner-change -a always,exit -F arch=b32 -S lchown,fchown,chown,fchownat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-owner-change -a always,exit -F arch=b64 -S lchown,fchown,chown,fchownat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-owner-change |
Configure auditing of successful ownership changes
Rule ID | xccdf_org.ssgproject.content_rule_audit_owner_change_success |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-audit_owner_change_success:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-82385-6 References: AU-2(a), FAU_GEN.1.1.c, SRG-OS-000462-GPOS-00206, SRG-OS-000463-GPOS-00207, SRG-OS-000465-GPOS-00209, SRG-OS-000474-GPOS-00219, SRG-OS-000475-GPOS-00220, SRG-OS-000466-GPOS-00210, SRG-OS-000064-GPOS-00033 |
Description | Ensure that successful attempts to change an ownership of files or directories are audited.
The following rules configure audit as described above:
## Successful ownership change -a always,exit -F arch=b32 -S lchown,fchown,chown,fchownat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-owner-change -a always,exit -F arch=b64 -S lchown,fchown,chown,fchownat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-owner-changeThe Audit package provides pre-configured rules in /usr/share/audit/sample-rules . The above content can be found in /usr/share/audit/sample-rules/30-ospp-v42-6-owner-change-success.rules .
To deploy this configuration, it is recommended to copy it over to the /etc/audit/rules.d/ directory:
cp /usr/share/audit/sample-rules/30-ospp-v42-6-owner-change-success.rules /etc/audit/rules.d/The file has the following SHA-256 checksum: 7eb41a6aaf6737c2571b6424fae7fa53af4b41a9115b6c5732a5778ccd9900adLoad new Audit rules into kernel by running: augenrules --loadNote: This rule utilizes a file provided by Audit package to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are alligned with your needs. |
Rationale | Auditing of successful ownership changes of files or directories helps in monitoring or investingating of activities performed on the system. |
Tests if contents of /etc/audit/rules.d/30-ospp-v42-6-owner-change-success.rules is exactly what is defined in rule description oval:ssg-test_whole_file_contents_tc_audit_rules_d_30_ospp_v42_6_owner_change_success_rules:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/audit/rules.d/30-ospp-v42-6-owner-change-success.rules | ## Successful ownership change -a always,exit -F arch=b32 -S lchown,fchown,chown,fchownat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-owner-change -a always,exit -F arch=b64 -S lchown,fchown,chown,fchownat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-owner-change |
Configure auditing of unsuccessful permission changes
Rule ID | xccdf_org.ssgproject.content_rule_audit_perm_change_failed |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-audit_perm_change_failed:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-82837-6 References: AU-2(a), FAU_GEN.1.1.c, SRG-OS-000462-GPOS-00206, SRG-OS-000463-GPOS-00207, SRG-OS-000465-GPOS-00209, SRG-OS-000474-GPOS-00219, SRG-OS-000475-GPOS-00220, SRG-OS-000466-GPOS-00210, SRG-OS-000064-GPOS-00033 |
Description | Ensure that unsuccessful attempts to change file or directory permissions are audited.
The following rules configure audit as described above:
## Unsuccessful permission change -a always,exit -F arch=b32 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-perm-change -a always,exit -F arch=b64 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-perm-change -a always,exit -F arch=b32 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-perm-change -a always,exit -F arch=b64 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-perm-changeThe Audit package provides pre-configured rules in /usr/share/audit/sample-rules . The above content can be found in /usr/share/audit/sample-rules/30-ospp-v42-5-perm-change-failed.rules .
To deploy this configuration, it is recommended to copy it over to the /etc/audit/rules.d/ directory:
cp /usr/share/audit/sample-rules/30-ospp-v42-5-perm-change-failed.rules /etc/audit/rules.d/Load new Audit rules into kernel by running: augenrules --loadNote: This rule utilizes a file provided by Audit package to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are alligned with your needs. |
Rationale | Unsuccessful attempts to change permissions of files or directories might be signs of malicious activity. Having such events audited helps in monitoring and investigation of such activities. |
Tests if contents of /etc/audit/rules.d/30-ospp-v42-5-perm-change-failed.rules is exactly what is defined in rule description oval:ssg-test_whole_file_contents_tc_audit_rules_d_30_ospp_v42_5_perm_change_failed_rules:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/audit/rules.d/30-ospp-v42-5-perm-change-failed.rules | ## Unsuccessful permission change -a always,exit -F arch=b32 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-perm-change -a always,exit -F arch=b64 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-perm-change -a always,exit -F arch=b32 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-perm-change -a always,exit -F arch=b64 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-perm-change |
Configure auditing of successful permission changes
Rule ID | xccdf_org.ssgproject.content_rule_audit_perm_change_success |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-audit_perm_change_success:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-82383-1 References: AU-2(a), FAU_GEN.1.1.c, SRG-OS-000462-GPOS-00206, SRG-OS-000463-GPOS-00207, SRG-OS-000465-GPOS-00209, SRG-OS-000474-GPOS-00219, SRG-OS-000475-GPOS-00220, SRG-OS-000466-GPOS-00210, SRG-OS-000064-GPOS-00033 |
Description | Ensure that successful attempts to modify permissions of iles or directories are audited.
The following rules configure audit as described above:
## Successful permission change -a always,exit -F arch=b32 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change -a always,exit -F arch=b64 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-changeThe Audit package provides pre-configured rules in /usr/share/audit/sample-rules . The above content can be found in /usr/share/audit/sample-rules/30-ospp-v42-5-perm-change-success.rules .
To deploy this configuration, it is recommended to copy it over to the /etc/audit/rules.d/ directory:
cp /usr/share/audit/sample-rules/30-ospp-v42-5-perm-change-success.rules /etc/audit/rules.d/Load new Audit rules into kernel by running: augenrules --loadNote: This rule utilizes a file provided by Audit package to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are alligned with your needs. |
Rationale | Auditing successful file or directory permission changes helps in monitoring and investigating of activities performed on the system. |
Tests if contents of /etc/audit/rules.d/30-ospp-v42-5-perm-change-success.rules is exactly what is defined in rule description oval:ssg-test_whole_file_contents_tc_audit_rules_d_30_ospp_v42_5_perm_change_success_rules:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/audit/rules.d/30-ospp-v42-5-perm-change-success.rules | ## Successful permission change -a always,exit -F arch=b32 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change -a always,exit -F arch=b64 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change |
Install audispd-plugins Package
Rule ID | xccdf_org.ssgproject.content_rule_package_audispd-plugins_installed |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-package_audispd-plugins_installed:def:1 |
Time | 2022-02-10T22:29:26+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-82953-1 References: FMT_SMF_EXT.1, SRG-OS-000342-GPOS-00133 |
Description | The audispd-plugins package can be installed with the following command:
$ sudo yum install audispd-plugins |
Rationale | audispd-plugins provides plugins for the real-time interface to the
audit subsystem, audispd . These plugins can do things like relay events
to remote machines or analyze events for suspicious behavior. |
package audispd-plugins is installed oval:ssg-test_package_audispd-plugins_installed:tst:1 true
Following items have been found on the system:
Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
---|---|---|---|---|---|---|---|
audispd-plugins | x86_64 | (none) | 0.17.20191104git1c2f876.el8 | 3.0 | 0:3.0-0.17.20191104git1c2f876.el8 | 199e2f91fd431d51 | audispd-plugins-0:3.0-0.17.20191104git1c2f876.el8.x86_64 |
Ensure the audit Subsystem is Installed
package audit is installed oval:ssg-test_package_audit_installed:tst:1 true
Following items have been found on the system:
Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
---|---|---|---|---|---|---|---|
audit | x86_64 | (none) | 0.17.20191104git1c2f876.el8 | 3.0 | 0:3.0-0.17.20191104git1c2f876.el8 | 199e2f91fd431d51 | audit-0:3.0-0.17.20191104git1c2f876.el8.x86_64 |
Enable auditd Service
package audit is installed oval:ssg-test_service_auditd_package_audit_installed:tst:1 true
Following items have been found on the system:
Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
---|---|---|---|---|---|---|---|
audit | x86_64 | (none) | 0.17.20191104git1c2f876.el8 | 3.0 | 0:3.0-0.17.20191104git1c2f876.el8 | 199e2f91fd431d51 | audit-0:3.0-0.17.20191104git1c2f876.el8.x86_64 |
Test that the auditd service is running oval:ssg-test_service_running_auditd:tst:1 true
Following items have been found on the system:
Unit | Property | Value |
---|---|---|
auditd.service | ActiveState | active |
systemd test oval:ssg-test_multi_user_wants_auditd:tst:1 true
Following items have been found on the system:
Unit | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency |
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
multi-user.target | basic.target | sysinit.target | systemd-udev-trigger.service | systemd-firstboot.service | systemd-journald.service | systemd-tmpfiles-setup.service | systemd-journal-flush.service | systemd-sysctl.service | dev-mqueue.mount | systemd-udevd.service | swap.target | dev-disk-by\x2duuid-1e5c0ff6\x2dd83c\x2d4f59\x2db028\x2d3cdb40431877.swap | dev-mapper-VolGroup\x2dswap.swap | systemd-machine-id-commit.service | systemd-update-done.service | systemd-sysusers.service | dracut-shutdown.service | multipathd.service | cryptsetup.target | import-state.service | lvm2-monitor.service | plymouth-read-write.service | proc-sys-fs-binfmt_misc.automount | plymouth-start.service | systemd-tmpfiles-setup-dev.service | systemd-binfmt.service | systemd-journal-catalog-update.service | local-fs.target | var-log.mount | var-log-audit.mount | boot-efi.mount | var-tmp.mount | boot.mount | home.mount | var.mount | -.mount | tmp.mount | systemd-remount-fs.service | ostree-remount.service | kmod-static-nodes.service | ldconfig.service | systemd-ask-password-console.path | sys-fs-fuse-connections.mount | nis-domainname.service | dev-hugepages.mount | systemd-hwdb-update.service | systemd-random-seed.service | sys-kernel-debug.mount | loadmodules.service | lvm2-lvmpolld.socket | sys-kernel-config.mount | selinux-autorelabel-mark.service | systemd-modules-load.service | systemd-update-utmp.service | usbguard.service | paths.target | slices.target | system.slice | -.slice | microcode.service | timers.target | systemd-tmpfiles-clean.timer | dnf-automatic.timer | dnf-makecache.timer | unbound-anchor.timer | sockets.target | systemd-coredump.socket | systemd-udevd-control.socket | systemd-udevd-kernel.socket | systemd-initctl.socket | dbus.socket | systemd-journald.socket | dm-event.socket | multipathd.socket | systemd-journald-dev-log.socket | sssd-kcm.socket | chronyd.service | plymouth-quit.service | systemd-update-utmp-runlevel.service | systemd-user-sessions.service | crond.service | remote-fs.target | dbus.service | firewalld.service | rhsmcertd.service | mdmonitor.service | NetworkManager.service | plymouth-quit-wait.service | sshd.service | fapolicyd.service | rsyslog.service | systemd-ask-password-wall.path | systemd-logind.service | irqbalance.service | getty.target | getty@tty1.service | tuned.service | auditd.service | sssd.service |
systemd test oval:ssg-test_multi_user_wants_auditd_socket:tst:1 false
Following items have been found on the system:
Unit | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency |
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
multi-user.target | basic.target | sysinit.target | systemd-udev-trigger.service | systemd-firstboot.service | systemd-journald.service | systemd-tmpfiles-setup.service | systemd-journal-flush.service | systemd-sysctl.service | dev-mqueue.mount | systemd-udevd.service | swap.target | dev-disk-by\x2duuid-1e5c0ff6\x2dd83c\x2d4f59\x2db028\x2d3cdb40431877.swap | dev-mapper-VolGroup\x2dswap.swap | systemd-machine-id-commit.service | systemd-update-done.service | systemd-sysusers.service | dracut-shutdown.service | multipathd.service | cryptsetup.target | import-state.service | lvm2-monitor.service | plymouth-read-write.service | proc-sys-fs-binfmt_misc.automount | plymouth-start.service | systemd-tmpfiles-setup-dev.service | systemd-binfmt.service | systemd-journal-catalog-update.service | local-fs.target | var-log.mount | var-log-audit.mount | boot-efi.mount | var-tmp.mount | boot.mount | home.mount | var.mount | -.mount | tmp.mount | systemd-remount-fs.service | ostree-remount.service | kmod-static-nodes.service | ldconfig.service | systemd-ask-password-console.path | sys-fs-fuse-connections.mount | nis-domainname.service | dev-hugepages.mount | systemd-hwdb-update.service | systemd-random-seed.service | sys-kernel-debug.mount | loadmodules.service | lvm2-lvmpolld.socket | sys-kernel-config.mount | selinux-autorelabel-mark.service | systemd-modules-load.service | systemd-update-utmp.service | usbguard.service | paths.target | slices.target | system.slice | -.slice | microcode.service | timers.target | systemd-tmpfiles-clean.timer | dnf-automatic.timer | dnf-makecache.timer | unbound-anchor.timer | sockets.target | systemd-coredump.socket | systemd-udevd-control.socket | systemd-udevd-kernel.socket | systemd-initctl.socket | dbus.socket | systemd-journald.socket | dm-event.socket | multipathd.socket | systemd-journald-dev-log.socket | sssd-kcm.socket | chronyd.service | plymouth-quit.service | systemd-update-utmp-runlevel.service | systemd-user-sessions.service | crond.service | remote-fs.target | dbus.service | firewalld.service | rhsmcertd.service | mdmonitor.service | NetworkManager.service | plymouth-quit-wait.service | sshd.service | fapolicyd.service | rsyslog.service | systemd-ask-password-wall.path | systemd-logind.service | irqbalance.service | getty.target | getty@tty1.service | tuned.service | auditd.service | sssd.service |
Enable Auditing for Processes Which Start Prior to the Audit Daemon
Rule ID | xccdf_org.ssgproject.content_rule_grub2_audit_argument |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-grub2_audit_argument:def:1 |
Time | 2022-02-10T22:29:26+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-80825-3 References: 4.1.1.3, 1, 11, 12, 13, 14, 15, 16, 19, 3, 4, 5, 6, 7, 8, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS05.02, DSS05.03, DSS05.04, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.3.1, CCI-001464, CCI-000130, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(C), 164.310(a)(2)(iv), 164.310(d)(2)(iii), 164.312(b), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, AC-17(1), AU-14(1), AU-10, CM-6(a), IR-5(1), DE.AE-3, DE.AE-5, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, Req-10.3, SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215, SRG-OS-000473-GPOS-00218, SRG-OS-000254-GPOS-00095, RHEL-08-030601, SV-230468r627750_rule, SRG-OS-000254-VMM-000880 |
Description | To ensure all processes can be audited, even those which start
prior to the audit daemon, add the argument audit=1 to the default
GRUB 2 command line for the Linux operating system in
/boot/grub2/grubenv , in the manner below:
# grub2-editenv - set "$(grub2-editenv - list | grep kernelopts) audit=1" |
Rationale | Each process on the system carries an "auditable" flag which indicates whether
its activities can be audited. Although auditd takes care of enabling
this for all processes which launch after it does, adding the kernel argument
ensures it is set for every process during boot. |
Warnings | warning
The GRUB 2 configuration file, grub.cfg ,
is automatically updated each time a new kernel is installed. Note that any
changes to /etc/default/grub require rebuilding the grub.cfg
file. To update the GRUB 2 configuration file manually, use the
grub2-mkconfig -ocommand as follows:
|
check forkernel command line parameters audit=1 in /boot/grub2/grubenv for all kernels oval:ssg-test_grub2_audit_argument_grub_env:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/boot/grub2/grubenv | kernelopts=root=/dev/mapper/VolGroup-root ro audit=1 audit_backlog_limit=8192 crashkernel=auto resume=/dev/mapper/VolGroup-swap rd.lvm.lv=VolGroup/root rd.lvm.lv=VolGroup/swap rhgb quiet fips=1 boot=UUID=e5fe751a-8dfb-40d1-840e-ef8d20bc4298 random.trust_cpu=on pti=on page_poison=1 slub_debug=P |
Extend Audit Backlog Limit for the Audit Daemon
Rule ID | xccdf_org.ssgproject.content_rule_grub2_audit_backlog_limit_argument |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-grub2_audit_backlog_limit_argument:def:1 |
Time | 2022-02-10T22:29:26+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-80943-4 References: 4.1.1.4, CCI-001849, CM-6(a), SRG-OS-000254-GPOS-00095, SRG-OS-000341-GPOS-00132, RHEL-08-030602, SV-230469r744004_rule |
Description | To improve the kernel capacity to queue all log events, even those which occurred
prior to the audit daemon, add the argument audit_backlog_limit=8192 to the default
GRUB 2 command line for the Linux operating system in
/etc/default/grub , in the manner below:
GRUB_CMDLINE_LINUX="crashkernel=auto rd.lvm.lv=VolGroup/LogVol06 rd.lvm.lv=VolGroup/lv_swap rhgb quiet rd.shell=0 audit=1 audit_backlog_limit=8192" |
Rationale | audit_backlog_limit sets the queue length for audit events awaiting transfer
to the audit daemon. Until the audit daemon is up and running, all log messages
are stored in this queue. If the queue is overrun during boot process, the action
defined by audit failure flag is taken. |
Warnings | warning
The GRUB 2 configuration file, grub.cfg ,
is automatically updated each time a new kernel is installed. Note that any
changes to /etc/default/grub require rebuilding the grub.cfg
file. To update the GRUB 2 configuration file manually, use the
grub2-mkconfig -ocommand as follows:
|
check forkernel command line parameters audit_backlog_limit=8192 in /boot/grub2/grubenv for all kernels oval:ssg-test_grub2_audit_backlog_limit_argument_grub_env:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/boot/grub2/grubenv | kernelopts=root=/dev/mapper/VolGroup-root ro audit=1 audit_backlog_limit=8192 crashkernel=auto resume=/dev/mapper/VolGroup-swap rd.lvm.lv=VolGroup/root rd.lvm.lv=VolGroup/swap rhgb quiet fips=1 boot=UUID=e5fe751a-8dfb-40d1-840e-ef8d20bc4298 random.trust_cpu=on pti=on page_poison=1 slub_debug=P |
Set the UEFI Boot Loader Password
Rule ID | xccdf_org.ssgproject.content_rule_grub2_uefi_password |
Result | notapplicable |
Multi-check rule | no |
Time | 2022-02-10T22:29:27+00:00 |
Severity | high |
Identifiers and References | Identifiers: CCE-80829-5 References: BP28(R17), 1.5.2, 11, 12, 14, 15, 16, 18, 3, 5, DSS05.02, DSS05.04, DSS05.05, DSS05.07, DSS06.03, DSS06.06, 3.4.5, CCI-000213, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, A.6.1.2, A.7.1.1, A.9.1.2, A.9.2.1, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CM-6(a), PR.AC-4, PR.AC-6, PR.PT-3, FIA_UAU.1, SRG-OS-000080-GPOS-00048, RHEL-08-010140, SV-230234r743922_rule |
Description | The grub2 boot loader should have a superuser account and password
protection enabled to protect boot-time settings.
Since plaintext passwords are a security risk, generate a hash for the password by running the following command: $ grub2-setpasswordWhen prompted, enter the password that was selected. Once the superuser password has been added, update the grub.cfg file by running:
grub2-mkconfig -o /boot/efi/EFI/redhat/grub.cfg |
Rationale | Password protection on the boot loader configuration ensures
users with physical access cannot trivially alter
important bootloader settings. These include which kernel to use,
and whether to enter single-user mode. |
Warnings | warning
To prevent hard-coded passwords, automatic remediation of this control is not available. Remediation
must be automated as a component of machine provisioning, or followed manually as outlined above.
Also, do NOT manually add the superuser account and password to the
grub.cfg file as the grub2-mkconfig command overwrites this file. |
Configure kernel to trust the CPU random number generator
Rule ID | xccdf_org.ssgproject.content_rule_grub2_kernel_trust_cpu_rng |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-grub2_kernel_trust_cpu_rng:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-83314-5 References: FCS_RBG_EXT.1.1, SRG-OS-000480-GPOS-00227 |
Description | There exist two ways how to ensure that the Linux kernel trusts the CPU
hardware random number generator. If the option is configured during kernel
compilation, e.g. the option CONFIG_RANDOM_TRUST_CPU is set to
Y , make sure that it is not overridden with the boot parameter.
There must not exist the boot parameter random.trust_cpu=off . If
the option is not compiled in, make sure that random.trust_cpu=on
is configured as a boot parameter by running the following command:
sudo grub2-editenv - set "$(grub2-editenv - list | grep kernelopts) random.trust_cpu=on" |
Rationale | The Linux kernel offers an option which signifies if the kernel should trust
data provided by CPU hardware random number generator. Hardware random
number generators can provide random data very quickly and are used to generate random cryptographic keys. They can
be useful during boot time when other means of getting random data can be
slow because there is not yet enough entropy in the system. |
check if the parameter was set at the compile time for current kernel oval:ssg-test_trust_cpu_rng_compiled_in:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_trust_cpu_rng_compiled_in:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
/boot/config-4.18.0-348.el8.x86_64 | ^CONFIG_RANDOM_TRUST_CPU=Y$ | 1 |
check forkernel command line parameters random.trust_cpu=off in /boot/grub2/grubenv for all kernels oval:ssg-test_trust_cpu_rng_boot_param_off:tst:1 false
Following items have been found on the system:
Path | Content |
---|---|
/boot/grub2/grubenv | kernelopts=root=/dev/mapper/VolGroup-root ro audit=1 audit_backlog_limit=8192 crashkernel=auto resume=/dev/mapper/VolGroup-swap rd.lvm.lv=VolGroup/root rd.lvm.lv=VolGroup/swap rhgb quiet fips=1 boot=UUID=e5fe751a-8dfb-40d1-840e-ef8d20bc4298 random.trust_cpu=on pti=on page_poison=1 slub_debug=P |
check forkernel command line parameters random.trust_cpu=on in /boot/grub2/grubenv for all kernels oval:ssg-test_trust_cpu_rng_boot_param_on:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/boot/grub2/grubenv | kernelopts=root=/dev/mapper/VolGroup-root ro audit=1 audit_backlog_limit=8192 crashkernel=auto resume=/dev/mapper/VolGroup-swap rd.lvm.lv=VolGroup/root rd.lvm.lv=VolGroup/swap rhgb quiet fips=1 boot=UUID=e5fe751a-8dfb-40d1-840e-ef8d20bc4298 random.trust_cpu=on pti=on page_poison=1 slub_debug=P |
Enable Kernel Page-Table Isolation (KPTI)
Rule ID | xccdf_org.ssgproject.content_rule_grub2_pti_argument |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-grub2_pti_argument:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | high |
Identifiers and References | Identifiers: CCE-82194-2 References: CCI-000381, SI-16, SRG-OS-000433-GPOS-00193, SRG-OS-000095-GPOS-00049, RHEL-08-040004, SV-230491r627750_rule |
Description | To enable Kernel page-table isolation,
add the argument pti=on to the default
GRUB 2 command line for the Linux operating system in
/etc/default/grub , in the manner below:
GRUB_CMDLINE_LINUX="pti=on" |
Rationale | Kernel page-table isolation is a kernel feature that mitigates
the Meltdown security vulnerability and hardens the kernel
against attempts to bypass kernel address space layout
randomization (KASLR). |
Warnings | warning
The GRUB 2 configuration file, grub.cfg ,
is automatically updated each time a new kernel is installed. Note that any
changes to /etc/default/grub require rebuilding the grub.cfg
file. To update the GRUB 2 configuration file manually, use the
grub2-mkconfig -ocommand as follows:
|
check forkernel command line parameters pti=on in /boot/grub2/grubenv for all kernels oval:ssg-test_grub2_pti_argument_grub_env:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/boot/grub2/grubenv | kernelopts=root=/dev/mapper/VolGroup-root ro audit=1 audit_backlog_limit=8192 crashkernel=auto resume=/dev/mapper/VolGroup-swap rd.lvm.lv=VolGroup/root rd.lvm.lv=VolGroup/swap rhgb quiet fips=1 boot=UUID=e5fe751a-8dfb-40d1-840e-ef8d20bc4298 random.trust_cpu=on pti=on page_poison=1 slub_debug=P |
Disable vsyscalls
Rule ID | xccdf_org.ssgproject.content_rule_grub2_vsyscall_argument |
Result | informational |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-grub2_vsyscall_argument:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | info |
Identifiers and References | Identifiers: CCE-80946-7 References: CCI-001084, CM-7(a), SRG-OS-000480-GPOS-00227, SRG-OS-000134-GPOS-00068, RHEL-08-010422, SV-230278r743948_rule |
Description | To disable use of virtual syscalls,
add the argument vsyscall=none to the default
GRUB 2 command line for the Linux operating system in
/etc/default/grub , in the manner below:
GRUB_CMDLINE_LINUX="vsyscall=none" |
Rationale | Virtual Syscalls provide an opportunity of attack for a user who has control
of the return instruction pointer. |
Warnings | warning
The GRUB 2 configuration file, grub.cfg ,
is automatically updated each time a new kernel is installed. Note that any
changes to /etc/default/grub require rebuilding the grub.cfg
file. To update the GRUB 2 configuration file manually, use the
grub2-mkconfig -ocommand as follows:
|
check forkernel command line parameters vsyscall=none in /boot/grub2/grubenv for all kernels oval:ssg-test_grub2_vsyscall_argument_grub_env:tst:1 false
Following items have been found on the system:
Path | Content |
---|---|
/boot/grub2/grubenv | kernelopts=root=/dev/mapper/VolGroup-root ro audit=1 audit_backlog_limit=8192 crashkernel=auto resume=/dev/mapper/VolGroup-swap rd.lvm.lv=VolGroup/root rd.lvm.lv=VolGroup/swap rhgb quiet fips=1 boot=UUID=e5fe751a-8dfb-40d1-840e-ef8d20bc4298 random.trust_cpu=on pti=on page_poison=1 slub_debug=P |
Enable Auditing to Start Prior to the Audit Daemon in zIPL
Rule ID | xccdf_org.ssgproject.content_rule_zipl_audit_argument |
Result | notapplicable |
Multi-check rule | no |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-83321-0 |
Description | To ensure all processes can be audited, even those which start prior to the audit daemon,
check that all boot entries in /boot/loader/entries/*.conf have audit=1
included in its options.To ensure that new kernels and boot entries continue to enable audit, add audit=1 to /etc/kernel/cmdline . |
Rationale | Each process on the system carries an "auditable" flag which indicates whether
its activities can be audited. Although auditd takes care of enabling
this for all processes which launch after it does, adding the kernel argument
ensures it is set for every process during boot. |
Extend Audit Backlog Limit for the Audit Daemon in zIPL
Rule ID | xccdf_org.ssgproject.content_rule_zipl_audit_backlog_limit_argument |
Result | notapplicable |
Multi-check rule | no |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-83341-8 |
Description | To improve the kernel capacity to queue all log events, even those which start prior to the audit daemon,
check that all boot entries in /boot/loader/entries/*.conf have audit_backlog_limit=8192
included in its options.To ensure that new kernels and boot entries continue to extend the audit log events queue, add audit_backlog_limit=8192 to /etc/kernel/cmdline . |
Rationale | audit_backlog_limit sets the queue length for audit events awaiting transfer
to the audit daemon. Until the audit daemon is up and running, all log messages
are stored in this queue. If the queue is overrun during boot process, the action
defined by audit failure flag is taken. |
Ensure all zIPL boot entries are BLS compliant
Rule ID | xccdf_org.ssgproject.content_rule_zipl_bls_entries_only |
Result | notapplicable |
Multi-check rule | no |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-83485-3 |
Description | Ensure that zIPL boot entries fully adheres to Boot Loader Specification (BLS)
by checking that /etc/zipl.conf doesn't contain image = . |
Rationale | Red Hat Enterprise Linux 8 adheres to Boot Loader Specification (BLS) and is the prefered method of
configuration. |
Warnings | warning
To prevent breakage or removal of all boot entries oconfigured in /etc/zipl.conf
automated remediation for this rule is not available. |
Ensure zIPL bootmap is up to date
Rule ID | xccdf_org.ssgproject.content_rule_zipl_bootmap_is_up_to_date |
Result | notapplicable |
Multi-check rule | no |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-83486-1 |
Description | Make sure that /boot/bootmap is up to date.Every time a boot entry or zIPL configuration is changed /boot/bootmap needs to
be updated to reflect the changes.Run zipl command to generate an updated /boot/bootmap . |
Rationale | The file /boot/bootmap contains all boot data, keeping it up to date is crucial to
boot correct kernel and options. |
Enable page allocator poisoning in zIPL
Rule ID | xccdf_org.ssgproject.content_rule_zipl_page_poison_argument |
Result | notapplicable |
Multi-check rule | no |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-83351-7 |
Description | To enable poisoning of free pages,
check that all boot entries in /boot/loader/entries/*.conf have page_poison=1
included in its options.To ensure that new kernels and boot entries continue to enable page poisoning, add page_poison=1 to /etc/kernel/cmdline . |
Rationale | Poisoning writes an arbitrary value to freed pages, so any modification or
reference to that page after being freed or before being initialized will be
detected and prevented.
This prevents many types of use-after-free vulnerabilities at little performance cost.
Also prevents leak of data and detection of corrupted memory. |
Enable SLUB/SLAB allocator poisoning in zIPL
Rule ID | xccdf_org.ssgproject.content_rule_zipl_slub_debug_argument |
Result | notapplicable |
Multi-check rule | no |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-83371-5 |
Description | To enable poisoning of SLUB/SLAB objects,
check that all boot entries in /boot/loader/entries/*.conf have slub_debug=P
included in its options.To ensure that new kernels and boot entries continue to enable poisoning of SLUB/SLAB objects, add slub_debug=P to /etc/kernel/cmdline . |
Rationale | Poisoning writes an arbitrary value to freed objects, so any modification or
reference to that object after being freed or before being initialized will be
detected and prevented.
This prevents many types of use-after-free vulnerabilities at little performance cost.
Also prevents leak of data and detection of corrupted memory. |
Disable vsyscalls in zIPL
Rule ID | xccdf_org.ssgproject.content_rule_zipl_vsyscall_argument |
Result | notapplicable |
Multi-check rule | no |
Time | 2022-02-10T22:29:27+00:00 |
Severity | info |
Identifiers and References | Identifiers: CCE-83381-4 |
Description | To disable use of virtual syscalls,
check that all boot entries in /boot/loader/entries/*.conf have vsyscall=none
included in its options.To ensure that new kernels and boot entries continue to disable virtual syscalls, add vsyscall=none to /etc/kernel/cmdline . |
Rationale | Virtual Syscalls provide an opportunity of attack for a user who has control
of the return instruction pointer. |
Configure TLS for rsyslog remote logging
Rule ID | xccdf_org.ssgproject.content_rule_rsyslog_remote_tls |
Result | fail |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-rsyslog_remote_tls:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-82457-3 References: BP28(R43), 0988, 1405, AU-9(3), CM-6(a), FCS_TLSC_EXT.1, FTP_ITC_EXT.1.1, SRG-OS-000480-GPOS-00227, SRG-OS-000120-GPOS-00061 |
Description | Configure rsyslog to use Transport Layer
Security (TLS) support for logging to remote server
for the Forwarding Output Module in /etc/rsyslog.conf
using action. You can use the following command:
echo 'action(type="omfwd" protocol="tcp" Target="<remote system>" port="6514" StreamDriver="gtls" StreamDriverMode="1" StreamDriverAuthMode="x509/name" streamdriver.CheckExtendedKeyPurpose="on")' >> /etc/rsyslog.confReplace the <remote system> in the above command with an IP address or a host name of the remote logging server. |
Rationale | For protection of data being logged, the connection to the
remote logging server needs to be authenticated and encrypted. |
tests the omfwd action configuration oval:ssg-test_rsyslog_remote_tls:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_rsyslog_remote_tls:obj:1 of type textfilecontent54_object
Behaviors | Filepath | Pattern | Instance |
---|---|---|---|
no value | ^/etc/rsyslog\.(conf|d/.+\.conf)$ | ^\s*action\((?i)type(?-i)="omfwd"(.+?)\) | 0 |
Configure CA certificate for rsyslog remote logging
Rule ID | xccdf_org.ssgproject.content_rule_rsyslog_remote_tls_cacert |
Result | fail |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-rsyslog_remote_tls_cacert:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-82458-1 References: BP28(R43), 0988, 1405, FCS_TLSC_EXT.1, FTP_ITC_EXT.1.1, SRG-OS-000480-GPOS-00227 |
Description | Configure CA certificate for rsyslog logging
to remote server using Transport Layer Security (TLS)
using correct path for the DefaultNetstreamDriverCAFile
global option in /etc/rsyslog.conf , for example with the following command:
echo 'global(DefaultNetstreamDriverCAFile="/etc/pki/tls/cert.pem")' >> /etc/rsyslog.confReplace the /etc/pki/tls/cert.pem in the above command with the path to the file with CA certificate generated for the purpose of remote logging. |
Rationale | The CA certificate needs to be set or rsyslog.service
fails to start with
error: ca certificate is not set, cannot continue |
tests the DefaultNetstreamDriverCAFile configuration oval:ssg-test_rsyslog_remote_tls_cacert:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_rsyslog_remote_tls_cacert:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
^/etc/rsyslog\.(conf|d/.+\.conf)$ | ^\s*global\(DefaultNetstreamDriverCAFile="(.+?)"\)\s*\n | 0 |
Ensure rsyslog-gnutls is installed
Rule ID | xccdf_org.ssgproject.content_rule_package_rsyslog-gnutls_installed |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-package_rsyslog-gnutls_installed:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-82859-0 References: BP28(R43), CCI-000366, FTP_ITC_EXT.1.1, SRG-OS-000480-GPOS-00227, SRG-OS-000120-GPOS-00061, RHEL-08-030680, SV-230478r744011_rule |
Description | TLS protocol support for rsyslog is installed.
The rsyslog-gnutls package can be installed with the following command:
$ sudo yum install rsyslog-gnutls |
Rationale | The rsyslog-gnutls package provides Transport Layer Security (TLS) support
for the rsyslog daemon, which enables secure remote logging. |
package rsyslog-gnutls is installed oval:ssg-test_package_rsyslog-gnutls_installed:tst:1 true
Following items have been found on the system:
Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
---|---|---|---|---|---|---|---|
rsyslog-gnutls | x86_64 | (none) | 5.el8 | 8.2102.0 | 0:8.2102.0-5.el8 | 199e2f91fd431d51 | rsyslog-gnutls-0:8.2102.0-5.el8.x86_64 |
Ensure rsyslog is Installed
Rule ID | xccdf_org.ssgproject.content_rule_package_rsyslog_installed |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-package_rsyslog_installed:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-80847-7 References: BP28(R5), NT28(R46), 4.2.1.1, 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-001311, CCI-001312, CCI-000366, 164.312(a)(2)(ii), 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1, SRG-OS-000479-GPOS-00224, SRG-OS-000051-GPOS-00024, SRG-OS-000480-GPOS-00227, RHEL-08-030670, SV-230477r627750_rule |
Description | Rsyslog is installed by default. The rsyslog package can be installed with the following command: $ sudo yum install rsyslog |
Rationale | The rsyslog package provides the rsyslog daemon, which provides
system logging services. |
package rsyslog is installed oval:ssg-test_package_rsyslog_installed:tst:1 true
Following items have been found on the system:
Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
---|---|---|---|---|---|---|---|
rsyslog | x86_64 | (none) | 5.el8 | 8.2102.0 | 0:8.2102.0-5.el8 | 199e2f91fd431d51 | rsyslog-0:8.2102.0-5.el8.x86_64 |
Install firewalld Package
Rule ID | xccdf_org.ssgproject.content_rule_package_firewalld_installed |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-package_firewalld_installed:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-82998-6 References: 3.4.1.1, CCI-002314, CM-6(a), SRG-OS-000096-GPOS-00050, SRG-OS-000297-GPOS-00115, SRG-OS-000298-GPOS-00116, SRG-OS-000480-GPOS-00227, SRG-OS-000480-GPOS-00232, RHEL-08-040100, SV-230505r744020_rule |
Description | The firewalld package can be installed with the following command:
$ sudo yum install firewalld |
Rationale | The firewalld package should be installed to provide access control methods. |
package firewalld is installed oval:ssg-test_package_firewalld_installed:tst:1 true
Following items have been found on the system:
Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
---|---|---|---|---|---|---|---|
firewalld | noarch | (none) | 7.el8 | 0.9.3 | 0:0.9.3-7.el8 | 199e2f91fd431d51 | firewalld-0:0.9.3-7.el8.noarch |
Verify firewalld Enabled
Rule ID | xccdf_org.ssgproject.content_rule_service_firewalld_enabled |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-service_firewalld_enabled:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-80877-4 References: 3.4.2.1, 11, 3, 9, BAI10.01, BAI10.02, BAI10.03, BAI10.05, 3.1.3, 3.4.7, CCI-000366, CCI-000382, CCI-002314, 4.3.4.3.2, 4.3.4.3.3, SR 7.6, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, CIP-003-3 R4, CIP-003-3 R5, CIP-004-3 R3, AC-4, CM-7(b), CA-3(5), SC-7(21), CM-6(a), PR.IP-1, FMT_MOF_EXT.1, SRG-OS-000096-GPOS-00050, SRG-OS-000297-GPOS-00115, SRG-OS-000480-GPOS-00227, SRG-OS-000480-GPOS-00231, SRG-OS-000480-GPOS-00232, RHEL-08-040101, SV-244544r743881_rule |
Description |
The firewalld service can be enabled with the following command:
$ sudo systemctl enable firewalld.service |
Rationale | Access control methods provide the ability to enhance system security posture
by restricting services and known good IP addresses and address ranges. This
prevents connections from unknown hosts and protocols. |
package firewalld is installed oval:ssg-test_service_firewalld_package_firewalld_installed:tst:1 true
Following items have been found on the system:
Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
---|---|---|---|---|---|---|---|
firewalld | noarch | (none) | 7.el8 | 0.9.3 | 0:0.9.3-7.el8 | 199e2f91fd431d51 | firewalld-0:0.9.3-7.el8.noarch |
Test that the firewalld service is running oval:ssg-test_service_running_firewalld:tst:1 true
Following items have been found on the system:
Unit | Property | Value |
---|---|---|
firewalld.service | ActiveState | active |
systemd test oval:ssg-test_multi_user_wants_firewalld:tst:1 true
Following items have been found on the system:
Unit | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency |
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
multi-user.target | basic.target | sysinit.target | systemd-udev-trigger.service | systemd-firstboot.service | systemd-journald.service | systemd-tmpfiles-setup.service | systemd-journal-flush.service | systemd-sysctl.service | dev-mqueue.mount | systemd-udevd.service | swap.target | dev-disk-by\x2duuid-1e5c0ff6\x2dd83c\x2d4f59\x2db028\x2d3cdb40431877.swap | dev-mapper-VolGroup\x2dswap.swap | systemd-machine-id-commit.service | systemd-update-done.service | systemd-sysusers.service | dracut-shutdown.service | multipathd.service | cryptsetup.target | import-state.service | lvm2-monitor.service | plymouth-read-write.service | proc-sys-fs-binfmt_misc.automount | plymouth-start.service | systemd-tmpfiles-setup-dev.service | systemd-binfmt.service | systemd-journal-catalog-update.service | local-fs.target | var-log.mount | var-log-audit.mount | boot-efi.mount | var-tmp.mount | boot.mount | home.mount | var.mount | -.mount | tmp.mount | systemd-remount-fs.service | ostree-remount.service | kmod-static-nodes.service | ldconfig.service | systemd-ask-password-console.path | sys-fs-fuse-connections.mount | nis-domainname.service | dev-hugepages.mount | systemd-hwdb-update.service | systemd-random-seed.service | sys-kernel-debug.mount | loadmodules.service | lvm2-lvmpolld.socket | sys-kernel-config.mount | selinux-autorelabel-mark.service | systemd-modules-load.service | systemd-update-utmp.service | usbguard.service | paths.target | slices.target | system.slice | -.slice | microcode.service | timers.target | systemd-tmpfiles-clean.timer | dnf-automatic.timer | dnf-makecache.timer | unbound-anchor.timer | sockets.target | systemd-coredump.socket | systemd-udevd-control.socket | systemd-udevd-kernel.socket | systemd-initctl.socket | dbus.socket | systemd-journald.socket | dm-event.socket | multipathd.socket | systemd-journald-dev-log.socket | sssd-kcm.socket | chronyd.service | plymouth-quit.service | systemd-update-utmp-runlevel.service | systemd-user-sessions.service | crond.service | remote-fs.target | dbus.service | firewalld.service | rhsmcertd.service | mdmonitor.service | NetworkManager.service | plymouth-quit-wait.service | sshd.service | fapolicyd.service | rsyslog.service | systemd-ask-password-wall.path | systemd-logind.service | irqbalance.service | getty.target | getty@tty1.service | tuned.service | auditd.service | sssd.service |
systemd test oval:ssg-test_multi_user_wants_firewalld_socket:tst:1 false
Following items have been found on the system:
Unit | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency |
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
multi-user.target | basic.target | sysinit.target | systemd-udev-trigger.service | systemd-firstboot.service | systemd-journald.service | systemd-tmpfiles-setup.service | systemd-journal-flush.service | systemd-sysctl.service | dev-mqueue.mount | systemd-udevd.service | swap.target | dev-disk-by\x2duuid-1e5c0ff6\x2dd83c\x2d4f59\x2db028\x2d3cdb40431877.swap | dev-mapper-VolGroup\x2dswap.swap | systemd-machine-id-commit.service | systemd-update-done.service | systemd-sysusers.service | dracut-shutdown.service | multipathd.service | cryptsetup.target | import-state.service | lvm2-monitor.service | plymouth-read-write.service | proc-sys-fs-binfmt_misc.automount | plymouth-start.service | systemd-tmpfiles-setup-dev.service | systemd-binfmt.service | systemd-journal-catalog-update.service | local-fs.target | var-log.mount | var-log-audit.mount | boot-efi.mount | var-tmp.mount | boot.mount | home.mount | var.mount | -.mount | tmp.mount | systemd-remount-fs.service | ostree-remount.service | kmod-static-nodes.service | ldconfig.service | systemd-ask-password-console.path | sys-fs-fuse-connections.mount | nis-domainname.service | dev-hugepages.mount | systemd-hwdb-update.service | systemd-random-seed.service | sys-kernel-debug.mount | loadmodules.service | lvm2-lvmpolld.socket | sys-kernel-config.mount | selinux-autorelabel-mark.service | systemd-modules-load.service | systemd-update-utmp.service | usbguard.service | paths.target | slices.target | system.slice | -.slice | microcode.service | timers.target | systemd-tmpfiles-clean.timer | dnf-automatic.timer | dnf-makecache.timer | unbound-anchor.timer | sockets.target | systemd-coredump.socket | systemd-udevd-control.socket | systemd-udevd-kernel.socket | systemd-initctl.socket | dbus.socket | systemd-journald.socket | dm-event.socket | multipathd.socket | systemd-journald-dev-log.socket | sssd-kcm.socket | chronyd.service | plymouth-quit.service | systemd-update-utmp-runlevel.service | systemd-user-sessions.service | crond.service | remote-fs.target | dbus.service | firewalld.service | rhsmcertd.service | mdmonitor.service | NetworkManager.service | plymouth-quit-wait.service | sshd.service | fapolicyd.service | rsyslog.service | systemd-ask-password-wall.path | systemd-logind.service | irqbalance.service | getty.target | getty@tty1.service | tuned.service | auditd.service | sssd.service |
Configure Accepting Router Advertisements on All IPv6 Interfaces
Rule ID | xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_accept_ra |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-sysctl_net_ipv6_conf_all_accept_ra:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-81006-9 References: 3.2.9, 11, 14, 3, 9, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06, 3.1.20, CCI-000366, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.IP-1, PR.PT-3, SRG-OS-000480-GPOS-00227, RHEL-08-040261, SV-230541r627750_rule |
Description | To set the runtime status of the net.ipv6.conf.all.accept_ra kernel parameter, run the following command: $ sudo sysctl -w net.ipv6.conf.all.accept_ra=0To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d : net.ipv6.conf.all.accept_ra = 0 |
Rationale | An illicit router advertisement message could result in a man-in-the-middle attack. |
net.ipv6.conf.all.disable_ipv6 static configuration oval:ssg-test_static_sysctl_net_ipv6_conf_all_disable_ipv6:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
/etc/sysctl.conf | ^[\s]*net.ipv6.conf.all.disable_ipv6[\s]*=[\s]*1[\s]*$ | 1 |
net.ipv6.conf.all.disable_ipv6 static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_disable_ipv6:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_etc_sysctld_net_ipv6_conf_all_disable_ipv6:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/etc/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv6.conf.all.disable_ipv6[\s]*=[\s]*1[\s]*$ | 1 |
net.ipv6.conf.all.disable_ipv6 static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_disable_ipv6:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_run_sysctld_net_ipv6_conf_all_disable_ipv6:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/run/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv6.conf.all.disable_ipv6[\s]*=[\s]*1[\s]*$ | 1 |
net.ipv6.conf.all.disable_ipv6 static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_disable_ipv6:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_all_disable_ipv6:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/usr/lib/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv6.conf.all.disable_ipv6[\s]*=[\s]*1[\s]*$ | 1 |
kernel runtime parameter net.ipv6.conf.all.disable_ipv6 set to 1 oval:ssg-test_sysctl_runtime_net_ipv6_conf_all_disable_ipv6:tst:1 false
Following items have been found on the system:
Name | Value |
---|---|
net.ipv6.conf.all.disable_ipv6 | 0 |
net.ipv6.conf.all.accept_ra static configuration oval:ssg-test_static_sysctl_net_ipv6_conf_all_accept_ra:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/sysctl.conf | # Per CCE-81006-9: Set net.ipv6.conf.all.accept_ra = 0 in /etc/sysctl.conf net.ipv6.conf.all.accept_ra = 0 |
net.ipv6.conf.all.accept_ra static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_accept_ra:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/sysctl.d/99-sysctl.conf | # Per CCE-81006-9: Set net.ipv6.conf.all.accept_ra = 0 in /etc/sysctl.conf net.ipv6.conf.all.accept_ra = 0 |
net.ipv6.conf.all.accept_ra static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_accept_ra:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_run_sysctld_net_ipv6_conf_all_accept_ra:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/run/sysctl.d | ^.*\.conf$ | (?:^|.*\n)[^#]*net.ipv6.conf.all.accept_ra[\s]*=[\s]*(\d+)[\s]*\n | 1 |
net.ipv6.conf.all.accept_ra static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_accept_ra:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_all_accept_ra:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/usr/lib/sysctl.d | ^.*\.conf$ | (?:^|.*\n)[^#]*net.ipv6.conf.all.accept_ra[\s]*=[\s]*(\d+)[\s]*\n | 1 |
kernel runtime parameter net.ipv6.conf.all.accept_ra set to the appropriate value oval:ssg-test_sysctl_runtime_net_ipv6_conf_all_accept_ra:tst:1 true
Following items have been found on the system:
Name | Value |
---|---|
net.ipv6.conf.all.accept_ra | 0 |
Disable Accepting ICMP Redirects for All IPv6 Interfaces
Rule ID | xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_accept_redirects |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-sysctl_net_ipv6_conf_all_accept_redirects:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-81009-3 References: BP28(R22), 3.2.2, 11, 14, 3, 9, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06, 3.1.20, CCI-000366, CCI-001551, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), CM-6(b), CM-6.1(iv), PR.IP-1, PR.PT-3, SRG-OS-000480-GPOS-00227, RHEL-08-040280, SV-230544r744050_rule |
Description | To set the runtime status of the net.ipv6.conf.all.accept_redirects kernel parameter, run the following command: $ sudo sysctl -w net.ipv6.conf.all.accept_redirects=0To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d : net.ipv6.conf.all.accept_redirects = 0 |
Rationale | An illicit ICMP redirect message could result in a man-in-the-middle attack. |
net.ipv6.conf.all.disable_ipv6 static configuration oval:ssg-test_static_sysctl_net_ipv6_conf_all_disable_ipv6:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
/etc/sysctl.conf | ^[\s]*net.ipv6.conf.all.disable_ipv6[\s]*=[\s]*1[\s]*$ | 1 |
net.ipv6.conf.all.disable_ipv6 static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_disable_ipv6:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_etc_sysctld_net_ipv6_conf_all_disable_ipv6:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/etc/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv6.conf.all.disable_ipv6[\s]*=[\s]*1[\s]*$ | 1 |
net.ipv6.conf.all.disable_ipv6 static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_disable_ipv6:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_run_sysctld_net_ipv6_conf_all_disable_ipv6:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/run/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv6.conf.all.disable_ipv6[\s]*=[\s]*1[\s]*$ | 1 |
net.ipv6.conf.all.disable_ipv6 static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_disable_ipv6:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_all_disable_ipv6:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/usr/lib/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv6.conf.all.disable_ipv6[\s]*=[\s]*1[\s]*$ | 1 |
kernel runtime parameter net.ipv6.conf.all.disable_ipv6 set to 1 oval:ssg-test_sysctl_runtime_net_ipv6_conf_all_disable_ipv6:tst:1 false
Following items have been found on the system:
Name | Value |
---|---|
net.ipv6.conf.all.disable_ipv6 | 0 |
net.ipv6.conf.all.accept_redirects static configuration oval:ssg-test_static_sysctl_net_ipv6_conf_all_accept_redirects:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/sysctl.conf | # Per CCE-81009-3: Set net.ipv6.conf.all.accept_redirects = 0 in /etc/sysctl.conf net.ipv6.conf.all.accept_redirects = 0 |
net.ipv6.conf.all.accept_redirects static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_accept_redirects:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/sysctl.d/99-sysctl.conf | # Per CCE-81009-3: Set net.ipv6.conf.all.accept_redirects = 0 in /etc/sysctl.conf net.ipv6.conf.all.accept_redirects = 0 |
net.ipv6.conf.all.accept_redirects static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_accept_redirects:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_run_sysctld_net_ipv6_conf_all_accept_redirects:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/run/sysctl.d | ^.*\.conf$ | (?:^|.*\n)[^#]*net.ipv6.conf.all.accept_redirects[\s]*=[\s]*(\d+)[\s]*\n | 1 |
net.ipv6.conf.all.accept_redirects static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_accept_redirects:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_all_accept_redirects:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/usr/lib/sysctl.d | ^.*\.conf$ | (?:^|.*\n)[^#]*net.ipv6.conf.all.accept_redirects[\s]*=[\s]*(\d+)[\s]*\n | 1 |
kernel runtime parameter net.ipv6.conf.all.accept_redirects set to the appropriate value oval:ssg-test_sysctl_runtime_net_ipv6_conf_all_accept_redirects:tst:1 true
Following items have been found on the system:
Name | Value |
---|---|
net.ipv6.conf.all.accept_redirects | 0 |
Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces
Rule ID | xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_accept_source_route |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-sysctl_net_ipv6_conf_all_accept_source_route:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-81013-5 References: BP28(R22), 3.2.1, 1, 12, 13, 14, 15, 16, 18, 4, 6, 8, 9, APO01.06, APO13.01, DSS01.05, DSS03.01, DSS05.02, DSS05.04, DSS05.07, DSS06.02, 3.1.20, CCI-000366, 4.2.3.4, 4.3.3.4, 4.4.3.3, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.1.1, A.12.1.2, A.13.1.1, A.13.1.2, A.13.1.3, A.13.2.1, A.13.2.2, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CM-7(a), CM-7(b), CM-6(a), DE.AE-1, ID.AM-3, PR.AC-5, PR.DS-5, PR.PT-4, SRG-OS-000480-GPOS-00227, RHEL-08-040240, SV-230538r744042_rule |
Description | To set the runtime status of the net.ipv6.conf.all.accept_source_route kernel parameter, run the following command: $ sudo sysctl -w net.ipv6.conf.all.accept_source_route=0To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d : net.ipv6.conf.all.accept_source_route = 0 |
Rationale | Source-routed packets allow the source of the packet to suggest routers
forward the packet along a different path than configured on the router, which can
be used to bypass network security measures. This requirement applies only to the
forwarding of source-routerd traffic, such as when IPv6 forwarding is enabled and
the system is functioning as a router.
Accepting source-routed packets in the IPv6 protocol has few legitimate uses. It should be disabled unless it is absolutely required. |
net.ipv6.conf.all.disable_ipv6 static configuration oval:ssg-test_static_sysctl_net_ipv6_conf_all_disable_ipv6:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
/etc/sysctl.conf | ^[\s]*net.ipv6.conf.all.disable_ipv6[\s]*=[\s]*1[\s]*$ | 1 |
net.ipv6.conf.all.disable_ipv6 static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_disable_ipv6:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_etc_sysctld_net_ipv6_conf_all_disable_ipv6:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/etc/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv6.conf.all.disable_ipv6[\s]*=[\s]*1[\s]*$ | 1 |
net.ipv6.conf.all.disable_ipv6 static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_disable_ipv6:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_run_sysctld_net_ipv6_conf_all_disable_ipv6:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/run/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv6.conf.all.disable_ipv6[\s]*=[\s]*1[\s]*$ | 1 |
net.ipv6.conf.all.disable_ipv6 static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_disable_ipv6:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_all_disable_ipv6:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/usr/lib/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv6.conf.all.disable_ipv6[\s]*=[\s]*1[\s]*$ | 1 |
kernel runtime parameter net.ipv6.conf.all.disable_ipv6 set to 1 oval:ssg-test_sysctl_runtime_net_ipv6_conf_all_disable_ipv6:tst:1 false
Following items have been found on the system:
Name | Value |
---|---|
net.ipv6.conf.all.disable_ipv6 | 0 |
net.ipv6.conf.all.accept_source_route static configuration oval:ssg-test_static_sysctl_net_ipv6_conf_all_accept_source_route:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/sysctl.conf | # Per CCE-81013-5: Set net.ipv6.conf.all.accept_source_route = 0 in /etc/sysctl.conf net.ipv6.conf.all.accept_source_route = 0 |
net.ipv6.conf.all.accept_source_route static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_accept_source_route:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/sysctl.d/99-sysctl.conf | # Per CCE-81013-5: Set net.ipv6.conf.all.accept_source_route = 0 in /etc/sysctl.conf net.ipv6.conf.all.accept_source_route = 0 |
net.ipv6.conf.all.accept_source_route static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_accept_source_route:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_run_sysctld_net_ipv6_conf_all_accept_source_route:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/run/sysctl.d | ^.*\.conf$ | (?:^|.*\n)[^#]*net.ipv6.conf.all.accept_source_route[\s]*=[\s]*(\d+)[\s]*\n | 1 |
net.ipv6.conf.all.accept_source_route static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_accept_source_route:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_all_accept_source_route:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/usr/lib/sysctl.d | ^.*\.conf$ | (?:^|.*\n)[^#]*net.ipv6.conf.all.accept_source_route[\s]*=[\s]*(\d+)[\s]*\n | 1 |
kernel runtime parameter net.ipv6.conf.all.accept_source_route set to the appropriate value oval:ssg-test_sysctl_runtime_net_ipv6_conf_all_accept_source_route:tst:1 true
Following items have been found on the system:
Name | Value |
---|---|
net.ipv6.conf.all.accept_source_route | 0 |
Disable Accepting Router Advertisements on all IPv6 Interfaces by Default
Rule ID | xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_ra |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-sysctl_net_ipv6_conf_default_accept_ra:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-81007-7 References: 3.2.9, 11, 14, 3, 9, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06, 3.1.20, CCI-000366, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.IP-1, PR.PT-3, SRG-OS-000480-GPOS-00227, RHEL-08-040262, SV-230542r627750_rule |
Description | To set the runtime status of the net.ipv6.conf.default.accept_ra kernel parameter, run the following command: $ sudo sysctl -w net.ipv6.conf.default.accept_ra=0To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d : net.ipv6.conf.default.accept_ra = 0 |
Rationale | An illicit router advertisement message could result in a man-in-the-middle attack. |
net.ipv6.conf.all.disable_ipv6 static configuration oval:ssg-test_static_sysctl_net_ipv6_conf_all_disable_ipv6:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
/etc/sysctl.conf | ^[\s]*net.ipv6.conf.all.disable_ipv6[\s]*=[\s]*1[\s]*$ | 1 |
net.ipv6.conf.all.disable_ipv6 static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_disable_ipv6:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_etc_sysctld_net_ipv6_conf_all_disable_ipv6:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/etc/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv6.conf.all.disable_ipv6[\s]*=[\s]*1[\s]*$ | 1 |
net.ipv6.conf.all.disable_ipv6 static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_disable_ipv6:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_run_sysctld_net_ipv6_conf_all_disable_ipv6:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/run/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv6.conf.all.disable_ipv6[\s]*=[\s]*1[\s]*$ | 1 |
net.ipv6.conf.all.disable_ipv6 static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_disable_ipv6:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_all_disable_ipv6:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/usr/lib/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv6.conf.all.disable_ipv6[\s]*=[\s]*1[\s]*$ | 1 |
kernel runtime parameter net.ipv6.conf.all.disable_ipv6 set to 1 oval:ssg-test_sysctl_runtime_net_ipv6_conf_all_disable_ipv6:tst:1 false
Following items have been found on the system:
Name | Value |
---|---|
net.ipv6.conf.all.disable_ipv6 | 0 |
net.ipv6.conf.default.accept_ra static configuration oval:ssg-test_static_sysctl_net_ipv6_conf_default_accept_ra:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/sysctl.conf | # Per CCE-81007-7: Set net.ipv6.conf.default.accept_ra = 0 in /etc/sysctl.conf net.ipv6.conf.default.accept_ra = 0 |
net.ipv6.conf.default.accept_ra static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_accept_ra:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/sysctl.d/99-sysctl.conf | # Per CCE-81007-7: Set net.ipv6.conf.default.accept_ra = 0 in /etc/sysctl.conf net.ipv6.conf.default.accept_ra = 0 |
net.ipv6.conf.default.accept_ra static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_accept_ra:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_run_sysctld_net_ipv6_conf_default_accept_ra:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/run/sysctl.d | ^.*\.conf$ | (?:^|.*\n)[^#]*net.ipv6.conf.default.accept_ra[\s]*=[\s]*(\d+)[\s]*\n | 1 |
net.ipv6.conf.default.accept_ra static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_accept_ra:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_default_accept_ra:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/usr/lib/sysctl.d | ^.*\.conf$ | (?:^|.*\n)[^#]*net.ipv6.conf.default.accept_ra[\s]*=[\s]*(\d+)[\s]*\n | 1 |
kernel runtime parameter net.ipv6.conf.default.accept_ra set to the appropriate value oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_accept_ra:tst:1 true
Following items have been found on the system:
Name | Value |
---|---|
net.ipv6.conf.default.accept_ra | 0 |
Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
Rule ID | xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_redirects |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-sysctl_net_ipv6_conf_default_accept_redirects:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-81010-1 References: BP28(R22), 3.2.2, 11, 14, 3, 9, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06, 3.1.20, CCI-000366, CCI-001551, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.IP-1, PR.PT-3, SRG-OS-000480-GPOS-00227, RHEL-08-040210, SV-230535r744035_rule |
Description | To set the runtime status of the net.ipv6.conf.default.accept_redirects kernel parameter, run the following command: $ sudo sysctl -w net.ipv6.conf.default.accept_redirects=0To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d : net.ipv6.conf.default.accept_redirects = 0 |
Rationale | An illicit ICMP redirect message could result in a man-in-the-middle attack. |
net.ipv6.conf.all.disable_ipv6 static configuration oval:ssg-test_static_sysctl_net_ipv6_conf_all_disable_ipv6:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
/etc/sysctl.conf | ^[\s]*net.ipv6.conf.all.disable_ipv6[\s]*=[\s]*1[\s]*$ | 1 |
net.ipv6.conf.all.disable_ipv6 static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_disable_ipv6:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_etc_sysctld_net_ipv6_conf_all_disable_ipv6:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/etc/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv6.conf.all.disable_ipv6[\s]*=[\s]*1[\s]*$ | 1 |
net.ipv6.conf.all.disable_ipv6 static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_disable_ipv6:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_run_sysctld_net_ipv6_conf_all_disable_ipv6:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/run/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv6.conf.all.disable_ipv6[\s]*=[\s]*1[\s]*$ | 1 |
net.ipv6.conf.all.disable_ipv6 static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_disable_ipv6:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_all_disable_ipv6:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/usr/lib/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv6.conf.all.disable_ipv6[\s]*=[\s]*1[\s]*$ | 1 |
kernel runtime parameter net.ipv6.conf.all.disable_ipv6 set to 1 oval:ssg-test_sysctl_runtime_net_ipv6_conf_all_disable_ipv6:tst:1 false
Following items have been found on the system:
Name | Value |
---|---|
net.ipv6.conf.all.disable_ipv6 | 0 |
net.ipv6.conf.default.accept_redirects static configuration oval:ssg-test_static_sysctl_net_ipv6_conf_default_accept_redirects:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/sysctl.conf | # Per CCE-81010-1: Set net.ipv6.conf.default.accept_redirects = 0 in /etc/sysctl.conf net.ipv6.conf.default.accept_redirects = 0 |
net.ipv6.conf.default.accept_redirects static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_accept_redirects:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/sysctl.d/99-sysctl.conf | # Per CCE-81010-1: Set net.ipv6.conf.default.accept_redirects = 0 in /etc/sysctl.conf net.ipv6.conf.default.accept_redirects = 0 |
net.ipv6.conf.default.accept_redirects static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_accept_redirects:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_run_sysctld_net_ipv6_conf_default_accept_redirects:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/run/sysctl.d | ^.*\.conf$ | (?:^|.*\n)[^#]*net.ipv6.conf.default.accept_redirects[\s]*=[\s]*(\d+)[\s]*\n | 1 |
net.ipv6.conf.default.accept_redirects static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_accept_redirects:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_default_accept_redirects:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/usr/lib/sysctl.d | ^.*\.conf$ | (?:^|.*\n)[^#]*net.ipv6.conf.default.accept_redirects[\s]*=[\s]*(\d+)[\s]*\n | 1 |
kernel runtime parameter net.ipv6.conf.default.accept_redirects set to the appropriate value oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_accept_redirects:tst:1 true
Following items have been found on the system:
Name | Value |
---|---|
net.ipv6.conf.default.accept_redirects | 0 |
Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default
Rule ID | xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_source_route |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-sysctl_net_ipv6_conf_default_accept_source_route:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-81015-0 References: BP28(R22), 3.2.1, 1, 12, 13, 14, 15, 16, 18, 4, 6, 8, 9, APO01.06, APO13.01, DSS01.05, DSS03.01, DSS05.02, DSS05.04, DSS05.07, DSS06.02, 3.1.20, CCI-000366, 4.2.3.4, 4.3.3.4, 4.4.3.3, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.1.1, A.12.1.2, A.13.1.1, A.13.1.2, A.13.1.3, A.13.2.1, A.13.2.2, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CM-7(a), CM-7(b), CM-6(a), CM-6(b), CM-6.1(iv), DE.AE-1, ID.AM-3, PR.AC-5, PR.DS-5, PR.PT-4, SRG-OS-000480-GPOS-00227, RHEL-08-040250, SV-230539r744045_rule |
Description | To set the runtime status of the net.ipv6.conf.default.accept_source_route kernel parameter, run the following command: $ sudo sysctl -w net.ipv6.conf.default.accept_source_route=0To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d : net.ipv6.conf.default.accept_source_route = 0 |
Rationale | Source-routed packets allow the source of the packet to suggest routers
forward the packet along a different path than configured on the router, which can
be used to bypass network security measures. This requirement applies only to the
forwarding of source-routerd traffic, such as when IPv6 forwarding is enabled and
the system is functioning as a router.
Accepting source-routed packets in the IPv6 protocol has few legitimate
uses. It should be disabled unless it is absolutely required. |
net.ipv6.conf.all.disable_ipv6 static configuration oval:ssg-test_static_sysctl_net_ipv6_conf_all_disable_ipv6:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
/etc/sysctl.conf | ^[\s]*net.ipv6.conf.all.disable_ipv6[\s]*=[\s]*1[\s]*$ | 1 |
net.ipv6.conf.all.disable_ipv6 static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_disable_ipv6:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_etc_sysctld_net_ipv6_conf_all_disable_ipv6:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/etc/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv6.conf.all.disable_ipv6[\s]*=[\s]*1[\s]*$ | 1 |
net.ipv6.conf.all.disable_ipv6 static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_disable_ipv6:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_run_sysctld_net_ipv6_conf_all_disable_ipv6:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/run/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv6.conf.all.disable_ipv6[\s]*=[\s]*1[\s]*$ | 1 |
net.ipv6.conf.all.disable_ipv6 static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_disable_ipv6:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_all_disable_ipv6:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/usr/lib/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv6.conf.all.disable_ipv6[\s]*=[\s]*1[\s]*$ | 1 |
kernel runtime parameter net.ipv6.conf.all.disable_ipv6 set to 1 oval:ssg-test_sysctl_runtime_net_ipv6_conf_all_disable_ipv6:tst:1 false
Following items have been found on the system:
Name | Value |
---|---|
net.ipv6.conf.all.disable_ipv6 | 0 |
net.ipv6.conf.default.accept_source_route static configuration oval:ssg-test_static_sysctl_net_ipv6_conf_default_accept_source_route:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/sysctl.conf | # Per CCE-81015-0: Set net.ipv6.conf.default.accept_source_route = 0 in /etc/sysctl.conf net.ipv6.conf.default.accept_source_route = 0 |
net.ipv6.conf.default.accept_source_route static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_accept_source_route:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/sysctl.d/99-sysctl.conf | # Per CCE-81015-0: Set net.ipv6.conf.default.accept_source_route = 0 in /etc/sysctl.conf net.ipv6.conf.default.accept_source_route = 0 |
net.ipv6.conf.default.accept_source_route static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_accept_source_route:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_run_sysctld_net_ipv6_conf_default_accept_source_route:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/run/sysctl.d | ^.*\.conf$ | (?:^|.*\n)[^#]*net.ipv6.conf.default.accept_source_route[\s]*=[\s]*(\d+)[\s]*\n | 1 |
net.ipv6.conf.default.accept_source_route static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_accept_source_route:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_default_accept_source_route:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/usr/lib/sysctl.d | ^.*\.conf$ | (?:^|.*\n)[^#]*net.ipv6.conf.default.accept_source_route[\s]*=[\s]*(\d+)[\s]*\n | 1 |
kernel runtime parameter net.ipv6.conf.default.accept_source_route set to the appropriate value oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_accept_source_route:tst:1 true
Following items have been found on the system:
Name | Value |
---|---|
net.ipv6.conf.default.accept_source_route | 0 |
Disable Accepting ICMP Redirects for All IPv4 Interfaces
Rule ID | xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_accept_redirects |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-sysctl_net_ipv4_conf_all_accept_redirects:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-80917-8 References: BP28(R22), 3.2.2, 1, 11, 12, 13, 14, 15, 16, 2, 3, 7, 8, 9, 5.10.1.1, APO13.01, BAI04.04, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS05.02, DSS05.05, DSS05.07, DSS06.06, 3.1.20, CCI-000366, CCI-001503, CCI-001551, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 6.2, SR 7.1, SR 7.2, SR 7.6, A.12.1.2, A.12.1.3, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.17.2.1, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), SC-7(a), DE.CM-1, PR.DS-4, PR.IP-1, PR.PT-3, SRG-OS-000480-GPOS-00227, RHEL-08-040279, SV-244553r743908_rule |
Description | To set the runtime status of the net.ipv4.conf.all.accept_redirects kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.all.accept_redirects=0To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d : net.ipv4.conf.all.accept_redirects = 0 |
Rationale | ICMP redirect messages are used by routers to inform hosts that a more
direct route exists for a particular destination. These messages modify the
host's route table and are unauthenticated. An illicit ICMP redirect
message could result in a man-in-the-middle attack.
This feature of the IPv4 protocol has few legitimate uses. It should be disabled unless absolutely required." |
net.ipv4.conf.all.accept_redirects static configuration oval:ssg-test_static_sysctl_net_ipv4_conf_all_accept_redirects:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/sysctl.conf | # Per CCE-80917-8: Set net.ipv4.conf.all.accept_redirects = 0 in /etc/sysctl.conf net.ipv4.conf.all.accept_redirects = 0 |
net.ipv4.conf.all.accept_redirects static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_accept_redirects:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/sysctl.d/99-sysctl.conf | # Per CCE-80917-8: Set net.ipv4.conf.all.accept_redirects = 0 in /etc/sysctl.conf net.ipv4.conf.all.accept_redirects = 0 |
net.ipv4.conf.all.accept_redirects static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_accept_redirects:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_accept_redirects:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/run/sysctl.d | ^.*\.conf$ | (?:^|.*\n)[^#]*net.ipv4.conf.all.accept_redirects[\s]*=[\s]*(\d+)[\s]*\n | 1 |
net.ipv4.conf.all.accept_redirects static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_accept_redirects:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_accept_redirects:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/usr/lib/sysctl.d | ^.*\.conf$ | (?:^|.*\n)[^#]*net.ipv4.conf.all.accept_redirects[\s]*=[\s]*(\d+)[\s]*\n | 1 |
kernel runtime parameter net.ipv4.conf.all.accept_redirects set to the appropriate value oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_accept_redirects:tst:1 true
Following items have been found on the system:
Name | Value |
---|---|
net.ipv4.conf.all.accept_redirects | 0 |
Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
Rule ID | xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_accept_source_route |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-sysctl_net_ipv4_conf_all_accept_source_route:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-81011-9 References: BP28(R22), 3.2.1, 1, 11, 12, 13, 14, 15, 16, 18, 2, 3, 4, 6, 7, 8, 9, APO01.06, APO13.01, BAI04.04, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS01.05, DSS03.01, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, DSS06.02, DSS06.06, 3.1.20, CCI-000366, 4.2.3.4, 4.3.3.4, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, 4.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.2, SR 7.1, SR 7.2, SR 7.6, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.1.1, A.12.1.2, A.12.1.3, A.12.5.1, A.12.6.2, A.13.1.1, A.13.1.2, A.13.1.3, A.13.2.1, A.13.2.2, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.17.2.1, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CIP-007-3 R4, CIP-007-3 R4.1, CIP-007-3 R4.2, CIP-007-3 R5.1, CM-7(a), CM-7(b), SC-5, CM-6(a), SC-7(a), DE.AE-1, DE.CM-1, ID.AM-3, PR.AC-5, PR.DS-4, PR.DS-5, PR.IP-1, PR.PT-3, PR.PT-4, SRG-OS-000480-GPOS-00227, RHEL-08-040239, SV-244551r743902_rule |
Description | To set the runtime status of the net.ipv4.conf.all.accept_source_route kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.all.accept_source_route=0To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d : net.ipv4.conf.all.accept_source_route = 0 |
Rationale | Source-routed packets allow the source of the packet to suggest routers
forward the packet along a different path than configured on the router,
which can be used to bypass network security measures. This requirement
applies only to the forwarding of source-routerd traffic, such as when IPv4
forwarding is enabled and the system is functioning as a router.
Accepting source-routed packets in the IPv4 protocol has few legitimate uses. It should be disabled unless it is absolutely required. |
net.ipv4.conf.all.accept_source_route static configuration oval:ssg-test_static_sysctl_net_ipv4_conf_all_accept_source_route:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_sysctl_net_ipv4_conf_all_accept_source_route:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
/etc/sysctl.conf | (?:^|.*\n)[^#]*net.ipv4.conf.all.accept_source_route[\s]*=[\s]*(\d+)[\s]*\n | 1 |
net.ipv4.conf.all.accept_source_route static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_accept_source_route:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_accept_source_route:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/etc/sysctl.d | ^.*\.conf$ | (?:^|.*\n)[^#]*net.ipv4.conf.all.accept_source_route[\s]*=[\s]*(\d+)[\s]*\n | 1 |
net.ipv4.conf.all.accept_source_route static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_accept_source_route:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_accept_source_route:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/run/sysctl.d | ^.*\.conf$ | (?:^|.*\n)[^#]*net.ipv4.conf.all.accept_source_route[\s]*=[\s]*(\d+)[\s]*\n | 1 |
net.ipv4.conf.all.accept_source_route static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_accept_source_route:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/usr/lib/sysctl.d/50-default.conf | # Do not accept source routing net.ipv4.conf.all.accept_source_route = 0 |
kernel runtime parameter net.ipv4.conf.all.accept_source_route set to the appropriate value oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_accept_source_route:tst:1 true
Following items have been found on the system:
Name | Value |
---|---|
net.ipv4.conf.all.accept_source_route | 0 |
Enable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
Rule ID | xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_log_martians |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-sysctl_net_ipv4_conf_all_log_martians:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | unknown |
Identifiers and References | Identifiers: CCE-81018-4 References: BP28(R22), 3.2.4, 1, 11, 12, 13, 14, 15, 16, 2, 3, 7, 8, 9, APO13.01, BAI04.04, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS01.04, DSS03.05, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.06, 3.1.20, CCI-000126, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.2, SR 7.1, SR 7.2, SR 7.6, A.11.2.6, A.12.1.2, A.12.1.3, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.17.2.1, A.6.2.1, A.6.2.2, A.9.1.2, CM-7(a), CM-7(b), SC-5(3)(a), DE.CM-1, PR.AC-3, PR.DS-4, PR.IP-1, PR.PT-3, PR.PT-4, SRG-OS-000480-GPOS-00227 |
Description | To set the runtime status of the net.ipv4.conf.all.log_martians kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.all.log_martians=1To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d : net.ipv4.conf.all.log_martians = 1 |
Rationale | The presence of "martian" packets (which have impossible addresses)
as well as spoofed packets, source-routed packets, and redirects could be a
sign of nefarious network activity. Logging these packets enables this activity
to be detected. |
net.ipv4.conf.all.log_martians static configuration oval:ssg-test_static_sysctl_net_ipv4_conf_all_log_martians:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/sysctl.conf | # Per CCE-81018-4: Set net.ipv4.conf.all.log_martians = 1 in /etc/sysctl.conf net.ipv4.conf.all.log_martians = 1 |
net.ipv4.conf.all.log_martians static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_log_martians:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/sysctl.d/99-sysctl.conf | # Per CCE-81018-4: Set net.ipv4.conf.all.log_martians = 1 in /etc/sysctl.conf net.ipv4.conf.all.log_martians = 1 |
net.ipv4.conf.all.log_martians static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_log_martians:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_log_martians:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/run/sysctl.d | ^.*\.conf$ | (?:^|.*\n)[^#]*net.ipv4.conf.all.log_martians[\s]*=[\s]*(\d+)[\s]*\n | 1 |
net.ipv4.conf.all.log_martians static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_log_martians:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_log_martians:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/usr/lib/sysctl.d | ^.*\.conf$ | (?:^|.*\n)[^#]*net.ipv4.conf.all.log_martians[\s]*=[\s]*(\d+)[\s]*\n | 1 |
kernel runtime parameter net.ipv4.conf.all.log_martians set to the appropriate value oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_log_martians:tst:1 true
Following items have been found on the system:
Name | Value |
---|---|
net.ipv4.conf.all.log_martians | 1 |
Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
Rule ID | xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_rp_filter |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-sysctl_net_ipv4_conf_all_rp_filter:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-81021-8 References: BP28(R22), 3.2.7, 1, 12, 13, 14, 15, 16, 18, 2, 4, 6, 7, 8, 9, APO01.06, APO13.01, BAI04.04, DSS01.03, DSS01.05, DSS03.01, DSS03.05, DSS05.02, DSS05.04, DSS05.07, DSS06.02, 3.1.20, CCI-000366, CCI-001551, 4.2.3.4, 4.3.3.4, 4.4.3.3, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.2, SR 7.1, SR 7.2, SR 7.6, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.1.1, A.12.1.2, A.12.1.3, A.13.1.1, A.13.1.2, A.13.1.3, A.13.2.1, A.13.2.2, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.17.2.1, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CM-7(a), CM-7(b), CM-6(a), SC-7(a), DE.AE-1, DE.CM-1, ID.AM-3, PR.AC-5, PR.DS-4, PR.DS-5, PR.PT-4, SRG-OS-000480-GPOS-00227, RHEL-08-040285, SV-230549r627750_rule |
Description | To set the runtime status of the net.ipv4.conf.all.rp_filter kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.all.rp_filter=1To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d : net.ipv4.conf.all.rp_filter = 1 |
Rationale | Enabling reverse path filtering drops packets with source addresses
that should not have been able to be received on the interface they were
received on. It should not be used on systems which are routers for
complicated networks, but is helpful for end hosts and routers serving small
networks. |
net.ipv4.conf.all.rp_filter static configuration oval:ssg-test_static_sysctl_net_ipv4_conf_all_rp_filter:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_sysctl_net_ipv4_conf_all_rp_filter:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
/etc/sysctl.conf | (?:^|.*\n)[^#]*net.ipv4.conf.all.rp_filter[\s]*=[\s]*(\d+)[\s]*\n | 1 |
net.ipv4.conf.all.rp_filter static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_rp_filter:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_rp_filter:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/etc/sysctl.d | ^.*\.conf$ | (?:^|.*\n)[^#]*net.ipv4.conf.all.rp_filter[\s]*=[\s]*(\d+)[\s]*\n | 1 |
net.ipv4.conf.all.rp_filter static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_rp_filter:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_rp_filter:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/run/sysctl.d | ^.*\.conf$ | (?:^|.*\n)[^#]*net.ipv4.conf.all.rp_filter[\s]*=[\s]*(\d+)[\s]*\n | 1 |
net.ipv4.conf.all.rp_filter static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_rp_filter:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/usr/lib/sysctl.d/50-default.conf | # Source route verification net.ipv4.conf.all.rp_filter = 1 |
kernel runtime parameter net.ipv4.conf.all.rp_filter set to the appropriate value oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_rp_filter:tst:1 true
Following items have been found on the system:
Name | Value |
---|---|
net.ipv4.conf.all.rp_filter | 1 |
Disable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
Rule ID | xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_secure_redirects |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-sysctl_net_ipv4_conf_all_secure_redirects:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-81016-8 References: BP28(R22), 3.2.3, 1, 11, 12, 13, 14, 15, 16, 18, 2, 3, 4, 6, 7, 8, 9, APO01.06, APO13.01, BAI04.04, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS01.05, DSS03.01, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, DSS06.02, DSS06.06, 3.1.20, CCI-001503, CCI-001551, 4.2.3.4, 4.3.3.4, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, 4.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.2, SR 7.1, SR 7.2, SR 7.6, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.1.1, A.12.1.2, A.12.1.3, A.12.5.1, A.12.6.2, A.13.1.1, A.13.1.2, A.13.1.3, A.13.2.1, A.13.2.2, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.17.2.1, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CM-7(a), CM-7(b), CM-6(a), SC-7(a), DE.AE-1, DE.CM-1, ID.AM-3, PR.AC-5, PR.DS-4, PR.DS-5, PR.IP-1, PR.PT-3, PR.PT-4, SRG-OS-000480-GPOS-00227 |
Description | To set the runtime status of the net.ipv4.conf.all.secure_redirects kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.all.secure_redirects=0To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d : net.ipv4.conf.all.secure_redirects = 0 |
Rationale | Accepting "secure" ICMP redirects (from those gateways listed as
default gateways) has few legitimate uses. It should be disabled unless it is
absolutely required. |
net.ipv4.conf.all.secure_redirects static configuration oval:ssg-test_static_sysctl_net_ipv4_conf_all_secure_redirects:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/sysctl.conf | # Per CCE-81016-8: Set net.ipv4.conf.all.secure_redirects = 0 in /etc/sysctl.conf net.ipv4.conf.all.secure_redirects = 0 |
net.ipv4.conf.all.secure_redirects static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_secure_redirects:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/sysctl.d/99-sysctl.conf | # Per CCE-81016-8: Set net.ipv4.conf.all.secure_redirects = 0 in /etc/sysctl.conf net.ipv4.conf.all.secure_redirects = 0 |
net.ipv4.conf.all.secure_redirects static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_secure_redirects:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_secure_redirects:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/run/sysctl.d | ^.*\.conf$ | (?:^|.*\n)[^#]*net.ipv4.conf.all.secure_redirects[\s]*=[\s]*(\d+)[\s]*\n | 1 |
net.ipv4.conf.all.secure_redirects static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_secure_redirects:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_secure_redirects:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/usr/lib/sysctl.d | ^.*\.conf$ | (?:^|.*\n)[^#]*net.ipv4.conf.all.secure_redirects[\s]*=[\s]*(\d+)[\s]*\n | 1 |
kernel runtime parameter net.ipv4.conf.all.secure_redirects set to the appropriate value oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_secure_redirects:tst:1 true
Following items have been found on the system:
Name | Value |
---|---|
net.ipv4.conf.all.secure_redirects | 0 |
Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
Rule ID | xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_accept_redirects |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-sysctl_net_ipv4_conf_default_accept_redirects:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-80919-4 References: BP28(R22), 3.2.2, 1, 11, 12, 13, 14, 15, 16, 18, 2, 3, 4, 6, 7, 8, 9, 5.10.1.1, APO01.06, APO13.01, BAI04.04, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS01.05, DSS03.01, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, DSS06.02, DSS06.06, 3.1.20, CCI-000366, CCI-001551, 4.2.3.4, 4.3.3.4, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, 4.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.2, SR 7.1, SR 7.2, SR 7.6, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.1.1, A.12.1.2, A.12.1.3, A.12.5.1, A.12.6.2, A.13.1.1, A.13.1.2, A.13.1.3, A.13.2.1, A.13.2.2, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.17.2.1, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CM-7(a), CM-7(b), CM-6(a), SC-7(a), DE.AE-1, DE.CM-1, ID.AM-3, PR.AC-5, PR.DS-4, PR.DS-5, PR.IP-1, PR.PT-3, PR.PT-4, SRG-OS-000480-GPOS-00227, RHEL-08-040209, SV-244550r743899_rule |
Description | To set the runtime status of the net.ipv4.conf.default.accept_redirects kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.default.accept_redirects=0To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d : net.ipv4.conf.default.accept_redirects = 0 |
Rationale | ICMP redirect messages are used by routers to inform hosts that a more
direct route exists for a particular destination. These messages modify the
host's route table and are unauthenticated. An illicit ICMP redirect
message could result in a man-in-the-middle attack.
This feature of the IPv4 protocol has few legitimate uses. It should be disabled unless absolutely required. |
net.ipv4.conf.default.accept_redirects static configuration oval:ssg-test_static_sysctl_net_ipv4_conf_default_accept_redirects:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/sysctl.conf | # Per CCE-80919-4: Set net.ipv4.conf.default.accept_redirects = 0 in /etc/sysctl.conf net.ipv4.conf.default.accept_redirects = 0 |
net.ipv4.conf.default.accept_redirects static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_etc_sysctld_net_ipv4_conf_default_accept_redirects:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/sysctl.d/99-sysctl.conf | # Per CCE-80919-4: Set net.ipv4.conf.default.accept_redirects = 0 in /etc/sysctl.conf net.ipv4.conf.default.accept_redirects = 0 |
net.ipv4.conf.default.accept_redirects static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_run_sysctld_net_ipv4_conf_default_accept_redirects:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_run_sysctld_net_ipv4_conf_default_accept_redirects:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/run/sysctl.d | ^.*\.conf$ | (?:^|.*\n)[^#]*net.ipv4.conf.default.accept_redirects[\s]*=[\s]*(\d+)[\s]*\n | 1 |
net.ipv4.conf.default.accept_redirects static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_default_accept_redirects:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_default_accept_redirects:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/usr/lib/sysctl.d | ^.*\.conf$ | (?:^|.*\n)[^#]*net.ipv4.conf.default.accept_redirects[\s]*=[\s]*(\d+)[\s]*\n | 1 |
kernel runtime parameter net.ipv4.conf.default.accept_redirects set to the appropriate value oval:ssg-test_sysctl_runtime_net_ipv4_conf_default_accept_redirects:tst:1 true
Following items have been found on the system:
Name | Value |
---|---|
net.ipv4.conf.default.accept_redirects | 0 |
Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
Rule ID | xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_accept_source_route |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-sysctl_net_ipv4_conf_default_accept_source_route:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-80920-2 References: BP28(R22), 3.2.1, 1, 11, 12, 13, 14, 15, 16, 18, 2, 3, 4, 6, 7, 8, 9, 5.10.1.1, APO01.06, APO13.01, BAI04.04, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS01.05, DSS03.01, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, DSS06.02, DSS06.06, 3.1.20, CCI-000366, CCI-001551, 4.2.3.4, 4.3.3.4, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, 4.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.2, SR 7.1, SR 7.2, SR 7.6, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.1.1, A.12.1.2, A.12.1.3, A.12.5.1, A.12.6.2, A.13.1.1, A.13.1.2, A.13.1.3, A.13.2.1, A.13.2.2, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.17.2.1, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CIP-007-3 R4, CIP-007-3 R4.1, CIP-007-3 R4.2, CIP-007-3 R5.1, CM-7(a), CM-7(b), SC-5, SC-7(a), DE.AE-1, DE.CM-1, ID.AM-3, PR.AC-5, PR.DS-4, PR.DS-5, PR.IP-1, PR.PT-3, PR.PT-4, SRG-OS-000480-GPOS-00227, RHEL-08-040249, SV-244552r743905_rule |
Description | To set the runtime status of the net.ipv4.conf.default.accept_source_route kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.default.accept_source_route=0To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d : net.ipv4.conf.default.accept_source_route = 0 |
Rationale | Source-routed packets allow the source of the packet to suggest routers
forward the packet along a different path than configured on the router,
which can be used to bypass network security measures.
Accepting source-routed packets in the IPv4 protocol has few legitimate uses. It should be disabled unless it is absolutely required, such as when IPv4 forwarding is enabled and the system is legitimately functioning as a router. |
net.ipv4.conf.default.accept_source_route static configuration oval:ssg-test_static_sysctl_net_ipv4_conf_default_accept_source_route:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/sysctl.conf | # Per CCE-80920-2: Set net.ipv4.conf.default.accept_source_route = 0 in /etc/sysctl.conf net.ipv4.conf.default.accept_source_route = 0 |
net.ipv4.conf.default.accept_source_route static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_etc_sysctld_net_ipv4_conf_default_accept_source_route:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/sysctl.d/99-sysctl.conf | # Per CCE-80920-2: Set net.ipv4.conf.default.accept_source_route = 0 in /etc/sysctl.conf net.ipv4.conf.default.accept_source_route = 0 |
net.ipv4.conf.default.accept_source_route static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_run_sysctld_net_ipv4_conf_default_accept_source_route:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_run_sysctld_net_ipv4_conf_default_accept_source_route:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/run/sysctl.d | ^.*\.conf$ | (?:^|.*\n)[^#]*net.ipv4.conf.default.accept_source_route[\s]*=[\s]*(\d+)[\s]*\n | 1 |
net.ipv4.conf.default.accept_source_route static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_default_accept_source_route:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_default_accept_source_route:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/usr/lib/sysctl.d | ^.*\.conf$ | (?:^|.*\n)[^#]*net.ipv4.conf.default.accept_source_route[\s]*=[\s]*(\d+)[\s]*\n | 1 |
kernel runtime parameter net.ipv4.conf.default.accept_source_route set to the appropriate value oval:ssg-test_sysctl_runtime_net_ipv4_conf_default_accept_source_route:tst:1 true
Following items have been found on the system:
Name | Value |
---|---|
net.ipv4.conf.default.accept_source_route | 0 |
Enable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
Rule ID | xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_log_martians |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-sysctl_net_ipv4_conf_default_log_martians:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | unknown |
Identifiers and References | Identifiers: CCE-81020-0 References: 3.2.4, 1, 11, 12, 13, 14, 15, 16, 2, 3, 7, 8, 9, APO13.01, BAI04.04, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS01.04, DSS03.05, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.06, 3.1.20, CCI-000126, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.2, SR 7.1, SR 7.2, SR 7.6, A.11.2.6, A.12.1.2, A.12.1.3, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.17.2.1, A.6.2.1, A.6.2.2, A.9.1.2, CM-7(a), CM-7(b), SC-5(3)(a), DE.CM-1, PR.AC-3, PR.DS-4, PR.IP-1, PR.PT-3, PR.PT-4, SRG-OS-000480-GPOS-00227 |
Description | To set the runtime status of the net.ipv4.conf.default.log_martians kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.default.log_martians=1To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d : net.ipv4.conf.default.log_martians = 1 |
Rationale | The presence of "martian" packets (which have impossible addresses)
as well as spoofed packets, source-routed packets, and redirects could be a
sign of nefarious network activity. Logging these packets enables this activity
to be detected. |
net.ipv4.conf.default.log_martians static configuration oval:ssg-test_static_sysctl_net_ipv4_conf_default_log_martians:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/sysctl.conf | # Per CCE-81020-0: Set net.ipv4.conf.default.log_martians = 1 in /etc/sysctl.conf net.ipv4.conf.default.log_martians = 1 |
net.ipv4.conf.default.log_martians static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_etc_sysctld_net_ipv4_conf_default_log_martians:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/sysctl.d/99-sysctl.conf | # Per CCE-81020-0: Set net.ipv4.conf.default.log_martians = 1 in /etc/sysctl.conf net.ipv4.conf.default.log_martians = 1 |
net.ipv4.conf.default.log_martians static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_run_sysctld_net_ipv4_conf_default_log_martians:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_run_sysctld_net_ipv4_conf_default_log_martians:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/run/sysctl.d | ^.*\.conf$ | (?:^|.*\n)[^#]*net.ipv4.conf.default.log_martians[\s]*=[\s]*(\d+)[\s]*\n | 1 |
net.ipv4.conf.default.log_martians static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_default_log_martians:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_default_log_martians:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/usr/lib/sysctl.d | ^.*\.conf$ | (?:^|.*\n)[^#]*net.ipv4.conf.default.log_martians[\s]*=[\s]*(\d+)[\s]*\n | 1 |
kernel runtime parameter net.ipv4.conf.default.log_martians set to the appropriate value oval:ssg-test_sysctl_runtime_net_ipv4_conf_default_log_martians:tst:1 true
Following items have been found on the system:
Name | Value |
---|---|
net.ipv4.conf.default.log_martians | 1 |
Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
Rule ID | xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_rp_filter |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-sysctl_net_ipv4_conf_default_rp_filter:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-81022-6 References: BP28(R22), 3.2.7, 1, 12, 13, 14, 15, 16, 18, 2, 4, 6, 7, 8, 9, APO01.06, APO13.01, BAI04.04, DSS01.03, DSS01.05, DSS03.01, DSS03.05, DSS05.02, DSS05.04, DSS05.07, DSS06.02, 3.1.20, CCI-000366, 4.2.3.4, 4.3.3.4, 4.4.3.3, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.2, SR 7.1, SR 7.2, SR 7.6, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.1.1, A.12.1.2, A.12.1.3, A.13.1.1, A.13.1.2, A.13.1.3, A.13.2.1, A.13.2.2, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.17.2.1, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CM-7(a), CM-7(b), CM-6(a), SC-7(a), DE.AE-1, DE.CM-1, ID.AM-3, PR.AC-5, PR.DS-4, PR.DS-5, PR.PT-4, SRG-OS-000480-GPOS-00227 |
Description | To set the runtime status of the net.ipv4.conf.default.rp_filter kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.default.rp_filter=1To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d : net.ipv4.conf.default.rp_filter = 1 |
Rationale | Enabling reverse path filtering drops packets with source addresses
that should not have been able to be received on the interface they were
received on. It should not be used on systems which are routers for
complicated networks, but is helpful for end hosts and routers serving small
networks. |
net.ipv4.conf.default.rp_filter static configuration oval:ssg-test_static_sysctl_net_ipv4_conf_default_rp_filter:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/sysctl.conf | # Per CCE-81022-6: Set net.ipv4.conf.default.rp_filter = 1 in /etc/sysctl.conf net.ipv4.conf.default.rp_filter = 1 |
net.ipv4.conf.default.rp_filter static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_etc_sysctld_net_ipv4_conf_default_rp_filter:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/sysctl.d/99-sysctl.conf | # Per CCE-81022-6: Set net.ipv4.conf.default.rp_filter = 1 in /etc/sysctl.conf net.ipv4.conf.default.rp_filter = 1 |
net.ipv4.conf.default.rp_filter static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_run_sysctld_net_ipv4_conf_default_rp_filter:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_run_sysctld_net_ipv4_conf_default_rp_filter:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/run/sysctl.d | ^.*\.conf$ | (?:^|.*\n)[^#]*net.ipv4.conf.default.rp_filter[\s]*=[\s]*(\d+)[\s]*\n | 1 |
net.ipv4.conf.default.rp_filter static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_default_rp_filter:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_default_rp_filter:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/usr/lib/sysctl.d | ^.*\.conf$ | (?:^|.*\n)[^#]*net.ipv4.conf.default.rp_filter[\s]*=[\s]*(\d+)[\s]*\n | 1 |
kernel runtime parameter net.ipv4.conf.default.rp_filter set to the appropriate value oval:ssg-test_sysctl_runtime_net_ipv4_conf_default_rp_filter:tst:1 true
Following items have been found on the system:
Name | Value |
---|---|
net.ipv4.conf.default.rp_filter | 1 |
Configure Kernel Parameter for Accepting Secure Redirects By Default
Rule ID | xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_secure_redirects |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-sysctl_net_ipv4_conf_default_secure_redirects:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-81017-6 References: BP28(R22), 3.2.3, 1, 11, 12, 13, 14, 15, 16, 18, 2, 3, 4, 6, 7, 8, 9, APO01.06, APO13.01, BAI04.04, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS01.05, DSS03.01, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, DSS06.02, DSS06.06, 3.1.20, CCI-001551, 4.2.3.4, 4.3.3.4, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, 4.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.2, SR 7.1, SR 7.2, SR 7.6, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.1.1, A.12.1.2, A.12.1.3, A.12.5.1, A.12.6.2, A.13.1.1, A.13.1.2, A.13.1.3, A.13.2.1, A.13.2.2, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.17.2.1, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CIP-007-3 R4, CIP-007-3 R4.1, CIP-007-3 R4.2, CIP-007-3 R5.1, CM-7(a), CM-7(b), SC-5, SC-7(a), DE.AE-1, DE.CM-1, ID.AM-3, PR.AC-5, PR.DS-4, PR.DS-5, PR.IP-1, PR.PT-3, PR.PT-4, SRG-OS-000480-GPOS-00227 |
Description | To set the runtime status of the net.ipv4.conf.default.secure_redirects kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.default.secure_redirects=0To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d : net.ipv4.conf.default.secure_redirects = 0 |
Rationale | Accepting "secure" ICMP redirects (from those gateways listed as
default gateways) has few legitimate uses. It should be disabled unless it is
absolutely required. |
net.ipv4.conf.default.secure_redirects static configuration oval:ssg-test_static_sysctl_net_ipv4_conf_default_secure_redirects:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/sysctl.conf | # Per CCE-81017-6: Set net.ipv4.conf.default.secure_redirects = 0 in /etc/sysctl.conf net.ipv4.conf.default.secure_redirects = 0 |
net.ipv4.conf.default.secure_redirects static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_etc_sysctld_net_ipv4_conf_default_secure_redirects:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/sysctl.d/99-sysctl.conf | # Per CCE-81017-6: Set net.ipv4.conf.default.secure_redirects = 0 in /etc/sysctl.conf net.ipv4.conf.default.secure_redirects = 0 |
net.ipv4.conf.default.secure_redirects static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_run_sysctld_net_ipv4_conf_default_secure_redirects:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_run_sysctld_net_ipv4_conf_default_secure_redirects:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/run/sysctl.d | ^.*\.conf$ | (?:^|.*\n)[^#]*net.ipv4.conf.default.secure_redirects[\s]*=[\s]*(\d+)[\s]*\n | 1 |
net.ipv4.conf.default.secure_redirects static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_default_secure_redirects:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_default_secure_redirects:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/usr/lib/sysctl.d | ^.*\.conf$ | (?:^|.*\n)[^#]*net.ipv4.conf.default.secure_redirects[\s]*=[\s]*(\d+)[\s]*\n | 1 |
kernel runtime parameter net.ipv4.conf.default.secure_redirects set to the appropriate value oval:ssg-test_sysctl_runtime_net_ipv4_conf_default_secure_redirects:tst:1 true
Following items have been found on the system:
Name | Value |
---|---|
net.ipv4.conf.default.secure_redirects | 0 |
Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
Rule ID | xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_icmp_echo_ignore_broadcasts |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-sysctl_net_ipv4_icmp_echo_ignore_broadcasts:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-80922-8 References: 3.2.5, 1, 11, 12, 13, 14, 15, 16, 18, 2, 3, 4, 6, 7, 8, 9, 5.10.1.1, APO01.06, APO13.01, BAI04.04, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS01.05, DSS03.01, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, DSS06.02, DSS06.06, 3.1.20, CCI-000366, 4.2.3.4, 4.3.3.4, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, 4.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.2, SR 7.1, SR 7.2, SR 7.6, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.1.1, A.12.1.2, A.12.1.3, A.12.5.1, A.12.6.2, A.13.1.1, A.13.1.2, A.13.1.3, A.13.2.1, A.13.2.2, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.17.2.1, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CIP-007-3 R4, CIP-007-3 R4.1, CIP-007-3 R4.2, CIP-007-3 R5.1, CM-7(a), CM-7(b), SC-5, DE.AE-1, DE.CM-1, ID.AM-3, PR.AC-5, PR.DS-4, PR.DS-5, PR.IP-1, PR.PT-3, PR.PT-4, SRG-OS-000480-GPOS-00227, RHEL-08-040230, SV-230537r744039_rule |
Description | To set the runtime status of the net.ipv4.icmp_echo_ignore_broadcasts kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.icmp_echo_ignore_broadcasts=1To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d : net.ipv4.icmp_echo_ignore_broadcasts = 1 |
Rationale | Responding to broadcast (ICMP) echoes facilitates network mapping
and provides a vector for amplification attacks.
Ignoring ICMP echo requests (pings) sent to broadcast or multicast addresses makes the system slightly more difficult to enumerate on the network. |
net.ipv4.icmp_echo_ignore_broadcasts static configuration oval:ssg-test_static_sysctl_net_ipv4_icmp_echo_ignore_broadcasts:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/sysctl.conf | # Per CCE-80922-8: Set net.ipv4.icmp_echo_ignore_broadcasts = 1 in /etc/sysctl.conf net.ipv4.icmp_echo_ignore_broadcasts = 1 |
net.ipv4.icmp_echo_ignore_broadcasts static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_etc_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/sysctl.d/99-sysctl.conf | # Per CCE-80922-8: Set net.ipv4.icmp_echo_ignore_broadcasts = 1 in /etc/sysctl.conf net.ipv4.icmp_echo_ignore_broadcasts = 1 |
net.ipv4.icmp_echo_ignore_broadcasts static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_run_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_run_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/run/sysctl.d | ^.*\.conf$ | (?:^|.*\n)[^#]*net.ipv4.icmp_echo_ignore_broadcasts[\s]*=[\s]*(\d+)[\s]*\n | 1 |
net.ipv4.icmp_echo_ignore_broadcasts static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_usr_lib_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_usr_lib_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/usr/lib/sysctl.d | ^.*\.conf$ | (?:^|.*\n)[^#]*net.ipv4.icmp_echo_ignore_broadcasts[\s]*=[\s]*(\d+)[\s]*\n | 1 |
kernel runtime parameter net.ipv4.icmp_echo_ignore_broadcasts set to the appropriate value oval:ssg-test_sysctl_runtime_net_ipv4_icmp_echo_ignore_broadcasts:tst:1 true
Following items have been found on the system:
Name | Value |
---|---|
net.ipv4.icmp_echo_ignore_broadcasts | 1 |
Enable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
Rule ID | xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_icmp_ignore_bogus_error_responses |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-sysctl_net_ipv4_icmp_ignore_bogus_error_responses:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | unknown |
Identifiers and References | Identifiers: CCE-81023-4 References: BP28(R22), 3.2.6, 1, 11, 12, 13, 14, 15, 16, 2, 3, 7, 8, 9, APO13.01, BAI04.04, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS05.02, DSS05.05, DSS05.07, DSS06.06, 3.1.20, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 6.2, SR 7.1, SR 7.2, SR 7.6, A.12.1.2, A.12.1.3, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.17.2.1, A.9.1.2, CIP-007-3 R4, CIP-007-3 R4.1, CIP-007-3 R4.2, CIP-007-3 R5.1, CM-7(a), CM-7(b), SC-5, DE.CM-1, PR.DS-4, PR.IP-1, PR.PT-3, SRG-OS-000480-GPOS-00227 |
Description | To set the runtime status of the net.ipv4.icmp_ignore_bogus_error_responses kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.icmp_ignore_bogus_error_responses=1To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d : net.ipv4.icmp_ignore_bogus_error_responses = 1 |
Rationale | Ignoring bogus ICMP error responses reduces
log size, although some activity would not be logged. |
net.ipv4.icmp_ignore_bogus_error_responses static configuration oval:ssg-test_static_sysctl_net_ipv4_icmp_ignore_bogus_error_responses:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/sysctl.conf | # Per CCE-81023-4: Set net.ipv4.icmp_ignore_bogus_error_responses = 1 in /etc/sysctl.conf net.ipv4.icmp_ignore_bogus_error_responses = 1 |
net.ipv4.icmp_ignore_bogus_error_responses static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_etc_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/sysctl.d/99-sysctl.conf | # Per CCE-81023-4: Set net.ipv4.icmp_ignore_bogus_error_responses = 1 in /etc/sysctl.conf net.ipv4.icmp_ignore_bogus_error_responses = 1 |
net.ipv4.icmp_ignore_bogus_error_responses static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_run_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_run_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/run/sysctl.d | ^.*\.conf$ | (?:^|.*\n)[^#]*net.ipv4.icmp_ignore_bogus_error_responses[\s]*=[\s]*(\d+)[\s]*\n | 1 |
net.ipv4.icmp_ignore_bogus_error_responses static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_usr_lib_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_usr_lib_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/usr/lib/sysctl.d | ^.*\.conf$ | (?:^|.*\n)[^#]*net.ipv4.icmp_ignore_bogus_error_responses[\s]*=[\s]*(\d+)[\s]*\n | 1 |
kernel runtime parameter net.ipv4.icmp_ignore_bogus_error_responses set to the appropriate value oval:ssg-test_sysctl_runtime_net_ipv4_icmp_ignore_bogus_error_responses:tst:1 true
Following items have been found on the system:
Name | Value |
---|---|
net.ipv4.icmp_ignore_bogus_error_responses | 1 |
Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
Rule ID | xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_send_redirects |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-sysctl_net_ipv4_conf_all_send_redirects:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-80918-6 References: BP28(R22), 3.1.2, 1, 11, 12, 13, 14, 15, 16, 18, 2, 3, 4, 6, 7, 8, 9, 5.10.1.1, APO01.06, APO13.01, BAI04.04, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS01.05, DSS03.01, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, DSS06.02, DSS06.06, 3.1.20, CCI-000366, 4.2.3.4, 4.3.3.4, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, 4.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.2, SR 7.1, SR 7.2, SR 7.6, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.1.1, A.12.1.2, A.12.1.3, A.12.5.1, A.12.6.2, A.13.1.1, A.13.1.2, A.13.1.3, A.13.2.1, A.13.2.2, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.17.2.1, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CIP-007-3 R4, CIP-007-3 R4.1, CIP-007-3 R4.2, CIP-007-3 R5.1, CM-7(a), CM-7(b), SC-5, CM-6(a), SC-7(a), DE.AE-1, DE.CM-1, ID.AM-3, PR.AC-5, PR.DS-4, PR.DS-5, PR.IP-1, PR.PT-3, PR.PT-4, SRG-OS-000480-GPOS-00227, RHEL-08-040220, SV-230536r744037_rule |
Description | To set the runtime status of the net.ipv4.conf.all.send_redirects kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.all.send_redirects=0To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d : net.ipv4.conf.all.send_redirects = 0 |
Rationale | ICMP redirect messages are used by routers to inform hosts that a more
direct route exists for a particular destination. These messages contain information
from the system's route table possibly revealing portions of the network topology.
The ability to send ICMP redirects is only appropriate for systems acting as routers. |
net.ipv4.conf.all.send_redirects static configuration oval:ssg-test_static_sysctl_net_ipv4_conf_all_send_redirects:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/sysctl.conf | net.ipv4.conf.all.send_redirects = 0 |
net.ipv4.conf.all.send_redirects static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_send_redirects:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/sysctl.d/99-sysctl.conf | net.ipv4.conf.all.send_redirects = 0 |
net.ipv4.conf.all.send_redirects static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_send_redirects:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_send_redirects:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/run/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv4.conf.all.send_redirects[\s]*=[\s]*0[\s]*$ | 1 |
net.ipv4.conf.all.send_redirects static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_send_redirects:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_send_redirects:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/usr/lib/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv4.conf.all.send_redirects[\s]*=[\s]*0[\s]*$ | 1 |
kernel runtime parameter net.ipv4.conf.all.send_redirects set to 0 oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_send_redirects:tst:1 true
Following items have been found on the system:
Name | Value |
---|---|
net.ipv4.conf.all.send_redirects | 0 |
Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
Rule ID | xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_send_redirects |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-sysctl_net_ipv4_conf_default_send_redirects:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-80921-0 References: BP28(R22), 3.1.2, 1, 11, 12, 13, 14, 15, 16, 18, 2, 3, 4, 6, 7, 8, 9, 5.10.1.1, APO01.06, APO13.01, BAI04.04, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS01.05, DSS03.01, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, DSS06.02, DSS06.06, 3.1.20, CCI-000366, 4.2.3.4, 4.3.3.4, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, 4.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.2, SR 7.1, SR 7.2, SR 7.6, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.1.1, A.12.1.2, A.12.1.3, A.12.5.1, A.12.6.2, A.13.1.1, A.13.1.2, A.13.1.3, A.13.2.1, A.13.2.2, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.17.2.1, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CIP-007-3 R4, CIP-007-3 R4.1, CIP-007-3 R4.2, CIP-007-3 R5.1, CM-7(a), CM-7(b), SC-5, CM-6(a), SC-7(a), DE.AE-1, DE.CM-1, ID.AM-3, PR.AC-5, PR.DS-4, PR.DS-5, PR.IP-1, PR.PT-3, PR.PT-4, SRG-OS-000480-GPOS-00227, RHEL-08-040270, SV-230543r744047_rule |
Description | To set the runtime status of the net.ipv4.conf.default.send_redirects kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.default.send_redirects=0To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d : net.ipv4.conf.default.send_redirects = 0 |
Rationale | ICMP redirect messages are used by routers to inform hosts that a more
direct route exists for a particular destination. These messages contain information
from the system's route table possibly revealing portions of the network topology.
The ability to send ICMP redirects is only appropriate for systems acting as routers. |
net.ipv4.conf.default.send_redirects static configuration oval:ssg-test_static_sysctl_net_ipv4_conf_default_send_redirects:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/sysctl.conf | net.ipv4.conf.default.send_redirects = 0 |
net.ipv4.conf.default.send_redirects static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_etc_sysctld_net_ipv4_conf_default_send_redirects:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/sysctl.d/99-sysctl.conf | net.ipv4.conf.default.send_redirects = 0 |
net.ipv4.conf.default.send_redirects static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_run_sysctld_net_ipv4_conf_default_send_redirects:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_run_sysctld_net_ipv4_conf_default_send_redirects:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/run/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv4.conf.default.send_redirects[\s]*=[\s]*0[\s]*$ | 1 |
net.ipv4.conf.default.send_redirects static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_default_send_redirects:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_default_send_redirects:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/usr/lib/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv4.conf.default.send_redirects[\s]*=[\s]*0[\s]*$ | 1 |
kernel runtime parameter net.ipv4.conf.default.send_redirects set to 0 oval:ssg-test_sysctl_runtime_net_ipv4_conf_default_send_redirects:tst:1 true
Following items have been found on the system:
Name | Value |
---|---|
net.ipv4.conf.default.send_redirects | 0 |
Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces
Rule ID | xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_ip_forward |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-sysctl_net_ipv4_ip_forward:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-81024-2 References: BP28(R22), 3.1.1, 1, 11, 12, 13, 14, 15, 16, 2, 3, 7, 8, 9, APO13.01, BAI04.04, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS05.02, DSS05.05, DSS05.07, DSS06.06, 3.1.20, CCI-000366, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.2, SR 7.1, SR 7.2, SR 7.6, A.12.1.2, A.12.1.3, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.17.2.1, A.9.1.2, CIP-007-3 R4, CIP-007-3 R4.1, CIP-007-3 R4.2, CIP-007-3 R5.1, CM-7(a), CM-7(b), SC-5, CM-6(a), SC-7(a), DE.CM-1, PR.DS-4, PR.IP-1, PR.PT-3, PR.PT-4, SRG-OS-000480-GPOS-00227, RHEL-08-040260, SV-230540r627750_rule |
Description | To set the runtime status of the net.ipv4.ip_forward kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.ip_forward=0To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d : net.ipv4.ip_forward = 0 |
Rationale | Routing protocol daemons are typically used on routers to exchange
network topology information with other routers. If this capability is used when
not required, system network information may be unnecessarily transmitted across
the network. |
Warnings | warning
Certain technologies such as virtual machines, containers, etc. rely on IPv4 forwarding to enable and use networking.
Disabling IPv4 forwarding would cause those technologies to stop working. Therefore, this rule should not be used in
profiles or benchmarks that target usage of IPv4 forwarding. |
net.ipv4.ip_forward static configuration oval:ssg-test_static_sysctl_net_ipv4_ip_forward:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/sysctl.conf | net.ipv4.ip_forward = 0 |
net.ipv4.ip_forward static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_etc_sysctld_net_ipv4_ip_forward:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/sysctl.d/99-sysctl.conf | net.ipv4.ip_forward = 0 |
net.ipv4.ip_forward static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_run_sysctld_net_ipv4_ip_forward:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_run_sysctld_net_ipv4_ip_forward:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/run/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv4.ip_forward[\s]*=[\s]*0[\s]*$ | 1 |
net.ipv4.ip_forward static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_usr_lib_sysctld_net_ipv4_ip_forward:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_usr_lib_sysctld_net_ipv4_ip_forward:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/usr/lib/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv4.ip_forward[\s]*=[\s]*0[\s]*$ | 1 |
kernel runtime parameter net.ipv4.ip_forward set to 0 oval:ssg-test_sysctl_runtime_net_ipv4_ip_forward:tst:1 true
Following items have been found on the system:
Name | Value |
---|---|
net.ipv4.ip_forward | 0 |
Disable ATM Support
Rule ID | xccdf_org.ssgproject.content_rule_kernel_module_atm_disabled |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-kernel_module_atm_disabled:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-82028-2 References: CCI-000381, FMT_SMF_EXT.1, SRG-OS-000095-GPOS-00049, RHEL-08-040021, SV-230494r627750_rule |
Description | The Asynchronous Transfer Mode (ATM) is a protocol operating on
network, data link, and physical layers, based on virtual circuits
and virtual paths.
To configure the system to prevent the atm
kernel module from being loaded, add the following line to a file in the directory /etc/modprobe.d :
install atm /bin/true |
Rationale | Disabling ATM protects the system against exploitation of any
flaws in its implementation. |
kernel module atm disabled oval:ssg-test_kernmod_atm_disabled:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/modprobe.d/atm.conf | install atm /bin/true |
kernel module atm disabled in /etc/modules-load.d oval:ssg-test_kernmod_atm_etcmodules-load:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_kernmod_atm_etcmodules-load:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/etc/modules-load.d | ^.*\.conf$ | ^\s*install\s+atm\s+(/bin/false|/bin/true)$ | 1 |
kernel module atm disabled in /run/modules-load.d oval:ssg-test_kernmod_atm_runmodules-load:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_kernmod_atm_runmodules-load:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/run/modules-load.d | ^.*\.conf$ | ^\s*install\s+atm\s+(/bin/false|/bin/true)$ | 1 |
kernel module atm disabled in /usr/lib/modules-load.d oval:ssg-test_kernmod_atm_libmodules-load:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_kernmod_atm_libmodules-load:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/usr/lib/modules-load.d | ^.*\.conf$ | ^\s*install\s+atm\s+(/bin/false|/bin/true)$ | 1 |
kernel module atm disabled in /run/modprobe.d oval:ssg-test_kernmod_atm_runmodprobed:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_kernmod_atm_runmodprobed:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/run/modprobe.d | ^.*\.conf$ | ^\s*install\s+atm\s+(/bin/false|/bin/true)$ | 1 |
kernel module atm disabled in /usr/lib/modprobe.d oval:ssg-test_kernmod_atm_libmodprobed:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_kernmod_atm_libmodprobed:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/usr/lib/modprobe.d | ^.*\.conf$ | ^\s*install\s+atm\s+(/bin/false|/bin/true)$ | 1 |
kernel module atm disabled in /etc/modprobe.conf oval:ssg-test_kernmod_atm_modprobeconf:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_kernmod_atm_modprobeconf:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
/etc/modprobe.conf | ^\s*install\s+atm\s+(/bin/false|/bin/true)$ | 1 |
Disable CAN Support
Rule ID | xccdf_org.ssgproject.content_rule_kernel_module_can_disabled |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-kernel_module_can_disabled:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-82059-7 References: CCI-000381, FMT_SMF_EXT.1, SRG-OS-000095-GPOS-00049, RHEL-08-040022, SV-230495r627750_rule |
Description | The Controller Area Network (CAN) is a serial communications
protocol which was initially developed for automotive and
is now also used in marine, industrial, and medical applications.
To configure the system to prevent the can
kernel module from being loaded, add the following line to a file in the directory /etc/modprobe.d :
install can /bin/true |
Rationale | Disabling CAN protects the system against exploitation of any
flaws in its implementation. |
kernel module can disabled oval:ssg-test_kernmod_can_disabled:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/modprobe.d/can.conf | install can /bin/true |
kernel module can disabled in /etc/modules-load.d oval:ssg-test_kernmod_can_etcmodules-load:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_kernmod_can_etcmodules-load:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/etc/modules-load.d | ^.*\.conf$ | ^\s*install\s+can\s+(/bin/false|/bin/true)$ | 1 |
kernel module can disabled in /run/modules-load.d oval:ssg-test_kernmod_can_runmodules-load:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_kernmod_can_runmodules-load:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/run/modules-load.d | ^.*\.conf$ | ^\s*install\s+can\s+(/bin/false|/bin/true)$ | 1 |
kernel module can disabled in /usr/lib/modules-load.d oval:ssg-test_kernmod_can_libmodules-load:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_kernmod_can_libmodules-load:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/usr/lib/modules-load.d | ^.*\.conf$ | ^\s*install\s+can\s+(/bin/false|/bin/true)$ | 1 |
kernel module can disabled in /run/modprobe.d oval:ssg-test_kernmod_can_runmodprobed:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_kernmod_can_runmodprobed:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/run/modprobe.d | ^.*\.conf$ | ^\s*install\s+can\s+(/bin/false|/bin/true)$ | 1 |
kernel module can disabled in /usr/lib/modprobe.d oval:ssg-test_kernmod_can_libmodprobed:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_kernmod_can_libmodprobed:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/usr/lib/modprobe.d | ^.*\.conf$ | ^\s*install\s+can\s+(/bin/false|/bin/true)$ | 1 |
kernel module can disabled in /etc/modprobe.conf oval:ssg-test_kernmod_can_modprobeconf:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_kernmod_can_modprobeconf:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
/etc/modprobe.conf | ^\s*install\s+can\s+(/bin/false|/bin/true)$ | 1 |
Disable IEEE 1394 (FireWire) Support
Rule ID | xccdf_org.ssgproject.content_rule_kernel_module_firewire-core_disabled |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-kernel_module_firewire-core_disabled:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-82005-0 References: CCI-000381, FMT_SMF_EXT.1, SRG-OS-000095-GPOS-00049, RHEL-08-040026, SV-230499r627750_rule |
Description | The IEEE 1394 (FireWire) is a serial bus standard for
high-speed real-time communication.
To configure the system to prevent the firewire-core
kernel module from being loaded, add the following line to a file in the directory /etc/modprobe.d :
install firewire-core /bin/true |
Rationale | Disabling FireWire protects the system against exploitation of any
flaws in its implementation. |
kernel module firewire-core disabled oval:ssg-test_kernmod_firewire-core_disabled:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/modprobe.d/firewire-core.conf | install firewire-core /bin/true |
kernel module firewire-core disabled in /etc/modules-load.d oval:ssg-test_kernmod_firewire-core_etcmodules-load:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_kernmod_firewire-core_etcmodules-load:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/etc/modules-load.d | ^.*\.conf$ | ^\s*install\s+firewire-core\s+(/bin/false|/bin/true)$ | 1 |
kernel module firewire-core disabled in /run/modules-load.d oval:ssg-test_kernmod_firewire-core_runmodules-load:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_kernmod_firewire-core_runmodules-load:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/run/modules-load.d | ^.*\.conf$ | ^\s*install\s+firewire-core\s+(/bin/false|/bin/true)$ | 1 |
kernel module firewire-core disabled in /usr/lib/modules-load.d oval:ssg-test_kernmod_firewire-core_libmodules-load:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_kernmod_firewire-core_libmodules-load:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/usr/lib/modules-load.d | ^.*\.conf$ | ^\s*install\s+firewire-core\s+(/bin/false|/bin/true)$ | 1 |
kernel module firewire-core disabled in /run/modprobe.d oval:ssg-test_kernmod_firewire-core_runmodprobed:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_kernmod_firewire-core_runmodprobed:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/run/modprobe.d | ^.*\.conf$ | ^\s*install\s+firewire-core\s+(/bin/false|/bin/true)$ | 1 |
kernel module firewire-core disabled in /usr/lib/modprobe.d oval:ssg-test_kernmod_firewire-core_libmodprobed:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_kernmod_firewire-core_libmodprobed:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/usr/lib/modprobe.d | ^.*\.conf$ | ^\s*install\s+firewire-core\s+(/bin/false|/bin/true)$ | 1 |
kernel module firewire-core disabled in /etc/modprobe.conf oval:ssg-test_kernmod_firewire-core_modprobeconf:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_kernmod_firewire-core_modprobeconf:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
/etc/modprobe.conf | ^\s*install\s+firewire-core\s+(/bin/false|/bin/true)$ | 1 |
Disable SCTP Support
Rule ID | xccdf_org.ssgproject.content_rule_kernel_module_sctp_disabled |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-kernel_module_sctp_disabled:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-80834-5 References: 3.3.2, 11, 14, 3, 9, 5.10.1, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06, 3.4.6, CCI-000381, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.IP-1, PR.PT-3, SRG-OS-000095-GPOS-00049, RHEL-08-040023, SV-230496r744017_rule |
Description | The Stream Control Transmission Protocol (SCTP) is a
transport layer protocol, designed to support the idea of
message-oriented communication, with several streams of messages
within one connection.
To configure the system to prevent the sctp
kernel module from being loaded, add the following line to a file in the directory /etc/modprobe.d :
install sctp /bin/true |
Rationale | Disabling SCTP protects
the system against exploitation of any flaws in its implementation. |
kernel module sctp disabled oval:ssg-test_kernmod_sctp_disabled:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/modprobe.d/sctp.conf | install sctp /bin/true |
kernel module sctp disabled in /etc/modules-load.d oval:ssg-test_kernmod_sctp_etcmodules-load:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_kernmod_sctp_etcmodules-load:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/etc/modules-load.d | ^.*\.conf$ | ^\s*install\s+sctp\s+(/bin/false|/bin/true)$ | 1 |
kernel module sctp disabled in /run/modules-load.d oval:ssg-test_kernmod_sctp_runmodules-load:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_kernmod_sctp_runmodules-load:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/run/modules-load.d | ^.*\.conf$ | ^\s*install\s+sctp\s+(/bin/false|/bin/true)$ | 1 |
kernel module sctp disabled in /usr/lib/modules-load.d oval:ssg-test_kernmod_sctp_libmodules-load:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_kernmod_sctp_libmodules-load:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/usr/lib/modules-load.d | ^.*\.conf$ | ^\s*install\s+sctp\s+(/bin/false|/bin/true)$ | 1 |
kernel module sctp disabled in /run/modprobe.d oval:ssg-test_kernmod_sctp_runmodprobed:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_kernmod_sctp_runmodprobed:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/run/modprobe.d | ^.*\.conf$ | ^\s*install\s+sctp\s+(/bin/false|/bin/true)$ | 1 |
kernel module sctp disabled in /usr/lib/modprobe.d oval:ssg-test_kernmod_sctp_libmodprobed:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_kernmod_sctp_libmodprobed:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/usr/lib/modprobe.d | ^.*\.conf$ | ^\s*install\s+sctp\s+(/bin/false|/bin/true)$ | 1 |
kernel module sctp disabled in /etc/modprobe.conf oval:ssg-test_kernmod_sctp_modprobeconf:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_kernmod_sctp_modprobeconf:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
/etc/modprobe.conf | ^\s*install\s+sctp\s+(/bin/false|/bin/true)$ | 1 |
Disable TIPC Support
Rule ID | xccdf_org.ssgproject.content_rule_kernel_module_tipc_disabled |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-kernel_module_tipc_disabled:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-82297-3 References: 3.3.4, 11, 14, 3, 9, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06, CCI-000381, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.IP-1, PR.PT-3, FMT_SMF_EXT.1, SRG-OS-000095-GPOS-00049, RHEL-08-040024, SV-230497r627750_rule |
Description | The Transparent Inter-Process Communication (TIPC) protocol
is designed to provide communications between nodes in a
cluster.
To configure the system to prevent the tipc
kernel module from being loaded, add the following line to a file in the directory /etc/modprobe.d :
install tipc /bin/true |
Rationale | Disabling TIPC protects
the system against exploitation of any flaws in its implementation. |
Warnings | warning
This configuration baseline was created to deploy the base operating system for general purpose
workloads. When the operating system is configured for certain purposes, such as
a node in High Performance Computing cluster, it is expected that
the tipc kernel module will be loaded. |
kernel module tipc disabled oval:ssg-test_kernmod_tipc_disabled:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/modprobe.d/tipc.conf | install tipc /bin/true |
kernel module tipc disabled in /etc/modules-load.d oval:ssg-test_kernmod_tipc_etcmodules-load:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_kernmod_tipc_etcmodules-load:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/etc/modules-load.d | ^.*\.conf$ | ^\s*install\s+tipc\s+(/bin/false|/bin/true)$ | 1 |
kernel module tipc disabled in /run/modules-load.d oval:ssg-test_kernmod_tipc_runmodules-load:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_kernmod_tipc_runmodules-load:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/run/modules-load.d | ^.*\.conf$ | ^\s*install\s+tipc\s+(/bin/false|/bin/true)$ | 1 |
kernel module tipc disabled in /usr/lib/modules-load.d oval:ssg-test_kernmod_tipc_libmodules-load:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_kernmod_tipc_libmodules-load:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/usr/lib/modules-load.d | ^.*\.conf$ | ^\s*install\s+tipc\s+(/bin/false|/bin/true)$ | 1 |
kernel module tipc disabled in /run/modprobe.d oval:ssg-test_kernmod_tipc_runmodprobed:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_kernmod_tipc_runmodprobed:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/run/modprobe.d | ^.*\.conf$ | ^\s*install\s+tipc\s+(/bin/false|/bin/true)$ | 1 |
kernel module tipc disabled in /usr/lib/modprobe.d oval:ssg-test_kernmod_tipc_libmodprobed:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_kernmod_tipc_libmodprobed:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/usr/lib/modprobe.d | ^.*\.conf$ | ^\s*install\s+tipc\s+(/bin/false|/bin/true)$ | 1 |
kernel module tipc disabled in /etc/modprobe.conf oval:ssg-test_kernmod_tipc_modprobeconf:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_kernmod_tipc_modprobeconf:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
/etc/modprobe.conf | ^\s*install\s+tipc\s+(/bin/false|/bin/true)$ | 1 |
Disable Bluetooth Kernel Module
Rule ID | xccdf_org.ssgproject.content_rule_kernel_module_bluetooth_disabled |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-kernel_module_bluetooth_disabled:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-80832-9 References: 11, 12, 14, 15, 3, 8, 9, 5.13.1.3, APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.04, DSS05.02, DSS05.03, DSS05.05, DSS06.06, 3.1.16, CCI-000085, CCI-001551, CCI-001443, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, A.11.2.6, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.2.1, A.6.2.2, A.9.1.2, AC-18(a), AC-18(3), CM-7(a), CM-7(b), CM-6(a), MP-7, PR.AC-3, PR.IP-1, PR.PT-3, PR.PT-4, SRG-OS-000095-GPOS-00049, SRG-OS-000300-GPOS-00118, RHEL-08-040111, SV-230507r627750_rule |
Description | The kernel's module loading system can be configured to prevent
loading of the Bluetooth module. Add the following to
the appropriate /etc/modprobe.d configuration file
to prevent the loading of the Bluetooth module:
install bluetooth /bin/true |
Rationale | If Bluetooth functionality must be disabled, preventing the kernel
from loading the kernel module provides an additional safeguard against its
activation. |
kernel module bluetooth disabled oval:ssg-test_kernmod_bluetooth_disabled:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/modprobe.d/bluetooth.conf | install bluetooth /bin/true |
kernel module bluetooth disabled in /etc/modules-load.d oval:ssg-test_kernmod_bluetooth_etcmodules-load:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_kernmod_bluetooth_etcmodules-load:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/etc/modules-load.d | ^.*\.conf$ | ^\s*install\s+bluetooth\s+(/bin/false|/bin/true)$ | 1 |
kernel module bluetooth disabled in /run/modules-load.d oval:ssg-test_kernmod_bluetooth_runmodules-load:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_kernmod_bluetooth_runmodules-load:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/run/modules-load.d | ^.*\.conf$ | ^\s*install\s+bluetooth\s+(/bin/false|/bin/true)$ | 1 |
kernel module bluetooth disabled in /usr/lib/modules-load.d oval:ssg-test_kernmod_bluetooth_libmodules-load:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_kernmod_bluetooth_libmodules-load:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/usr/lib/modules-load.d | ^.*\.conf$ | ^\s*install\s+bluetooth\s+(/bin/false|/bin/true)$ | 1 |
kernel module bluetooth disabled in /run/modprobe.d oval:ssg-test_kernmod_bluetooth_runmodprobed:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_kernmod_bluetooth_runmodprobed:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/run/modprobe.d | ^.*\.conf$ | ^\s*install\s+bluetooth\s+(/bin/false|/bin/true)$ | 1 |
kernel module bluetooth disabled in /usr/lib/modprobe.d oval:ssg-test_kernmod_bluetooth_libmodprobed:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_kernmod_bluetooth_libmodprobed:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/usr/lib/modprobe.d | ^.*\.conf$ | ^\s*install\s+bluetooth\s+(/bin/false|/bin/true)$ | 1 |
kernel module bluetooth disabled in /etc/modprobe.conf oval:ssg-test_kernmod_bluetooth_modprobeconf:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_kernmod_bluetooth_modprobeconf:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
/etc/modprobe.conf | ^\s*install\s+bluetooth\s+(/bin/false|/bin/true)$ | 1 |
Enable Kernel Parameter to Enforce DAC on Hardlinks
Rule ID | xccdf_org.ssgproject.content_rule_sysctl_fs_protected_hardlinks |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-sysctl_fs_protected_hardlinks:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-81027-5 References: BP28(R23), CCI-002165, CIP-003-3 R5.1.1, CIP-003-3 R5.3, CIP-004-3 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2, CM-6(a), AC-6(1), SRG-OS-000324-GPOS-00125, RHEL-08-010374, SV-230268r627750_rule |
Description | To set the runtime status of the fs.protected_hardlinks kernel parameter, run the following command: $ sudo sysctl -w fs.protected_hardlinks=1To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d : fs.protected_hardlinks = 1 |
Rationale | By enabling this kernel parameter, users can no longer create soft or hard links to
files which they do not own. Disallowing such hardlinks mitigate vulnerabilities
based on insecure file system accessed by privileged programs, avoiding an
exploitation vector exploiting unsafe use of open() or creat() . |
fs.protected_hardlinks static configuration oval:ssg-test_static_sysctl_fs_protected_hardlinks:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_sysctl_fs_protected_hardlinks:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
/etc/sysctl.conf | ^[\s]*fs.protected_hardlinks[\s]*=[\s]*1[\s]*$ | 1 |
fs.protected_hardlinks static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_etc_sysctld_fs_protected_hardlinks:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_etc_sysctld_fs_protected_hardlinks:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/etc/sysctl.d | ^.*\.conf$ | ^[\s]*fs.protected_hardlinks[\s]*=[\s]*1[\s]*$ | 1 |
fs.protected_hardlinks static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_run_sysctld_fs_protected_hardlinks:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_run_sysctld_fs_protected_hardlinks:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/run/sysctl.d | ^.*\.conf$ | ^[\s]*fs.protected_hardlinks[\s]*=[\s]*1[\s]*$ | 1 |
fs.protected_hardlinks static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_usr_lib_sysctld_fs_protected_hardlinks:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/usr/lib/sysctl.d/50-default.conf | fs.protected_hardlinks = 1 |
kernel runtime parameter fs.protected_hardlinks set to 1 oval:ssg-test_sysctl_runtime_fs_protected_hardlinks:tst:1 true
Following items have been found on the system:
Name | Value |
---|---|
fs.protected_hardlinks | 1 |
Enable Kernel Parameter to Enforce DAC on Symlinks
Rule ID | xccdf_org.ssgproject.content_rule_sysctl_fs_protected_symlinks |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-sysctl_fs_protected_symlinks:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-81030-9 References: BP28(R23), CCI-002165, CIP-003-3 R5.1.1, CIP-003-3 R5.3, CIP-004-3 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2, CM-6(a), AC-6(1), SRG-OS-000324-GPOS-00125, RHEL-08-010373, SV-230267r627750_rule |
Description | To set the runtime status of the fs.protected_symlinks kernel parameter, run the following command: $ sudo sysctl -w fs.protected_symlinks=1To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d : fs.protected_symlinks = 1 |
Rationale | By enabling this kernel parameter, symbolic links are permitted to be followed
only when outside a sticky world-writable directory, or when the UID of the
link and follower match, or when the directory owner matches the symlink's owner.
Disallowing such symlinks helps mitigate vulnerabilities based on insecure file system
accessed by privileged programs, avoiding an exploitation vector exploiting unsafe use of
open() or creat() . |
fs.protected_symlinks static configuration oval:ssg-test_static_sysctl_fs_protected_symlinks:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_sysctl_fs_protected_symlinks:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
/etc/sysctl.conf | ^[\s]*fs.protected_symlinks[\s]*=[\s]*1[\s]*$ | 1 |
fs.protected_symlinks static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_etc_sysctld_fs_protected_symlinks:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_etc_sysctld_fs_protected_symlinks:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/etc/sysctl.d | ^.*\.conf$ | ^[\s]*fs.protected_symlinks[\s]*=[\s]*1[\s]*$ | 1 |
fs.protected_symlinks static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_run_sysctld_fs_protected_symlinks:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_run_sysctld_fs_protected_symlinks:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/run/sysctl.d | ^.*\.conf$ | ^[\s]*fs.protected_symlinks[\s]*=[\s]*1[\s]*$ | 1 |
fs.protected_symlinks static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_usr_lib_sysctld_fs_protected_symlinks:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/usr/lib/sysctl.d/50-default.conf | fs.protected_symlinks = 1 |
kernel runtime parameter fs.protected_symlinks set to 1 oval:ssg-test_sysctl_runtime_fs_protected_symlinks:tst:1 true
Following items have been found on the system:
Name | Value |
---|---|
fs.protected_symlinks | 1 |
Disable Mounting of cramfs
Rule ID | xccdf_org.ssgproject.content_rule_kernel_module_cramfs_disabled |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-kernel_module_cramfs_disabled:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | low |
Identifiers and References | Identifiers: CCE-81031-7 References: 1.1.1.1, 11, 14, 3, 9, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06, 3.4.6, CCI-000381, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.IP-1, PR.PT-3, SRG-OS-000095-GPOS-00049, RHEL-08-040025, SV-230498r627750_rule |
Description |
To configure the system to prevent the cramfs
kernel module from being loaded, add the following line to a file in the directory /etc/modprobe.d :
install cramfs /bin/trueThis effectively prevents usage of this uncommon filesystem. The cramfs filesystem type is a compressed read-only
Linux filesystem embedded in small footprint systems. A
cramfs image can be used without having to first
decompress the image. |
Rationale | Removing support for unneeded filesystem types reduces the local attack surface
of the server. |
kernel module cramfs disabled oval:ssg-test_kernmod_cramfs_disabled:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/modprobe.d/cramfs.conf | install cramfs /bin/true |
kernel module cramfs disabled in /etc/modules-load.d oval:ssg-test_kernmod_cramfs_etcmodules-load:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_kernmod_cramfs_etcmodules-load:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/etc/modules-load.d | ^.*\.conf$ | ^\s*install\s+cramfs\s+(/bin/false|/bin/true)$ | 1 |
kernel module cramfs disabled in /run/modules-load.d oval:ssg-test_kernmod_cramfs_runmodules-load:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_kernmod_cramfs_runmodules-load:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/run/modules-load.d | ^.*\.conf$ | ^\s*install\s+cramfs\s+(/bin/false|/bin/true)$ | 1 |
kernel module cramfs disabled in /usr/lib/modules-load.d oval:ssg-test_kernmod_cramfs_libmodules-load:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_kernmod_cramfs_libmodules-load:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/usr/lib/modules-load.d | ^.*\.conf$ | ^\s*install\s+cramfs\s+(/bin/false|/bin/true)$ | 1 |
kernel module cramfs disabled in /run/modprobe.d oval:ssg-test_kernmod_cramfs_runmodprobed:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_kernmod_cramfs_runmodprobed:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/run/modprobe.d | ^.*\.conf$ | ^\s*install\s+cramfs\s+(/bin/false|/bin/true)$ | 1 |
kernel module cramfs disabled in /usr/lib/modprobe.d oval:ssg-test_kernmod_cramfs_libmodprobed:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_kernmod_cramfs_libmodprobed:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/usr/lib/modprobe.d | ^.*\.conf$ | ^\s*install\s+cramfs\s+(/bin/false|/bin/true)$ | 1 |
kernel module cramfs disabled in /etc/modprobe.conf oval:ssg-test_kernmod_cramfs_modprobeconf:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_kernmod_cramfs_modprobeconf:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
/etc/modprobe.conf | ^\s*install\s+cramfs\s+(/bin/false|/bin/true)$ | 1 |
Add nodev Option to /boot
Rule ID | xccdf_org.ssgproject.content_rule_mount_option_boot_nodev |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-mount_option_boot_nodev:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-82941-6 References: CIP-003-3 R5.1.1, CIP-003-3 R5.3, CIP-004-3 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2, CM-7(a), CM-7(b), CM-6(a), AC-6, AC-6(1), MP-7, PR.IP-1, PR.PT-2, PR.PT-3, SRG-OS-000368-GPOS-00154 |
Description | The nodev mount option can be used to prevent device files from
being created in /boot .
Legitimate character and block devices should exist only in
the /dev directory on the root partition or within chroot
jails built for system services.
Add the nodev option to the fourth column of
/etc/fstab for the line which controls mounting of
/boot . |
Rationale | The only legitimate location for device files is the /dev directory
located on the root partition. The only exception to this is chroot jails. |
nodev on /boot optional yes oval:ssg-test_boot_partition_nodev_optional_yes:tst:1 true
Following items have been found on the system:
Mount point | Device | Uuid | Fs type | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Total space | Space used | Space left |
---|---|---|---|---|---|---|---|---|---|---|---|---|---|
/boot | /dev/sda1 | e5fe751a-8dfb-40d1-840e-ef8d20bc4298 | ext4 | rw | seclabel | nosuid | nodev | noexec | relatime | bind | 124914 | 37133 | 87781 |
Add nosuid Option to /boot
Rule ID | xccdf_org.ssgproject.content_rule_mount_option_boot_nosuid |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-mount_option_boot_nosuid:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-81033-3 References: BP28(R12), CCI-000366, CIP-003-3 R5.1.1, CIP-003-3 R5.3, CIP-004-3 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2, CM-7(a), CM-7(b), CM-6(a), AC-6, AC-6(1), MP-7, PR.IP-1, PR.PT-2, PR.PT-3, SRG-OS-000368-GPOS-00154, SRG-OS-000480-GPOS-00227, RHEL-08-010571, SV-230300r743959_rule |
Description | The nosuid mount option can be used to prevent
execution of setuid programs in /boot . The SUID and SGID permissions
should not be required on the boot partition.
Add the nosuid option to the fourth column of
/etc/fstab for the line which controls mounting of
/boot . |
Rationale | The presence of SUID and SGID executables should be tightly controlled. Users
should not be able to execute SUID or SGID binaries from boot partitions. |
nosuid on /boot optional yes oval:ssg-test_boot_partition_nosuid_optional_yes:tst:1 true
Following items have been found on the system:
Mount point | Device | Uuid | Fs type | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Total space | Space used | Space left |
---|---|---|---|---|---|---|---|---|---|---|---|---|---|
/boot | /dev/sda1 | e5fe751a-8dfb-40d1-840e-ef8d20bc4298 | ext4 | rw | seclabel | nosuid | nodev | noexec | relatime | bind | 124914 | 37133 | 87781 |
Add nodev Option to /dev/shm
Rule ID | xccdf_org.ssgproject.content_rule_mount_option_dev_shm_nodev |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-mount_option_dev_shm_nodev:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | low |
Identifiers and References | Identifiers: CCE-80837-8 References: 1.1.5, 11, 13, 14, 3, 8, 9, APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS05.06, DSS06.06, CCI-001764, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, A.11.2.9, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.8.2.1, A.8.2.2, A.8.2.3, A.8.3.1, A.8.3.3, A.9.1.2, CIP-003-3 R5.1.1, CIP-003-3 R5.3, CIP-004-3 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2, CM-7(a), CM-7(b), CM-6(a), AC-6, AC-6(1), MP-7, PR.IP-1, PR.PT-2, PR.PT-3, SRG-OS-000368-GPOS-00154, RHEL-08-040120, SV-230508r627750_rule |
Description | The nodev mount option can be used to prevent creation of device
files in /dev/shm . Legitimate character and block devices should
not exist within temporary directories like /dev/shm .
Add the nodev option to the fourth column of
/etc/fstab for the line which controls mounting of
/dev/shm . |
Rationale | The only legitimate location for device files is the /dev directory
located on the root partition. The only exception to this is chroot jails. |
nodev on /dev/shm optional no oval:ssg-test_dev_shm_partition_nodev_optional_no:tst:1 true
Following items have been found on the system:
Mount point | Device | Uuid | Fs type | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Total space | Space used | Space left |
---|---|---|---|---|---|---|---|---|---|---|---|---|---|
/dev/shm | tmpfs | tmpfs | rw | seclabel | nosuid | nodev | noexec | relatime | bind | 232570 | 0 | 232570 |
/dev/shm exists oval:ssg-test_dev_shm_no_partition_nodev_optional_no:tst:1 true
Following items have been found on the system:
Mount point | Device | Uuid | Fs type | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Total space | Space used | Space left |
---|---|---|---|---|---|---|---|---|---|---|---|---|---|
/dev/shm | tmpfs | tmpfs | rw | seclabel | nosuid | nodev | noexec | relatime | bind | 232570 | 0 | 232570 |
Add noexec Option to /dev/shm
Rule ID | xccdf_org.ssgproject.content_rule_mount_option_dev_shm_noexec |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-mount_option_dev_shm_noexec:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | low |
Identifiers and References | Identifiers: CCE-80838-6 References: 1.1.17, 11, 13, 14, 3, 8, 9, APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS05.06, DSS06.06, CCI-001764, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, A.11.2.9, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.8.2.1, A.8.2.2, A.8.2.3, A.8.3.1, A.8.3.3, A.9.1.2, CIP-003-3 R5.1.1, CIP-003-3 R5.3, CIP-004-3 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2, CM-7(a), CM-7(b), CM-6(a), AC-6, AC-6(1), MP-7, PR.IP-1, PR.PT-2, PR.PT-3, SRG-OS-000368-GPOS-00154, RHEL-08-040122, SV-230510r627750_rule |
Description | The noexec mount option can be used to prevent binaries
from being executed out of /dev/shm .
It can be dangerous to allow the execution of binaries
from world-writable temporary storage directories such as /dev/shm .
Add the noexec option to the fourth column of
/etc/fstab for the line which controls mounting of
/dev/shm . |
Rationale | Allowing users to execute binaries from world-writable directories
such as /dev/shm can expose the system to potential compromise. |
noexec on /dev/shm optional no oval:ssg-test_dev_shm_partition_noexec_optional_no:tst:1 true
Following items have been found on the system:
Mount point | Device | Uuid | Fs type | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Total space | Space used | Space left |
---|---|---|---|---|---|---|---|---|---|---|---|---|---|
/dev/shm | tmpfs | tmpfs | rw | seclabel | nosuid | nodev | noexec | relatime | bind | 232570 | 0 | 232570 |
/dev/shm exists oval:ssg-test_dev_shm_no_partition_noexec_optional_no:tst:1 true
Following items have been found on the system:
Mount point | Device | Uuid | Fs type | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Total space | Space used | Space left |
---|---|---|---|---|---|---|---|---|---|---|---|---|---|
/dev/shm | tmpfs | tmpfs | rw | seclabel | nosuid | nodev | noexec | relatime | bind | 232570 | 0 | 232570 |
Add nosuid Option to /dev/shm
Rule ID | xccdf_org.ssgproject.content_rule_mount_option_dev_shm_nosuid |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-mount_option_dev_shm_nosuid:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | low |
Identifiers and References | Identifiers: CCE-80839-4 References: 1.1.16, 11, 13, 14, 3, 8, 9, APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS05.06, DSS06.06, CCI-001764, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, A.11.2.9, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.8.2.1, A.8.2.2, A.8.2.3, A.8.3.1, A.8.3.3, A.9.1.2, CIP-003-3 R5.1.1, CIP-003-3 R5.3, CIP-004-3 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2, CM-7(a), CM-7(b), CM-6(a), AC-6, AC-6(1), MP-7, PR.IP-1, PR.PT-2, PR.PT-3, SRG-OS-000368-GPOS-00154, RHEL-08-040121, SV-230509r627750_rule |
Description | The nosuid mount option can be used to prevent execution
of setuid programs in /dev/shm . The SUID and SGID permissions should not
be required in these world-writable directories.
Add the nosuid option to the fourth column of
/etc/fstab for the line which controls mounting of
/dev/shm . |
Rationale | The presence of SUID and SGID executables should be tightly controlled. Users
should not be able to execute SUID or SGID binaries from temporary storage partitions. |
nosuid on /dev/shm optional no oval:ssg-test_dev_shm_partition_nosuid_optional_no:tst:1 true
Following items have been found on the system:
Mount point | Device | Uuid | Fs type | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Total space | Space used | Space left |
---|---|---|---|---|---|---|---|---|---|---|---|---|---|
/dev/shm | tmpfs | tmpfs | rw | seclabel | nosuid | nodev | noexec | relatime | bind | 232570 | 0 | 232570 |
/dev/shm exists oval:ssg-test_dev_shm_no_partition_nosuid_optional_no:tst:1 true
Following items have been found on the system:
Mount point | Device | Uuid | Fs type | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Total space | Space used | Space left |
---|---|---|---|---|---|---|---|---|---|---|---|---|---|
/dev/shm | tmpfs | tmpfs | rw | seclabel | nosuid | nodev | noexec | relatime | bind | 232570 | 0 | 232570 |
Add nodev Option to /home
Rule ID | xccdf_org.ssgproject.content_rule_mount_option_home_nodev |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-mount_option_home_nodev:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | unknown |
Identifiers and References | Identifiers: CCE-81048-1 References: BP28(R12), 1.1.14, SRG-OS-000368-GPOS-00154 |
Description | The nodev mount option can be used to prevent device files from
being created in /home .
Legitimate character and block devices should exist only in
the /dev directory on the root partition or within chroot
jails built for system services.
Add the nodev option to the fourth column of
/etc/fstab for the line which controls mounting of
/home . |
Rationale | The only legitimate location for device files is the /dev directory
located on the root partition. The only exception to this is chroot jails. |
nodev on /home optional yes oval:ssg-test_home_partition_nodev_optional_yes:tst:1 true
Following items have been found on the system:
Mount point | Device | Uuid | Fs type | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Total space | Space used | Space left |
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
/home | /dev/mapper/VolGroup-home | 81520328-5db1-4cce-8fbe-c0877f522a72 | xfs | rw | seclabel | nosuid | nodev | relatime | attr2 | inode64 | logbufs=8 | logbsize=32k | noquota | bind | 1046016 | 15648 | 1030368 |
Add nosuid Option to /home
Rule ID | xccdf_org.ssgproject.content_rule_mount_option_home_nosuid |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-mount_option_home_nosuid:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-81050-7 References: BP28(R12), 11, 13, 14, 3, 8, 9, APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS05.06, DSS06.06, CCI-000366, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, A.11.2.9, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.8.2.1, A.8.2.2, A.8.2.3, A.8.3.1, A.8.3.3, A.9.1.2, CIP-003-3 R5.1.1, CIP-003-3 R5.3, CIP-004-3 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2, CM-7(a), CM-7(b), CM-6(a), AC-6, AC-6(1), MP-7, PR.IP-1, PR.PT-2, PR.PT-3, SRG-OS-000368-GPOS-00154, SRG-OS-000480-GPOS-00227, RHEL-08-010570, SV-230299r627750_rule |
Description | The nosuid mount option can be used to prevent
execution of setuid programs in /home . The SUID and SGID permissions
should not be required in these user data directories.
Add the nosuid option to the fourth column of
/etc/fstab for the line which controls mounting of
/home . |
Rationale | The presence of SUID and SGID executables should be tightly controlled. Users
should not be able to execute SUID or SGID binaries from user home directory partitions. |
nosuid on /home optional yes oval:ssg-test_home_partition_nosuid_optional_yes:tst:1 true
Following items have been found on the system:
Mount point | Device | Uuid | Fs type | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Total space | Space used | Space left |
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
/home | /dev/mapper/VolGroup-home | 81520328-5db1-4cce-8fbe-c0877f522a72 | xfs | rw | seclabel | nosuid | nodev | relatime | attr2 | inode64 | logbufs=8 | logbsize=32k | noquota | bind | 1046016 | 15648 | 1030368 |
Add nodev Option to Non-Root Local Partitions
Rule ID | xccdf_org.ssgproject.content_rule_mount_option_nodev_nonroot_local_partitions |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-mount_option_nodev_nonroot_local_partitions:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-82069-6 References: BP28(R12), 11, 14, 3, 9, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06, CCI-000366, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2, CIP-003-3 R5.1.1, CIP-003-3 R5.3, CIP-004-3 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2, CM-7(a), CM-7(b), CM-6(a), AC-6, AC-6(1), MP-7, PR.IP-1, PR.PT-3, SRG-OS-000368-GPOS-00154, SRG-OS-000480-GPOS-00227, RHEL-08-010580, SV-230301r627750_rule |
Description | The nodev mount option prevents files from being interpreted as
character or block devices. Legitimate character and block devices should
exist only in the /dev directory on the root partition or within
chroot jails built for system services.
Add the nodev option to the fourth column of
/etc/fstab for the line which controls mounting of
any non-root local partitions. |
Rationale | The nodev mount option prevents files from being
interpreted as character or block devices. The only legitimate location
for device files is the /dev directory located on the root partition.
The only exception to this is chroot jails, for which it is not advised
to set nodev on these filesystems. |
nodev on local filesystems oval:ssg-test_nodev_nonroot_local_partitions:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_non_root_partitions:obj:1 of type partition_object
Mount point | Filter |
---|---|
^/\w.*$ | oval:ssg-state_local_nodev:ste:1 |
Add nodev Option to /tmp
Rule ID | xccdf_org.ssgproject.content_rule_mount_option_tmp_nodev |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-mount_option_tmp_nodev:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-82623-0 References: BP28(R12), 1.1.3, 11, 13, 14, 3, 8, 9, APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS05.06, DSS06.06, CCI-001764, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, A.11.2.9, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.8.2.1, A.8.2.2, A.8.2.3, A.8.3.1, A.8.3.3, A.9.1.2, CIP-003-3 R5.1.1, CIP-003-3 R5.3, CIP-004-3 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2, CM-7(a), CM-7(b), CM-6(a), AC-6, AC-6(1), MP-7, PR.IP-1, PR.PT-2, PR.PT-3, SRG-OS-000368-GPOS-00154, RHEL-08-040123, SV-230511r627750_rule |
Description | The nodev mount option can be used to prevent device files from
being created in /tmp . Legitimate character and block devices
should not exist within temporary directories like /tmp .
Add the nodev option to the fourth column of
/etc/fstab for the line which controls mounting of
/tmp . |
Rationale | The only legitimate location for device files is the /dev directory
located on the root partition. The only exception to this is chroot jails. |
nodev on /tmp optional yes oval:ssg-test_tmp_partition_nodev_optional_yes:tst:1 true
Following items have been found on the system:
Mount point | Device | Uuid | Fs type | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Total space | Space used | Space left |
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
/tmp | /dev/mapper/VolGroup-tmp | f39ccec1-a2a1-4163-891a-9644ec01364f | xfs | rw | seclabel | nosuid | nodev | noexec | relatime | attr2 | inode64 | logbufs=8 | logbsize=32k | noquota | bind | 521728 | 12613 | 509115 |
Add noexec Option to /tmp
Rule ID | xccdf_org.ssgproject.content_rule_mount_option_tmp_noexec |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-mount_option_tmp_noexec:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-82139-7 References: BP28(R12), 1.1.5, 11, 13, 14, 3, 8, 9, APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS05.06, DSS06.06, CCI-001764, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, A.11.2.9, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.8.2.1, A.8.2.2, A.8.2.3, A.8.3.1, A.8.3.3, A.9.1.2, CIP-003-3 R5.1.1, CIP-003-3 R5.3, CIP-004-3 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2, CM-7(a), CM-7(b), CM-6(a), AC-6, AC-6(1), MP-7, PR.IP-1, PR.PT-2, PR.PT-3, SRG-OS-000368-GPOS-00154, RHEL-08-040125, SV-230513r627750_rule |
Description | The noexec mount option can be used to prevent binaries
from being executed out of /tmp .
Add the noexec option to the fourth column of
/etc/fstab for the line which controls mounting of
/tmp . |
Rationale | Allowing users to execute binaries from world-writable directories
such as /tmp should never be necessary in normal operation and
can expose the system to potential compromise. |
noexec on /tmp optional yes oval:ssg-test_tmp_partition_noexec_optional_yes:tst:1 true
Following items have been found on the system:
Mount point | Device | Uuid | Fs type | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Total space | Space used | Space left |
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
/tmp | /dev/mapper/VolGroup-tmp | f39ccec1-a2a1-4163-891a-9644ec01364f | xfs | rw | seclabel | nosuid | nodev | noexec | relatime | attr2 | inode64 | logbufs=8 | logbsize=32k | noquota | bind | 521728 | 12613 | 509115 |
Add nosuid Option to /tmp
Rule ID | xccdf_org.ssgproject.content_rule_mount_option_tmp_nosuid |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-mount_option_tmp_nosuid:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-82140-5 References: BP28(R12), 1.1.4, 11, 13, 14, 3, 8, 9, APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS05.06, DSS06.06, CCI-001764, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, A.11.2.9, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.8.2.1, A.8.2.2, A.8.2.3, A.8.3.1, A.8.3.3, A.9.1.2, CIP-003-3 R5.1.1, CIP-003-3 R5.3, CIP-004-3 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2, CM-7(a), CM-7(b), CM-6(a), AC-6, AC-6(1), MP-7, PR.IP-1, PR.PT-2, PR.PT-3, SRG-OS-000368-GPOS-00154, RHEL-08-040124, SV-230512r627750_rule |
Description | The nosuid mount option can be used to prevent
execution of setuid programs in /tmp . The SUID and SGID permissions
should not be required in these world-writable directories.
Add the nosuid option to the fourth column of
/etc/fstab for the line which controls mounting of
/tmp . |
Rationale | The presence of SUID and SGID executables should be tightly controlled. Users
should not be able to execute SUID or SGID binaries from temporary storage partitions. |
nosuid on /tmp optional yes oval:ssg-test_tmp_partition_nosuid_optional_yes:tst:1 true
Following items have been found on the system:
Mount point | Device | Uuid | Fs type | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Total space | Space used | Space left |
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
/tmp | /dev/mapper/VolGroup-tmp | f39ccec1-a2a1-4163-891a-9644ec01364f | xfs | rw | seclabel | nosuid | nodev | noexec | relatime | attr2 | inode64 | logbufs=8 | logbsize=32k | noquota | bind | 521728 | 12613 | 509115 |
Add nodev Option to /var/log/audit
Rule ID | xccdf_org.ssgproject.content_rule_mount_option_var_log_audit_nodev |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-mount_option_var_log_audit_nodev:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-82080-3 References: CCI-001764, CIP-003-3 R5.1.1, CIP-003-3 R5.3, CIP-004-3 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2, CM-7(a), CM-7(b), CM-6(a), AC-6, AC-6(1), MP-7, PR.IP-1, PR.PT-2, PR.PT-3, SRG-OS-000368-GPOS-00154, RHEL-08-040129, SV-230517r627750_rule |
Description | The nodev mount option can be used to prevent device files from
being created in /var/log/audit .
Legitimate character and block devices should exist only in
the /dev directory on the root partition or within chroot
jails built for system services.
Add the nodev option to the fourth column of
/etc/fstab for the line which controls mounting of
/var/log/audit . |
Rationale | The only legitimate location for device files is the /dev directory
located on the root partition. The only exception to this is chroot jails. |
nodev on /var/log/audit optional yes oval:ssg-test_var_log_audit_partition_nodev_optional_yes:tst:1 true
Following items have been found on the system:
Mount point | Device | Uuid | Fs type | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Total space | Space used | Space left |
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
/var/log/audit | /dev/mapper/VolGroup-audit | f4bb8355-95bf-43b9-8095-f70b08b2f896 | xfs | rw | seclabel | nosuid | nodev | noexec | relatime | attr2 | inode64 | logbufs=8 | logbsize=32k | noquota | bind | 521728 | 22118 | 499610 |
Add noexec Option to /var/log/audit
Rule ID | xccdf_org.ssgproject.content_rule_mount_option_var_log_audit_noexec |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-mount_option_var_log_audit_noexec:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-82975-4 References: CCI-001764, CIP-003-3 R5.1.1, CIP-003-3 R5.3, CIP-004-3 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2, CM-7(a), CM-7(b), CM-6(a), AC-6, AC-6(1), MP-7, PR.IP-1, PR.PT-2, PR.PT-3, SRG-OS-000368-GPOS-00154, RHEL-08-040131, SV-230519r627750_rule |
Description | The noexec mount option can be used to prevent binaries
from being executed out of /var/log/audit .
Add the noexec option to the fourth column of
/etc/fstab for the line which controls mounting of
/var/log/audit . |
Rationale | Allowing users to execute binaries from directories containing audit log files
such as /var/log/audit should never be necessary in normal operation and
can expose the system to potential compromise. |
noexec on /var/log/audit optional yes oval:ssg-test_var_log_audit_partition_noexec_optional_yes:tst:1 true
Following items have been found on the system:
Mount point | Device | Uuid | Fs type | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Total space | Space used | Space left |
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
/var/log/audit | /dev/mapper/VolGroup-audit | f4bb8355-95bf-43b9-8095-f70b08b2f896 | xfs | rw | seclabel | nosuid | nodev | noexec | relatime | attr2 | inode64 | logbufs=8 | logbsize=32k | noquota | bind | 521728 | 22118 | 499610 |
Add nosuid Option to /var/log/audit
Rule ID | xccdf_org.ssgproject.content_rule_mount_option_var_log_audit_nosuid |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-mount_option_var_log_audit_nosuid:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-82921-8 References: CCI-001764, CIP-003-3 R5.1.1, CIP-003-3 R5.3, CIP-004-3 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2, CM-7(a), CM-7(b), CM-6(a), AC-6, AC-6(1), MP-7, PR.IP-1, PR.PT-2, PR.PT-3, SRG-OS-000368-GPOS-00154, RHEL-08-040130, SV-230518r627750_rule |
Description | The nosuid mount option can be used to prevent
execution of setuid programs in /var/log/audit . The SUID and SGID permissions
should not be required in directories containing audit log files.
Add the nosuid option to the fourth column of
/etc/fstab for the line which controls mounting of
/var/log/audit . |
Rationale | The presence of SUID and SGID executables should be tightly controlled. Users
should not be able to execute SUID or SGID binaries from partitions
designated for audit log files. |
nosuid on /var/log/audit optional yes oval:ssg-test_var_log_audit_partition_nosuid_optional_yes:tst:1 true
Following items have been found on the system:
Mount point | Device | Uuid | Fs type | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Total space | Space used | Space left |
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
/var/log/audit | /dev/mapper/VolGroup-audit | f4bb8355-95bf-43b9-8095-f70b08b2f896 | xfs | rw | seclabel | nosuid | nodev | noexec | relatime | attr2 | inode64 | logbufs=8 | logbsize=32k | noquota | bind | 521728 | 22118 | 499610 |
Add nodev Option to /var/log
Rule ID | xccdf_org.ssgproject.content_rule_mount_option_var_log_nodev |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-mount_option_var_log_nodev:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-82077-9 References: CCI-001764, CIP-003-3 R5.1.1, CIP-003-3 R5.3, CIP-004-3 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2, CM-7(a), CM-7(b), CM-6(a), AC-6, AC-6(1), MP-7, PR.IP-1, PR.PT-2, PR.PT-3, SRG-OS-000368-GPOS-00154, RHEL-08-040126, SV-230514r627750_rule |
Description | The nodev mount option can be used to prevent device files from
being created in /var/log .
Legitimate character and block devices should exist only in
the /dev directory on the root partition or within chroot
jails built for system services.
Add the nodev option to the fourth column of
/etc/fstab for the line which controls mounting of
/var/log . |
Rationale | The only legitimate location for device files is the /dev directory
located on the root partition. The only exception to this is chroot jails. |
nodev on /var/log optional yes oval:ssg-test_var_log_partition_nodev_optional_yes:tst:1 true
Following items have been found on the system:
Mount point | Device | Uuid | Fs type | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Total space | Space used | Space left |
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
/var/log | /dev/mapper/VolGroup-log | b0748915-6fad-4cd6-ae14-779ea6301807 | xfs | rw | seclabel | nosuid | nodev | noexec | relatime | attr2 | inode64 | logbufs=8 | logbsize=32k | noquota | bind | 259584 | 11681 | 247903 |
Add noexec Option to /var/log
Rule ID | xccdf_org.ssgproject.content_rule_mount_option_var_log_noexec |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-mount_option_var_log_noexec:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-82008-4 References: BP28(R12), CCI-001764, CIP-003-3 R5.1.1, CIP-003-3 R5.3, CIP-004-3 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2, CM-7(a), CM-7(b), CM-6(a), AC-6, AC-6(1), MP-7, PR.IP-1, PR.PT-2, PR.PT-3, SRG-OS-000368-GPOS-00154, RHEL-08-040128, SV-230516r627750_rule |
Description | The noexec mount option can be used to prevent binaries
from being executed out of /var/log .
Add the noexec option to the fourth column of
/etc/fstab for the line which controls mounting of
/var/log . |
Rationale | Allowing users to execute binaries from directories containing log files
such as /var/log should never be necessary in normal operation and
can expose the system to potential compromise. |
noexec on /var/log optional yes oval:ssg-test_var_log_partition_noexec_optional_yes:tst:1 true
Following items have been found on the system:
Mount point | Device | Uuid | Fs type | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Total space | Space used | Space left |
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
/var/log | /dev/mapper/VolGroup-log | b0748915-6fad-4cd6-ae14-779ea6301807 | xfs | rw | seclabel | nosuid | nodev | noexec | relatime | attr2 | inode64 | logbufs=8 | logbsize=32k | noquota | bind | 259584 | 11681 | 247903 |
Add nosuid Option to /var/log
Rule ID | xccdf_org.ssgproject.content_rule_mount_option_var_log_nosuid |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-mount_option_var_log_nosuid:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-82065-4 References: BP28(R12), CCI-001764, CIP-003-3 R5.1.1, CIP-003-3 R5.3, CIP-004-3 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2, CM-7(a), CM-7(b), CM-6(a), AC-6, AC-6(1), MP-7, PR.IP-1, PR.PT-2, PR.PT-3, SRG-OS-000368-GPOS-00154, RHEL-08-040127, SV-230515r627750_rule |
Description | The nosuid mount option can be used to prevent
execution of setuid programs in /var/log . The SUID and SGID permissions
should not be required in directories containing log files.
Add the nosuid option to the fourth column of
/etc/fstab for the line which controls mounting of
/var/log . |
Rationale | The presence of SUID and SGID executables should be tightly controlled. Users
should not be able to execute SUID or SGID binaries from partitions
designated for log files. |
nosuid on /var/log optional yes oval:ssg-test_var_log_partition_nosuid_optional_yes:tst:1 true
Following items have been found on the system:
Mount point | Device | Uuid | Fs type | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Total space | Space used | Space left |
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
/var/log | /dev/mapper/VolGroup-log | b0748915-6fad-4cd6-ae14-779ea6301807 | xfs | rw | seclabel | nosuid | nodev | noexec | relatime | attr2 | inode64 | logbufs=8 | logbsize=32k | noquota | bind | 259584 | 11681 | 247903 |
Add nodev Option to /var
Rule ID | xccdf_org.ssgproject.content_rule_mount_option_var_nodev |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-mount_option_var_nodev:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-82062-1 References: CIP-003-3 R5.1.1, CIP-003-3 R5.3, CIP-004-3 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2, CM-7(a), CM-7(b), CM-6(a), AC-6, AC-6(1), MP-7, PR.IP-1, PR.PT-2, PR.PT-3, SRG-OS-000368-GPOS-00154 |
Description | The nodev mount option can be used to prevent device files from
being created in /var .
Legitimate character and block devices should exist only in
the /dev directory on the root partition or within chroot
jails built for system services.
Add the nodev option to the fourth column of
/etc/fstab for the line which controls mounting of
/var . |
Rationale | The only legitimate location for device files is the /dev directory
located on the root partition. The only exception to this is chroot jails. |
nodev on /var optional yes oval:ssg-test_var_partition_nodev_optional_yes:tst:1 true
Following items have been found on the system:
Mount point | Device | Uuid | Fs type | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Total space | Space used | Space left |
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
/var | /dev/mapper/VolGroup-var | 5d6ea26d-5887-49fa-ad24-3b1ad6033d70 | xfs | rw | seclabel | nodev | relatime | attr2 | inode64 | logbufs=8 | logbsize=32k | noquota | bind | 783872 | 61187 | 722685 |
Add nodev Option to /var/tmp
Rule ID | xccdf_org.ssgproject.content_rule_mount_option_var_tmp_nodev |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-mount_option_var_tmp_nodev:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-82068-8 References: BP28(R12), 1.1.8, CCI-001764, SRG-OS-000368-GPOS-00154, RHEL-08-040132, SV-230520r627750_rule |
Description | The nodev mount option can be used to prevent device files from
being created in /var/tmp . Legitimate character and block devices
should not exist within temporary directories like /var/tmp .
Add the nodev option to the fourth column of
/etc/fstab for the line which controls mounting of
/var/tmp . |
Rationale | The only legitimate location for device files is the /dev directory
located on the root partition. The only exception to this is chroot jails. |
nodev on /var/tmp optional yes oval:ssg-test_var_tmp_partition_nodev_optional_yes:tst:1 true
Following items have been found on the system:
Mount point | Device | Uuid | Fs type | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Total space | Space used | Space left |
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
/var/tmp | /dev/mapper/VolGroup-vartmp | 45b37d67-9a15-46da-8775-734e79e9dc2f | xfs | rw | seclabel | nosuid | nodev | noexec | relatime | attr2 | inode64 | logbufs=8 | logbsize=32k | noquota | bind | 259584 | 10097 | 249487 |
Add noexec Option to /var/tmp
Rule ID | xccdf_org.ssgproject.content_rule_mount_option_var_tmp_noexec |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-mount_option_var_tmp_noexec:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-82151-2 References: BP28(R12), 1.1.10, CCI-001764, SRG-OS-000368-GPOS-00154, RHEL-08-040134, SV-230522r627750_rule |
Description | The noexec mount option can be used to prevent binaries
from being executed out of /var/tmp .
Add the noexec option to the fourth column of
/etc/fstab for the line which controls mounting of
/var/tmp . |
Rationale | Allowing users to execute binaries from world-writable directories
such as /var/tmp should never be necessary in normal operation and
can expose the system to potential compromise. |
noexec on /var/tmp optional yes oval:ssg-test_var_tmp_partition_noexec_optional_yes:tst:1 true
Following items have been found on the system:
Mount point | Device | Uuid | Fs type | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Total space | Space used | Space left |
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
/var/tmp | /dev/mapper/VolGroup-vartmp | 45b37d67-9a15-46da-8775-734e79e9dc2f | xfs | rw | seclabel | nosuid | nodev | noexec | relatime | attr2 | inode64 | logbufs=8 | logbsize=32k | noquota | bind | 259584 | 10097 | 249487 |
Add nosuid Option to /var/tmp
Rule ID | xccdf_org.ssgproject.content_rule_mount_option_var_tmp_nosuid |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-mount_option_var_tmp_nosuid:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-82154-6 References: BP28(R12), 1.1.9, CCI-001764, SRG-OS-000368-GPOS-00154, RHEL-08-040133, SV-230521r627750_rule |
Description | The nosuid mount option can be used to prevent
execution of setuid programs in /var/tmp . The SUID and SGID permissions
should not be required in these world-writable directories.
Add the nosuid option to the fourth column of
/etc/fstab for the line which controls mounting of
/var/tmp . |
Rationale | The presence of SUID and SGID executables should be tightly controlled. Users
should not be able to execute SUID or SGID binaries from temporary storage partitions. |
nosuid on /var/tmp optional yes oval:ssg-test_var_tmp_partition_nosuid_optional_yes:tst:1 true
Following items have been found on the system:
Mount point | Device | Uuid | Fs type | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Total space | Space used | Space left |
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
/var/tmp | /dev/mapper/VolGroup-vartmp | 45b37d67-9a15-46da-8775-734e79e9dc2f | xfs | rw | seclabel | nosuid | nodev | noexec | relatime | attr2 | inode64 | logbufs=8 | logbsize=32k | noquota | bind | 259584 | 10097 | 249487 |
Disable acquiring, saving, and processing core dumps
Rule ID | xccdf_org.ssgproject.content_rule_service_systemd-coredump_disabled |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-service_systemd-coredump_disabled:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-82881-4 References: CCI-000366, FMT_SMF_EXT.1, SRG-OS-000480-GPOS-00227, RHEL-08-010672, SV-230312r627750_rule |
Description | The systemd-coredump.socket unit is a socket activation of
the systemd-coredump@.service which processes core dumps.
By masking the unit, core dump processing is disabled. |
Rationale | A core dump includes a memory image taken at the time the operating system
terminates an application. The memory image could contain sensitive data
and is generally useful only for developers trying to debug problems. |
package systemd is removed oval:ssg-test_service_systemd-coredump_package_systemd_removed:tst:1 false
Following items have been found on the system:
Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
---|---|---|---|---|---|---|---|
systemd | x86_64 | (none) | 51.el8 | 239 | 0:239-51.el8 | 199e2f91fd431d51 | systemd-0:239-51.el8.x86_64 |
Test that the systemd-coredump service is not running oval:ssg-test_service_not_running_systemd-coredump:tst:1 true
Following items have been found on the system:
Unit | Property | Value |
---|---|---|
systemd-coredump.socket | ActiveState | inactive |
Test that the property LoadState from the service systemd-coredump is masked oval:ssg-test_service_loadstate_is_masked_systemd-coredump:tst:1 true
Following items have been found on the system:
Unit | Property | Value |
---|---|---|
systemd-coredump.socket | LoadState | masked |
Test that the property FragmentPath from the service systemd-coredump is set to /dev/null oval:ssg-test_service_fragmentpath_is_dev_null_systemd-coredump:tst:1 true
Following items have been found on the system:
Unit | Property | Value |
---|---|---|
systemd-coredump.socket | FragmentPath | /dev/null |
Disable core dump backtraces
Rule ID | xccdf_org.ssgproject.content_rule_coredump_disable_backtraces |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-coredump_disable_backtraces:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-82251-0 References: 1.6.1, CCI-000366, FMT_SMF_EXT.1, SRG-OS-000480-GPOS-00227, RHEL-08-010675, SV-230315r627750_rule |
Description | The ProcessSizeMax option in [Coredump] section
of /etc/systemd/coredump.conf
specifies the maximum size in bytes of a core which will be processed.
Core dumps exceeding this size may be stored, but the backtrace will not
be generated. |
Rationale | A core dump includes a memory image taken at the time the operating system
terminates an application. The memory image could contain sensitive data
and is generally useful only for developers or system operators trying to
debug problems.
Enabling core dumps on production systems is not recommended,
however there may be overriding operational requirements to enable advanced
debuging. Permitting temporary enablement of core dumps during such situations
should be reviewed through local needs and policy. |
Warnings | warning
If the /etc/systemd/coredump.conf file
does not already contain the [Coredump] section,
the value will not be configured correctly. |
tests the value of ProcessSizeMax setting in the /etc/systemd/coredump.conf file oval:ssg-test_coredump_disable_backtraces:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/systemd/coredump.conf | [Coredump] #Storage=external #Compress=yes #ProcessSizeMax=2G #ExternalSizeMax=2G #JournalSizeMax=767M #MaxUse= #KeepFree= ProcessSizeMax=0 |
Disable storing core dump
Rule ID | xccdf_org.ssgproject.content_rule_coredump_disable_storage |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-coredump_disable_storage:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-82252-8 References: 1.6.1, CCI-000366, FMT_SMF_EXT.1, SRG-OS-000480-GPOS-00227, RHEL-08-010674, SV-230314r627750_rule |
Description | The Storage option in [Coredump] section
of /etc/systemd/coredump.conf
can be set to none to disable storing core dumps permanently. |
Rationale | A core dump includes a memory image taken at the time the operating system
terminates an application. The memory image could contain sensitive data
and is generally useful only for developers or system operators trying to
debug problems. Enabling core dumps on production systems is not recommended,
however there may be overriding operational requirements to enable advanced
debuging. Permitting temporary enablement of core dumps during such situations
should be reviewed through local needs and policy. |
Warnings | warning
If the /etc/systemd/coredump.conf file
does not already contain the [Coredump] section,
the value will not be configured correctly. |
tests the value of Storage setting in the /etc/systemd/coredump.conf file oval:ssg-test_coredump_disable_storage:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/systemd/coredump.conf | [Coredump] #Storage=external #Compress=yes #ProcessSizeMax=2G #ExternalSizeMax=2G #JournalSizeMax=767M #MaxUse= #KeepFree= ProcessSizeMax=0 Storage=none |
Disable Core Dumps for All Users
Rule ID | xccdf_org.ssgproject.content_rule_disable_users_coredumps |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-disable_users_coredumps:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-81038-2 References: 1.6.1, 1, 12, 13, 15, 16, 2, 7, 8, APO13.01, BAI04.04, DSS01.03, DSS03.05, DSS05.07, CCI-000366, SR 6.2, SR 7.1, SR 7.2, A.12.1.3, A.17.2.1, DE.CM-1, PR.DS-4, SRG-OS-000480-GPOS-00227, RHEL-08-010673, SV-230313r627750_rule |
Description | To disable core dumps for all users, add the following line to
/etc/security/limits.conf , or to a file within the
/etc/security/limits.d/ directory:
* hard core 0 |
Rationale | A core dump includes a memory image taken at the time the operating system
terminates an application. The memory image could contain sensitive data and is generally useful
only for developers trying to debug problems. |
Tests the value of the ^[\s]*\*[\s]+(hard|-)[\s]+core[\s]+([\d]+) setting in the /etc/security/limits.d directory oval:ssg-test_core_dumps_limits_d:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_core_dumps_limits_d:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/etc/security/limits.d | ^.*\.conf$ | ^[\s]*\*[\s]+(?:hard|-)[\s]+core[\s]+([\d]+) | 1 |
Tests for existance of the ^[\s]*\*[\s]+(hard|-)[\s]+core setting in the /etc/security/limits.d directory oval:ssg-test_core_dumps_limits_d_exists:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_core_dumps_limits_d_exists:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/etc/security/limits.d | ^.*\.conf$ | ^[\s]*\*[\s]+(?:hard|-)[\s]+core | 1 |
Tests the value of the ^[\s]*\*[\s]+(hard|-)[\s]+core[\s]+([\d]+) setting in the /etc/security/limits.conf file oval:ssg-test_core_dumps_limitsconf:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/security/limits.conf | * hard core 0 |
Restrict Exposed Kernel Pointer Addresses Access
Rule ID | xccdf_org.ssgproject.content_rule_sysctl_kernel_kptr_restrict |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-sysctl_kernel_kptr_restrict:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-80915-2 References: BP28(R23), CCI-002824, CCI-000366, CIP-002-3 R1.1, CIP-002-3 R1.2, CIP-003-3 R5.1.1, CIP-003-3 R5.3, CIP-004-3 4.1, CIP-004-3 4.2, CIP-004-3 R2.2.3, CIP-004-3 R2.2.4, CIP-004-3 R2.3, CIP-004-3 R4, CIP-005-3a R1, CIP-005-3a R1.1, CIP-005-3a R1.2, CIP-007-3 R3, CIP-007-3 R3.1, CIP-007-3 R5.1, CIP-007-3 R5.1.2, CIP-007-3 R5.1.3, CIP-007-3 R5.2.1, CIP-007-3 R5.2.3, CIP-007-3 R8.4, CIP-009-3 R.1.1, CIP-009-3 R4, SC-30, SC-30(2), SC-30(5), CM-6(a), SRG-OS-000132-GPOS-00067, SRG-OS-000433-GPOS-00192, SRG-OS-000480-GPOS-00227, RHEL-08-040283, SV-230547r627750_rule |
Description | To set the runtime status of the kernel.kptr_restrict kernel parameter, run the following command: $ sudo sysctl -w kernel.kptr_restrict=1To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d : kernel.kptr_restrict = 1 |
Rationale | Exposing kernel pointers (through procfs or seq_printf() ) exposes
kernel writeable structures that can contain functions pointers. If a write vulnereability occurs
in the kernel allowing a write access to any of this structure, the kernel can be compromise. This
option disallow any program withtout the CAP_SYSLOG capability from getting the kernel pointers addresses,
replacing them with 0. |
kernel.kptr_restrict static configuration oval:ssg-test_static_sysctl_kernel_kptr_restrict:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_sysctl_kernel_kptr_restrict:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
/etc/sysctl.conf | ^[\s]*kernel.kptr_restrict[\s]*=[\s]*1[\s]*$ | 1 |
kernel.kptr_restrict static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_etc_sysctld_kernel_kptr_restrict:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_etc_sysctld_kernel_kptr_restrict:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/etc/sysctl.d | ^.*\.conf$ | ^[\s]*kernel.kptr_restrict[\s]*=[\s]*1[\s]*$ | 1 |
kernel.kptr_restrict static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_run_sysctld_kernel_kptr_restrict:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_run_sysctld_kernel_kptr_restrict:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/run/sysctl.d | ^.*\.conf$ | ^[\s]*kernel.kptr_restrict[\s]*=[\s]*1[\s]*$ | 1 |
kernel.kptr_restrict static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_usr_lib_sysctld_kernel_kptr_restrict:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/usr/lib/sysctl.d/50-default.conf | kernel.kptr_restrict = 1 |
kernel runtime parameter kernel.kptr_restrict set to 1 oval:ssg-test_sysctl_runtime_kernel_kptr_restrict:tst:1 true
Following items have been found on the system:
Name | Value |
---|---|
kernel.kptr_restrict | 1 |
Enable page allocator poisoning
Rule ID | xccdf_org.ssgproject.content_rule_grub2_page_poison_argument |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-grub2_page_poison_argument:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-80944-2 References: CCI-001084, CM-6(a), SRG-OS-000480-GPOS-00227, SRG-OS-000134-GPOS-00068, RHEL-08-010421, SV-230277r627750_rule |
Description | To enable poisoning of free pages,
add the argument page_poison=1 to the default
GRUB 2 command line for the Linux operating system in
/etc/default/grub , in the manner below:
GRUB_CMDLINE_LINUX="page_poison=1" |
Rationale | Poisoning writes an arbitrary value to freed pages, so any modification or
reference to that page after being freed or before being initialized will be
detected and prevented.
This prevents many types of use-after-free vulnerabilities at little performance cost.
Also prevents leak of data and detection of corrupted memory. |
Warnings | warning
The GRUB 2 configuration file, grub.cfg ,
is automatically updated each time a new kernel is installed. Note that any
changes to /etc/default/grub require rebuilding the grub.cfg
file. To update the GRUB 2 configuration file manually, use the
grub2-mkconfig -ocommand as follows:
|
check forkernel command line parameters page_poison=1 in /boot/grub2/grubenv for all kernels oval:ssg-test_grub2_page_poison_argument_grub_env:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/boot/grub2/grubenv | kernelopts=root=/dev/mapper/VolGroup-root ro audit=1 audit_backlog_limit=8192 crashkernel=auto resume=/dev/mapper/VolGroup-swap rd.lvm.lv=VolGroup/root rd.lvm.lv=VolGroup/swap rhgb quiet fips=1 boot=UUID=e5fe751a-8dfb-40d1-840e-ef8d20bc4298 random.trust_cpu=on pti=on page_poison=1 slub_debug=P |
Enable SLUB/SLAB allocator poisoning
Rule ID | xccdf_org.ssgproject.content_rule_grub2_slub_debug_argument |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-grub2_slub_debug_argument:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-80945-9 References: CCI-001084, CM-6(a), SRG-OS-000433-GPOS-00192, SRG-OS-000134-GPOS-00068, RHEL-08-010423, SV-230279r627750_rule |
Description | To enable poisoning of SLUB/SLAB objects,
add the argument slub_debug=P to the default
GRUB 2 command line for the Linux operating system in
/etc/default/grub , in the manner below:
GRUB_CMDLINE_LINUX="slub_debug=P" |
Rationale | Poisoning writes an arbitrary value to freed objects, so any modification or
reference to that object after being freed or before being initialized will be
detected and prevented.
This prevents many types of use-after-free vulnerabilities at little performance cost.
Also prevents leak of data and detection of corrupted memory. |
Warnings | warning
The GRUB 2 configuration file, grub.cfg ,
is automatically updated each time a new kernel is installed. Note that any
changes to /etc/default/grub require rebuilding the grub.cfg
file. To update the GRUB 2 configuration file manually, use the
grub2-mkconfig -ocommand as follows:
|
check forkernel command line parameters slub_debug=P in /boot/grub2/grubenv for all kernels oval:ssg-test_grub2_slub_debug_argument_grub_env:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/boot/grub2/grubenv | kernelopts=root=/dev/mapper/VolGroup-root ro audit=1 audit_backlog_limit=8192 crashkernel=auto resume=/dev/mapper/VolGroup-swap rd.lvm.lv=VolGroup/root rd.lvm.lv=VolGroup/swap rhgb quiet fips=1 boot=UUID=e5fe751a-8dfb-40d1-840e-ef8d20bc4298 random.trust_cpu=on pti=on page_poison=1 slub_debug=P |
Disable storing core dumps
Rule ID | xccdf_org.ssgproject.content_rule_sysctl_kernel_core_pattern |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-sysctl_kernel_core_pattern:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-82215-5 References: CCI-000366, FMT_SMF_EXT.1, SRG-OS-000480-GPOS-00227, RHEL-08-010671, SV-230311r627750_rule |
Description | To set the runtime status of the kernel.core_pattern kernel parameter, run the following command: $ sudo sysctl -w kernel.core_pattern=|/bin/falseTo make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d : kernel.core_pattern = |/bin/false |
Rationale | A core dump includes a memory image taken at the time the operating system
terminates an application. The memory image could contain sensitive data and is generally useful
only for developers trying to debug problems. |
kernel.core_pattern static configuration oval:ssg-test_static_sysctl_kernel_core_pattern:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/sysctl.conf | kernel.core_pattern = |
kernel.core_pattern static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_etc_sysctld_kernel_core_pattern:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/sysctl.d/99-sysctl.conf | kernel.core_pattern = |
kernel.core_pattern static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_run_sysctld_kernel_core_pattern:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_run_sysctld_kernel_core_pattern:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/run/sysctl.d | ^.*\.conf$ | ^[\s]*kernel.core_pattern[\s]*=[\s]*|/bin/false[\s]*$ | 1 |
kernel.core_pattern static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_usr_lib_sysctld_kernel_core_pattern:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/usr/lib/sysctl.d/50-coredump.conf | kernel.core_pattern= |
kernel runtime parameter kernel.core_pattern set to |/bin/false oval:ssg-test_sysctl_runtime_kernel_core_pattern:tst:1 true
Following items have been found on the system:
Name | Value |
---|---|
kernel.core_pattern | |/bin/false |
Restrict Access to Kernel Message Buffer
Rule ID | xccdf_org.ssgproject.content_rule_sysctl_kernel_dmesg_restrict |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-sysctl_kernel_dmesg_restrict:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-80913-7 References: BP28(R23), 3.1.5, CCI-001314, 164.308(a)(1)(ii)(D), 164.308(a)(3), 164.308(a)(4), 164.310(b), 164.310(c), 164.312(a), 164.312(e), SI-11(a), SI-11(b), SRG-OS-000132-GPOS-00067, SRG-OS-000138-GPOS-00069, RHEL-08-010375, SV-230269r627750_rule |
Description | To set the runtime status of the kernel.dmesg_restrict kernel parameter, run the following command: $ sudo sysctl -w kernel.dmesg_restrict=1To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d : kernel.dmesg_restrict = 1 |
Rationale | Unprivileged access to the kernel syslog can expose sensitive kernel
address information. |
kernel.dmesg_restrict static configuration oval:ssg-test_static_sysctl_kernel_dmesg_restrict:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/sysctl.conf | kernel.dmesg_restrict = 1 |
kernel.dmesg_restrict static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_etc_sysctld_kernel_dmesg_restrict:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/sysctl.d/99-sysctl.conf | kernel.dmesg_restrict = 1 |
kernel.dmesg_restrict static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_run_sysctld_kernel_dmesg_restrict:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_run_sysctld_kernel_dmesg_restrict:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/run/sysctl.d | ^.*\.conf$ | ^[\s]*kernel.dmesg_restrict[\s]*=[\s]*1[\s]*$ | 1 |
kernel.dmesg_restrict static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_usr_lib_sysctld_kernel_dmesg_restrict:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_usr_lib_sysctld_kernel_dmesg_restrict:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/usr/lib/sysctl.d | ^.*\.conf$ | ^[\s]*kernel.dmesg_restrict[\s]*=[\s]*1[\s]*$ | 1 |
kernel runtime parameter kernel.dmesg_restrict set to 1 oval:ssg-test_sysctl_runtime_kernel_dmesg_restrict:tst:1 true
Following items have been found on the system:
Name | Value |
---|---|
kernel.dmesg_restrict | 1 |
Disable Kernel Image Loading
Rule ID | xccdf_org.ssgproject.content_rule_sysctl_kernel_kexec_load_disabled |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-sysctl_kernel_kexec_load_disabled:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-80952-5 References: CCI-001749, SRG-OS-000480-GPOS-00227, SRG-OS-000366-GPOS-00153, RHEL-08-010372, SV-230266r627750_rule |
Description | To set the runtime status of the kernel.kexec_load_disabled kernel parameter, run the following command: $ sudo sysctl -w kernel.kexec_load_disabled=1To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d : kernel.kexec_load_disabled = 1 |
Rationale | Disabling kexec_load allows greater control of the kernel memory.
It makes it impossible to load another kernel image after it has been disabled.
|
kernel.kexec_load_disabled static configuration oval:ssg-test_static_sysctl_kernel_kexec_load_disabled:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/sysctl.conf | kernel.kexec_load_disabled = 1 |
kernel.kexec_load_disabled static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_etc_sysctld_kernel_kexec_load_disabled:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/sysctl.d/99-sysctl.conf | kernel.kexec_load_disabled = 1 |
kernel.kexec_load_disabled static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_run_sysctld_kernel_kexec_load_disabled:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_run_sysctld_kernel_kexec_load_disabled:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/run/sysctl.d | ^.*\.conf$ | ^[\s]*kernel.kexec_load_disabled[\s]*=[\s]*1[\s]*$ | 1 |
kernel.kexec_load_disabled static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_usr_lib_sysctld_kernel_kexec_load_disabled:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_usr_lib_sysctld_kernel_kexec_load_disabled:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/usr/lib/sysctl.d | ^.*\.conf$ | ^[\s]*kernel.kexec_load_disabled[\s]*=[\s]*1[\s]*$ | 1 |
kernel runtime parameter kernel.kexec_load_disabled set to 1 oval:ssg-test_sysctl_runtime_kernel_kexec_load_disabled:tst:1 true
Following items have been found on the system:
Name | Value |
---|---|
kernel.kexec_load_disabled | 1 |
Disallow kernel profiling by unprivileged users
Rule ID | xccdf_org.ssgproject.content_rule_sysctl_kernel_perf_event_paranoid |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-sysctl_kernel_perf_event_paranoid:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-81054-9 References: BP28(R23), CCI-001090, FMT_SMF_EXT.1, SRG-OS-000132-GPOS-00067, SRG-OS-000138-GPOS-00069, RHEL-08-010376, SV-230270r627750_rule |
Description | To set the runtime status of the kernel.perf_event_paranoid kernel parameter, run the following command: $ sudo sysctl -w kernel.perf_event_paranoid=2To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d : kernel.perf_event_paranoid = 2 |
Rationale | Kernel profiling can reveal sensitive information about kernel behaviour. |
kernel.perf_event_paranoid static configuration oval:ssg-test_static_sysctl_kernel_perf_event_paranoid:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/sysctl.conf | kernel.perf_event_paranoid = 2 |
kernel.perf_event_paranoid static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_etc_sysctld_kernel_perf_event_paranoid:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/sysctl.d/99-sysctl.conf | kernel.perf_event_paranoid = 2 |
kernel.perf_event_paranoid static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_run_sysctld_kernel_perf_event_paranoid:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_run_sysctld_kernel_perf_event_paranoid:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/run/sysctl.d | ^.*\.conf$ | ^[\s]*kernel.perf_event_paranoid[\s]*=[\s]*2[\s]*$ | 1 |
kernel.perf_event_paranoid static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_usr_lib_sysctld_kernel_perf_event_paranoid:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_usr_lib_sysctld_kernel_perf_event_paranoid:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/usr/lib/sysctl.d | ^.*\.conf$ | ^[\s]*kernel.perf_event_paranoid[\s]*=[\s]*2[\s]*$ | 1 |
kernel runtime parameter kernel.perf_event_paranoid set to 2 oval:ssg-test_sysctl_runtime_kernel_perf_event_paranoid:tst:1 true
Following items have been found on the system:
Name | Value |
---|---|
kernel.perf_event_paranoid | 2 |
Disable Access to Network bpf() Syscall From Unprivileged Processes
Rule ID | xccdf_org.ssgproject.content_rule_sysctl_kernel_unprivileged_bpf_disabled |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-sysctl_kernel_unprivileged_bpf_disabled:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-82974-7 References: CCI-000366, FMT_SMF_EXT.1, SRG-OS-000132-GPOS-00067, SRG-OS-000480-GPOS-00227, RHEL-08-040281, SV-230545r627750_rule |
Description | To set the runtime status of the kernel.unprivileged_bpf_disabled kernel parameter, run the following command: $ sudo sysctl -w kernel.unprivileged_bpf_disabled=1To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d : kernel.unprivileged_bpf_disabled = 1 |
Rationale | Loading and accessing the packet filters programs and maps using the bpf()
syscall has the potential of revealing sensitive information about the kernel state. |
kernel.unprivileged_bpf_disabled static configuration oval:ssg-test_static_sysctl_kernel_unprivileged_bpf_disabled:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/sysctl.conf | kernel.unprivileged_bpf_disabled = 1 |
kernel.unprivileged_bpf_disabled static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_etc_sysctld_kernel_unprivileged_bpf_disabled:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/sysctl.d/99-sysctl.conf | kernel.unprivileged_bpf_disabled = 1 |
kernel.unprivileged_bpf_disabled static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_run_sysctld_kernel_unprivileged_bpf_disabled:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_run_sysctld_kernel_unprivileged_bpf_disabled:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/run/sysctl.d | ^.*\.conf$ | ^[\s]*kernel.unprivileged_bpf_disabled[\s]*=[\s]*1[\s]*$ | 1 |
kernel.unprivileged_bpf_disabled static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_usr_lib_sysctld_kernel_unprivileged_bpf_disabled:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_usr_lib_sysctld_kernel_unprivileged_bpf_disabled:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/usr/lib/sysctl.d | ^.*\.conf$ | ^[\s]*kernel.unprivileged_bpf_disabled[\s]*=[\s]*1[\s]*$ | 1 |
kernel runtime parameter kernel.unprivileged_bpf_disabled set to 1 oval:ssg-test_sysctl_runtime_kernel_unprivileged_bpf_disabled:tst:1 true
Following items have been found on the system:
Name | Value |
---|---|
kernel.unprivileged_bpf_disabled | 1 |
Restrict usage of ptrace to descendant processes
Rule ID | xccdf_org.ssgproject.content_rule_sysctl_kernel_yama_ptrace_scope |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-sysctl_kernel_yama_ptrace_scope:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-80953-3 References: BP28(R25), CCI-000366, SRG-OS-000132-GPOS-00067, SRG-OS-000480-GPOS-00227, RHEL-08-040282, SV-230546r627750_rule |
Description | To set the runtime status of the kernel.yama.ptrace_scope kernel parameter, run the following command: $ sudo sysctl -w kernel.yama.ptrace_scope=1To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d : kernel.yama.ptrace_scope = 1 |
Rationale | Unrestricted usage of ptrace allows compromised binaries to run ptrace
on another processes of the user. Like this, the attacker can steal
sensitive information from the target processes (e.g. SSH sessions, web browser, ...)
without any additional assistance from the user (i.e. without resorting to phishing).
|
kernel.yama.ptrace_scope static configuration oval:ssg-test_static_sysctl_kernel_yama_ptrace_scope:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/sysctl.conf | kernel.yama.ptrace_scope = 1 |
kernel.yama.ptrace_scope static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_etc_sysctld_kernel_yama_ptrace_scope:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/sysctl.d/99-sysctl.conf | kernel.yama.ptrace_scope = 1 |
kernel.yama.ptrace_scope static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_run_sysctld_kernel_yama_ptrace_scope:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_run_sysctld_kernel_yama_ptrace_scope:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/run/sysctl.d | ^.*\.conf$ | ^[\s]*kernel.yama.ptrace_scope[\s]*=[\s]*1[\s]*$ | 1 |
kernel.yama.ptrace_scope static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_usr_lib_sysctld_kernel_yama_ptrace_scope:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_usr_lib_sysctld_kernel_yama_ptrace_scope:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/usr/lib/sysctl.d | ^.*\.conf$ | ^[\s]*kernel.yama.ptrace_scope[\s]*=[\s]*1[\s]*$ | 1 |
kernel runtime parameter kernel.yama.ptrace_scope set to 1 oval:ssg-test_sysctl_runtime_kernel_yama_ptrace_scope:tst:1 true
Following items have been found on the system:
Name | Value |
---|---|
kernel.yama.ptrace_scope | 1 |
Harden the operation of the BPF just-in-time compiler
Rule ID | xccdf_org.ssgproject.content_rule_sysctl_net_core_bpf_jit_harden |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-sysctl_net_core_bpf_jit_harden:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-82934-1 References: CCI-000366, CM-6b, FMT_SMF_EXT.1, SRG-OS-000480-GPOS-00227, RHEL-08-040286, SV-244554r743911_rule |
Description | To set the runtime status of the net.core.bpf_jit_harden kernel parameter, run the following command: $ sudo sysctl -w net.core.bpf_jit_harden=2To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d : net.core.bpf_jit_harden = 2 |
Rationale | When hardened, the extended Berkeley Packet Filter just-in-time compiler
will randomize any kernel addresses in the BPF programs and maps,
and will not expose the JIT addresses in /proc/kallsyms . |
net.core.bpf_jit_harden static configuration oval:ssg-test_static_sysctl_net_core_bpf_jit_harden:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/sysctl.conf | net.core.bpf_jit_harden = 2 |
net.core.bpf_jit_harden static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_etc_sysctld_net_core_bpf_jit_harden:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/sysctl.d/99-sysctl.conf | net.core.bpf_jit_harden = 2 |
net.core.bpf_jit_harden static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_run_sysctld_net_core_bpf_jit_harden:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_run_sysctld_net_core_bpf_jit_harden:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/run/sysctl.d | ^.*\.conf$ | ^[\s]*net.core.bpf_jit_harden[\s]*=[\s]*2[\s]*$ | 1 |
net.core.bpf_jit_harden static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_usr_lib_sysctld_net_core_bpf_jit_harden:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_usr_lib_sysctld_net_core_bpf_jit_harden:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/usr/lib/sysctl.d | ^.*\.conf$ | ^[\s]*net.core.bpf_jit_harden[\s]*=[\s]*2[\s]*$ | 1 |
kernel runtime parameter net.core.bpf_jit_harden set to 2 oval:ssg-test_sysctl_runtime_net_core_bpf_jit_harden:tst:1 true
Following items have been found on the system:
Name | Value |
---|---|
net.core.bpf_jit_harden | 2 |
Disable the use of user namespaces
Rule ID | xccdf_org.ssgproject.content_rule_sysctl_user_max_user_namespaces |
Result | informational |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-sysctl_user_max_user_namespaces:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | info |
Identifiers and References | Identifiers: CCE-82211-4 References: CCI-000366, SC-39, CM-6(a), FMT_SMF_EXT.1, SRG-OS-000480-GPOS-00227, RHEL-08-040284, SV-230548r627750_rule |
Description | To set the runtime status of the user.max_user_namespaces kernel parameter,
run the following command:
$ sudo sysctl -w user.max_user_namespaces=0To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d :
user.max_user_namespaces = 0When containers are deployed on the machine, the value should be set to large non-zero value. |
Rationale | User namespaces are used primarily for Linux containers. The value 0
disallows the use of user namespaces. |
Warnings | warning
This configuration baseline was created to deploy the base operating system for general purpose
workloads. When the operating system is configured for certain purposes, such as to host Linux Containers,
it is expected that user.max_user_namespaces will be enabled. |
user.max_user_namespaces static configuration oval:ssg-test_static_sysctl_user_max_user_namespaces:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_sysctl_user_max_user_namespaces:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
/etc/sysctl.conf | ^[\s]*user.max_user_namespaces[\s]*=[\s]*0[\s]*$ | 1 |
user.max_user_namespaces static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_etc_sysctld_user_max_user_namespaces:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_etc_sysctld_user_max_user_namespaces:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/etc/sysctl.d | ^.*\.conf$ | ^[\s]*user.max_user_namespaces[\s]*=[\s]*0[\s]*$ | 1 |
user.max_user_namespaces static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_run_sysctld_user_max_user_namespaces:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_run_sysctld_user_max_user_namespaces:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/run/sysctl.d | ^.*\.conf$ | ^[\s]*user.max_user_namespaces[\s]*=[\s]*0[\s]*$ | 1 |
user.max_user_namespaces static configuration in /etc/sysctl.d/*.conf oval:ssg-test_static_usr_lib_sysctld_user_max_user_namespaces:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_usr_lib_sysctld_user_max_user_namespaces:obj:1 of type textfilecontent54_object
Path | Filename | Pattern | Instance |
---|---|---|---|
/usr/lib/sysctl.d | ^.*\.conf$ | ^[\s]*user.max_user_namespaces[\s]*=[\s]*0[\s]*$ | 1 |
kernel runtime parameter user.max_user_namespaces set to 0 oval:ssg-test_sysctl_runtime_user_max_user_namespaces:tst:1 false
Following items have been found on the system:
Name | Value |
---|---|
user.max_user_namespaces | 7113 |
Install policycoreutils-python-utils package
Rule ID | xccdf_org.ssgproject.content_rule_package_policycoreutils-python-utils_installed |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-package_policycoreutils-python-utils_installed:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-82724-6 References: SRG-OS-000480-GPOS-00227 |
Description | The policycoreutils-python-utils package can be installed with the following command:
$ sudo yum install policycoreutils-python-utils |
Rationale | This package is required to operate and manage an SELinux environment and its policies.
It provides utilities such as semanage, audit2allow, audit2why, chcat and sandbox. |
package policycoreutils-python-utils is installed oval:ssg-test_package_policycoreutils-python-utils_installed:tst:1 true
Following items have been found on the system:
Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
---|---|---|---|---|---|---|---|
policycoreutils-python-utils | noarch | (none) | 16.el8 | 2.9 | 0:2.9-16.el8 | 199e2f91fd431d51 | policycoreutils-python-utils-0:2.9-16.el8.noarch |
Install policycoreutils Package
Rule ID | xccdf_org.ssgproject.content_rule_package_policycoreutils_installed |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-package_policycoreutils_installed:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | high |
Identifiers and References | Identifiers: CCE-82976-2 References: CCI-001084, SRG-OS-000480-GPOS-00227, RHEL-08-010171, SV-230241r627750_rule |
Description | The policycoreutils package can be installed with the following command:
$ sudo yum install policycoreutils |
Rationale | Security-enhanced Linux is a feature of the Linux kernel and a number of utilities
with enhanced security functionality designed to add mandatory access controls to Linux.
The Security-enhanced Linux kernel contains new architectural components originally
developed to improve security of the Flask operating system. These architectural components
provide general support for the enforcement of many kinds of mandatory access control
policies, including those based on the concepts of Type Enforcement, Role-based Access
Control, and Multi-level Security.
policycoreutils contains the policy core utilities that are required for
basic operation of an SELinux-enabled system. These utilities include load_policy
to load SELinux policies, setfiles to label filesystems, newrole to
switch roles, and so on. |
package policycoreutils is installed oval:ssg-test_package_policycoreutils_installed:tst:1 true
Following items have been found on the system:
Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
---|---|---|---|---|---|---|---|
policycoreutils | x86_64 | (none) | 16.el8 | 2.9 | 0:2.9-16.el8 | 199e2f91fd431d51 | policycoreutils-0:2.9-16.el8.x86_64 |
Configure SELinux Policy
Rule ID | xccdf_org.ssgproject.content_rule_selinux_policytype |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-selinux_policytype:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-80868-3 References: BP28(R66), 1.7.1.3, 1, 11, 12, 13, 14, 15, 16, 18, 3, 4, 5, 6, 8, 9, APO01.06, APO11.04, APO13.01, BAI03.05, DSS01.05, DSS03.01, DSS05.02, DSS05.04, DSS05.05, DSS05.07, DSS06.02, DSS06.03, DSS06.06, MEA02.01, 3.1.2, 3.7.2, CCI-002165, CCI-002696, 164.308(a)(1)(ii)(D), 164.308(a)(3), 164.308(a)(4), 164.310(b), 164.310(c), 164.312(a), 164.312(e), 4.2.3.4, 4.3.3.2.2, 4.3.3.3.9, 4.3.3.4, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, 4.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.10, SR 2.11, SR 2.12, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.1.1, A.12.1.2, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.1.2, A.13.1.3, A.13.2.1, A.13.2.2, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.1, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CIP-003-3 R5.1.1, CIP-003-3 R5.2, CIP-003-3 R5.3, CIP-004-3 R2.2.3, CIP-004-3 R2.3, CIP-004-3 R3.3, CIP-007-3 R5.1, CIP-007-3 R5.1.2, CIP-007-3 R5.2, CIP-007-3 R5.3.1, CIP-007-3 R5.3.2, CIP-007-3 R5.3.3, CIP-007-3 R6.5, AC-3, AC-3(3)(a), AU-9, SC-7(21), DE.AE-1, ID.AM-3, PR.AC-4, PR.AC-5, PR.AC-6, PR.DS-5, PR.PT-1, PR.PT-3, PR.PT-4, SRG-OS-000445-GPOS-00199, RHEL-08-010450, SV-230282r627750_rule, SRG-OS-000445-VMM-001780 |
Description | The SELinux targeted policy is appropriate for
general-purpose desktops and servers, as well as systems in many other roles.
To configure the system to use this policy, add or correct the following line
in /etc/selinux/config :
SELINUXTYPE=targetedOther policies, such as mls , provide additional security labeling
and greater confinement but are not compatible with many general-purpose
use cases. |
Rationale | Setting the SELinux policy to targeted or a more specialized policy
ensures the system will confine processes that are likely to be
targeted for exploitation, such as network or system services.
Note: During the development or debugging of SELinux modules, it is common to temporarily place non-production systems in permissive mode. In such
temporary cases, SELinux policies should be developed, and once work
is completed, the system should be reconfigured to
targeted . |
Tests the value of the ^[\s]*SELINUXTYPE[\s]*=[\s]*([^#]*) expression in the /etc/selinux/config file oval:ssg-test_selinux_policy:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/selinux/config | SELINUXTYPE=targeted |
Ensure SELinux State is Enforcing
/selinux/enforce is 1 oval:ssg-test_etc_selinux_config:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/selinux/config | SELINUX=enforcing |
Uninstall Automatic Bug Reporting Tool (abrt)
Rule ID | xccdf_org.ssgproject.content_rule_package_abrt_removed |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-package_abrt_removed:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-80948-3 References: CCI-000381, SRG-OS-000095-GPOS-00049, RHEL-08-040001, SV-230488r627750_rule |
Description | The Automatic Bug Reporting Tool ( abrt ) collects
and reports crash data when an application crash is detected. Using a variety
of plugins, abrt can email crash reports to system administrators, log crash
reports to files, or forward crash reports to a centralized issue tracking
system such as RHTSupport.
The abrt package can be removed with the following command:
$ sudo yum erase abrt |
Rationale | Mishandling crash data could expose sensitive information about
vulnerabilities in software executing on the system, as well as sensitive
information from within a process's address space or registers. |
package abrt is removed oval:ssg-test_package_abrt_removed:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-obj_test_package_abrt_removed:obj:1 of type rpminfo_object
Name |
---|
abrt |
Disable KDump Kernel Crash Analyzer (kdump)
Rule ID | xccdf_org.ssgproject.content_rule_service_kdump_disabled |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-service_kdump_disabled:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-80878-2 References: 11, 12, 14, 15, 3, 8, 9, APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.04, DSS05.02, DSS05.03, DSS05.05, DSS06.06, CCI-000366, 164.308(a)(1)(ii)(D), 164.308(a)(3), 164.308(a)(4), 164.310(b), 164.310(c), 164.312(a), 164.312(e), 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, A.11.2.6, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.2.1, A.6.2.2, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.AC-3, PR.IP-1, PR.PT-3, PR.PT-4, FMT_SMF_EXT.1.1, SRG-OS-000480-GPOS-00227, RHEL-08-010670, SV-230310r627750_rule |
Description | The kdump service provides a kernel crash dump analyzer. It uses the kexec
system call to boot a secondary kernel ("capture" kernel) following a system
crash, which can load information from the crashed kernel for analysis.
The kdump service can be disabled with the following command:
$ sudo systemctl mask --now kdump.service |
Rationale | Kernel core dumps may contain the full contents of system memory at the
time of the crash. Kernel core dumps consume a considerable amount of disk
space and may result in denial of service by exhausting the available space
on the target file system partition. Unless the system is used for kernel
development or testing, there is little need to run the kdump service. |
package kexec-tools is removed oval:ssg-test_service_kdump_package_kexec-tools_removed:tst:1 false
Following items have been found on the system:
Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
---|---|---|---|---|---|---|---|
kexec-tools | x86_64 | (none) | 57.el8 | 2.0.20 | 0:2.0.20-57.el8 | 199e2f91fd431d51 | kexec-tools-0:2.0.20-57.el8.x86_64 |
Test that the kdump service is not running oval:ssg-test_service_not_running_kdump:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-obj_service_not_running_kdump:obj:1 of type systemdunitproperty_object
Unit | Property |
---|---|
^kdump\.(service|socket)$ | ActiveState |
Test that the property LoadState from the service kdump is masked oval:ssg-test_service_loadstate_is_masked_kdump:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-obj_service_loadstate_is_masked_kdump:obj:1 of type systemdunitproperty_object
Unit | Property |
---|---|
^kdump\.(service|socket)$ | LoadState |
Test that the property FragmentPath from the service kdump is set to /dev/null oval:ssg-test_service_fragmentpath_is_dev_null_kdump:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-obj_service_fragmentpath_is_dev_null_kdump:obj:1 of type systemdunitproperty_object
Unit | Property |
---|---|
^kdump\.(service|socket)$ | FragmentPath |
Install fapolicyd Package
Rule ID | xccdf_org.ssgproject.content_rule_package_fapolicyd_installed |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-package_fapolicyd_installed:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-82191-8 References: CCI-001764, CM-6(a), SI-4(22), SRG-OS-000370-GPOS-00155, SRG-OS-000368-GPOS-00154, RHEL-08-040135, SV-230523r744023_rule |
Description | The fapolicyd package can be installed with the following command:
$ sudo yum install fapolicyd |
Rationale | fapolicyd (File Access Policy Daemon)
implements application whitelisting to decide file access rights. |
package fapolicyd is installed oval:ssg-test_package_fapolicyd_installed:tst:1 true
Following items have been found on the system:
Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
---|---|---|---|---|---|---|---|
fapolicyd | x86_64 | (none) | 6.el8 | 1.0.2 | 0:1.0.2-6.el8 | 199e2f91fd431d51 | fapolicyd-0:1.0.2-6.el8.x86_64 |
Enable the File Access Policy Service
Rule ID | xccdf_org.ssgproject.content_rule_service_fapolicyd_enabled |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-service_fapolicyd_enabled:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-82249-4 References: CCI-001764, CM-6(a), SI-4(22), FMT_SMF_EXT.1, SRG-OS-000370-GPOS-00155, SRG-OS-000368-GPOS-00154, RHEL-08-040136, SV-244545r743884_rule |
Description | The File Access Policy service should be enabled.
The fapolicyd service can be enabled with the following command:
$ sudo systemctl enable fapolicyd.service |
Rationale | The fapolicyd service (File Access Policy Daemon)
implements application whitelisting to decide file access rights. |
package fapolicyd is installed oval:ssg-test_service_fapolicyd_package_fapolicyd_installed:tst:1 true
Following items have been found on the system:
Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
---|---|---|---|---|---|---|---|
fapolicyd | x86_64 | (none) | 6.el8 | 1.0.2 | 0:1.0.2-6.el8 | 199e2f91fd431d51 | fapolicyd-0:1.0.2-6.el8.x86_64 |
Test that the fapolicyd service is running oval:ssg-test_service_running_fapolicyd:tst:1 true
Following items have been found on the system:
Unit | Property | Value |
---|---|---|
fapolicyd.service | ActiveState | active |
systemd test oval:ssg-test_multi_user_wants_fapolicyd:tst:1 true
Following items have been found on the system:
Unit | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency |
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
multi-user.target | basic.target | sysinit.target | systemd-udev-trigger.service | systemd-firstboot.service | systemd-journald.service | systemd-tmpfiles-setup.service | systemd-journal-flush.service | systemd-sysctl.service | dev-mqueue.mount | systemd-udevd.service | swap.target | dev-disk-by\x2duuid-1e5c0ff6\x2dd83c\x2d4f59\x2db028\x2d3cdb40431877.swap | dev-mapper-VolGroup\x2dswap.swap | systemd-machine-id-commit.service | systemd-update-done.service | systemd-sysusers.service | dracut-shutdown.service | multipathd.service | cryptsetup.target | import-state.service | lvm2-monitor.service | plymouth-read-write.service | proc-sys-fs-binfmt_misc.automount | plymouth-start.service | systemd-tmpfiles-setup-dev.service | systemd-binfmt.service | systemd-journal-catalog-update.service | local-fs.target | var-log.mount | var-log-audit.mount | boot-efi.mount | var-tmp.mount | boot.mount | home.mount | var.mount | -.mount | tmp.mount | systemd-remount-fs.service | ostree-remount.service | kmod-static-nodes.service | ldconfig.service | systemd-ask-password-console.path | sys-fs-fuse-connections.mount | nis-domainname.service | dev-hugepages.mount | systemd-hwdb-update.service | systemd-random-seed.service | sys-kernel-debug.mount | loadmodules.service | lvm2-lvmpolld.socket | sys-kernel-config.mount | selinux-autorelabel-mark.service | systemd-modules-load.service | systemd-update-utmp.service | usbguard.service | paths.target | slices.target | system.slice | -.slice | microcode.service | timers.target | systemd-tmpfiles-clean.timer | dnf-automatic.timer | dnf-makecache.timer | unbound-anchor.timer | sockets.target | systemd-coredump.socket | systemd-udevd-control.socket | systemd-udevd-kernel.socket | systemd-initctl.socket | dbus.socket | systemd-journald.socket | dm-event.socket | multipathd.socket | systemd-journald-dev-log.socket | sssd-kcm.socket | chronyd.service | plymouth-quit.service | systemd-update-utmp-runlevel.service | systemd-user-sessions.service | crond.service | remote-fs.target | dbus.service | firewalld.service | rhsmcertd.service | mdmonitor.service | NetworkManager.service | plymouth-quit-wait.service | sshd.service | fapolicyd.service | rsyslog.service | systemd-ask-password-wall.path | systemd-logind.service | irqbalance.service | getty.target | getty@tty1.service | tuned.service | auditd.service | sssd.service |
systemd test oval:ssg-test_multi_user_wants_fapolicyd_socket:tst:1 false
Following items have been found on the system:
Unit | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency |
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
multi-user.target | basic.target | sysinit.target | systemd-udev-trigger.service | systemd-firstboot.service | systemd-journald.service | systemd-tmpfiles-setup.service | systemd-journal-flush.service | systemd-sysctl.service | dev-mqueue.mount | systemd-udevd.service | swap.target | dev-disk-by\x2duuid-1e5c0ff6\x2dd83c\x2d4f59\x2db028\x2d3cdb40431877.swap | dev-mapper-VolGroup\x2dswap.swap | systemd-machine-id-commit.service | systemd-update-done.service | systemd-sysusers.service | dracut-shutdown.service | multipathd.service | cryptsetup.target | import-state.service | lvm2-monitor.service | plymouth-read-write.service | proc-sys-fs-binfmt_misc.automount | plymouth-start.service | systemd-tmpfiles-setup-dev.service | systemd-binfmt.service | systemd-journal-catalog-update.service | local-fs.target | var-log.mount | var-log-audit.mount | boot-efi.mount | var-tmp.mount | boot.mount | home.mount | var.mount | -.mount | tmp.mount | systemd-remount-fs.service | ostree-remount.service | kmod-static-nodes.service | ldconfig.service | systemd-ask-password-console.path | sys-fs-fuse-connections.mount | nis-domainname.service | dev-hugepages.mount | systemd-hwdb-update.service | systemd-random-seed.service | sys-kernel-debug.mount | loadmodules.service | lvm2-lvmpolld.socket | sys-kernel-config.mount | selinux-autorelabel-mark.service | systemd-modules-load.service | systemd-update-utmp.service | usbguard.service | paths.target | slices.target | system.slice | -.slice | microcode.service | timers.target | systemd-tmpfiles-clean.timer | dnf-automatic.timer | dnf-makecache.timer | unbound-anchor.timer | sockets.target | systemd-coredump.socket | systemd-udevd-control.socket | systemd-udevd-kernel.socket | systemd-initctl.socket | dbus.socket | systemd-journald.socket | dm-event.socket | multipathd.socket | systemd-journald-dev-log.socket | sssd-kcm.socket | chronyd.service | plymouth-quit.service | systemd-update-utmp-runlevel.service | systemd-user-sessions.service | crond.service | remote-fs.target | dbus.service | firewalld.service | rhsmcertd.service | mdmonitor.service | NetworkManager.service | plymouth-quit-wait.service | sshd.service | fapolicyd.service | rsyslog.service | systemd-ask-password-wall.path | systemd-logind.service | irqbalance.service | getty.target | getty@tty1.service | tuned.service | auditd.service | sssd.service |
Disable Kerberos by removing host keytab
Rule ID | xccdf_org.ssgproject.content_rule_kerberos_disable_no_keytab |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-kerberos_disable_no_keytab:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-82175-1 References: CCI-000803, 0418, 1055, 1402, FTP_ITC_EXT.1, SRG-OS-000120-GPOS-00061, RHEL-08-010161, SV-230238r646862_rule |
Description | Kerberos is not an approved key distribution method for
Common Criteria. To prevent using Kerberos by system daemons,
remove the Kerberos keytab files, especially
/etc/krb5.keytab . |
Rationale | The key derivation function (KDF) in Kerberos is not FIPS compatible. |
Ensure keytab file does not exist oval:ssg-test_kerberos_disable_no_keytab:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-obj_kerberos_disable_no_keytab:obj:1 of type file_object
Filepath |
---|
^/etc/.+\.keytab$ |
Uninstall Sendmail Package
Rule ID | xccdf_org.ssgproject.content_rule_package_sendmail_removed |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-package_sendmail_removed:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-81039-0 References: BP28(R1), 11, 14, 3, 9, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06, CCI-000381, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.IP-1, PR.PT-3, SRG-OS-000480-GPOS-00227, SRG-OS-000095-GPOS-00049, RHEL-08-040002, SV-230489r627750_rule |
Description | Sendmail is not the default mail transfer agent and is
not installed by default.
The sendmail package can be removed with the following command:
$ sudo yum erase sendmail |
Rationale | The sendmail software was not developed with security in mind and
its design prevents it from being effectively contained by SELinux. Postfix
should be used instead. |
package sendmail is removed oval:ssg-test_package_sendmail_removed:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-obj_test_package_sendmail_removed:obj:1 of type rpminfo_object
Name |
---|
sendmail |
Uninstall nfs-utils Package
Rule ID | xccdf_org.ssgproject.content_rule_package_nfs-utils_removed |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-package_nfs-utils_removed:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | low |
Identifiers and References | Identifiers: CCE-82932-5 References: SRG-OS-000095-GPOS-00049 |
Description | The nfs-utils package can be removed with the following command:
$ sudo yum erase nfs-utils |
Rationale | nfs-utils provides a daemon for the kernel NFS server and related tools. This
package also contains the showmount program. showmount queries the mount
daemon on a remote host for information about the Network File System (NFS) server on the
remote host. For example, showmount can display the clients which are mounted on
that host. |
package nfs-utils is removed oval:ssg-test_package_nfs-utils_removed:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-obj_test_package_nfs-utils_removed:obj:1 of type rpminfo_object
Name |
---|
nfs-utils |
The Chrony package is installed
Rule ID | xccdf_org.ssgproject.content_rule_package_chrony_installed |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-package_chrony_installed:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-82874-9 References: BP28(R43), 2.2.1.1, 0988, 1405, FMT_SMF_EXT.1, SRG-OS-000355-GPOS-00143 |
Description | System time should be synchronized between all systems in an environment. This is
typically done by establishing an authoritative time server or set of servers and having all
systems synchronize their clocks to them.
The chrony package can be installed with the following command:
$ sudo yum install chrony |
Rationale | Time synchronization is important to support time sensitive security mechanisms like
Kerberos and also ensures log files have consistent time records across the enterprise,
which aids in forensic investigations. |
package chrony is installed oval:ssg-test_package_chrony_installed:tst:1 true
Following items have been found on the system:
Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
---|---|---|---|---|---|---|---|
chrony | x86_64 | (none) | 1.el8 | 4.1 | 0:4.1-1.el8 | 199e2f91fd431d51 | chrony-0:4.1-1.el8.x86_64 |
Disable chrony daemon from acting as server
Rule ID | xccdf_org.ssgproject.content_rule_chronyd_client_only |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-chronyd_client_only:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | low |
Identifiers and References | Identifiers: CCE-82988-7 References: CCI-000381, FMT_SMF_EXT.1, SRG-OS-000096-GPOS-00050, SRG-OS-000095-GPOS-00049, RHEL-08-030741, SV-230485r627750_rule |
Description | The port option in /etc/chrony.conf can be set to
0 to make chrony daemon to never open any listening port
for server operation and to operate strictly in a client-only mode. |
Rationale | Minimizing the exposure of the server functionality of the chrony
daemon diminishes the attack surface. |
package chrony is installed oval:ssg-test_service_chronyd_package_chrony_installed:tst:1 true
Following items have been found on the system:
Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
---|---|---|---|---|---|---|---|
chrony | x86_64 | (none) | 1.el8 | 4.1 | 0:4.1-1.el8 | 199e2f91fd431d51 | chrony-0:4.1-1.el8.x86_64 |
Test that the chronyd service is running oval:ssg-test_service_running_chronyd:tst:1 true
Following items have been found on the system:
Unit | Property | Value |
---|---|---|
chronyd.service | ActiveState | active |
systemd test oval:ssg-test_multi_user_wants_chronyd:tst:1 true
Following items have been found on the system:
Unit | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency |
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
multi-user.target | basic.target | sysinit.target | systemd-udev-trigger.service | systemd-firstboot.service | systemd-journald.service | systemd-tmpfiles-setup.service | systemd-journal-flush.service | systemd-sysctl.service | dev-mqueue.mount | systemd-udevd.service | swap.target | dev-disk-by\x2duuid-1e5c0ff6\x2dd83c\x2d4f59\x2db028\x2d3cdb40431877.swap | dev-mapper-VolGroup\x2dswap.swap | systemd-machine-id-commit.service | systemd-update-done.service | systemd-sysusers.service | dracut-shutdown.service | multipathd.service | cryptsetup.target | import-state.service | lvm2-monitor.service | plymouth-read-write.service | proc-sys-fs-binfmt_misc.automount | plymouth-start.service | systemd-tmpfiles-setup-dev.service | systemd-binfmt.service | systemd-journal-catalog-update.service | local-fs.target | var-log.mount | var-log-audit.mount | boot-efi.mount | var-tmp.mount | boot.mount | home.mount | var.mount | -.mount | tmp.mount | systemd-remount-fs.service | ostree-remount.service | kmod-static-nodes.service | ldconfig.service | systemd-ask-password-console.path | sys-fs-fuse-connections.mount | nis-domainname.service | dev-hugepages.mount | systemd-hwdb-update.service | systemd-random-seed.service | sys-kernel-debug.mount | loadmodules.service | lvm2-lvmpolld.socket | sys-kernel-config.mount | selinux-autorelabel-mark.service | systemd-modules-load.service | systemd-update-utmp.service | usbguard.service | paths.target | slices.target | system.slice | -.slice | microcode.service | timers.target | systemd-tmpfiles-clean.timer | dnf-automatic.timer | dnf-makecache.timer | unbound-anchor.timer | sockets.target | systemd-coredump.socket | systemd-udevd-control.socket | systemd-udevd-kernel.socket | systemd-initctl.socket | dbus.socket | systemd-journald.socket | dm-event.socket | multipathd.socket | systemd-journald-dev-log.socket | sssd-kcm.socket | chronyd.service | plymouth-quit.service | systemd-update-utmp-runlevel.service | systemd-user-sessions.service | crond.service | remote-fs.target | dbus.service | firewalld.service | rhsmcertd.service | mdmonitor.service | NetworkManager.service | plymouth-quit-wait.service | sshd.service | fapolicyd.service | rsyslog.service | systemd-ask-password-wall.path | systemd-logind.service | irqbalance.service | getty.target | getty@tty1.service | tuned.service | auditd.service | sssd.service |
systemd test oval:ssg-test_multi_user_wants_chronyd_socket:tst:1 false
Following items have been found on the system:
Unit | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency |
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
multi-user.target | basic.target | sysinit.target | systemd-udev-trigger.service | systemd-firstboot.service | systemd-journald.service | systemd-tmpfiles-setup.service | systemd-journal-flush.service | systemd-sysctl.service | dev-mqueue.mount | systemd-udevd.service | swap.target | dev-disk-by\x2duuid-1e5c0ff6\x2dd83c\x2d4f59\x2db028\x2d3cdb40431877.swap | dev-mapper-VolGroup\x2dswap.swap | systemd-machine-id-commit.service | systemd-update-done.service | systemd-sysusers.service | dracut-shutdown.service | multipathd.service | cryptsetup.target | import-state.service | lvm2-monitor.service | plymouth-read-write.service | proc-sys-fs-binfmt_misc.automount | plymouth-start.service | systemd-tmpfiles-setup-dev.service | systemd-binfmt.service | systemd-journal-catalog-update.service | local-fs.target | var-log.mount | var-log-audit.mount | boot-efi.mount | var-tmp.mount | boot.mount | home.mount | var.mount | -.mount | tmp.mount | systemd-remount-fs.service | ostree-remount.service | kmod-static-nodes.service | ldconfig.service | systemd-ask-password-console.path | sys-fs-fuse-connections.mount | nis-domainname.service | dev-hugepages.mount | systemd-hwdb-update.service | systemd-random-seed.service | sys-kernel-debug.mount | loadmodules.service | lvm2-lvmpolld.socket | sys-kernel-config.mount | selinux-autorelabel-mark.service | systemd-modules-load.service | systemd-update-utmp.service | usbguard.service | paths.target | slices.target | system.slice | -.slice | microcode.service | timers.target | systemd-tmpfiles-clean.timer | dnf-automatic.timer | dnf-makecache.timer | unbound-anchor.timer | sockets.target | systemd-coredump.socket | systemd-udevd-control.socket | systemd-udevd-kernel.socket | systemd-initctl.socket | dbus.socket | systemd-journald.socket | dm-event.socket | multipathd.socket | systemd-journald-dev-log.socket | sssd-kcm.socket | chronyd.service | plymouth-quit.service | systemd-update-utmp-runlevel.service | systemd-user-sessions.service | crond.service | remote-fs.target | dbus.service | firewalld.service | rhsmcertd.service | mdmonitor.service | NetworkManager.service | plymouth-quit-wait.service | sshd.service | fapolicyd.service | rsyslog.service | systemd-ask-password-wall.path | systemd-logind.service | irqbalance.service | getty.target | getty@tty1.service | tuned.service | auditd.service | sssd.service |
check if port is 0 in /etc/chrony.conf oval:ssg-test_chronyd_client_only:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/chrony.conf | port 0 |
Disable network management of chrony daemon
Rule ID | xccdf_org.ssgproject.content_rule_chronyd_no_chronyc_network |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-chronyd_no_chronyc_network:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | low |
Identifiers and References | Identifiers: CCE-82840-0 References: CCI-000381, FMT_SMF_EXT.1, SRG-OS-000096-GPOS-00050, SRG-OS-000095-GPOS-00049, RHEL-08-030742, SV-230486r627750_rule |
Description | The cmdport option in /etc/chrony.conf can be set to
0 to stop chrony daemon from listening on the UDP port 323
for management connections made by chronyc. |
Rationale | Not exposing the management interface of the chrony daemon on
the network diminishes the attack space. |
package chrony is installed oval:ssg-test_service_chronyd_package_chrony_installed:tst:1 true
Following items have been found on the system:
Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
---|---|---|---|---|---|---|---|
chrony | x86_64 | (none) | 1.el8 | 4.1 | 0:4.1-1.el8 | 199e2f91fd431d51 | chrony-0:4.1-1.el8.x86_64 |
Test that the chronyd service is running oval:ssg-test_service_running_chronyd:tst:1 true
Following items have been found on the system:
Unit | Property | Value |
---|---|---|
chronyd.service | ActiveState | active |
systemd test oval:ssg-test_multi_user_wants_chronyd:tst:1 true
Following items have been found on the system:
Unit | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency |
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
multi-user.target | basic.target | sysinit.target | systemd-udev-trigger.service | systemd-firstboot.service | systemd-journald.service | systemd-tmpfiles-setup.service | systemd-journal-flush.service | systemd-sysctl.service | dev-mqueue.mount | systemd-udevd.service | swap.target | dev-disk-by\x2duuid-1e5c0ff6\x2dd83c\x2d4f59\x2db028\x2d3cdb40431877.swap | dev-mapper-VolGroup\x2dswap.swap | systemd-machine-id-commit.service | systemd-update-done.service | systemd-sysusers.service | dracut-shutdown.service | multipathd.service | cryptsetup.target | import-state.service | lvm2-monitor.service | plymouth-read-write.service | proc-sys-fs-binfmt_misc.automount | plymouth-start.service | systemd-tmpfiles-setup-dev.service | systemd-binfmt.service | systemd-journal-catalog-update.service | local-fs.target | var-log.mount | var-log-audit.mount | boot-efi.mount | var-tmp.mount | boot.mount | home.mount | var.mount | -.mount | tmp.mount | systemd-remount-fs.service | ostree-remount.service | kmod-static-nodes.service | ldconfig.service | systemd-ask-password-console.path | sys-fs-fuse-connections.mount | nis-domainname.service | dev-hugepages.mount | systemd-hwdb-update.service | systemd-random-seed.service | sys-kernel-debug.mount | loadmodules.service | lvm2-lvmpolld.socket | sys-kernel-config.mount | selinux-autorelabel-mark.service | systemd-modules-load.service | systemd-update-utmp.service | usbguard.service | paths.target | slices.target | system.slice | -.slice | microcode.service | timers.target | systemd-tmpfiles-clean.timer | dnf-automatic.timer | dnf-makecache.timer | unbound-anchor.timer | sockets.target | systemd-coredump.socket | systemd-udevd-control.socket | systemd-udevd-kernel.socket | systemd-initctl.socket | dbus.socket | systemd-journald.socket | dm-event.socket | multipathd.socket | systemd-journald-dev-log.socket | sssd-kcm.socket | chronyd.service | plymouth-quit.service | systemd-update-utmp-runlevel.service | systemd-user-sessions.service | crond.service | remote-fs.target | dbus.service | firewalld.service | rhsmcertd.service | mdmonitor.service | NetworkManager.service | plymouth-quit-wait.service | sshd.service | fapolicyd.service | rsyslog.service | systemd-ask-password-wall.path | systemd-logind.service | irqbalance.service | getty.target | getty@tty1.service | tuned.service | auditd.service | sssd.service |
systemd test oval:ssg-test_multi_user_wants_chronyd_socket:tst:1 false
Following items have been found on the system:
Unit | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency |
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
multi-user.target | basic.target | sysinit.target | systemd-udev-trigger.service | systemd-firstboot.service | systemd-journald.service | systemd-tmpfiles-setup.service | systemd-journal-flush.service | systemd-sysctl.service | dev-mqueue.mount | systemd-udevd.service | swap.target | dev-disk-by\x2duuid-1e5c0ff6\x2dd83c\x2d4f59\x2db028\x2d3cdb40431877.swap | dev-mapper-VolGroup\x2dswap.swap | systemd-machine-id-commit.service | systemd-update-done.service | systemd-sysusers.service | dracut-shutdown.service | multipathd.service | cryptsetup.target | import-state.service | lvm2-monitor.service | plymouth-read-write.service | proc-sys-fs-binfmt_misc.automount | plymouth-start.service | systemd-tmpfiles-setup-dev.service | systemd-binfmt.service | systemd-journal-catalog-update.service | local-fs.target | var-log.mount | var-log-audit.mount | boot-efi.mount | var-tmp.mount | boot.mount | home.mount | var.mount | -.mount | tmp.mount | systemd-remount-fs.service | ostree-remount.service | kmod-static-nodes.service | ldconfig.service | systemd-ask-password-console.path | sys-fs-fuse-connections.mount | nis-domainname.service | dev-hugepages.mount | systemd-hwdb-update.service | systemd-random-seed.service | sys-kernel-debug.mount | loadmodules.service | lvm2-lvmpolld.socket | sys-kernel-config.mount | selinux-autorelabel-mark.service | systemd-modules-load.service | systemd-update-utmp.service | usbguard.service | paths.target | slices.target | system.slice | -.slice | microcode.service | timers.target | systemd-tmpfiles-clean.timer | dnf-automatic.timer | dnf-makecache.timer | unbound-anchor.timer | sockets.target | systemd-coredump.socket | systemd-udevd-control.socket | systemd-udevd-kernel.socket | systemd-initctl.socket | dbus.socket | systemd-journald.socket | dm-event.socket | multipathd.socket | systemd-journald-dev-log.socket | sssd-kcm.socket | chronyd.service | plymouth-quit.service | systemd-update-utmp-runlevel.service | systemd-user-sessions.service | crond.service | remote-fs.target | dbus.service | firewalld.service | rhsmcertd.service | mdmonitor.service | NetworkManager.service | plymouth-quit-wait.service | sshd.service | fapolicyd.service | rsyslog.service | systemd-ask-password-wall.path | systemd-logind.service | irqbalance.service | getty.target | getty@tty1.service | tuned.service | auditd.service | sssd.service |
check if cmdport is 0 in /etc/chrony.conf oval:ssg-test_chronyd_no_chronyc_network:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/chrony.conf | cmdport 0 |
Configure session renegotiation for SSH client
Rule ID | xccdf_org.ssgproject.content_rule_ssh_client_rekey_limit |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-ssh_client_rekey_limit:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-82880-6 References: CCI-000068, FCS_SSHS_EXT.1, SRG-OS-000423-GPOS-00187, SRG-OS-000033-GPOS-00014 |
Description | The RekeyLimit parameter specifies how often
the session key is renegotiated, both in terms of
amount of data that may be transmitted and the time
elapsed. To decrease the default limits, put line
RekeyLimit 1G 1h to file /etc/ssh/ssh_config.d/02-rekey-limit.conf .
Make sure that there is no other RekeyLimit configuration preceding
the include directive in the main config file
/etc/ssh/ssh_config . Check also other files in
/etc/ssh/ssh_config.d directory. Files are processed according to
lexicographical order of file names. Make sure that there is no file
processed before 02-rekey-limit.conf containing definition of
RekeyLimit . |
Rationale | By decreasing the limit based on the amount of data and enabling
time-based limit, effects of potential attacks against
encryption keys are limited. |
tests the value of RekeyLimit setting in /etc/ssh/ssh_config file oval:ssg-test_ssh_client_rekey_limit_main_config:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_ssh_client_rekey_limit_main_config:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
/etc/ssh/ssh_config | ^[\s]*RekeyLimit.*$ | 1 |
tests the value of RekeyLimit setting in /etc/ssh/ssh_config.d/*.conf oval:ssg-test_ssh_client_rekey_limit_include_configs:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/ssh/ssh_config.d/02-rekey-limit.conf | RekeyLimit 1G 1h |
SSH client uses strong entropy to seed (for CSH like shells)
Rule ID | xccdf_org.ssgproject.content_rule_ssh_client_use_strong_rng_csh |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-ssh_client_use_strong_rng_csh:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-83349-1 References: FCS_CKM.1.1, SRG-OS-000480-GPOS-00227 |
Description | To set up SSH client to use entropy from a high-quality source, make sure
that the appropriate shell environment variable is configured. The
SSH_USE_STRONG_RNG environment variable determines how many bytes
of entropy to use. Make sure that the file
/etc/profile.d/cc-ssh-strong-rng.csh contains line
setenv SSH_USE_STRONG_RNG 32. |
Rationale | Some SSH implementations use the openssl library for entropy, which by default, doesn't use high-entropy sources.
Randomness is needed to generate considerably more secure data-encryption keys. Plaintext padding, initialization vectors
in encryption algorithms, and high-quality entropy eliminates the possibility that the output of
the random number generator used by SSH would be known to potential attackers. |
check correct entropy configuration in /etc/profile.d/cc-ssh-strong-rng.csh oval:ssg-test_ssh_client_strong_rng_csh:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/profile.d/cc-ssh-strong-rng.csh | setenv SSH_USE_STRONG_RNG 32 |
check that the configuration is not overridden in /etc/profile oval:ssg-test_ssh_client_strong_rng_csh_not_overridden:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-obj_ssh_client_strong_rng_csh_not_overridden:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
/etc/profile | ^[\s]*setenv[\s]+SSH_USE_STRONG_RNG.*$ | 1 |
SSH client uses strong entropy to seed (Bash-like shells)
Rule ID | xccdf_org.ssgproject.content_rule_ssh_client_use_strong_rng_sh |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-ssh_client_use_strong_rng_sh:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-83346-7 References: FCS_CKM.1.1, SRG-OS-000480-GPOS-00227 |
Description | To set up SSH client to use entropy from a high-quality source, make sure
that the appropriate shell environment variable is configured. The
SSH_USE_STRONG_RNG environment variable determines how many bytes
of entropy to use. Make sure that the file
/etc/profile.d/cc-ssh-strong-rng.sh contains line
export SSH_USE_STRONG_RNG=32. |
Rationale | Some SSH implementations use the openssl library for entropy, which by default, doesn't use high-entropy sources.
Randomness is needed to generate considerably more secure data-encryption keys. Plaintext padding, initialization vectors
in encryption algorithms, and high-quality entropy eliminates the possibility that the output of
the random number generator used by SSH would be known to potential attackers. |
check correct entropy configuration in /etc/profile.d/cc-ssh-strong-rng.sh oval:ssg-test_ssh_client_strong_rng_sh:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/profile.d/cc-ssh-strong-rng.sh | export SSH_USE_STRONG_RNG=32 |
check that the configuration is not overridden in /etc/profile oval:ssg-test_ssh_client_strong_rng_sh_not_overridden:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-obj_ssh_client_strong_rng_sh_not_overridden:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
/etc/profile | ^[\s]*export[\s]+SSH_USE_STRONG_RNG=.*$ | 1 |
Disable Host-Based Authentication
Verify if Profile set Value sshd_required as not required oval:ssg-test_sshd_not_required:tst:1 false
Following items have been found on the system:
Var ref | Value |
---|---|
oval:ssg-sshd_required:var:1 | 0 |
Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true
Following items have been found on the system:
Var ref | Value |
---|---|
oval:ssg-sshd_required:var:1 | 0 |
package openssh-server is removed oval:ssg-test_package_openssh-server_removed:tst:1 false
Following items have been found on the system:
Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
---|---|---|---|---|---|---|---|
openssh-server | x86_64 | (none) | 10.el8 | 8.0p1 | 0:8.0p1-10.el8 | 199e2f91fd431d51 | openssh-server-0:8.0p1-10.el8.x86_64 |
Verify if Profile set Value sshd_required as required oval:ssg-test_sshd_required:tst:1 false
Following items have been found on the system:
Var ref | Value |
---|---|
oval:ssg-sshd_required:var:1 | 0 |
Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true
Following items have been found on the system:
Var ref | Value |
---|---|
oval:ssg-sshd_required:var:1 | 0 |
package openssh-server is installed oval:ssg-test_package_openssh-server_installed:tst:1 true
Following items have been found on the system:
Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
---|---|---|---|---|---|---|---|
openssh-server | x86_64 | (none) | 10.el8 | 8.0p1 | 0:8.0p1-10.el8 | 199e2f91fd431d51 | openssh-server-0:8.0p1-10.el8.x86_64 |
tests the value of HostbasedAuthentication setting in the /etc/ssh/sshd_config file oval:ssg-test_disable_host_auth:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_disable_host_auth:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
/etc/ssh/sshd_config | ^[ \t]*(?i)HostbasedAuthentication(?-i)[ \t]+(.+?)[ \t]*(?:$|#) | 1 |
tests the absence of HostbasedAuthentication setting in the /etc/ssh/sshd_config file oval:ssg-test_disable_host_auth_default_not_overriden:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-obj_disable_host_auth_default_not_overriden:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
/etc/ssh/sshd_config | ^[ \t]*(?i)HostbasedAuthentication(?-i)[ \t]+ | 1 |
Disable SSH Access via Empty Passwords
Verify if Profile set Value sshd_required as not required oval:ssg-test_sshd_not_required:tst:1 false
Following items have been found on the system:
Var ref | Value |
---|---|
oval:ssg-sshd_required:var:1 | 0 |
Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true
Following items have been found on the system:
Var ref | Value |
---|---|
oval:ssg-sshd_required:var:1 | 0 |
package openssh-server is removed oval:ssg-test_package_openssh-server_removed:tst:1 false
Following items have been found on the system:
Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
---|---|---|---|---|---|---|---|
openssh-server | x86_64 | (none) | 10.el8 | 8.0p1 | 0:8.0p1-10.el8 | 199e2f91fd431d51 | openssh-server-0:8.0p1-10.el8.x86_64 |
Verify if Profile set Value sshd_required as required oval:ssg-test_sshd_required:tst:1 false
Following items have been found on the system:
Var ref | Value |
---|---|
oval:ssg-sshd_required:var:1 | 0 |
Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true
Following items have been found on the system:
Var ref | Value |
---|---|
oval:ssg-sshd_required:var:1 | 0 |
package openssh-server is installed oval:ssg-test_package_openssh-server_installed:tst:1 true
Following items have been found on the system:
Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
---|---|---|---|---|---|---|---|
openssh-server | x86_64 | (none) | 10.el8 | 8.0p1 | 0:8.0p1-10.el8 | 199e2f91fd431d51 | openssh-server-0:8.0p1-10.el8.x86_64 |
tests the value of PermitEmptyPasswords setting in the /etc/ssh/sshd_config file oval:ssg-test_sshd_disable_empty_passwords:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_sshd_disable_empty_passwords:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
/etc/ssh/sshd_config | ^[ \t]*(?i)PermitEmptyPasswords(?-i)[ \t]+(.+?)[ \t]*(?:$|#) | 1 |
tests the absence of PermitEmptyPasswords setting in the /etc/ssh/sshd_config file oval:ssg-test_sshd_disable_empty_passwords_default_not_overriden:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-obj_sshd_disable_empty_passwords_default_not_overriden:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
/etc/ssh/sshd_config | ^[ \t]*(?i)PermitEmptyPasswords(?-i)[ \t]+ | 1 |
Disable GSSAPI Authentication
Rule ID | xccdf_org.ssgproject.content_rule_sshd_disable_gssapi_auth |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-sshd_disable_gssapi_auth:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-80897-2 References: 11, 3, 9, BAI10.01, BAI10.02, BAI10.03, BAI10.05, 3.1.12, CCI-000318, CCI-000368, CCI-001812, CCI-001813, CCI-001814, CCI-000366, 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.310(b), 164.312(e)(1), 164.312(e)(2)(ii), 4.3.4.3.2, 4.3.4.3.3, SR 7.6, 0418, 1055, 1402, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, CM-7(a), CM-7(b), CM-6(a), AC-17(a), PR.IP-1, FTP_ITC_EXT.1, SRG-OS-000364-GPOS-00151, SRG-OS-000480-GPOS-00227, RHEL-08-010522, SV-244528r743833_rule, SRG-OS-000480-VMM-002000 |
Description | Unless needed, SSH should not permit extraneous or unnecessary
authentication mechanisms like GSSAPI. To disable GSSAPI authentication, add or
correct the following line in the /etc/ssh/sshd_config file:
GSSAPIAuthentication no |
Rationale | GSSAPI authentication is used to provide additional authentication mechanisms to
applications. Allowing GSSAPI authentication through SSH exposes the system's
GSSAPI to remote hosts, increasing the attack surface of the system. |
Verify if Profile set Value sshd_required as not required oval:ssg-test_sshd_not_required:tst:1 false
Following items have been found on the system:
Var ref | Value |
---|---|
oval:ssg-sshd_required:var:1 | 0 |
Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true
Following items have been found on the system:
Var ref | Value |
---|---|
oval:ssg-sshd_required:var:1 | 0 |
package openssh-server is removed oval:ssg-test_package_openssh-server_removed:tst:1 false
Following items have been found on the system:
Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
---|---|---|---|---|---|---|---|
openssh-server | x86_64 | (none) | 10.el8 | 8.0p1 | 0:8.0p1-10.el8 | 199e2f91fd431d51 | openssh-server-0:8.0p1-10.el8.x86_64 |
Verify if Profile set Value sshd_required as required oval:ssg-test_sshd_required:tst:1 false
Following items have been found on the system:
Var ref | Value |
---|---|
oval:ssg-sshd_required:var:1 | 0 |
Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true
Following items have been found on the system:
Var ref | Value |
---|---|
oval:ssg-sshd_required:var:1 | 0 |
package openssh-server is installed oval:ssg-test_package_openssh-server_installed:tst:1 true
Following items have been found on the system:
Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
---|---|---|---|---|---|---|---|
openssh-server | x86_64 | (none) | 10.el8 | 8.0p1 | 0:8.0p1-10.el8 | 199e2f91fd431d51 | openssh-server-0:8.0p1-10.el8.x86_64 |
tests the value of GSSAPIAuthentication setting in the /etc/ssh/sshd_config file oval:ssg-test_sshd_disable_gssapi_auth:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/ssh/sshd_config | GSSAPIAuthentication no |
tests the absence of GSSAPIAuthentication setting in the /etc/ssh/sshd_config file oval:ssg-test_sshd_disable_gssapi_auth_default_not_overriden:tst:1 false
Following items have been found on the system:
Path | Content |
---|---|
/etc/ssh/sshd_config | GSSAPIAuthentication |
Disable Kerberos Authentication
Rule ID | xccdf_org.ssgproject.content_rule_sshd_disable_kerb_auth |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-sshd_disable_kerb_auth:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-80898-0 References: 11, 3, 9, BAI10.01, BAI10.02, BAI10.03, BAI10.05, 3.1.12, CCI-000318, CCI-000368, CCI-001812, CCI-001813, CCI-001814, CCI-000366, 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.310(b), 164.312(e)(1), 164.312(e)(2)(ii), 4.3.4.3.2, 4.3.4.3.3, SR 7.6, 0421, 0422, 0431, 0974, 1173, 1401, 1504, 1505, 1546, 1557, 1558, 1559, 1560, 1561, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, AC-17(a), CM-7(a), CM-7(b), CM-6(a), PR.IP-1, FTP_ITC_EXT.1, SRG-OS-000364-GPOS-00151, SRG-OS-000480-GPOS-00227, RHEL-08-010521, SV-230291r743957_rule, SRG-OS-000480-VMM-002000 |
Description | Unless needed, SSH should not permit extraneous or unnecessary
authentication mechanisms like Kerberos. To disable Kerberos authentication, add
or correct the following line in the /etc/ssh/sshd_config file:
KerberosAuthentication no |
Rationale | Kerberos authentication for SSH is often implemented using GSSAPI. If Kerberos
is enabled through SSH, the SSH daemon provides a means of access to the
system's Kerberos implementation. Vulnerabilities in the system's Kerberos
implementations may be subject to exploitation. |
Verify if Profile set Value sshd_required as not required oval:ssg-test_sshd_not_required:tst:1 false
Following items have been found on the system:
Var ref | Value |
---|---|
oval:ssg-sshd_required:var:1 | 0 |
Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true
Following items have been found on the system:
Var ref | Value |
---|---|
oval:ssg-sshd_required:var:1 | 0 |
package openssh-server is removed oval:ssg-test_package_openssh-server_removed:tst:1 false
Following items have been found on the system:
Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
---|---|---|---|---|---|---|---|
openssh-server | x86_64 | (none) | 10.el8 | 8.0p1 | 0:8.0p1-10.el8 | 199e2f91fd431d51 | openssh-server-0:8.0p1-10.el8.x86_64 |
Verify if Profile set Value sshd_required as required oval:ssg-test_sshd_required:tst:1 false
Following items have been found on the system:
Var ref | Value |
---|---|
oval:ssg-sshd_required:var:1 | 0 |
Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true
Following items have been found on the system:
Var ref | Value |
---|---|
oval:ssg-sshd_required:var:1 | 0 |
package openssh-server is installed oval:ssg-test_package_openssh-server_installed:tst:1 true
Following items have been found on the system:
Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
---|---|---|---|---|---|---|---|
openssh-server | x86_64 | (none) | 10.el8 | 8.0p1 | 0:8.0p1-10.el8 | 199e2f91fd431d51 | openssh-server-0:8.0p1-10.el8.x86_64 |
tests the value of KerberosAuthentication setting in the /etc/ssh/sshd_config file oval:ssg-test_sshd_disable_kerb_auth:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_sshd_disable_kerb_auth:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
/etc/ssh/sshd_config | ^[ \t]*(?i)KerberosAuthentication(?-i)[ \t]+(.+?)[ \t]*(?:$|#) | 1 |
tests the absence of KerberosAuthentication setting in the /etc/ssh/sshd_config file oval:ssg-test_sshd_disable_kerb_auth_default_not_overriden:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-obj_sshd_disable_kerb_auth_default_not_overriden:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
/etc/ssh/sshd_config | ^[ \t]*(?i)KerberosAuthentication(?-i)[ \t]+ | 1 |
Disable SSH Root Login
Verify if Profile set Value sshd_required as not required oval:ssg-test_sshd_not_required:tst:1 false
Following items have been found on the system:
Var ref | Value |
---|---|
oval:ssg-sshd_required:var:1 | 0 |
Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true
Following items have been found on the system:
Var ref | Value |
---|---|
oval:ssg-sshd_required:var:1 | 0 |
package openssh-server is removed oval:ssg-test_package_openssh-server_removed:tst:1 false
Following items have been found on the system:
Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
---|---|---|---|---|---|---|---|
openssh-server | x86_64 | (none) | 10.el8 | 8.0p1 | 0:8.0p1-10.el8 | 199e2f91fd431d51 | openssh-server-0:8.0p1-10.el8.x86_64 |
Verify if Profile set Value sshd_required as required oval:ssg-test_sshd_required:tst:1 false
Following items have been found on the system:
Var ref | Value |
---|---|
oval:ssg-sshd_required:var:1 | 0 |
Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true
Following items have been found on the system:
Var ref | Value |
---|---|
oval:ssg-sshd_required:var:1 | 0 |
package openssh-server is installed oval:ssg-test_package_openssh-server_installed:tst:1 true
Following items have been found on the system:
Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
---|---|---|---|---|---|---|---|
openssh-server | x86_64 | (none) | 10.el8 | 8.0p1 | 0:8.0p1-10.el8 | 199e2f91fd431d51 | openssh-server-0:8.0p1-10.el8.x86_64 |
tests the value of PermitRootLogin setting in the /etc/ssh/sshd_config file oval:ssg-test_sshd_disable_root_login:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/ssh/sshd_config | PermitRootLogin no |
Enable Use of Strict Mode Checking
Rule ID | xccdf_org.ssgproject.content_rule_sshd_enable_strictmodes |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-sshd_enable_strictmodes:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-80904-6 References: 12, 13, 14, 15, 16, 18, 3, 5, APO01.06, DSS05.04, DSS05.07, DSS06.02, 3.1.12, CCI-000366, 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.310(b), 164.312(e)(1), 164.312(e)(2)(ii), 4.3.3.7.3, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CIP-003-3 R5.1.1, CIP-003-3 R5.3, CIP-004-3 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2, AC-6, AC-17(a), CM-6(a), PR.AC-4, PR.DS-5, SRG-OS-000480-GPOS-00227, RHEL-08-010500, SV-230288r627750_rule, SRG-OS-000480-VMM-002000 |
Description | SSHs StrictModes option checks file and ownership permissions in
the user's home directory .ssh folder before accepting login. If world-
writable permissions are found, logon is rejected. To enable StrictModes in SSH,
add or correct the following line in the /etc/ssh/sshd_config file:
StrictModes yes |
Rationale | If other users have access to modify user-specific SSH configuration files, they
may be able to log into the system as another user. |
Verify if Profile set Value sshd_required as not required oval:ssg-test_sshd_not_required:tst:1 false
Following items have been found on the system:
Var ref | Value |
---|---|
oval:ssg-sshd_required:var:1 | 0 |
Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true
Following items have been found on the system:
Var ref | Value |
---|---|
oval:ssg-sshd_required:var:1 | 0 |
package openssh-server is removed oval:ssg-test_package_openssh-server_removed:tst:1 false
Following items have been found on the system:
Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
---|---|---|---|---|---|---|---|
openssh-server | x86_64 | (none) | 10.el8 | 8.0p1 | 0:8.0p1-10.el8 | 199e2f91fd431d51 | openssh-server-0:8.0p1-10.el8.x86_64 |
Verify if Profile set Value sshd_required as required oval:ssg-test_sshd_required:tst:1 false
Following items have been found on the system:
Var ref | Value |
---|---|
oval:ssg-sshd_required:var:1 | 0 |
Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true
Following items have been found on the system:
Var ref | Value |
---|---|
oval:ssg-sshd_required:var:1 | 0 |
package openssh-server is installed oval:ssg-test_package_openssh-server_installed:tst:1 true
Following items have been found on the system:
Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
---|---|---|---|---|---|---|---|
openssh-server | x86_64 | (none) | 10.el8 | 8.0p1 | 0:8.0p1-10.el8 | 199e2f91fd431d51 | openssh-server-0:8.0p1-10.el8.x86_64 |
tests the value of StrictModes setting in the /etc/ssh/sshd_config file oval:ssg-test_sshd_enable_strictmodes:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_sshd_enable_strictmodes:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
/etc/ssh/sshd_config | ^[ \t]*(?i)StrictModes(?-i)[ \t]+(.+?)[ \t]*(?:$|#) | 1 |
tests the absence of StrictModes setting in the /etc/ssh/sshd_config file oval:ssg-test_sshd_enable_strictmodes_default_not_overriden:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-obj_sshd_enable_strictmodes_default_not_overriden:obj:1 of type textfilecontent54_object
Filepath | Pattern | Instance |
---|---|---|
/etc/ssh/sshd_config | ^[ \t]*(?i)StrictModes(?-i)[ \t]+ | 1 |
Force frequent session key renegotiation
Rule ID | xccdf_org.ssgproject.content_rule_sshd_rekey_limit |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-sshd_rekey_limit:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-82177-7 References: CCI-000068, FCS_SSHS_EXT.1, SRG-OS-000480-GPOS-00227, SRG-OS-000033-GPOS-00014, RHEL-08-040161, SV-230527r627750_rule |
Description | The RekeyLimit parameter specifies how often
the session key of the is renegotiated, both in terms of
amount of data that may be transmitted and the time
elapsed. To decrease the default limits, put line
RekeyLimit 1G 1h to file /etc/ssh/sshd_config . |
Rationale | By decreasing the limit based on the amount of data and enabling
time-based limit, effects of potential attacks against
encryption keys are limited. |
Verify if Profile set Value sshd_required as not required oval:ssg-test_sshd_not_required:tst:1 false
Following items have been found on the system:
Var ref | Value |
---|---|
oval:ssg-sshd_required:var:1 | 0 |
Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true
Following items have been found on the system:
Var ref | Value |
---|---|
oval:ssg-sshd_required:var:1 | 0 |
package openssh-server is removed oval:ssg-test_package_openssh-server_removed:tst:1 false
Following items have been found on the system:
Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
---|---|---|---|---|---|---|---|
openssh-server | x86_64 | (none) | 10.el8 | 8.0p1 | 0:8.0p1-10.el8 | 199e2f91fd431d51 | openssh-server-0:8.0p1-10.el8.x86_64 |
Verify if Profile set Value sshd_required as required oval:ssg-test_sshd_required:tst:1 false
Following items have been found on the system:
Var ref | Value |
---|---|
oval:ssg-sshd_required:var:1 | 0 |
Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true
Following items have been found on the system:
Var ref | Value |
---|---|
oval:ssg-sshd_required:var:1 | 0 |
package openssh-server is installed oval:ssg-test_package_openssh-server_installed:tst:1 true
Following items have been found on the system:
Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
---|---|---|---|---|---|---|---|
openssh-server | x86_64 | (none) | 10.el8 | 8.0p1 | 0:8.0p1-10.el8 | 199e2f91fd431d51 | openssh-server-0:8.0p1-10.el8.x86_64 |
tests the value of RekeyLimit setting in the file oval:ssg-test_sshd_rekey_limit:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/ssh/sshd_config | RekeyLimit 1G 1h |
SSH server uses strong entropy to seed
Rule ID | xccdf_org.ssgproject.content_rule_sshd_use_strong_rng |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-sshd_use_strong_rng:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-82462-3 References: CCI-000366, FCS_RBG_EXT.1.2, SRG-OS-000480-GPOS-00227, RHEL-08-010292, SV-230253r627750_rule |
Description | To set up SSH server to use entropy from a high-quality source, edit the /etc/sysconfig/sshd file.
The SSH_USE_STRONG_RNG configuration value determines how many bytes of entropy to use, so
make sure that the file contains line
SSH_USE_STRONG_RNG=32 |
Rationale | SSH implementation in RHEL8 uses the openssl library, which doesn't use high-entropy sources by default.
Randomness is needed to generate data-encryption keys, and as plaintext padding and initialization vectors
in encryption algorithms, and high-quality entropy elliminates the possibility that the output of
the random number generator used by SSH would be known to potential attackers. |
Warnings | warning
This setting can cause problems on computers without the hardware random generator, because insufficient entropy causes the connection to be blocked until enough entropy is available. |
tests the value of SSH_USE_STRONG_RNG setting in the /etc/sysconfig/sshd file oval:ssg-test_sshd_use_strong_rng:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/sysconfig/sshd | SSH_USE_STRONG_RNG=32 |
Install OpenSSH client software
Rule ID | xccdf_org.ssgproject.content_rule_package_openssh-clients_installed |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-package_openssh-clients_installed:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-82722-0 References: FIA_UAU.5, FTP_ITC_EXT.1, SRG-OS-000480-GPOS-00227 |
Description | The openssh-clients package can be installed with the following command:
$ sudo yum install openssh-clients |
Rationale | This package includes utilities to make encrypted connections and transfer
files securely to SSH servers. |
package openssh-clients is installed oval:ssg-test_package_openssh-clients_installed:tst:1 true
Following items have been found on the system:
Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
---|---|---|---|---|---|---|---|
openssh-clients | x86_64 | (none) | 10.el8 | 8.0p1 | 0:8.0p1-10.el8 | 199e2f91fd431d51 | openssh-clients-0:8.0p1-10.el8.x86_64 |
Install the OpenSSH Server Package
Rule ID | xccdf_org.ssgproject.content_rule_package_openssh-server_installed |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-package_openssh-server_installed:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-83303-8 References: 13, 14, APO01.06, DSS05.02, DSS05.04, DSS05.07, DSS06.02, DSS06.06, CCI-002418, CCI-002420, CCI-002421, CCI-002422, SR 3.1, SR 3.8, SR 4.1, SR 4.2, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CM-6(a), PR.DS-2, PR.DS-5, FIA_UAU.5, FTP_ITC_EXT.1, SRG-OS-000423-GPOS-00187, SRG-OS-000424-GPOS-00188, SRG-OS-000425-GPOS-00189, SRG-OS-000426-GPOS-00190, RHEL-08-040159, SV-244549r743896_rule |
Description | The openssh-server package should be installed.
The openssh-server package can be installed with the following command:
$ sudo yum install openssh-server |
Rationale | Without protection of the transmitted information, confidentiality, and
integrity may be compromised because unprotected communications can be
intercepted and either read or altered. |
package openssh-server is installed oval:ssg-test_package_openssh-server_installed:tst:1 true
Following items have been found on the system:
Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
---|---|---|---|---|---|---|---|
openssh-server | x86_64 | (none) | 10.el8 | 8.0p1 | 0:8.0p1-10.el8 | 199e2f91fd431d51 | openssh-server-0:8.0p1-10.el8.x86_64 |
Install usbguard Package
Rule ID | xccdf_org.ssgproject.content_rule_package_usbguard_installed |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-package_usbguard_installed:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-82959-8 References: CCI-001958, 1418, SRG-OS-000378-GPOS-00163, RHEL-08-040139, SV-244547r743890_rule |
Description |
The usbguard package can be installed with the following command:
$ sudo yum install usbguard |
Rationale | usbguard is a software framework that helps to protect
against rogue USB devices by implementing basic whitelisting/blacklisting
capabilities based on USB device attributes. |
package usbguard is installed oval:ssg-test_package_usbguard_installed:tst:1 true
Following items have been found on the system:
Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
---|---|---|---|---|---|---|---|
usbguard | x86_64 | (none) | 2.el8 | 1.0.0 | 0:1.0.0-2.el8 | 199e2f91fd431d51 | usbguard-0:1.0.0-2.el8.x86_64 |
Enable the USBGuard Service
Rule ID | xccdf_org.ssgproject.content_rule_service_usbguard_enabled |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-service_usbguard_enabled:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-82853-3 References: CCI-000416, CCI-001958, 1418, CM-8(3)(a), IA-3, FMT_SMF_EXT.1, SRG-OS-000378-GPOS-00163, RHEL-08-040141, SV-244548r743893_rule |
Description | The USBGuard service should be enabled.
The usbguard service can be enabled with the following command:
$ sudo systemctl enable usbguard.service |
Rationale | The usbguard service must be running in order to
enforce the USB device authorization policy for all USB devices. |
package usbguard is installed oval:ssg-test_service_usbguard_package_usbguard_installed:tst:1 true
Following items have been found on the system:
Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
---|---|---|---|---|---|---|---|
usbguard | x86_64 | (none) | 2.el8 | 1.0.0 | 0:1.0.0-2.el8 | 199e2f91fd431d51 | usbguard-0:1.0.0-2.el8.x86_64 |
Test that the usbguard service is running oval:ssg-test_service_running_usbguard:tst:1 true
Following items have been found on the system:
Unit | Property | Value |
---|---|---|
usbguard.service | ActiveState | active |
systemd test oval:ssg-test_multi_user_wants_usbguard:tst:1 true
Following items have been found on the system:
Unit | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency |
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
multi-user.target | basic.target | sysinit.target | systemd-udev-trigger.service | systemd-firstboot.service | systemd-journald.service | systemd-tmpfiles-setup.service | systemd-journal-flush.service | systemd-sysctl.service | dev-mqueue.mount | systemd-udevd.service | swap.target | dev-disk-by\x2duuid-1e5c0ff6\x2dd83c\x2d4f59\x2db028\x2d3cdb40431877.swap | dev-mapper-VolGroup\x2dswap.swap | systemd-machine-id-commit.service | systemd-update-done.service | systemd-sysusers.service | dracut-shutdown.service | multipathd.service | cryptsetup.target | import-state.service | lvm2-monitor.service | plymouth-read-write.service | proc-sys-fs-binfmt_misc.automount | plymouth-start.service | systemd-tmpfiles-setup-dev.service | systemd-binfmt.service | systemd-journal-catalog-update.service | local-fs.target | var-log.mount | var-log-audit.mount | boot-efi.mount | var-tmp.mount | boot.mount | home.mount | var.mount | -.mount | tmp.mount | systemd-remount-fs.service | ostree-remount.service | kmod-static-nodes.service | ldconfig.service | systemd-ask-password-console.path | sys-fs-fuse-connections.mount | nis-domainname.service | dev-hugepages.mount | systemd-hwdb-update.service | systemd-random-seed.service | sys-kernel-debug.mount | loadmodules.service | lvm2-lvmpolld.socket | sys-kernel-config.mount | selinux-autorelabel-mark.service | systemd-modules-load.service | systemd-update-utmp.service | usbguard.service | paths.target | slices.target | system.slice | -.slice | microcode.service | timers.target | systemd-tmpfiles-clean.timer | dnf-automatic.timer | dnf-makecache.timer | unbound-anchor.timer | sockets.target | systemd-coredump.socket | systemd-udevd-control.socket | systemd-udevd-kernel.socket | systemd-initctl.socket | dbus.socket | systemd-journald.socket | dm-event.socket | multipathd.socket | systemd-journald-dev-log.socket | sssd-kcm.socket | chronyd.service | plymouth-quit.service | systemd-update-utmp-runlevel.service | systemd-user-sessions.service | crond.service | remote-fs.target | dbus.service | firewalld.service | rhsmcertd.service | mdmonitor.service | NetworkManager.service | plymouth-quit-wait.service | sshd.service | fapolicyd.service | rsyslog.service | systemd-ask-password-wall.path | systemd-logind.service | irqbalance.service | getty.target | getty@tty1.service | tuned.service | auditd.service | sssd.service |
systemd test oval:ssg-test_multi_user_wants_usbguard_socket:tst:1 false
Following items have been found on the system:
Unit | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency |
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
multi-user.target | basic.target | sysinit.target | systemd-udev-trigger.service | systemd-firstboot.service | systemd-journald.service | systemd-tmpfiles-setup.service | systemd-journal-flush.service | systemd-sysctl.service | dev-mqueue.mount | systemd-udevd.service | swap.target | dev-disk-by\x2duuid-1e5c0ff6\x2dd83c\x2d4f59\x2db028\x2d3cdb40431877.swap | dev-mapper-VolGroup\x2dswap.swap | systemd-machine-id-commit.service | systemd-update-done.service | systemd-sysusers.service | dracut-shutdown.service | multipathd.service | cryptsetup.target | import-state.service | lvm2-monitor.service | plymouth-read-write.service | proc-sys-fs-binfmt_misc.automount | plymouth-start.service | systemd-tmpfiles-setup-dev.service | systemd-binfmt.service | systemd-journal-catalog-update.service | local-fs.target | var-log.mount | var-log-audit.mount | boot-efi.mount | var-tmp.mount | boot.mount | home.mount | var.mount | -.mount | tmp.mount | systemd-remount-fs.service | ostree-remount.service | kmod-static-nodes.service | ldconfig.service | systemd-ask-password-console.path | sys-fs-fuse-connections.mount | nis-domainname.service | dev-hugepages.mount | systemd-hwdb-update.service | systemd-random-seed.service | sys-kernel-debug.mount | loadmodules.service | lvm2-lvmpolld.socket | sys-kernel-config.mount | selinux-autorelabel-mark.service | systemd-modules-load.service | systemd-update-utmp.service | usbguard.service | paths.target | slices.target | system.slice | -.slice | microcode.service | timers.target | systemd-tmpfiles-clean.timer | dnf-automatic.timer | dnf-makecache.timer | unbound-anchor.timer | sockets.target | systemd-coredump.socket | systemd-udevd-control.socket | systemd-udevd-kernel.socket | systemd-initctl.socket | dbus.socket | systemd-journald.socket | dm-event.socket | multipathd.socket | systemd-journald-dev-log.socket | sssd-kcm.socket | chronyd.service | plymouth-quit.service | systemd-update-utmp-runlevel.service | systemd-user-sessions.service | crond.service | remote-fs.target | dbus.service | firewalld.service | rhsmcertd.service | mdmonitor.service | NetworkManager.service | plymouth-quit-wait.service | sshd.service | fapolicyd.service | rsyslog.service | systemd-ask-password-wall.path | systemd-logind.service | irqbalance.service | getty.target | getty@tty1.service | tuned.service | auditd.service | sssd.service |
Log USBGuard daemon audit events using Linux Audit
Rule ID | xccdf_org.ssgproject.content_rule_configure_usbguard_auditbackend |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-configure_usbguard_auditbackend:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-82168-6 References: CCI-000169, FMT_SMF_EXT.1, SRG-OS-000062-GPOS-00031, RHEL-08-030603, SV-230470r744006_rule |
Description | To configure USBGuard daemon to log via Linux Audit
(as opposed directly to a file),
AuditBackend option in /etc/usbguard/usbguard-daemon.conf
needs to be set to LinuxAudit . |
Rationale | Using the Linux Audit logging allows for centralized trace
of events. |
tests the value of AuditBackend setting in the /etc/usbguard/usbguard-daemon.conf file oval:ssg-test_configure_usbguard_auditbackend:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/usbguard/usbguard-daemon.conf | AuditBackend=LinuxAudit |
The configuration file /etc/usbguard/usbguard-daemon.conf exists for configure_usbguard_auditbackend oval:ssg-test_configure_usbguard_auditbackend_config_file_exists:tst:1 true
Following items have been found on the system:
Path | Type | UID | GID | Size (B) | Permissions |
---|---|---|---|---|---|
/etc/usbguard/usbguard-daemon.conf | regular | 0 | 0 | 6419 | rw------- |
Authorize Human Interface Devices and USB hubs in USBGuard daemon
Rule ID | xccdf_org.ssgproject.content_rule_usbguard_allow_hid_and_hub |
Result | pass |
Multi-check rule | no |
OVAL Definition ID | oval:ssg-usbguard_allow_hid_and_hub:def:1 |
Time | 2022-02-10T22:29:27+00:00 |
Severity | medium |
Identifiers and References | Identifiers: CCE-82368-2 References: FMT_SMF_EXT.1, SRG-OS-000114-GPOS-00059 |
Description | To allow authorization of USB devices combining human interface device and hub capabilities
by USBGuard daemon,
add the line
allow with-interface match-all { 03:*:* 09:00:* }
to /etc/usbguard/rules.conf . |
Rationale | Without allowing Human Interface Devices, it might not be possible
to interact with the system. Without allowing hubs, it might not be possible to use any
USB devices on the system. |
Warnings | warning
This rule should be understood primarily as a convenience administration feature. This rule ensures that if the USBGuard default rules.conf file is present, it will alter it so that USB human interface devices and hubs are allowed. However, if the rules.conf file is altered by system administrator, the rule does not check if USB human interface devices and hubs are allowed. This assumes that an administrator modified the file with some purpose in mind. |
Check the usbguard rules in either /etc/usbguard/rules.conf or /etc/usbguard/rules.d/ contain at least one non whitespace character and exists oval:ssg-test_usbguard_rules_nonempty:tst:1 true
Following items have been found on the system:
Path | Content |
---|---|
/etc/usbguard/rules.conf | allow with-interface match-all { 03:*:* 09:00:* } |