From shawn at redhat.com Thu Aug 20 11:35:49 2015 Content-Type: multipart/mixed; boundary="===============2081371154702086732==" MIME-Version: 1.0 From: Shawn Wells To: scap-security-guide at lists.fedorahosted.org Subject: Re: [PATCH 3/3] add VMS IDs and release numbers Date: Mon, 18 Nov 2013 17:04:32 -0700 Message-ID: <528AAB10.7040404@redhat.com> In-Reply-To: 528AAAB4.2010106@redhat.com --===============2081371154702086732== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On 11/18/13, 5:03 PM, Shawn Wells wrote: > On 11/18/13, 1:37 PM, Steinke, Leland J Sr CTR DISA FSO (US) wrote: >> I am open to suggestions as to how to improve this method of = >> inserting DISA Vulnerability Management System ID numbers into the = >> SSG content. This patch at least makes the information available. >> >> >> Thanks, >> Leland >> -- = >> Leland Steinke, Security+ >> DISA FSO Technical Support Contractor >> tapestry technologies, Inc >> 717-267-5797 (DSN 570) >> leland.j.steinke.ctr(a)mail.mil (gov't) >> lsteinke(a)tapestrytech.com (com'l) >> >> --- >> RHEL6/input/auxiliary/stig_overlay.xml | 255 = >> ++++++++++++++++++++++++++++++++ >> 1 files changed, 255 insertions(+), 0 deletions(-) >> >> diff --git a/RHEL6/input/auxiliary/stig_overlay.xml = >> b/RHEL6/input/auxiliary/stig_overlay.xml >> index b2c7809..32eb751 100644 >> --- a/RHEL6/input/auxiliary/stig_overlay.xml >> +++ b/RHEL6/input/auxiliary/stig_overlay.xml >> @@ -1,45 +1,58 @@ >> >> >> > ownerid=3D"RHEL-06-000001" disa=3D"366" severity=3D"low"> >> + >> The system must use a separate file system for = >> /tmp. >> >> > ownerid=3D"RHEL-06-000002" disa=3D"366" severity=3D"low"> >> + >> The system must use a separate file system for = >> /var. >> >> > ownerid=3D"RHEL-06-000003" disa=3D"366" severity=3D"low"> >> + >> The system must use a separate file system for = >> /var/log. >> >> > ownerid=3D"RHEL-06-000004" disa=3D"137" severity=3D"low"> >> + >> The system must use a separate file system for the = >> system audit data path. >> >> > ruleid=3D"auditd_data_retention_space_left_action" = >> ownerid=3D"RHEL-06-000005" disa=3D"138" severity=3D"medium"> >> + >> The audit system must alert designated staff members = >> when the audit storage volume approaches capacity. >> >> > ownerid=3D"RHEL-06-000007" disa=3D"366" severity=3D"low"> >> + >> The system must use a separate file system for user = >> home directories. >> >> > ruleid=3D"ensure_redhat_gpgkey_installed" ownerid=3D"RHEL-06-000008" = >> disa=3D"352" severity=3D"high"> >> + >> Vendor-provided cryptographic certificates must be = >> installed to verify the integrity of system software. >> >> > ownerid=3D"RHEL-06-000009" disa=3D"382" severity=3D"low"> >> + >> The Red Hat Network Service (rhnsd) service must not = >> be running, unless using RHN or an RHN Satellite. >> >> > ownerid=3D"RHEL-06-000011" disa=3D"1233" severity=3D"medium"> >> + >> System security patches and updates must be = >> installed and up-to-date. >> >> > ruleid=3D"ensure_gpgcheck_globally_activated" ownerid=3D"RHEL-06-000013" = >> disa=3D"663" severity=3D"medium"> >> + >> The system package management tool must = >> cryptographically verify the authenticity of system software packages = >> during installation. >> >> > ruleid=3D"ensure_gpgcheck_never_disabled" ownerid=3D"RHEL-06-000015" = >> disa=3D"663" severity=3D"low"> >> + >> The system package management tool must = >> cryptographically verify the authenticity of all software packages = >> during installation. >> >> > ownerid=3D"RHEL-06-000016" disa=3D"1069" severity=3D"medium"> >> + >> A file integrity tool must be installed. >> >> > ownerid=3D"RHEL-06-000017" disa=3D"22" severity=3D"medium"> >> The system must use a Linux Security Module at boot = >> time. >> >> > ownerid=3D"RHEL-06-000019" disa=3D"1436" severity=3D"high"> >> + >> There must be no .rhosts or hosts.equiv files on the = >> system. >> >> > ownerid=3D"RHEL-06-000020" disa=3D"22" severity=3D"medium"> >> @@ -52,201 +65,266 @@ >> All device files must be monitored by the system = >> Linux Security Module. >> >> > ruleid=3D"securetty_root_login_console_only" ownerid=3D"RHEL-06-000027" = >> disa=3D"770" severity=3D"medium"> >> + >> The system must prevent the root account from = >> logging in from virtual consoles. >> >> > ownerid=3D"RHEL-06-000028" disa=3D"770" severity=3D"low"> >> + >> The system must prevent the root account from = >> logging in from serial consoles. >> >> > ownerid=3D"RHEL-06-000029" disa=3D"366" severity=3D"medium"> >> + >> Default system accounts, other than root, must be = >> locked. >> >> > ownerid=3D"RHEL-06-000030" disa=3D"366" severity=3D"high"> >> + >> The system must not have accounts configured with = >> blank or null passwords. >> >> > ownerid=3D"RHEL-06-000031" disa=3D"366" severity=3D"medium"> >> + >> The /etc/passwd file must not contain password = >> hashes. >> >> > ownerid=3D"RHEL-06-000032" disa=3D"366" severity=3D"medium"> >> + >> The root account must be the only account having a = >> UID of 0. >> >> > ownerid=3D"RHEL-06-000033" disa=3D"366" severity=3D"medium"> >> + >> The /etc/shadow file must be owned by root. >> >> > ownerid=3D"RHEL-06-000034" disa=3D"366" severity=3D"medium"> >> + >> The /etc/shadow file must be group-owned by = >> root. >> >> > ownerid=3D"RHEL-06-000035" disa=3D"366" severity=3D"medium"> >> + >> The /etc/shadow file must have mode 0000. >> >> > ownerid=3D"RHEL-06-000036" disa=3D"366" severity=3D"medium"> >> + >> The /etc/gshadow file must be owned by root. >> >> > ownerid=3D"RHEL-06-000037" disa=3D"366" severity=3D"medium"> >> + >> The /etc/gshadow file must be group-owned by = >> root. >> >> > ownerid=3D"RHEL-06-000038" disa=3D"366" severity=3D"medium"> >> + >> The /etc/gshadow file must have mode 0000. >> >> > ownerid=3D"RHEL-06-000039" disa=3D"366" severity=3D"medium"> >> + >> The /etc/passwd file must be owned by root. >> >> > ownerid=3D"RHEL-06-000040" disa=3D"366" severity=3D"medium"> >> + >> The /etc/passwd file must be group-owned by = >> root. >> >> > ownerid=3D"RHEL-06-000041" disa=3D"366" severity=3D"medium"> >> + >> The /etc/passwd file must have mode 0644 or less = >> permissive. >> >> > ownerid=3D"RHEL-06-000042" disa=3D"366" severity=3D"medium"> >> + >> The /etc/group file must be owned by root. >> >> > ownerid=3D"RHEL-06-000043" disa=3D"366" severity=3D"medium"> >> + >> The /etc/group file must be group-owned by = >> root. >> >> > ownerid=3D"RHEL-06-000044" disa=3D"366" severity=3D"medium"> >> + >> The /etc/group file must have mode 0644 or less = >> permissive. >> >> > ruleid=3D"file_permissions_library_dirs" ownerid=3D"RHEL-06-000045" = >> disa=3D"1499" severity=3D"medium"> >> + >> Library files must have mode 0755 or less = >> permissive. >> >> > ownerid=3D"RHEL-06-000046" disa=3D"1499" severity=3D"medium"> >> + >> Library files must be owned by root. >> >> > ownerid=3D"RHEL-06-000047" disa=3D"1499" severity=3D"medium"> >> + >> All system command files must have mode 0755 or less = >> permissive. >> >> > ownerid=3D"RHEL-06-000048" disa=3D"1499" severity=3D"medium"> >> + >> All system command files must be owned by root. >> >> > ruleid=3D"accounts_password_minlen_login_defs" ownerid=3D"RHEL-06-000050= " = >> disa=3D"205" severity=3D"medium"> >> + >> The system must require passwords to contain a = >> minimum of 14 characters. >> >> > ruleid=3D"accounts_minimum_age_login_defs" ownerid=3D"RHEL-06-000051" = >> disa=3D"198" severity=3D"medium"> >> + >> Users must not be able to change passwords more than = >> once every 24 hours. >> >> > ruleid=3D"accounts_maximum_age_login_defs" ownerid=3D"RHEL-06-000053" = >> disa=3D"199" severity=3D"medium"> >> + >> User passwords must be changed at least every 60 = >> days. >> >> > ruleid=3D"accounts_password_warn_age_login_defs" = >> ownerid=3D"RHEL-06-000054" disa=3D"366" severity=3D"low"> >> + >> Users must be warned 7 days in advance of password = >> expiration. >> >> > ruleid=3D"accounts_password_pam_cracklib_dcredit" = >> ownerid=3D"RHEL-06-000056" disa=3D"194" severity=3D"low"> >> + >> The system must require passwords to contain at = >> least one numeric character. >> >> > ownerid=3D"RHEL-06-000057" disa=3D"192" severity=3D"low"> >> + >> The system must require passwords to contain at = >> least one uppercase alphabetic character. >> >> > ownerid=3D"RHEL-06-000058" disa=3D"1619" severity=3D"low"> >> + >> The system must require passwords to contain at = >> least one special character. >> >> > ownerid=3D"RHEL-06-000059" disa=3D"193" severity=3D"low"> >> + >> The system must require passwords to contain at = >> least one lowercase alphabetic character. >> >> > ownerid=3D"RHEL-06-000060" disa=3D"195" severity=3D"low"> >> + >> The system must require at least four characters be = >> changed between the old and new passwords during a password = >> change. >> >> > ownerid=3D"RHEL-06-000061" disa=3D"44" severity=3D"medium"> >> + >> The system must disable accounts after three = >> consecutive unsuccessful login attempts. >> >> > ruleid=3D"set_password_hashing_algorithm_systemauth" = >> ownerid=3D"RHEL-06-000062" disa=3D"803" severity=3D"medium"> >> + >> The system must use a FIPS 140-2 approved = >> cryptographic hashing algorithm for generating account password = >> hashes (system-auth). >> >> > ruleid=3D"set_password_hashing_algorithm_logindefs" = >> ownerid=3D"RHEL-06-000063" disa=3D"803" severity=3D"medium"> >> + >> The system must use a FIPS 140-2 approved = >> cryptographic hashing algorithm for generating account password = >> hashes (login.defs). >> >> > ruleid=3D"set_password_hashing_algorithm_libuserconf" = >> ownerid=3D"RHEL-06-000064" disa=3D"803" severity=3D"medium"> >> + >> The system must use a FIPS 140-2 approved = >> cryptographic hashing algorithm for generating account password = >> hashes (libuser.conf). >> >> > ownerid=3D"RHEL-06-000065" disa=3D"366" severity=3D"medium"> >> + >> The system boot loader configuration file(s) must be = >> owned by root. >> >> > ownerid=3D"RHEL-06-000066" disa=3D"366" severity=3D"medium"> >> + >> The system boot loader configuration file(s) must be = >> group-owned by root. >> >> > ownerid=3D"RHEL-06-000067" disa=3D"366" severity=3D"medium"> >> + >> The system boot loader configuration file(s) must = >> have mode 0600 or less permissive. >> >> > ownerid=3D"RHEL-06-000068" disa=3D"213" severity=3D"medium"> >> + >> The system boot loader must require = >> authentication. >> >> > ownerid=3D"RHEL-06-000069" disa=3D"213" severity=3D"medium"> >> + >> The system must require authentication upon booting = >> into single-user and maintenance modes. >> >> > ownerid=3D"RHEL-06-000070" disa=3D"213" severity=3D"medium"> >> + >> The system must not permit interactive boot. >> >> > ownerid=3D"RHEL-06-000071" disa=3D"58" severity=3D"low"> >> + >> The system must allow locking of the console = >> screen. >> >> > ownerid=3D"RHEL-06-000073" disa=3D"1384, 1385, 1386, 1387, 1388" = >> severity=3D"medium"> >> + >> The Department of Defense (DoD) login banner must be = >> displayed immediately prior to, or as part of, console login = >> prompts. >> >> > ownerid=3D"RHEL-06-000078" disa=3D"366" severity=3D"medium"> >> + >> The system must implement virtual address space = >> randomization. >> >> > ownerid=3D"RHEL-06-000079" disa=3D"366" severity=3D"medium"> >> + >> The system must limit the ability of processes to = >> have simultaneous write and execute access to memory. >> >> > ruleid=3D"sysctl_net_ipv4_conf_default_send_redirects" = >> ownerid=3D"RHEL-06-000080" disa=3D"366" severity=3D"medium"> >> + >> The system must not send ICMPv4 redirects by = >> default. >> >> > ruleid=3D"sysctl_ipv4_all_send_redirects" ownerid=3D"RHEL-06-000081" = >> disa=3D"366" severity=3D"medium"> >> + >> The system must not send ICMPv4 redirects from any = >> interface. >> >> > ownerid=3D"RHEL-06-000082" disa=3D"366" severity=3D"medium"> >> + >> IP forwarding for IPv4 must not be enabled, unless = >> the system is a router. >> >> > ruleid=3D"sysctl_net_ipv4_conf_all_accept_source_route" = >> ownerid=3D"RHEL-06-000083" disa=3D"366" severity=3D"medium"> >> + >> The system must not accept IPv4 source-routed = >> packets on any interface. >> >> > ruleid=3D"sysctl_net_ipv4_conf_all_accept_redirects" = >> ownerid=3D"RHEL-06-000084" disa=3D"366" severity=3D"medium"> >> + >> The system must not accept ICMPv4 redirect packets = >> on any interface. >> >> > ruleid=3D"sysctl_net_ipv4_conf_all_secure_redirects" = >> ownerid=3D"RHEL-06-000086" disa=3D"366" severity=3D"medium"> >> + >> The system must not accept ICMPv4 secure redirect = >> packets on any interface. >> >> > ruleid=3D"sysctl_net_ipv4_conf_all_log_martians" = >> ownerid=3D"RHEL-06-000088" disa=3D"366" severity=3D"low"> >> + >> The system must log Martian packets. >> >> > ruleid=3D"sysctl_net_ipv4_conf_default_accept_source_route" = >> ownerid=3D"RHEL-06-000089" disa=3D"366" severity=3D"medium"> >> + >> The system must not accept IPv4 source-routed = >> packets by default. >> >> > ruleid=3D"sysctl_net_ipv4_conf_default_secure_redirects" = >> ownerid=3D"RHEL-06-000090" disa=3D"366" severity=3D"medium"> >> + >> The system must not accept ICMPv4 secure redirect = >> packets by default. >> >> > ruleid=3D"sysctl_net_ipv4_conf_default_accept_redirects" = >> ownerid=3D"RHEL-06-000091" disa=3D"366" severity=3D"low"> >> + >> The system must ignore IPv4 ICMP redirect = >> messages. >> >> > ruleid=3D"sysctl_net_ipv4_icmp_echo_ignore_broadcasts" = >> ownerid=3D"RHEL-06-000092" disa=3D"366" severity=3D"low"> >> + >> The system must not respond to ICMPv4 sent to a = >> broadcast address. >> >> > ruleid=3D"sysctl_net_ipv4_icmp_ignore_bogus_error_responses" = >> ownerid=3D"RHEL-06-000093" disa=3D"366" severity=3D"low"> >> + >> The system must ignore ICMPv4 bogus error = >> responses. >> >> > ruleid=3D"sysctl_net_ipv4_tcp_syncookies" ownerid=3D"RHEL-06-000095" = >> disa=3D"1095" severity=3D"medium"> >> + >> The system must be configured to use TCP syncookies = >> when experiencing a TCP SYN flood. >> >> > ruleid=3D"sysctl_net_ipv4_conf_all_rp_filter" ownerid=3D"RHEL-06-000096" = >> disa=3D"366" severity=3D"medium"> >> + >> The system must use a reverse-path filter for IPv4 = >> network traffic when possible on all interfaces. >> >> > ruleid=3D"sysctl_net_ipv4_conf_default_rp_filter" = >> ownerid=3D"RHEL-06-000097" disa=3D"366" severity=3D"medium"> >> + >> The system must use a reverse-path filter for IPv4 = >> network traffic when possible by default. >> >> > ruleid=3D"kernel_module_ipv6_option_disabled" ownerid=3D"RHEL-06-000098" = >> disa=3D"366" severity=3D"medium"> >> + >> The IPv6 protocol handler must not be bound to the = >> network stack unless needed. >> >> > ruleid=3D"sysctl_ipv6_default_accept_redirects" = >> ownerid=3D"RHEL-06-000099" disa=3D"366" severity=3D"medium"> >> + >> The system must ignore ICMPv6 redirects by = >> default. >> >> > ownerid=3D"RHEL-06-000103" disa=3D"1118" severity=3D"medium"> >> + >> The system must employ a local IPv6 firewall. >> >> > ownerid=3D"RHEL-06-000105" disa=3D"1117" severity=3D"medium"> >> The system must employ a local IPv6 firewall. >> >> > ownerid=3D"RHEL-06-000106" disa=3D"1098" severity=3D"medium"> >> + >> The system must employ a local IPv6 firewall. >> >> > ownerid=3D"RHEL-06-000107" disa=3D"1100" severity=3D"medium"> >> + >> The system must employ a local IPv6 firewall. >> >> > ownerid=3D"RHEL-06-000108" disa=3D"1097" severity=3D"medium"> >> @@ -256,15 +334,18 @@ >> The system must employ a local IPv6 firewall. >> >> > ownerid=3D"RHEL-06-000113" disa=3D"1118" severity=3D"medium"> >> + >> The system must employ a local IPv4 firewall. >> >> > ownerid=3D"RHEL-06-000115" disa=3D"1117" severity=3D"medium"> >> The system must employ a local IPv4 firewall. >> >> > ownerid=3D"RHEL-06-000116" disa=3D"1098" severity=3D"medium"> >> + >> The system must employ a local IPv4 firewall. >> >> > ownerid=3D"RHEL-06-000117" disa=3D"1100" severity=3D"medium"> >> + >> The system must employ a local IPv4 firewall. >> >> > ownerid=3D"RHEL-06-000118" disa=3D"1097" severity=3D"medium"> >> @@ -274,6 +355,7 @@ >> The system must employ a local IPv4 firewall. >> >> > ownerid=3D"RHEL-06-000120" disa=3D"66" severity=3D"medium"> >> + >> The system's local IPv4 firewall must implement a = >> deny-all, allow-by-exception policy for inbound packets. >> >> > ownerid=3D"RHEL-06-000121" disa=3D"1115" severity=3D"medium"> >> @@ -283,33 +365,43 @@ >> The system's local firewall must implement a = >> deny-all, allow-by-exception policy for inbound packets. >> >> > ownerid=3D"RHEL-06-000124" disa=3D"382" severity=3D"medium"> >> + >> The Datagram Congestion Control Protocol (DCCP) must = >> be disabled unless required. >> >> > ownerid=3D"RHEL-06-000125" disa=3D"382" severity=3D"medium"> >> + >> The Stream Control Transmission Protocol (SCTP) must = >> be disabled unless required. >> >> > ownerid=3D"RHEL-06-000126" disa=3D"382" severity=3D"low"> >> + >> The Reliable Datagram Sockets (RDS) protocol must be = >> disabled unless required. >> >> > ownerid=3D"RHEL-06-000127" disa=3D"382" severity=3D"medium"> >> + >> The Transparent Inter-Process Communication (TIPC) = >> protocol must be disabled unless required. >> >> > ownerid=3D"RHEL-06-000133" disa=3D"1314" severity=3D"medium"> >> + >> All rsyslog-generated log files must be owned by = >> root. >> >> > ownerid=3D"RHEL-06-000134" disa=3D"1314" severity=3D"medium"> >> + >> All rsyslog-generated log files must be group-owned = >> by root. >> >> > ownerid=3D"RHEL-06-000135" disa=3D"1314" severity=3D"medium"> >> + >> All rsyslog-generated log files must have mode 0600 = >> or less permissive. >> >> > ruleid=3D"rsyslog_send_messages_to_logserver" ownerid=3D"RHEL-06-000136" = >> disa=3D"1348" severity=3D"medium"> >> + >> The operating system must back up audit records on = >> an organization defined frequency onto a different system or media = >> than the system being audited. >> >> > ruleid=3D"rsyslog_send_messages_to_logserver" ownerid=3D"RHEL-06-000137" = >> disa=3D"136" severity=3D"medium"> >> + >> The operating system must support the requirement to = >> centrally manage the content of audit records generated by = >> organization defined information system components. >> >> > ownerid=3D"RHEL-06-000138" disa=3D"366" severity=3D"low"> >> + >> System logs must be rotated daily. >> >> > ownerid=3D"RHEL-06-000139" disa=3D"347" severity=3D"medium"> >> @@ -325,9 +417,11 @@ >> The operating system must produce a system-wide = >> (logical or physical) audit trail composed of audit records in a = >> standardized format. >> >> > ownerid=3D"RHEL-06-000145" disa=3D"1487" severity=3D"medium"> >> + >> The operating system must produce audit records = >> containing sufficient information to establish the identity of any = >> user/subject associated with the event. >> >> > ownerid=3D"RHEL-06-000148" disa=3D"67" severity=3D"medium"> >> + >> The operating system must employ automated = >> mechanisms to facilitate the monitoring and control of remote access = >> methods. >> >> > ownerid=3D"RHEL-06-000149" disa=3D"158" severity=3D"medium"> >> @@ -337,183 +431,240 @@ >> The operating system must fail to an organization = >> defined known state for organization defined types of failures. >> >> > ownerid=3D"RHEL-06-000154" disa=3D"130" severity=3D"medium"> >> + >> The operating system must produce audit records = >> containing sufficient information to establish what type of events = >> occurred. >> >> > ownerid=3D"RHEL-06-000157" disa=3D"1464" severity=3D"low"> >> Auditing must be enabled at boot by setting a kernel = >> parameter. >> >> > ownerid=3D"RHEL-06-000159" disa=3D"366" severity=3D"medium"> >> + >> The system must retain enough rotated audit logs to = >> cover the required log retention period. >> >> > ruleid=3D"configure_auditd_max_log_file" ownerid=3D"RHEL-06-000160" = >> disa=3D"366" severity=3D"medium"> >> + >> The system must set a maximum audit log file = >> size. >> >> > ruleid=3D"configure_auditd_max_log_file_action" = >> ownerid=3D"RHEL-06-000161" disa=3D"366" severity=3D"medium"> >> + >> The system must rotate audit log files that reach = >> the maximum file size. >> >> > ruleid=3D"configure_auditd_admin_space_left_action" = >> ownerid=3D"RHEL-06-000163" disa=3D"1343" severity=3D"medium"> >> The audit system must switch the system to = >> single-user mode when available audit storage volume becomes = >> dangerously low. >> >> > ownerid=3D"RHEL-06-000165" disa=3D"169" severity=3D"low"> >> + >> The audit system must be configured to audit all = >> attempts to alter system time through adjtimex. >> >> > ruleid=3D"audit_rules_time_settimeofday" ownerid=3D"RHEL-06-000167" = >> disa=3D"169" severity=3D"low"> >> + >> The audit system must be configured to audit all = >> attempts to alter system time through settimeofday. >> >> > ownerid=3D"RHEL-06-000169" disa=3D"169" severity=3D"low"> >> + >> The audit system must be configured to audit all = >> attempts to alter system time through stime. >> >> > ruleid=3D"audit_rules_time_clock_settime" ownerid=3D"RHEL-06-000171" = >> disa=3D"169" severity=3D"low"> >> + >> The audit system must be configured to audit all = >> attempts to alter system time through clock_settime. >> >> > ruleid=3D"audit_rules_time_watch_localtime" ownerid=3D"RHEL-06-000173" = >> disa=3D"169" severity=3D"low"> >> + >> The audit system must be configured to audit all = >> attempts to alter system time through /etc/localtime. >> >> > ownerid=3D"RHEL-06-000174" disa=3D"18" severity=3D"low"> >> + >> The operating system must automatically audit = >> account creation. >> >> > ownerid=3D"RHEL-06-000175" disa=3D"1403" severity=3D"low"> >> + >> The operating system must automatically audit = >> account modification. >> >> > ownerid=3D"RHEL-06-000176" disa=3D"1404" severity=3D"low"> >> + >> The operating system must automatically audit = >> account disabling actions. >> >> > ownerid=3D"RHEL-06-000177" disa=3D"1405" severity=3D"low"> >> + >> The operating system must automatically audit = >> account termination. >> >> > ownerid=3D"RHEL-06-000182" disa=3D"366" severity=3D"low"> >> + >> The audit system must be configured to audit = >> modifications to the systems network configuration. >> >> > ownerid=3D"RHEL-06-000183" disa=3D"366" severity=3D"low"> >> + >> The audit system must be configured to audit = >> modifications to the system's Mandatory Access Control (MAC) = >> configuration (SELinux). >> >> > ruleid=3D"audit_rules_dac_modification_chmod" ownerid=3D"RHEL-06-000184" = >> disa=3D"172" severity=3D"low"> >> + >> The audit system must be configured to audit all = >> discretionary access control permission modifications using = >> chmod. >> >> > ruleid=3D"audit_rules_dac_modification_chown" ownerid=3D"RHEL-06-000185" = >> disa=3D"172" severity=3D"low"> >> + >> The audit system must be configured to audit all = >> discretionary access control permission modifications using = >> chown. >> >> > ruleid=3D"audit_rules_dac_modification_fchmod" ownerid=3D"RHEL-06-000186= " = >> disa=3D"172" severity=3D"low"> >> + >> The audit system must be configured to audit all = >> discretionary access control permission modifications using = >> fchmod. >> >> > ruleid=3D"audit_rules_dac_modification_fchmodat" = >> ownerid=3D"RHEL-06-000187" disa=3D"172" severity=3D"low"> >> + >> The audit system must be configured to audit all = >> discretionary access control permission modifications using = >> fchmodat. >> >> > ruleid=3D"audit_rules_dac_modification_fchown" ownerid=3D"RHEL-06-000188= " = >> disa=3D"172" severity=3D"low"> >> + >> The audit system must be configured to audit all = >> discretionary access control permission modifications using = >> fchown. >> >> > ruleid=3D"audit_rules_dac_modification_fchownat" = >> ownerid=3D"RHEL-06-000189" disa=3D"172" severity=3D"low"> >> + >> The audit system must be configured to audit all = >> discretionary access control permission modifications using = >> fchownat. >> >> > ruleid=3D"audit_rules_dac_modification_fremovexattr" = >> ownerid=3D"RHEL-06-000190" disa=3D"172" severity=3D"low"> >> + >> The audit system must be configured to audit all = >> discretionary access control permission modifications using = >> fremovexattr. >> >> > ruleid=3D"audit_rules_dac_modification_fsetxattr" = >> ownerid=3D"RHEL-06-000191" disa=3D"172" severity=3D"low"> >> + >> The audit system must be configured to audit all = >> discretionary access control permission modifications using = >> fsetxattr. >> >> > ruleid=3D"audit_rules_dac_modification_lchown" ownerid=3D"RHEL-06-000192= " = >> disa=3D"172" severity=3D"low"> >> + >> The audit system must be configured to audit all = >> discretionary access control permission modifications using = >> lchown. >> >> > ruleid=3D"audit_rules_dac_modification_lremovexattr" = >> ownerid=3D"RHEL-06-000193" disa=3D"172" severity=3D"low"> >> + >> The audit system must be configured to audit all = >> discretionary access control permission modifications using = >> lremovexattr. >> >> > ruleid=3D"audit_rules_dac_modification_lsetxattr" = >> ownerid=3D"RHEL-06-000194" disa=3D"172" severity=3D"low"> >> + >> The audit system must be configured to audit all = >> discretionary access control permission modifications using = >> lsetxattr. >> >> > ruleid=3D"audit_rules_dac_modification_removexattr" = >> ownerid=3D"RHEL-06-000195" disa=3D"172" severity=3D"low"> >> + >> The audit system must be configured to audit all = >> discretionary access control permission modifications using = >> removexattr. >> >> > ruleid=3D"audit_rules_dac_modification_setxattr" = >> ownerid=3D"RHEL-06-000196" disa=3D"172" severity=3D"low"> >> + >> The audit system must be configured to audit all = >> discretionary access control permission modifications using = >> setxattr. >> >> > ownerid=3D"RHEL-06-000197" disa=3D"172" severity=3D"low"> >> + >> The audit system must be configured to audit failed = >> attempts to access files and programs. >> >> > ownerid=3D"RHEL-06-000198" disa=3D"40" severity=3D"low"> >> + >> The audit system must be configured to audit all use = >> of setuid programs. >> >> > ownerid=3D"RHEL-06-000199" disa=3D"172" severity=3D"low"> >> + >> The audit system must be configured to audit = >> successful file system mounts. >> >> > ownerid=3D"RHEL-06-000200" disa=3D"172" severity=3D"low"> >> + >> The audit system must be configured to audit user = >> deletions of files and programs. >> >> > ownerid=3D"RHEL-06-000201" disa=3D"172" severity=3D"low"> >> + >> The audit system must be configured to audit changes = >> to the "/etc/sudoers" file. >> >> > ownerid=3D"RHEL-06-000202" disa=3D"172" severity=3D"medium"> >> + >> The audit system must be configured to audit the = >> loading and unloading of dynamic kernel modules. >> >> > ownerid=3D"RHEL-06-000203" disa=3D"382" severity=3D"medium"> >> + >> The xinetd service must be disabled if no network = >> services utilizing it are enabled. >> >> > ownerid=3D"RHEL-06-000204" disa=3D"382" severity=3D"low"> >> + >> The xinetd service must be uninstalled if no network = >> services utilizing it are enabled. >> >> > ownerid=3D"RHEL-06-000206" disa=3D"381" severity=3D"high"> >> + >> The telnet-server package must not be = >> installed. >> >> > ownerid=3D"RHEL-06-000211" disa=3D"888" severity=3D"high"> >> + >> The telnet daemon must not be running. >> >> > ownerid=3D"RHEL-06-000213" disa=3D"381" severity=3D"high"> >> + >> The rsh-server package must not be installed. >> >> > ownerid=3D"RHEL-06-000214" disa=3D"68" severity=3D"high"> >> + >> The rshd service must not be running. >> >> > ownerid=3D"RHEL-06-000216" disa=3D"68" severity=3D"high"> >> + >> The rexecd service must not be running. >> >> > ownerid=3D"RHEL-06-000218" disa=3D"1436" severity=3D"high"> >> + >> The rlogind service must not be running. >> >> > ownerid=3D"RHEL-06-000220" disa=3D"381" severity=3D"medium"> >> + >> The ypserv package must not be installed. >> >> > ownerid=3D"RHEL-06-000221" disa=3D"382" severity=3D"medium"> >> + >> The ypbind service must not be running. >> >> > ownerid=3D"RHEL-06-000222" disa=3D"381" severity=3D"medium"> >> + >> The tftp-server package must not be installed. >> >> > ownerid=3D"RHEL-06-000223" disa=3D"1436" severity=3D"medium"> >> + >> The TFTP service must not be running. >> >> > ownerid=3D"RHEL-06-000224" disa=3D"366" severity=3D"medium"> >> + >> The cron service must be running. >> >> > ownerid=3D"RHEL-06-000227" disa=3D"774" severity=3D"high"> >> + >> The SSH daemon must be configured to use only the = >> SSHv2 protocol. >> >> > ownerid=3D"RHEL-06-000230" disa=3D"1133" severity=3D"low"> >> + >> The SSH daemon must set a timeout interval on idle = >> sessions. >> >> > ownerid=3D"RHEL-06-000231" disa=3D"879" severity=3D"low"> >> + >> The SSH daemon must set a timeout count on idle = >> sessions. >> >> > ownerid=3D"RHEL-06-000234" disa=3D"766" severity=3D"medium"> >> + >> The SSH daemon must ignore .rhosts files. >> >> > ownerid=3D"RHEL-06-000235" disa=3D"765" severity=3D"medium"> >> The SSH daemon must not allow host-based = >> authentication. >> >> > ownerid=3D"RHEL-06-000236" disa=3D"766" severity=3D"medium"> >> + >> The SSH daemon must not allow host-based = >> authentication. >> >> > ownerid=3D"RHEL-06-000237" disa=3D"770" severity=3D"medium"> >> + >> The system must not permit root logins using remote = >> access programs such as ssh. >> >> > ownerid=3D"RHEL-06-000239" disa=3D"766" severity=3D"high"> >> + >> The SSH daemon must not allow authentication using = >> an empty password. >> >> > ownerid=3D"RHEL-06-000240" disa=3D"48" severity=3D"medium"> >> + >> The SSH daemon must be configured with the = >> Department of Defense (DoD) login banner. >> >> > ownerid=3D"RHEL-06-000241" disa=3D"1414" severity=3D"low"> >> + >> The SSH daemon must not permit user environment = >> settings. >> >> > ownerid=3D"RHEL-06-000243" disa=3D"1144" severity=3D"medium"> >> + >> The SSH daemon must be configured to use only FIPS = >> 140-2 approved ciphers. >> >> > ownerid=3D"RHEL-06-000244" disa=3D"1145" severity=3D"medium"> >> @@ -523,144 +674,189 @@ >> The operating system must employ NSA-approved = >> cryptography to protect classified information. >> >> > ownerid=3D"RHEL-06-000246" disa=3D"366" severity=3D"low"> >> + >> The avahi service must be disabled. >> >> > ownerid=3D"RHEL-06-000247" disa=3D"160" severity=3D"medium"> >> + >> The system clock must be synchronized continuously, = >> or at least daily. >> >> > ownerid=3D"RHEL-06-000248" disa=3D"160" severity=3D"medium"> >> + >> The system clock must be synchronized to an = >> authoritative DoD time source. >> >> > ownerid=3D"RHEL-06-000249" disa=3D"382" severity=3D"medium"> >> + >> Mail relaying must be restricted. >> >> > ownerid=3D"RHEL-06-000251" disa=3D"778" severity=3D"medium"> >> The operating system must uniquely identify and = >> authenticate an organization defined list of specific devices and/or = >> types of devices before establishing a connection. >> >> > ownerid=3D"RHEL-06-000252" disa=3D"1453" severity=3D"medium"> >> + >> If the system is using LDAP for authentication or = >> account information, the system must use a TLS connection using FIPS = >> 140-2 approved cryptographic algorithms. >> >> > ownerid=3D"RHEL-06-000253" disa=3D"776" severity=3D"medium"> >> + >> The LDAP client must use a TLS connection using = >> trust certificates signed by the site CA. >> >> > ruleid=3D"package_openldap-servers_removed" ownerid=3D"RHEL-06-000256" = >> disa=3D"366" severity=3D"low"> >> + >> The openldap-servers package must not be installed = >> unless required. >> >> > ruleid=3D"set_screensaver_inactivity_timeout" ownerid=3D"RHEL-06-000257" = >> disa=3D"57" severity=3D"medium"> >> + >> The graphical desktop environment must set the idle = >> timeout to no more than 15 minutes. >> >> > ruleid=3D"enable_screensaver_after_idle" ownerid=3D"RHEL-06-000258" = >> disa=3D"57" severity=3D"medium"> >> + >> The graphical desktop environment must automatically = >> lock after 15 minutes of inactivity and the system must require user = >> to re-authenticate to unlock the environment. >> >> > ruleid=3D"enable_screensaver_password_lock" ownerid=3D"RHEL-06-000259" = >> disa=3D"57" severity=3D"medium"> >> + >> The graphical desktop environment must have = >> automatic lock enabled. >> >> > ownerid=3D"RHEL-06-000260" disa=3D"60" severity=3D"low"> >> + >> The system must display a publicly-viewable pattern = >> during a graphical desktop environment session lock. >> >> > ownerid=3D"RHEL-06-000261" disa=3D"382" severity=3D"low"> >> + >> The Automatic Bug Reporting Tool (abrtd) service = >> must not be running. >> >> > ownerid=3D"RHEL-06-000262" disa=3D"382" severity=3D"low"> >> + >> The atd service must be disabled. >> >> > ownerid=3D"RHEL-06-000263" disa=3D"1250" severity=3D"low"> >> Automated file system mounting tools must not be = >> enabled unless needed. >> >> > ownerid=3D"RHEL-06-000265" disa=3D"382" severity=3D"low"> >> + >> The ntpdate service must not be running. >> >> > ownerid=3D"RHEL-06-000266" disa=3D"382" severity=3D"low"> >> + >> The oddjobd service must not be running. >> >> > ownerid=3D"RHEL-06-000267" disa=3D"382" severity=3D"low"> >> + >> The qpidd service must not be running. >> >> > ownerid=3D"RHEL-06-000268" disa=3D"382" severity=3D"low"> >> + >> The rdisc service must not be running. >> >> > ruleid=3D"use_nodev_option_on_nfs_mounts" ownerid=3D"RHEL-06-000269" = >> disa=3D"366" severity=3D"medium"> >> + >> Remote file systems must be mounted with the "nodev" = >> option. >> >> > ruleid=3D"use_nosuid_option_on_nfs_mounts" ownerid=3D"RHEL-06-000270" = >> disa=3D"366" severity=3D"medium"> >> + >> Remote file systems must be mounted with the = >> "nosuid" option. >> >> > ruleid=3D"mountopt_noexec_on_removable_partitions" = >> ownerid=3D"RHEL-06-000271" disa=3D"87" severity=3D"low"> >> + >> The noexec option must be added to removable media = >> partitions. >> >> > ownerid=3D"RHEL-06-000272" disa=3D"366" severity=3D"low"> >> + >> The system must use SMB client signing for = >> connecting to samba servers using smbclient. >> >> > ruleid=3D"require_smb_client_signing_mount.cifs" = >> ownerid=3D"RHEL-06-000273" disa=3D"366" severity=3D"low"> >> + >> The system must use SMB client signing for = >> connecting to samba servers using mount.cifs. >> >> > ruleid=3D"accounts_password_reuse_limit" ownerid=3D"RHEL-06-000274" = >> disa=3D"200" severity=3D"medium"> >> + >> The system must prohibit the reuse of passwords = >> within twenty-four iterations. >> >> > ownerid=3D"RHEL-06-000275" disa=3D"1019" severity=3D"low"> >> + >> The operating system must employ cryptographic = >> mechanisms to protect information in storage. >> >> > ownerid=3D"RHEL-06-000276" disa=3D"1199" severity=3D"low"> >> + >> The operating system must protect the = >> confidentiality and integrity of data at rest. >> >> > ownerid=3D"RHEL-06-000277" disa=3D"1200" severity=3D"low"> >> + >> The operating system must employ cryptographic = >> mechanisms to prevent unauthorized disclosure of data at rest unless = >> otherwise protected by alternative physical measures. >> >> > ownerid=3D"RHEL-06-000278" disa=3D"1493" severity=3D"medium"> >> + >> The system package management tool must verify = >> permissions on all files and directories associated with the "audit" = >> package. >> >> > ownerid=3D"RHEL-06-000279" disa=3D"1494" severity=3D"medium"> >> + >> The system package management tool must verify = >> ownership on all files and directories associated with the "audit" = >> package. >> >> > ownerid=3D"RHEL-06-000280" disa=3D"1495" severity=3D"medium"> >> + >> The system package management tool must verify = >> group-ownership on all files and directories associated with the = >> "audit" package. >> >> > ownerid=3D"RHEL-06-000281" disa=3D"1496" severity=3D"medium"> >> + >> The system package management tool must verify = >> contents of all files associated with the audit package. >> >> > ownerid=3D"RHEL-06-000282" disa=3D"366" severity=3D"medium"> >> + >> There must be no world-writable files on the = >> system. >> >> > ownerid=3D"RHEL-06-000284" disa=3D"1668" severity=3D"high"> >> + >> The system must use and update a DoD-approved virus = >> scan program. >> >> > ownerid=3D"RHEL-06-000285" disa=3D"1263" severity=3D"medium"> >> + >> The system must have a host-based intrusion = >> detection tool installed. >> >> > ownerid=3D"RHEL-06-000286" disa=3D"366" severity=3D"high"> >> + >> The x86 Ctrl-Alt-Delete key sequence must be = >> disabled. >> >> > ownerid=3D"RHEL-06-000287" disa=3D"366" severity=3D"low"> >> + >> The postfix service must be enabled for mail = >> delivery. >> >> > ownerid=3D"RHEL-06-000288" disa=3D"366" severity=3D"medium"> >> + >> The sendmail package must be removed. >> >> > ownerid=3D"RHEL-06-000289" disa=3D"382" severity=3D"low"> >> + >> The netconsole service must be disabled unless = >> required. >> >> > ruleid=3D"disable_xwindows_with_runlevel" ownerid=3D"RHEL-06-000290" = >> disa=3D"1436" severity=3D"medium"> >> + >> X Windows must not be enabled unless required. >> >> > ownerid=3D"RHEL-06-000291" disa=3D"366" severity=3D"low"> >> + >> The xorg-x11-server-common (X Windows) package must = >> not be installed, unless required. >> >> > ownerid=3D"RHEL-06-000292" disa=3D"366" severity=3D"medium"> >> + >> The DHCP client must be disabled if not needed. >> >> > ownerid=3D"RHEL-06-000294" disa=3D"366" severity=3D"low"> >> + >> All GIDs referenced in /etc/passwd must be defined = >> in /etc/group >> >> > ownerid=3D"RHEL-06-000296" disa=3D"804" severity=3D"low"> >> + >> All accounts on the system must have unique user or = >> account names >> >> > ownerid=3D"RHEL-06-000297" disa=3D"16" severity=3D"low"> >> + >> Temporary accounts must be provisioned with an = >> expiration date. >> >> > ownerid=3D"RHEL-06-000298" disa=3D"1682" severity=3D"low"> >> + >> Emergency accounts must be provisioned with an = >> expiration date. >> >> > ruleid=3D"password_require_consecrepeat" ownerid=3D"RHEL-06-000299" = >> disa=3D"366" severity=3D"low"> >> + >> The system must require passwords to contain no more = >> than three consecutive repeating characters. >> >> > ownerid=3D"RHEL-06-000300" disa=3D"224" severity=3D"low"> >> @@ -670,111 +866,146 @@ >> All files must be owned by a group. >> >> > ownerid=3D"RHEL-06-000302" disa=3D"374" severity=3D"medium"> >> + >> A file integrity tool must be used at least weekly = >> to check for unauthorized file changes, particularly the addition of = >> unauthorized system libraries or binaries, or for unauthorized = >> modification to authorized system libraries or binaries. >> >> > ownerid=3D"RHEL-06-000303" disa=3D"416" severity=3D"medium"> >> + >> The operating system must employ automated = >> mechanisms, per organization defined frequency, to detect the = >> addition of unauthorized components/devices into the operating = >> system. >> >> > ownerid=3D"RHEL-06-000304" disa=3D"1069" severity=3D"medium"> >> + >> The operating system must employ automated = >> mechanisms to detect the presence of unauthorized software on = >> organizational information systems and notify designated = >> organizational officials in accordance with the organization defined = >> frequency. >> >> > ownerid=3D"RHEL-06-000305" disa=3D"1263" severity=3D"medium"> >> + >> The operating system must provide a near real-time = >> alert when any of the organization defined list of compromise or = >> potential compromise indicators occurs. >> >> > ownerid=3D"RHEL-06-000306" disa=3D"1297" severity=3D"medium"> >> + >> The operating system must detect unauthorized = >> changes to software and information. >> >> > ownerid=3D"RHEL-06-000307" disa=3D"1589" severity=3D"medium"> >> + >> The operating system must ensure unauthorized, = >> security-relevant configuration changes detected are tracked. >> >> > ownerid=3D"RHEL-06-000308" disa=3D"366" severity=3D"low"> >> + >> Process core dumps must be disabled unless = >> needed. >> >> > ownerid=3D"RHEL-06-000309" disa=3D"764" severity=3D"high"> >> + >> The NFS server must not have the insecure file = >> locking option enabled. >> >> > ruleid=3D"auditd_data_retention_space_left_action" = >> ownerid=3D"RHEL-06-000311" disa=3D"143" severity=3D"medium"> >> + >> The audit system must provide a warning when = >> allocated audit record storage volume reaches a documented percentage = >> of maximum audit record storage capacity. >> >> > ruleid=3D"auditd_data_retention_action_mail_acct" = >> ownerid=3D"RHEL-06-000313" disa=3D"139" severity=3D"medium"> >> + >> The audit system must identify staff members to = >> receive notifications of audit log storage volume capacity = >> issues. >> >> > ruleid=3D"kernel_module_bluetooth_disabled" ownerid=3D"RHEL-06-000315" = >> disa=3D"85" severity=3D"medium"> >> + >> The Bluetooth kernel module must be disabled. >> >> > ruleid=3D"kernel_module_usb-storage_disabled" ownerid=3D"RHEL-06-000317" = >> disa=3D"1250" severity=3D"medium"> >> The system must have USB Mass Storage disabled = >> unless needed. >> >> > ruleid=3D"accounts_max_concurrent_login_sessions" = >> ownerid=3D"RHEL-06-000319" disa=3D"54" severity=3D"low"> >> + >> The system must limit users to 10 simultaneous = >> system logins, or a site-defined number, in accordance with = >> operational requirements. >> >> > ruleid=3D"set_iptables_default_rule_forward" ownerid=3D"RHEL-06-000320" = >> disa=3D"1109" severity=3D"medium"> >> + >> The system's local firewall must implement a = >> deny-all, allow-by-exception policy for forwarded packets. >> >> > ownerid=3D"RHEL-06-000321" disa=3D"1130" severity=3D"low"> >> + >> The system must provide VPN connectivity for = >> communications over untrusted networks. >> >> > ownerid=3D"RHEL-06-000324" disa=3D"50" severity=3D"medium"> >> + >> A login banner must be displayed immediately prior = >> to, or as part of, graphical desktop environment login prompts. >> >> > ownerid=3D"RHEL-06-000326" disa=3D"1384, 1385, 1386, 1387, 1388" = >> severity=3D"medium"> >> + >> The Department of Defense (DoD) login banner must be = >> displayed immediately prior to, or as part of, graphical desktop = >> environment login prompts. >> >> > ownerid=3D"RHEL-06-000331" disa=3D"85" severity=3D"medium"> >> + >> The Bluetooth service must be disabled. >> >> > ruleid=3D"account_disable_post_pw_expiration" ownerid=3D"RHEL-06-000334" = >> disa=3D"17" severity=3D"low"> >> + >> Accounts must be locked upon 35 days of = >> inactivity. >> >> > ruleid=3D"account_disable_post_pw_expiration" ownerid=3D"RHEL-06-000335" = >> disa=3D"795" severity=3D"low"> >> + >> The operating system must manage information system = >> identifiers for users and devices by disabling the user identifier = >> after an organization defined time period of inactivity. >> >> > ownerid=3D"RHEL-06-000336" disa=3D"366" severity=3D"low"> >> + >> The sticky bit must be set on all public = >> directories. >> >> > ruleid=3D"world_writable_files_system_ownership" = >> ownerid=3D"RHEL-06-000337" disa=3D"366" severity=3D"low"> >> + >> All public directories must be owned by a system = >> account. >> >> > ownerid=3D"RHEL-06-000338" disa=3D"366" severity=3D"high"> >> + >> The TFTP daemon must operate in "secure mode" which = >> provides access only to a single directory on the host file = >> system. >> >> > ownerid=3D"RHEL-06-000339" disa=3D"130" severity=3D"low"> >> + >> The FTP daemon must be configured for logging or = >> verbose mode. >> >> > ownerid=3D"RHEL-06-000340" disa=3D"366" severity=3D"medium"> >> + >> The snmpd service must use only SNMP protocol = >> version 3 or newer. >> >> > ownerid=3D"RHEL-06-000341" disa=3D"366" severity=3D"high"> >> + >> The snmpd service must not use a default = >> password. >> >> > ownerid=3D"RHEL-06-000342" disa=3D"366" severity=3D"low"> >> + >> The system default umask for the bash shell must be = >> 077. >> >> > ownerid=3D"RHEL-06-000343" disa=3D"366" severity=3D"low"> >> + >> The system default umask for the csh shell must be = >> 077. >> >> > ownerid=3D"RHEL-06-000344" disa=3D"366" severity=3D"low"> >> + >> The system default umask in /etc/profile must be = >> 077. >> >> > ownerid=3D"RHEL-06-000345" disa=3D"366" severity=3D"low"> >> + >> The system default umask in /etc/login.defs must be = >> 077. >> >> > ownerid=3D"RHEL-06-000346" disa=3D"366" severity=3D"low"> >> + >> The system default umask for daemons must be 027 or = >> 022. >> >> > ownerid=3D"RHEL-06-000347" disa=3D"196" severity=3D"medium"> >> + >> There must be no .netrc files on the system. >> >> > ownerid=3D"RHEL-06-000348" disa=3D"48" severity=3D"medium"> >> + >> The FTPS/FTP service on the system must be = >> configured with the Department of Defense (DoD) login banner. >> >> > ownerid=3D"RHEL-06-000349" disa=3D"765" severity=3D"medium"> >> + >> The system must be configured to require the use of = >> a CAC, PIV compliant hardware token, or Alternate Logon Token (ALT) = >> for authentication. >> >> > ruleid=3D"deny_password_attempts_unlock_time" ownerid=3D"RHEL-06-000356" = >> disa=3D"47" severity=3D"medium"> >> + >> The system must require administrator action to = >> unlock an account locked by excessive failed login attempts. >> >> > ruleid=3D"accounts_passwords_pam_fail_interval" = >> ownerid=3D"RHEL-06-000357" disa=3D"1452" severity=3D"medium"> >> + >> The system must disable accounts after excessive = >> login failures within a 15-minute interval. >> >> > ownerid=3D"RHEL-06-000359" disa=3D"20" severity=3D"medium"> >> @@ -823,12 +1054,15 @@ >> The operating system must use internal system clocks = >> to generate time stamps for audit records. >> >> > ownerid=3D"RHEL-06-000383" disa=3D"163" severity=3D"medium"> >> + >> Audit log files must have mode 0640 or less = >> permissive. >> >> > ownerid=3D"RHEL-06-000384" disa=3D"162" severity=3D"medium"> >> + >> Audit log files must be owned by root. >> >> > ownerid=3D"RHEL-06-000385" disa=3D"164" severity=3D"medium"> >> + >> Audit log directories must have mode 0755 or less = >> permissive. >> >> > ownerid=3D"RHEL-06-000387" disa=3D"171" severity=3D"medium"> >> @@ -994,30 +1228,39 @@ >> The operating system must respond to security = >> function anomalies in accordance with organization defined responses = >> and alternative action(s). >> >> > ruleid=3D"kernel_module_usb-storage_disabled" ownerid=3D"RHEL-06-000503" = >> disa=3D"86" severity=3D"medium"> >> + >> The system must have USB Mass Storage disabled = >> unless needed. >> >> > ownerid=3D"RHEL-06-000504" disa=3D"535" severity=3D"medium"> >> + >> The operating system must conduct backups of = >> user-level information contained in the operating system per = >> organization defined frequency to conduct backups consistent with = >> recovery time and recovery point objectives. >> >> > ownerid=3D"RHEL-06-000505" disa=3D"537" severity=3D"medium"> >> + >> The operating system must conduct backups of = >> system-level information contained in the information system per = >> organization defined frequency to conduct backups that are consistent = >> with recovery time and recovery point objectives. >> >> > ownerid=3D"RHEL-06-000506" disa=3D"52" severity=3D"medium"> >> + >> The operating system, upon successful logon, must = >> display to the user the date and time of the last logon or access via = >> a local console or tty. >> >> > ownerid=3D"RHEL-06-000507" disa=3D"52" severity=3D"medium"> >> + >> The operating system, upon successful logon, must = >> display to the user the date and time of the last logon or access via = >> ssh. >> >> > ownerid=3D"RHEL-06-000508" disa=3D"58" severity=3D"low"> >> + >> The system must allow locking of graphical desktop = >> sessions. >> >> > ownerid=3D"RHEL-06-000509" disa=3D"136" severity=3D"low"> >> + >> The system must forward audit records to the syslog = >> service. >> >> > ownerid=3D"RHEL-06-000510" disa=3D"140" severity=3D"medium"> >> + >> The audit system must take appropriate action when = >> the audit storage volume is full. >> >> > ownerid=3D"RHEL-06-000511" disa=3D"140" severity=3D"medium"> >> + >> The audit system must take appropriate action when = >> there are disk errors on the audit storage volume. >> >> > ownerid=3D"RHEL-06-000512" disa=3D"144" severity=3D"medium"> >> @@ -1027,39 +1270,51 @@ >> The audit system must alert designated staff members = >> when audit storage volume is generating disk errors. >> >> > ownerid=3D"RHEL-06-000514" disa=3D"352" severity=3D"high"> >> + >> The RPM package management tool must = >> cryptographically verify the authenticity of all software packages = >> during installation. >> >> > ownerid=3D"RHEL-06-000515" disa=3D"764" severity=3D"low"> >> + >> The NFS server must not have the all_squash option = >> enabled. >> >> > ownerid=3D"RHEL-06-000516" disa=3D"366" severity=3D"low"> >> + >> The system package management tool must verify = >> ownership on all files and directories associated with packages. >> >> > ownerid=3D"RHEL-06-000517" disa=3D"366" severity=3D"low"> >> + >> The system package management tool must verify = >> group-ownership on all files and directories associated with = >> packages. >> >> > ownerid=3D"RHEL-06-000518" disa=3D"366" severity=3D"low"> >> + >> The system package management tool must verify = >> permissions on all files and directories associated with = >> packages. >> >> > ownerid=3D"RHEL-06-000519" disa=3D"366" severity=3D"low"> >> + >> The system package management tool must verify = >> contents of all files associated with packages. >> >> > ownerid=3D"RHEL-06-000521" disa=3D"366" severity=3D"medium"> >> + >> The mail system must forward all mail for root to = >> one or more system administrators. >> >> > ownerid=3D"RHEL-06-000522" disa=3D"162" severity=3D"medium"> >> + >> Audit log files must be group-owned by root. >> >> > ownerid=3D"RHEL-06-000523" disa=3D"66" severity=3D"medium"> >> + >> The system's local IPv6 firewall must implement a = >> deny-all, allow-by-exception policy for inbound packets. >> >> > ownerid=3D"RHEL-06-000524" disa=3D"15" severity=3D"low"> >> + >> The system must provide automated support for = >> account management functions. >> >> > ownerid=3D"RHEL-06-000525" disa=3D"169" severity=3D"low"> >> + >> Auditing must be enabled at boot by setting a kernel = >> parameter. >> >> > ownerid=3D"RHEL-06-000526" disa=3D"366" severity=3D"low"> >> + >> Automated file system mounting tools must not be = >> enabled unless needed. >> >> > ownerid=3D"SRG-OS-000006-NA" disa=3D"21" severity=3D"medium"> > > oh wow. hopefully you found a way to script this =3D/ Incredibly useful! > > We'll have to update the transforms to reflect these, akin to the = > tags.... I'm at SC13 this week. Perhaps someone is feeling = > ambitious? +ack --===============2081371154702086732==--