Red Hat Enterprise Linux 8 Security Technical Implementation Guide :: Version 1, Release: 14 Benchmark Date: 24 Apr 2024
Updated on 2024-07-02
All fix and check commands must be run as root.
The fix snippets listed later make use of the following helper functions:
# paste this block in before running the later fix commands
utils.add_if_missing() {
[[ $# -eq 2 ]] || return
[[ $1 != "${1%/*}" && ! -d ${1%/*} ]] && mkdir -p "${1%/*}"
grep -qsF -- "$2" "$1" || printf '%s\n' "$2" >>"$1"
}
utils.set_sysctl_option() {
[[ $# -eq 2 ]] || return
[[ $(sysctl -n "$1") == "$2" ]] ||
utils.add_if_missing /etc/sysctl.d/99-sysctl.conf "$1 = $2"
}
utils.set_ssh_option() {
[[ $# -eq 1 ]] || return
grep -qrsE -- "^$1" /etc/ssh/sshd_config /etc/ssh/sshd_config.d/* ||
utils.add_if_missing /etc/ssh/sshd_config.d/99-stig.conf "$1"
}
utils.blacklist_kernel_module() {
[[ $# -eq 1 ]] || return
utils.add_if_missing "/etc/modprobe.d/$1.conf" \
"$(printf 'install %s /bin/false\nblacklist %s' "$1" "$1")"
}
utils.add_audit_rule() {
[[ $# -eq 1 ]] || return
grep -qrs -- "$1" /etc/audit/audit.rules /etc/audit/rules.d/* ||
utils.add_if_missing /etc/audit/rules.d/stig.rules "$1"
}
utils.add_kernel_cmdline() {
[[ $# -eq 1 ]] || return
awk -i inplace -v p="$1" '
/CMDLINE/ && $0 !~ p {gsub(/(["'\''])$/, " "p"&")} 1
' /etc/default/grub
grubby --update-kernel=ALL --args="$1"
}
utils.ensure_package_installed() {
[[ $# -eq 1 ]] || return
rpm --quiet -q $1 || dnf -qy install $1
}
utils.ensure_package_removed() {
[[ $# -eq 1 ]] || return
rpm --quiet -q $1 && dnf -qy remove $1
}
utils.get_config_option() {
[[ $# -ge 2 ]] || return
local c='#' a d i=0 r1 r2
while [[ $# -gt 2 ]]; do
[[ $1 == -d ]] && d=$2 && shift 2
[[ $1 == -i ]] && i=1 && shift
done
[[ $# -eq 2 ]] || return
[[ $i -eq 1 ]] && a=$c c=''
r1="^[ \t]*(|${c:-}+.*)$"
r2="^[ \t${a:-}]*${2}[ \t]*${d:-[ \t]+}[ \t]*([^${c:-$a}]*).*$"
awk -v r1="$r1" -v r2="$r2" '$0 !~ r1 && $0 ~ r2 {match($0, r2, m);
gsub(/^[ \t]*|[ \t]*$/, "", m[1]); print m[1]; exit}' "$1"
}
utils.set_config_option() {
[[ $# -ge 3 ]] || return
local a c='#' a d i o r1 r2
while [[ $# -gt 3 ]]; do
[[ $1 == -a ]] && a=1 && shift
[[ $1 == -d ]] && d=$2 && shift 2
[[ $1 == -i ]] && i='-i' && shift
done
[[ $# -eq 3 ]] || return
[[ -f $1 ]] && o=$(utils.get_config_option -d "$d" ${i:-} "$1" "$2")
[[ ${a:-} || ! ${o:-} ]] &&
utils.add_if_missing "$1" "${2}${d:- }${3}" && return
[[ ${i:-} ]] && a=$c c=''
r1="^[ \t]*(|${c:-}+.*)$"
r2="^([ \t${a:-}]*)(${2}[ \t]*${d:-[ \t]+}[ \t]*)([^${c:-$a}]*)(.*)$"
awk -i inplace -v r1="$r1" -v r2="$r2" -v new="$3" '
$0 !~ r1 && $0 ~ r2 && c == 0 {
match($0, r2, m); gsub($0, m[2] new m[4]); c = 1
} 1' "$1"
}
RHEL 8 must be a vendor-supported release.
. /etc/os-release && echo $NAME $VERSION # RHEL 8.x
RHEL 8 must implement NIST FIPS-validated cryptography for the following: To provision digital signatures, to generate cryptographic hashes, and to protect data requiring data-at-rest protections in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.
fips-mode-setup --enable
RHEL 8 operating systems booted with United Extensible Firmware Interface (UEFI) must require authentication upon booting into single-user mode and maintenance.
grub2-set-password
# Follow the prompts to set password
RHEL 8 operating systems booted with a BIOS must require authentication upon booting into single-user and maintenance modes.
# Not applicable on UEFI systems
RHEL 8 must prevent the installation of software, patches, service packs, device drivers, or operating system components from a repository without verification they have been digitally signed using a certificate that is issued by a Certificate Authority (CA) that is recognized and approved by the organization.
sed -i 's/gpgcheck\s*=.*/gpgcheck=1/g' /etc/yum.repos.d/*
RHEL 8 must prevent the installation of software, patches, service packs, device drivers, or operating system components of local packages without verification they have been digitally signed using a certificate that is issued by a Certificate Authority (CA) that is recognized and approved by the organization.
utils.set_config_option -d = /etc/dnf/dnf.conf localpkg_gpgcheck 1
There must be no shosts.equiv files on the RHEL 8 operating system.
find / -name shosts.equiv -delete
There must be no .shosts files on the RHEL 8 operating system.
find / -name '*.shosts' -delete
Unattended or automatic logon via the RHEL 8 graphical user interface must not be allowed.
# no graphical interface installed
RHEL 8 must not allow accounts configured with blank or null passwords.
utils.set_ssh_option 'PermitEmptyPasswords no'
RHEL 8 must not have the telnet-server package installed.
utils.ensure_package_removed telnet-server
RHEL 8 must not have the rsh-server package installed.
utils.ensure_package_removed rsh-server
The x86 Ctrl-Alt-Delete key sequence must be disabled on RHEL 8.
systemctl mask --now ctrl-alt-del.target
The x86 Ctrl-Alt-Delete key sequence in RHEL 8 must be disabled if a graphical user interface is installed.
# no graphical interface installed
The systemd Ctrl-Alt-Delete burst key sequence in RHEL 8 must be disabled.
utils.add_if_missing /etc/systemd/system.conf.d/stig.conf 'CtrlAltDelBurstAction=none'
The Trivial File Transfer Protocol (TFTP) server package must not be installed if not required for RHEL 8 operational support.
utils.ensure_package_removed tftp-server
The root account must be the only account having unrestricted access to the RHEL 8 system.
awk -F: '$3 == 0 {print $1}' /etc/passwd # only root
A File Transfer Protocol (FTP) server package must not be installed unless mission essential on RHEL 8.
utils.ensure_package_removed vsftpd
RHEL 8 must not allow blank or null passwords in the system-auth file.
# Rule not reviewed
RHEL 8 must not allow blank or null passwords in the password-auth file.
# Rule not reviewed
The RHEL 8 operating system must not have accounts configured with blank or null passwords.
# Configured correctly by default
awk -F: '!$2 {print $1}' /etc/shadow
RHEL 8 vendor packaged system security patches and updates must be installed and up to date.
dnf -y update
All RHEL 8 local disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at rest protection.
# Not applicable to VMs
RHEL 8 must display the Standard Mandatory DOD Notice and Consent Banner before granting local or remote access to the system via a ssh logon.
utils.set_ssh_option 'Banner /etc/issue'
RHEL 8 must display the Standard Mandatory DoD Notice and Consent Banner before granting local or remote access to the system via a graphical user logon.
# no graphical interface installed
RHEL 8 must display the Standard Mandatory DoD Notice and Consent Banner before granting local or remote access to the system via a command line user logon.
cat <<'EOF' >/etc/issue
US Department of Defense Warning Statement
You are accessing a U.S. Government (USG) Information System (IS) that is
provided for USG-authorized use only. By using this IS (which includes any
device attached to this IS), you consent to the following conditions:
-The USG routinely intercepts and monitors communications on this IS for
purposes including, but not limited to, penetration testing, COMSEC monitoring,
network operations and defense, personnel misconduct (PM), law enforcement
(LE), and counterintelligence (CI) investigations.
-At any time, the USG may inspect and seize data stored on this IS.
-Communications using, or data stored on, this IS are not private, are subject
to routine monitoring, interception, and search, and may be disclosed or used
for any USG-authorized purpose.
-This IS includes security measures (e.g., authentication and access controls)
to protect USG interests -- not for your personal benefit or privacy.
-Notwithstanding the above, using this IS does not constitute consent to PM, LE
or CI investigative searching or monitoring of the content of privileged
communications, or work product, related to personal representation or services
by attorneys, psychotherapists, or clergy, and their assistants. Such
communications and work product are private and confidential. See User
Agreement for details.
EOF
All RHEL 8 remote access methods must be monitored.
utils.add_if_missing /etc/rsyslog.d/stig.conf 'auth.*;authpriv.*;daemon.* /var/log/secure'
RHEL 8, for PKI-based authentication, must validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor.
# Rule not reviewed
RHEL 8, for certificate-based authentication, must enforce authorized access to the corresponding private key.
# no key files in baseline
RHEL 8 must encrypt all stored passwords with a FIPS 140-2 approved cryptographic hashing algorithm.
utils.set_config_option /etc/login.defs ENCRYPT_METHOD SHA512
RHEL 8 must employ FIPS 140-2 approved cryptographic hashing algorithms for all stored passwords.
# configured correctly by default
awk -F: '$2 !~ /[!\*]+/ {print $2}' /etc/shadow
The RHEL 8 shadow password suite must be configured to use a sufficient number of hashing rounds.
utils.set_config_option /etc/login.defs SHA_CRYPT_MIN_ROUNDS 5000
RHEL 8 operating systems must require authentication upon booting into rescue mode.
# set by default
grep sulogin /usr/lib/systemd/system/rescue.service
The RHEL 8 pam_unix.so module must be configured in the password-auth file to use a FIPS 140-2 approved cryptographic hashing algorithm for system authentication.
# Rule not reviewed
RHEL 8 must prevent system daemons from using Kerberos for authentication.
# No keytabs installed by default
ls -al /etc/*.keytab
The krb5-workstation package must not be installed on RHEL 8.
utils.ensure_package_removed krb5-workstation
RHEL 8 must use a Linux Security Module configured to enforce limits on system services.
sed -i 's/SELINUX\s*=.*/SELINUX=enforcing/g' /etc/selinux/config
A sticky bit must be set on all RHEL 8 public directories to prevent unauthorized and unintended information transferred via shared system resources.
# permissions correct by default
find / -type d -perm -0002 ! -perm -1000
RHEL 8 must be configured so that all network connections associated with SSH traffic terminate after becoming unresponsive.
utils.set_ssh_option 'ClientAliveCountMax 1'
The RHEL 8 /var/log/messages file must have mode 0640 or less permissive.
# permissions correct by default
ls -la /var/log/messages
The RHEL 8 /var/log/messages file must be owned by root.
# permissions correct by default
ls -la /var/log/messages
The RHEL 8 /var/log/messages file must be group-owned by root.
# permissions correct by default
ls -la /var/log/messages
The RHEL 8 /var/log directory must have mode 0755 or less permissive.
# permissions correct by default
ls -ld /var/log
The RHEL 8 /var/log directory must be owned by root.
# permissions correct by default
ls -ld /var/log
The RHEL 8 /var/log directory must be group-owned by root.
# permissions correct by default
ls -ld /var/log
The RHEL 8 SSH server must be configured to use only Message Authentication Codes (MACs) employing FIPS 140-2 validated cryptographic hash algorithms.
# configured by default
grep MACs /etc/crypto-policies/back-ends/openssh.config
The RHEL 8 operating system must implement DoD-approved encryption to protect the confidentiality of SSH server connections.
# configured by default
grep Ciphers /etc/crypto-policies/back-ends/openssh.config
The RHEL 8 operating system must implement DoD-approved encryption in the OpenSSL package.
fips-mode-setup --enable
The RHEL 8 operating system must implement DoD-approved TLS encryption in the OpenSSL package.
update-crypto-policies --show # FIPS
The RHEL 8 operating system must implement DoD-approved TLS encryption in the GnuTLS package.
update-crypto-policies --show # FIPS
RHEL 8 system commands must have mode 755 or less permissive.
# permissions correct by default
find -L /usr{/local,}/{s,}bin /usr/libexec -perm /022 -exec ls -l {} \;
RHEL 8 system commands must be owned by root.
# permissions correct by default
find -L /usr{/local,}/{s,}bin /usr/libexec ! -user root -exec ls -l {} \;
RHEL 8 system commands must be group-owned by root or a system account.
# permissions correct by default
find -L /usr{/local,}/{s,}bin /usr/libexec ! -group root -exec ls -l {} \;
RHEL 8 library files must have mode 755 or less permissive.
# permissions correct by default
find -L /usr/lib{64,} -perm /022 -type f -exec ls -l {} \;
RHEL 8 library files must be owned by root.
# permissions correct by default
find -L /usr/lib{64,} ! -user root -type f -exec ls -l {} \;
RHEL 8 library files must be group-owned by root or a system account.
# permissions correct by default
find -L /usr/lib{64,} ! -group root -type f -exec ls -l {} \;
The RHEL 8 file integrity tool must notify the system administrator when changes to the baseline configuration or anomalies in the operation of any security functions are discovered within an organizationally defined frequency.
cat <<'EOF' >/etc/cron.daily/aide
#!/bin/bash
/usr/sbin/aide --check | /bin/mail -s "$HOSTNAME - Daily aide integrity check run" root@sysname.mil
EOF
RHEL 8 must prevent the loading of a new kernel for later execution.
utils.set_sysctl_option kernel.kexec_load_disabled 1
RHEL 8 must enable kernel parameters to enforce discretionary access control on symlinks.
utils.set_sysctl_option fs.protected_symlinks 1
RHEL 8 must enable kernel parameters to enforce discretionary access control on hardlinks.
utils.set_sysctl_option fs.protected_hardlinks 1
RHEL 8 must require users to provide a password for privilege escalation.
# configured correctly by default
grep -ri nopasswd /etc/sudoers /etc/sudoers.d/*
RHEL 8 must require users to reauthenticate for privilege escalation.
# Configured correctly by default
grep -ir '!authenticate' /etc/sudoers /etc/sudoers.d/*
RHEL 8 must have the packages required for multifactor authentication installed.
utils.ensure_package_installed openssl-pkcs11
RHEL 8 must implement certificate status checking for multifactor authentication.
# Rule not reviewed
RHEL 8 must accept Personal Identity Verification (PIV) credentials.
utils.ensure_package_installed opensc
RHEL 8 must implement non-executable data to protect its memory from unauthorized code execution.
# enabled by default
dmesg | grep '[NX|DX]*protection'
RHEL 8 must clear the page allocator to prevent use-after-free attacks.
utils.add_kernel_cmdline 'page_poison=1'
RHEL 8 must disable virtual syscalls.
utils.add_kernel_cmdline 'vsyscall=none'
RHEL 8 must clear SLUB/SLAB objects to prevent use-after-free attacks.
utils.add_kernel_cmdline 'slub_debug=P'
RHEL 8 must implement address space layout randomization (ASLR) to protect its memory from unauthorized code execution.
utils.set_sysctl_option kernel.randomize_va_space 2
RHEL 8 must enable the SELinux targeted policy.
# Targeted policy is default
grep SELINUXTYPE /etc/selinux/config
The RHEL 8 SSH public host key files must have mode 0644 or less permissive.
# permissions correct by default
ls -l /etc/ssh/*.pub
The RHEL 8 SSH private host key files must have mode 0640 or less permissive.
# permissions correct by default
ls -l /etc/ssh/*_key
The RHEL 8 SSH daemon must perform strict mode checking of home directory configuration files.
utils.set_ssh_option 'StrictModes yes'
The RHEL 8 SSH daemon must not allow authentication using known host’s authentication.
utils.set_ssh_option 'IgnoreUserKnownHosts yes'
The RHEL 8 SSH daemon must not allow Kerberos authentication, except to fulfill documented and validated mission requirements.
utils.set_ssh_option 'KerberosAuthentication no'
A separate RHEL 8 filesystem must be used for the /tmp directory.
# Already implemented during install
mountpoint /tmp
RHEL 8 must not permit direct logons to the root account using remote access via SSH.
utils.set_ssh_option 'PermitRootLogin no'
The rsyslog service must be running in RHEL 8.
# enabled by default
systemctl -q is-active rsyslog || systemctl enable --now rsyslog
RHEL 8 must prevent files with the setuid and setgid bit set from being executed on file systems that contain user home directories.
# Already implemented during install
mount | grep /home
RHEL 8 must prevent files with the setuid and setgid bit set from being executed on the /boot directory.
# Already implemented during install
mount | grep /home
RHEL 8 must prevent special devices on non-root local partitions.
mount | awk '$1 ~ /\/dev/ && $6 !~ /nodev/'
RHEL 8 must prevent code from being executed on file systems that contain user home directories.
# Already implemented during install
mount | grep /home
RHEL 8 must prevent special devices on file systems that are used with removable media.
# no removable media mounts present
RHEL 8 must prevent code from being executed on file systems that are used with removable media.
# no removable media mounts present
RHEL 8 must prevent files with the setuid and setgid bit set from being executed on file systems that are used with removable media.
# no removable media mounts present
RHEL 8 must prevent code from being executed on file systems that are imported via Network File System (NFS).
# no NFS mounts present
RHEL 8 must prevent special devices on file systems that are imported via Network File System (NFS).
# no NFS mounts present
RHEL 8 must prevent files with the setuid and setgid bit set from being executed on file systems that are imported via Network File System (NFS).
# no NFS mounts present
Local RHEL 8 initialization files must not execute world-writable programs.
# correctly configured by default
find /home -perm -002 -type f -name ".[^.]*" -exec ls -ld {} \;
RHEL 8 must disable kernel dumps unless needed.
systemctl mask --now kdump
RHEL 8 must disable the kernel.core_pattern.
utils.set_sysctl_option kernel.core_pattern '|/bin/false'
RHEL 8 must disable acquiring, saving, and processing core dumps.
systemctl mask --now systemd-coredump.socket
RHEL 8 must disable core dumps for all users.
utils.add_if_missing /etc/security/limits.d/stig.conf '* hard core 0'
RHEL 8 must disable storing core dumps.
utils.add_if_missing /etc/systemd/coredump.conf.d/stig.conf 'Storage=none'
RHEL 8 must disable core dump backtraces.
utils.add_if_missing /etc/systemd/coredump.conf.d/stig.conf 'ProcessSizeMax=0'
For RHEL 8 systems using Domain Name Servers (DNS) resolution, at least two name servers must be configured.
# nameservers set via DHCP
grep nameserver /etc/resolv.conf
Executable search paths within the initialization files of all local interactive RHEL 8 users must only contain paths that resolve to the system default or the users home directory.
# correctly configured by default
grep -si path= /home/*/.*
All RHEL 8 world-writable directories must be owned by root, sys, bin, or an application user.
# permissions correct by default
df --local -P | awk '{if (NR!=1) print $6}' |
xargs -I_ find _ -xdev -type d -perm -0002 -uid +0 -print
All RHEL 8 world-writable directories must be group-owned by root, sys, bin, or an application group.
# permissions correct by default
df --local -P | awk '{if (NR!=1) print $6}' |
xargs -I_ find _ -xdev -type d -perm -0002 -gid +0 -print
All RHEL 8 local interactive users must have a home directory assigned in the /etc/passwd file.
# correctly configured by default
awk -F: '$3 >= 1000 && $7 !~ /nologin/ {print $1, $3, $6}' /etc/passwd
All RHEL 8 local interactive user home directories must have mode 0750 or less permissive.
awk -F: '$3 >= 1000 && $7 !~ /nologin/ {print $6}' /etc/passwd |
xargs -l chmod 0750
All RHEL 8 local interactive user home directories must be group-owned by the home directory owner’s primary group.
# correctly configured by default
awk -F: '$3 >= 1000 && $7 !~ /nologin/ {print $6}' /etc/passwd
All RHEL 8 local interactive user home directories defined in the /etc/passwd file must exist.
# correctly configured by default
pwck -r
All RHEL 8 local interactive user accounts must be assigned a home directory upon creation.
utils.set_config_option /etc/login.defs CREATE_HOME yes
All RHEL 8 local initialization files must have mode 0740 or less permissive.
awk -F: '$3 >= 1000 && $7 !~ /nologin/ {print $6}' /etc/passwd |
xargs -I_ find _ -maxdepth 1 -exec chmod g-w,o-rwx "{}" \;
All RHEL 8 local files and directories must have a valid owner.
# All ownership valid in the baseline
df --local -P | awk '{if (NR!=1) print $6}' | xargs -I_ find _ -xdev -nouser
All RHEL 8 local files and directories must have a valid group owner.
# All ownership valid in the baseline
df --local -P | awk '{if (NR!=1) print $6}' | xargs -I_ find _ -xdev -nogroup
A separate RHEL 8 filesystem must be used for user home directories (such as /home or an equivalent).
# Already implemented during install
mountpoint /home
RHEL 8 must not allow users to override SSH environment variables.
utils.set_ssh_option 'PermitUserEnvironment no'
RHEL 8 temporary user accounts must be provisioned with an expiration time of 72 hours or less.
# no temp accounts exist by default
RHEL 8 must automatically lock an account when three unsuccessful logon attempts occur.
# Rule not reviewed
RHEL 8 must automatically lock an account when three unsuccessful logon attempts occur.
utils.set_config_option -i -d = /etc/security/faillock.conf deny 3
RHEL 8 must automatically lock an account when three unsuccessful logon attempts occur during a 15-minute time period.
# Rule not reviewed
RHEL 8 must automatically lock an account when three unsuccessful logon attempts occur during a 15-minute time period.
utils.set_config_option -i -d = /etc/security/faillock.conf fail_interval 900
RHEL 8 must automatically lock an account until the locked account is released by an administrator when three unsuccessful logon attempts occur during a 15-minute time period.
# Rule not reviewed
RHEL 8 must automatically lock an account until the locked account is released by an administrator when three unsuccessful logon attempts occur during a 15-minute time period.
utils.set_config_option -i -d = /etc/security/faillock.conf unlock_time 0
RHEL 8 must ensure account lockouts persist.
# Rule not reviewed
RHEL 8 must ensure account lockouts persist.
utils.set_config_option -i -d = /etc/security/faillock.conf dir /var/log/faillock
RHEL 8 must prevent system messages from being presented when three unsuccessful logon attempts occur.
# Rule not reviewed
RHEL 8 must prevent system messages from being presented when three unsuccessful logon attempts occur.
utils.set_config_option -i /etc/security/faillock.conf silent ''
RHEL 8 must log user name information when unsuccessful logon attempts occur.
# Rule not reviewed
RHEL 8 must log user name information when unsuccessful logon attempts occur.
utils.set_config_option -i /etc/security/faillock.conf audit ''
RHEL 8 must include root when automatically locking an account until the locked account is released by an administrator when three unsuccessful logon attempts occur during a 15-minute time period.
# Rule not reviewed
RHEL 8 must include root when automatically locking an account until the locked account is released by an administrator when three unsuccessful logon attempts occur during a 15-minute time period.
utils.set_config_option -i /etc/security/faillock.conf even_deny_root ''
RHEL 8 must enable a user session lock until that user re-establishes access using established identification and authentication procedures for graphical user sessions.
# no graphical interface installed
RHEL 8 must enable a user session lock until that user re-establishes access using established identification and authentication procedures for command line sessions.
utils.add_if_missing /etc/tmux.conf 'set -g lock-command vlock'
utils.add_if_missing /etc/tmux.conf 'bind X lock-session'
RHEL 8 must ensure session control is automatically started at shell initialization.
cat <<'EOF' >/etc/profile.d/tmux.sh
#!/bin/bash
[[ -n $PS1 && -z $TMUX && -z $DISPLAY && ! $(pstree -s $$) =~ tmux|sudo ]] && exec tmux new -As0
EOF
RHEL 8 must be able to initiate directly a session lock for all connection types using smartcard when the smartcard is removed.
# no graphical interface installed
RHEL 8 must automatically lock graphical user sessions after 15 minutes of inactivity.
# no graphical interface installed
RHEL 8 must automatically lock command line user sessions after 15 minutes of inactivity.
utils.add_if_missing /etc/tmux.conf 'set -g lock-after-time 900'
RHEL 8 must prevent a user from overriding the session lock-delay setting for the graphical user interface.
# no graphical interface installed
RHEL 8 must map the authenticated identity to the user or group account for PKI-based authentication.
# Rule not reviewed
RHEL 8 must ensure the password complexity module is enabled in the password-auth file.
# Rule not reviewed
RHEL 8 must enforce password complexity by requiring that at least one uppercase character be used.
utils.set_config_option -i -d = /etc/security/pwquality.conf ucredit '-1'
RHEL 8 must enforce password complexity by requiring that at least one lower-case character be used.
utils.set_config_option -i -d = /etc/security/pwquality.conf lcredit '-1'
RHEL 8 must enforce password complexity by requiring that at least one numeric character be used.
utils.set_config_option -i -d = /etc/security/pwquality.conf dcredit '-1'
RHEL 8 must require the maximum number of repeating characters of the same character class be limited to four when passwords are changed.
utils.set_config_option -i -d = /etc/security/pwquality.conf maxclassrepeat 4
RHEL 8 must require the maximum number of repeating characters be limited to three when passwords are changed.
utils.set_config_option -i -d = /etc/security/pwquality.conf maxrepeat 3
RHEL 8 must require the change of at least four character classes when passwords are changed.
utils.set_config_option -i -d = /etc/security/pwquality.conf minclass 4
RHEL 8 must require the change of at least 8 characters when passwords are changed.
utils.set_config_option -i -d = /etc/security/pwquality.conf difok 8
RHEL 8 passwords must have a 24 hours/1 day minimum password lifetime restriction in /etc/shadow.
# Set correctly on the default account
awk -F: '$3 >= 1000 && $3 < 65534 {print $1}' /etc/passwd |
xargs -I{} awk -F: -v u="{}" '$1 == u {print $1 " " $4}' /etc/shadow
RHEL 8 passwords for new users or password changes must have a 24 hours/1 day minimum password lifetime restriction in /etc/login.defs.
utils.set_config_option /etc/login.defs PASS_MIN_DAYS 1
RHEL 8 user account passwords must have a 60-day maximum password lifetime restriction.
utils.set_config_option /etc/login.defs PASS_MAX_DAYS 60
RHEL 8 user account passwords must be configured so that existing passwords are restricted to a 60-day maximum lifetime.
# correctly configured by default
awk -F: '$5 <= 0 {print $1 "" "" $5}' /etc/shadow
RHEL 8 must be configured in the password-auth file to prohibit password reuse for a minimum of five generations.
# Rule not reviewed
RHEL 8 passwords must have a minimum of 15 characters.
utils.set_config_option -i -d = /etc/security/pwquality.conf minlen '15'
RHEL 8 passwords for new users must have a minimum of 15 characters.
utils.set_config_option /etc/login.defs PASS_MIN_LEN 15
RHEL 8 duplicate User IDs (UIDs) must not exist for interactive users.
# correctly configured by default
awk -F ":" 'list[$3]++ {print $1, $3}' /etc/passwd
RHEL 8 must implement smart card logon for multifactor authentication for access to interactive accounts.
# Rule not reviewed
RHEL 8 account identifiers (individuals, groups, roles, and devices) must be disabled after 35 days of inactivity.
useradd -D -f 35
RHEL 8 must automatically expire temporary accounts within 72 hours.
# no temp accounts exist by default
All RHEL 8 passwords must contain at least one special character.
utils.set_config_option -i -d = /etc/security/pwquality.conf ocredit '-1'
RHEL 8 must prohibit the use of cached authentications after one day.
# Rule not reviewed
RHEL 8 must prevent the use of dictionary words for passwords.
utils.set_config_option -i -d = /etc/security/pwquality.conf dictcheck 1
RHEL 8 must enforce a delay of at least four seconds between logon prompts following a failed logon attempt.
utils.set_config_option /etc/login.defs FAIL_DELAY 4
RHEL 8 must not have unnecessary accounts.
# correctly configured by default
awk -F: '$3 >= 1000 && $7 !~ /nologin/ {print $6}' /etc/passwd
RHEL 8 must display the date and time of the last successful account logon upon an SSH logon.
utils.set_ssh_option 'PrintLastLog yes'
RHEL 8 must define default permissions for all authenticated users in such a way that the user can only read and modify their own files.
utils.set_config_option /etc/login.defs UMASK 077
RHEL 8 must set the umask value to 077 for all local interactive user accounts.
# no umask in user profiles by default
RHEL 8 must define default permissions for logon and non-logon shells.
utils.add_if_missing /etc/profile.d/umask.sh 'umask 077'
utils.add_if_missing /etc/profile.d/umask.csh 'umask 077'
The RHEL 8 audit system must be configured to audit the execution of privileged functions and prevent all software from executing at higher privilege levels than users executing the software.
utils.add_audit_rule -a always,exit -F arch=b32 -S execve -C uid!=euid -F euid=0 -k execpriv
utils.add_audit_rule -a always,exit -F arch=b64 -S execve -C uid!=euid -F euid=0 -k execpriv
utils.add_audit_rule -a always,exit -F arch=b32 -S execve -C gid!=egid -F egid=0 -k execpriv
utils.add_audit_rule -a always,exit -F arch=b64 -S execve -C gid!=egid -F egid=0 -k execpriv
Cron logging must be implemented in RHEL 8.
# configured correctly by default
grep -s cron /etc/rsyslog.conf /etc/rsyslog.d/*.conf
The RHEL 8 System Administrator (SA) and Information System Security Officer (ISSO) (at a minimum) must be alerted of an audit processing failure event.
utils.set_config_option -d = /etc/audit/auditd.conf action_mail_acct root
The RHEL 8 Information System Security Officer (ISSO) and System Administrator (SA) (at a minimum) must have mail aliases to be notified of an audit processing failure.
# Postfix package is not installed
The RHEL 8 System must take appropriate action when an audit processing failure occurs.
utils.set_config_option -d = /etc/audit/auditd.conf disk_error_action SYSLOG
The RHEL 8 audit system must take appropriate action when the audit storage volume is full.
utils.set_config_option -d = /etc/audit/auditd.conf disk_full_action SYSLOG
The RHEL 8 audit system must audit local events.
utils.set_config_option -d = /etc/audit/auditd.conf local_events yes
RHEL 8 must label all off-loaded audit logs before sending them to the central log server.
utils.set_config_option -d = /etc/audit/auditd.conf name_format hostname
RHEL 8 audit logs must have a mode of 0600 or less permissive to prevent unauthorized read access.
# permissions correct by default
ls -l /var/log/audit/audit.log
RHEL 8 audit logs must be owned by root to prevent unauthorized read access.
# permissions correct by default
ls -l /var/log/audit/audit.log
RHEL 8 audit logs must be group-owned by root to prevent unauthorized read access.
# permissions correct by default
ls -l /var/log/audit/audit.log
RHEL 8 audit log directory must be owned by root to prevent unauthorized read access.
# permissions correct by default
ls -ld /var/log/audit
RHEL 8 audit log directory must be group-owned by root to prevent unauthorized read access.
# permissions correct by default
ls -ld /var/log/audit
RHEL 8 audit log directory must have a mode of 0700 or less permissive to prevent unauthorized read access.
# permissions correct by default
ls -ld /var/log/audit
RHEL 8 audit system must protect auditing rules from unauthorized change.
utils.add_audit_rule '-e 2'
RHEL 8 audit system must protect logon UIDs from unauthorized change.
utils.add_audit_rule '--loginuid-immutable'
RHEL 8 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/shadow.
utils.add_audit_rule '-w /etc/shadow -p wa -k identity'
RHEL 8 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/security/opasswd.
utils.add_audit_rule '-w /etc/security/opasswd -p wa -k identity'
RHEL 8 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/passwd.
utils.add_audit_rule '-w /etc/passwd -p wa -k identity'
RHEL 8 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/gshadow.
utils.add_audit_rule '-w /etc/gshadow -p wa -k identity'
RHEL 8 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/group.
utils.add_audit_rule '-w /etc/group -p wa -k identity'
RHEL 8 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/sudoers.
utils.add_audit_rule '-w /etc/sudoers -p wa -k identity'
RHEL 8 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/sudoers.d/.
utils.add_audit_rule '-w /etc/sudoers.d/ -p wa -k identity'
The RHEL 8 audit package must be installed.
utils.ensure_package_installed audit
Successful/unsuccessful uses of the su command in RHEL 8 must generate an audit record.
utils.add_audit_rule '-a always,exit -F path=/usr/bin/su -F perm=x -F auid>=1000 -F auid!=unset -k privileged-priv_change'
The RHEL 8 audit system must be configured to audit any usage of the setxattr, fsetxattr, lsetxattr, removexattr, fremovexattr, and lremovexattr system calls.
utils.add_audit_rule '-a always,exit -F arch=b32 -S setxattr,fsetxattr,lsetxattr,removexattr,fremovexattr,lremovexattr -F auid>=1000 -F auid!=unset -k perm_mod'
utils.add_audit_rule '-a always,exit -F arch=b64 -S setxattr,fsetxattr,lsetxattr,removexattr,fremovexattr,lremovexattr -F auid>=1000 -F auid!=unset -k perm_mod'
utils.add_audit_rule '-a always,exit -F arch=b32 -S setxattr,fsetxattr,lsetxattr,removexattr,fremovexattr,lremovexattr -F auid=0 -k perm_mod'
utils.add_audit_rule '-a always,exit -F arch=b64 -S setxattr,fsetxattr,lsetxattr,removexattr,fremovexattr,lremovexattr -F auid=0 -k perm_mod'
Successful/unsuccessful uses of the chage command in RHEL 8 must generate an audit record.
utils.add_audit_rule '-a always,exit -F path=/usr/bin/chage -F perm=x -F auid>=1000 -F auid!=unset -k privileged-chage'
Successful/unsuccessful uses of the chcon command in RHEL 8 must generate an audit record.
utils.add_audit_rule '-a always,exit -F path=/usr/bin/chcon -F perm=x -F auid>=1000 -F auid!=unset -k perm_mod'
Successful/unsuccessful uses of the ssh-agent in RHEL 8 must generate an audit record.
utils.add_audit_rule '-a always,exit -F path=/usr/bin/ssh-agent -F perm=x -F auid>=1000 -F auid!=unset -k privileged-ssh'
Successful/unsuccessful uses of the passwd command in RHEL 8 must generate an audit record.
utils.add_audit_rule '-a always,exit -F path=/usr/bin/passwd -F perm=x -F auid>=1000 -F auid!=unset -k privileged-passwd'
Successful/unsuccessful uses of the mount command in RHEL 8 must generate an audit record.
utils.add_audit_rule '-a always,exit -F path=/usr/bin/mount -F perm=x -F auid>=1000 -F auid!=unset -k privileged-mount'
Successful/unsuccessful uses of the umount command in RHEL 8 must generate an audit record.
utils.add_audit_rule '-a always,exit -F path=/usr/bin/umount -F perm=x -F auid>=1000 -F auid!=unset -k privileged-mount'
Successful/unsuccessful uses of the mount syscall in RHEL 8 must generate an audit record.
utils.add_audit_rule '-a always,exit -F arch=b32 -S mount -F auid>=1000 -F auid!=unset -k privileged-mount'
utils.add_audit_rule '-a always,exit -F arch=b64 -S mount -F auid>=1000 -F auid!=unset -k privileged-mount'
Successful/unsuccessful uses of the unix_update in RHEL 8 must generate an audit record.
utils.add_audit_rule '-a always,exit -F path=/usr/sbin/unix_update -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update'
Successful/unsuccessful uses of postdrop in RHEL 8 must generate an audit record.
utils.add_audit_rule '-a always,exit -F path=/usr/sbin/postdrop -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update'
Successful/unsuccessful uses of postqueue in RHEL 8 must generate an audit record.
utils.add_audit_rule '-a always,exit -F path=/usr/sbin/postqueue -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update'
Successful/unsuccessful uses of semanage in RHEL 8 must generate an audit record.
utils.add_audit_rule '-a always,exit -F path=/usr/sbin/semanage -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update'
Successful/unsuccessful uses of setfiles in RHEL 8 must generate an audit record.
utils.add_audit_rule '-a always,exit -F path=/usr/sbin/setfiles -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update'
Successful/unsuccessful uses of userhelper in RHEL 8 must generate an audit record.
utils.add_audit_rule '-a always,exit -F path=/usr/sbin/userhelper -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update'
Successful/unsuccessful uses of setsebool in RHEL 8 must generate an audit record.
utils.add_audit_rule '-a always,exit -F path=/usr/sbin/setsebool -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update'
Successful/unsuccessful uses of unix_chkpwd in RHEL 8 must generate an audit record.
utils.add_audit_rule '-a always,exit -F path=/usr/sbin/unix_chkpwd -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update'
Successful/unsuccessful uses of the ssh-keysign in RHEL 8 must generate an audit record.
utils.add_audit_rule '-a always,exit -F path=/usr/libexec/openssh/ssh-keysign -F perm=x -F auid>=1000 -F auid!=unset -k privileged-ssh'
Successful/unsuccessful uses of the setfacl command in RHEL 8 must generate an audit record.
utils.add_audit_rule '-a always,exit -F path=/usr/bin/setfacl -F perm=x -F auid>=1000 -F auid!=unset -k perm_mod'
Successful/unsuccessful uses of the pam_timestamp_check command in RHEL 8 must generate an audit record.
utils.add_audit_rule '-a always,exit -F path=/usr/sbin/pam_timestamp_check -F perm=x -F auid>=1000 -F auid!=unset -k privileged-pam_timestamp_check'
Successful/unsuccessful uses of the newgrp command in RHEL 8 must generate an audit record.
utils.add_audit_rule '-a always,exit -F path=/usr/bin/newgrp -F perm=x -F auid>=1000 -F auid!=unset -k priv_cmd'
Successful/unsuccessful uses of the init_module and finit_module system calls in RHEL 8 must generate an audit record.
utils.add_audit_rule '-a always,exit -F arch=b32 -S init_module,finit_module -F auid>=1000 -F auid!=unset -k module_chng'
utils.add_audit_rule '-a always,exit -F arch=b64 -S init_module,finit_module -F auid>=1000 -F auid!=unset -k module_chng'
Successful/unsuccessful uses of the rename, unlink, rmdir, renameat, and unlinkat system calls in RHEL 8 must generate an audit record.
utils.add_audit_rule '-a always,exit -F arch=b32 -S rename,unlink,rmdir,renameat,unlinkat -F auid>=1000 -F auid!=unset -k delete'
utils.add_audit_rule '-a always,exit -F arch=b64 -S rename,unlink,rmdir,renameat,unlinkat -F auid>=1000 -F auid!=unset -k delete'
Successful/unsuccessful uses of the gpasswd command in RHEL 8 must generate an audit record.
utils.add_audit_rule '-a always,exit -F path=/usr/bin/gpasswd -F perm=x -F auid>=1000 -F auid!=unset -k privileged-gpasswd'
Successful/unsuccessful uses of the delete_module command in RHEL 8 must generate an audit record.
utils.add_audit_rule '-a always,exit -F arch=b32 -S delete_module -F auid>=1000 -F auid!=unset -k module_chng'
utils.add_audit_rule '-a always,exit -F arch=b64 -S delete_module -F auid>=1000 -F auid!=unset -k module_chng'
Successful/unsuccessful uses of the crontab command in RHEL 8 must generate an audit record.
utils.add_audit_rule '-a always,exit -F path=/usr/bin/crontab -F perm=x -F auid>=1000 -F auid!=unset -k privileged-crontab'
Successful/unsuccessful uses of the chsh command in RHEL 8 must generate an audit record.
utils.add_audit_rule '-a always,exit -F path=/usr/bin/chsh -F perm=x -F auid>=1000 -F auid!=unset -k priv_cmd'
Successful/unsuccessful uses of the truncate, ftruncate, creat, open, openat, and open_by_handle_at system calls in RHEL 8 must generate an audit record.
utils.add_audit_rule '-a always,exit -F arch=b32 -S truncate,ftruncate,creat,open,openat,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -k perm_access'
utils.add_audit_rule '-a always,exit -F arch=b64 -S truncate,ftruncate,creat,open,openat,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -k perm_access'
utils.add_audit_rule '-a always,exit -F arch=b32 -S truncate,ftruncate,creat,open,openat,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -k perm_access'
utils.add_audit_rule '-a always,exit -F arch=b64 -S truncate,ftruncate,creat,open,openat,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -k perm_access'
Successful/unsuccessful uses of the chown, fchown, fchownat, and lchown system calls in RHEL 8 must generate an audit record.
utils.add_audit_rule '-a always,exit -F arch=b32 -S chown,fchown,fchownat,lchown -F auid>=1000 -F auid!=unset -k perm_mod'
utils.add_audit_rule '-a always,exit -F arch=b64 -S chown,fchown,fchownat,lchown -F auid>=1000 -F auid!=unset -k perm_mod'
Successful/unsuccessful uses of the chmod, fchmod, and fchmodat system calls in RHEL 8 must generate an audit record.
utils.add_audit_rule '-a always,exit -F arch=b32 -S chmod,fchmod,fchmodat -F auid>=1000 -F auid!=unset -k perm_mod'
utils.add_audit_rule '-a always,exit -F arch=b64 -S chmod,fchmod,fchmodat -F auid>=1000 -F auid!=unset -k perm_mod'
Successful/unsuccessful uses of the sudo command in RHEL 8 must generate an audit record.
utils.add_audit_rule '-a always,exit -F path=/usr/bin/sudo -F perm=x -F auid>=1000 -F auid!=unset -k priv_cmd'
Successful/unsuccessful uses of the usermod command in RHEL 8 must generate an audit record.
utils.add_audit_rule '-a always,exit -F path=/usr/sbin/usermod -F perm=x -F auid>=1000 -F auid!=unset -k privileged-usermod'
Successful/unsuccessful uses of the chacl command in RHEL 8 must generate an audit record.
utils.add_audit_rule '-a always,exit -F path=/usr/bin/chacl -F perm=x -F auid>=1000 -F auid!=unset -k perm_mod'
Successful/unsuccessful uses of the kmod command in RHEL 8 must generate an audit record.
utils.add_audit_rule '-a always,exit -F path=/usr/bin/kmod -F perm=x -F auid>=1000 -F auid!=unset -k modules'
Successful/unsuccessful modifications to the faillock log file in RHEL 8 must generate an audit record.
utils.add_audit_rule '-w /var/log/faillock -p wa -k logins'
Successful/unsuccessful modifications to the lastlog file in RHEL 8 must generate an audit record.
utils.add_audit_rule '-w /var/log/lastlog -p wa -k logins'
RHEL 8 must allow only the Information System Security Manager (ISSM) (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited.
# permissions correct by default
ls -l /etc/audit/auditd.conf /etc/audit/rules.d/*.rules
RHEL 8 audit tools must have a mode of 0755 or less permissive.
# permissions correct by default
ls -la /sbin/{auditctl,aureport,ausearch,autrace,auditd,rsyslogd,augenrules}
RHEL 8 audit tools must be owned by root.
# permissions correct by default
ls -la /sbin/{auditctl,aureport,ausearch,autrace,auditd,rsyslogd,augenrules}
RHEL 8 audit tools must be group-owned by root.
# permissions correct by default
ls -la /sbin/{auditctl,aureport,ausearch,autrace,auditd,rsyslogd,augenrules}
RHEL 8 must use cryptographic mechanisms to protect the integrity of audit tools.
cat <<'EOF' >>/etc/aide.conf
# STIG V-258137
/usr/sbin/auditctl p+i+n+u+g+s+b+acl+xattrs+sha512
/usr/sbin/auditd p+i+n+u+g+s+b+acl+xattrs+sha512
/usr/sbin/ausearch p+i+n+u+g+s+b+acl+xattrs+sha512
/usr/sbin/aureport p+i+n+u+g+s+b+acl+xattrs+sha512
/usr/sbin/autrace p+i+n+u+g+s+b+acl+xattrs+sha512
/usr/sbin/augenrules p+i+n+u+g+s+b+acl+xattrs+sha512
EOF
RHEL 8 must allocate audit record storage capacity to store at least one week of audit records, when audit records are not immediately sent to a central audit record storage facility.
df -h /var/log/audit
RHEL 8 must have the packages required for offloading audit logs installed.
utils.ensure_package_installed rsyslog
RHEL 8 must have the packages required for encrypting offloaded audit logs installed.
utils.ensure_package_installed rsyslog-gnutls
The RHEL 8 audit records must be off-loaded onto a different system or storage media from the system being audited.
# Rule not reviewed
RHEL 8 must take appropriate action when the internal event queue is full.
utils.set_config_option -d = /etc/audit/auditd.conf overflow_action syslog
RHEL 8 must encrypt the transfer of audit records off-loaded onto a different system or media from the system being audited.
# Rule not reviewed
RHEL 8 must authenticate the remote logging server for off-loading audit logs.
# Rule not reviewed
RHEL 8 must take action when allocated audit record storage volume reaches 75 percent of the repository maximum audit record storage capacity.
utils.set_config_option -d = /etc/audit/auditd.conf space_left '25%'
RHEL 8 must securely compare internal information system clocks at least every 24 hours with a server synchronized to an authoritative time source, such as the United States Naval Observatory (USNO) time servers, or a time server designated for the appropriate DoD network (NIPRNet/SIPRNet), and/or the Global Positioning System (GPS).
# Point to domain controllers
sed -i '/^server/d' /etc/chrony.conf
utils.add_if_missing /etc/chrony.conf 'server time.home.cpt.local iburst maxpoll 16'
utils.add_if_missing /etc/chrony.conf 'server time.kitX.cpt.local iburst maxpoll 16'
RHEL 8 must not have any automated bug reporting tools installed.
utils.ensure_package_removed abrt*
RHEL 8 must not have the sendmail package installed.
utils.ensure_package_removed sendmail
RHEL 8 must cover or disable the built-in or attached camera when not in use.
# no camera installed
RHEL 8 must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services, as defined in the Ports, Protocols, and Services Management (PPSM) Category Assignments List (CAL) and vulnerability assessments.
# only necessary services enabled by default
firewall-cmd --list-all
The RHEL 8 file system automounter must be disabled unless required.
# not installed in baseline
RHEL 8 must be configured to disable USB mass storage.
# storage controller disabled on baseline vm anyway
utils.blacklist_kernel_module usb-storage
A RHEL 8 firewall must employ a deny-all, allow-by-exception policy for allowing connections to other systems.
# Correct zone for servers is work zone
firewall-cmd --list-all
A firewall must be installed on RHEL 8.
utils.ensure_package_installed firewalld
RHEL 8 wireless network adapters must be disabled.
# no wireless radios in a VM
RHEL 8 Bluetooth must be disabled.
utils.blacklist_kernel_module bluetooth
RHEL 8 must mount /dev/shm with the nodev option.
# Implemented by default
mount | grep /dev/shm
RHEL 8 must mount /dev/shm with the nosuid option.
# Implemented by default
mount | grep /dev/shm
RHEL 8 must mount /dev/shm with the noexec option.
# Implemented during install
mount | grep /dev/shm
RHEL 8 must mount /tmp with the nodev option.
# Implemented during install
mount | grep /tmp
RHEL 8 must mount /tmp with the nosuid option.
# Implemented during install
mount | grep /tmp
RHEL 8 must mount /tmp with the noexec option.
# Implemented during install
mount | grep /tmp
RHEL 8 must mount /var/log with the nodev option.
# Implemented during install
mount | grep /var/log
RHEL 8 must mount /var/log with the nosuid option.
# Implemented during install
mount | grep /var/log
RHEL 8 must mount /var/log with the noexec option.
# Implemented during install
mount | grep /var/log
RHEL 8 must mount /var/log/audit with the nodev option.
# Implemented during install
mount | grep /var/log/audit
RHEL 8 must mount /var/log/audit with the nosuid option.
# Implemented during install
mount | grep /var/log/audit
RHEL 8 must mount /var/log/audit with the noexec option.
# Implemented during install
mount | grep /var/log/audit
RHEL 8 must mount /var/tmp with the nodev option.
# Implemented during install
mount | grep /var/tmp
RHEL 8 must mount /var/tmp with the nosuid option.
# Implemented during install
mount | grep /var/tmp
RHEL 8 must mount /var/tmp with the noexec option.
# Implemented during install
mount | grep /var/tmp
The RHEL 8 fapolicy module must be installed.
utils.ensure_package_installed fapolicyd
RHEL 8 must block unauthorized peripherals before establishing a connection.
# no USB controller present in VM
A firewall must be able to protect against or limit the effects of Denial of Service (DoS) attacks by ensuring RHEL 8 can implement rate-limiting measures on impacted network interfaces.
utils.set_config_option -i -d = /etc/firewalld/firewalld.conf FirewallBackend nftables
All RHEL 8 networked systems must have and implement SSH to protect the confidentiality and integrity of transmitted and received information, as well as information during preparation for transmission.
# enabled by default
systemctl -q is-active sshd || systemctl enable --now sshd
RHEL 8 must force a frequent session key renegotiation for SSH connections to the server.
utils.set_ssh_option 'RekeyLimit 1G 1h'
The debug-shell systemd service must be disabled on RHEL 8.
# disabled by default
systemctl -q is-active debug-shell && systemctl disable --now debug-shell
RHEL 8 must prevent IPv6 Internet Control Message Protocol (ICMP) redirect messages from being accepted.
utils.set_sysctl_option net.ipv6.conf.default.accept_redirects 0
RHEL 8 must not send Internet Control Message Protocol (ICMP) redirects.
utils.set_sysctl_option net.ipv4.conf.all.send_redirects 0
RHEL 8 must not respond to Internet Control Message Protocol (ICMP) echoes sent to a broadcast address.
utils.set_sysctl_option net.ipv4.icmp_echo_ignore_broadcasts 1
RHEL 8 must not forward IPv6 source-routed packets.
utils.set_sysctl_option net.ipv6.conf.all.accept_source_route 0
RHEL 8 must not forward IPv6 source-routed packets by default.
utils.set_sysctl_option net.ipv6.conf.default.accept_source_route 0
RHEL 8 must not enable IPv6 packet forwarding unless the system is a router.
utils.set_sysctl_option net.ipv6.conf.all.forwarding 0
RHEL 8 must not accept router advertisements on all IPv6 interfaces.
utils.set_sysctl_option net.ipv6.conf.all.accept_ra 0
RHEL 8 must not accept router advertisements on all IPv6 interfaces by default.
utils.set_sysctl_option net.ipv6.conf.default.accept_ra 0
RHEL 8 must not allow interfaces to perform Internet Control Message Protocol (ICMP) redirects by default.
utils.set_sysctl_option net.ipv4.conf.default.send_redirects 0
RHEL 8 must ignore IPv6 Internet Control Message Protocol (ICMP) redirect messages.
utils.set_sysctl_option net.ipv6.conf.all.accept_redirects 0
RHEL 8 must disable access to network bpf syscall from unprivileged processes.
utils.set_sysctl_option kernel.unprivileged_bpf_disabled 1
RHEL 8 must restrict usage of ptrace to descendant processes.
utils.set_sysctl_option kernel.yama.ptrace_scope 1
RHEL 8 must restrict exposed kernel pointer addresses access.
utils.set_sysctl_option kernel.kptr_restrict 1
RHEL 8 must disable the use of user namespaces.
utils.set_sysctl_option user.max_user_namespaces 0
RHEL 8 must use reverse path filtering on all IPv4 interfaces.
utils.set_sysctl_option net.ipv4.conf.all.rp_filter 1
RHEL 8 must be configured to prevent unrestricted mail relaying.
# Postfix is not installed
The graphical display manager must not be installed on RHEL 8 unless approved.
dnf list --installed "xorg*common"
RHEL 8 network interfaces must not be in promiscuous mode.
# correctly configured by default
ip link | grep -i promisc
RHEL 8 remote X connections for interactive users must be disabled unless to fulfill documented and validated mission requirements.
utils.set_ssh_option 'X11Forwarding no'
The RHEL 8 SSH daemon must prevent remote hosts from connecting to the proxy display.
utils.set_ssh_option 'X11UseLocalhost yes'
If the Trivial File Transfer Protocol (TFTP) server is required, the RHEL 8 TFTP daemon must be configured to operate in secure mode.
# no tftp server installed
utils.ensure_package_removed tftp-server
The gssproxy package must not be installed unless mission essential on RHEL 8.
utils.ensure_package_removed gssproxy
The iprutils package must not be installed unless mission essential on RHEL 8.
utils.ensure_package_removed iprutils
The tuned package must not be installed unless mission essential on RHEL 8.
utils.ensure_package_removed tuned
The krb5-server package must not be installed on RHEL 8.
utils.ensure_package_removed krb5-server
RHEL 8 must restrict privilege elevation to authorized personnel.
# Configured correctly by default
grep -wE '^ALL' /etc/sudoers /etc/sudoers.d/*
RHEL 8 must use the invoking user's password for privilege escalation when using "sudo".
utils.add_if_missing /etc/sudoers.d/01_stig $'Defaults !targetpw\nDefaults !rootpw\nDefaults !runaspw'
RHEL 8 must require re-authentication when using the "sudo" command.
utils.add_if_missing /etc/sudoers.d/01_stig 'Defaults timestamp_timeout=0'
RHEL 8 must display a banner before granting local or remote access to the system via a graphical user logon.
# no graphical interface installed
RHEL 8 operating systems booted with United Extensible Firmware Interface (UEFI) must require a unique superusers name upon booting into single-user mode and maintenance.
# superuser name is root
cat /boot/grub2/user.cfg
RHEL 8 operating systems booted with a BIOS must require a unique superusers name upon booting into single-user and maintenance modes.
# not applicable to UEFI systems
RHEL 8 operating systems must require authentication upon booting into emergency mode.
grep sulogin /usr/lib/systemd/system/emergency.service
The RHEL 8 pam_unix.so module must be configured in the system-auth file to use a FIPS 140-2 approved cryptographic hashing algorithm for system authentication.
# Rule not reviewed
RHEL 8 must be configured so that all network connections associated with SSH traffic are terminated after 10 minutes of becoming unresponsive.
utils.set_ssh_option 'ClientAliveInterval 600'
The RHEL 8 SSH daemon must be configured to use system-wide crypto policies.
# configured correctly by default
grep CRYPTO_POLICY /etc/sysconfig/sshd
The RHEL 8 SSH daemon must not allow GSSAPI authentication, except to fulfill documented and validated mission requirements.
utils.set_ssh_option 'GSSAPIAuthentication no'
RHEL 8 must use a separate file system for /var/tmp.
# Already implemented during install
mountpoint /var/tmp
RHEL 8 must prevent files with the setuid and setgid bit set from being executed on the /boot/efi directory.
# Implemented during install
mount | grep /boot/efi
All RHEL 8 local interactive user home directory files must have mode 0750 or less permissive.
# permissions correct in baseline
RHEL 8 must be configured so that all files and directories contained in local interactive user home directories are group-owned by a group of which the home directory owner is a member.
# permissions correct in baseline
RHEL 8 must configure the use of the pam_faillock.so module in the /etc/pam.d/system-auth file.
# Rule not reviewed
RHEL 8 must configure the use of the pam_faillock.so module in the /etc/pam.d/password-auth file.
# Rule not reviewed
RHEL 8 must initiate a session lock for graphical user interfaces when the screensaver is activated.
# no graphical interface installed
RHEL 8 must disable the user list at logon for graphical user interfaces.
# no graphical interface installed
RHEL 8 must have the tmux package installed.
utils.ensure_package_installed tmux
RHEL 8 must prevent a user from overriding the session idle-delay setting for the graphical user interface.
# no graphical interface installed
RHEL 8 must prevent a user from overriding the screensaver lock-enabled setting for the graphical user interface.
# no graphical interface installed
RHEL 8 audit records must contain information to establish what type of events occurred, the source of events, where events occurred, and the outcome of events.
# enabled by default
systemctl -q is-active auditd || systemctl enable --now auditd
RHEL 8 must notify the System Administrator (SA) and Information System Security Officer (ISSO) (at a minimum) when allocated audit record storage volume 75 percent utilization.
utils.set_config_option -d = /etc/audit/auditd.conf space_left_action email
A firewall must be active on RHEL 8.
# enabled by default
systemctl -q is-active firewalld || systemctl enable --now firewalld
The RHEL 8 fapolicy module must be enabled.
systemctl -q is-active fapolicyd || systemctl enable --now fapolicyd
The RHEL 8 fapolicy module must be configured to employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs.
# configured correctly by default
grep permissive /etc/fapolicyd/fapolicyd.conf
RHEL 8 must have the USBGuard installed.
# USB controller not present in VM
RHEL 8 must enable the USBGuard.
# USB controller not present in VM
All RHEL 8 networked systems must have SSH installed.
utils.ensure_package_installed openssh-server
RHEL 8 must prevent IPv4 Internet Control Message Protocol (ICMP) redirect messages from being accepted.
utils.set_sysctl_option net.ipv4.conf.default.accept_redirects 0
RHEL 8 must not forward IPv4 source-routed packets.
utils.set_sysctl_option net.ipv4.conf.all.accept_source_route 0
RHEL 8 must not forward IPv4 source-routed packets by default.
utils.set_sysctl_option net.ipv4.conf.default.accept_source_route 0
RHEL 8 must ignore IPv4 Internet Control Message Protocol (ICMP) redirect messages.
utils.set_sysctl_option net.ipv4.conf.all.accept_redirects 0
RHEL 8 must enable hardening for the Berkeley Packet Filter Just-in-time compiler.
utils.set_sysctl_option net.core.bpf_jit_harden 2
The RHEL 8 operating system must implement the Endpoint Security for Linux Threat Prevention tool.
# not implemented in baseline
RHEL 8 systems, versions 8.2 and above, must configure SELinux context type to allow the use of a non-default faillock tally directory.
dir='/var/log/faillock'
utils.set_config_option -i -d = /etc/security/faillock.conf dir "$dir"
semanage fcontext -a -t faillog_t "$dir(/.*)?"
mkdir -p "$dir" && restorecon -R "$dir"
RHEL 8 systems below version 8.2 must configure SELinux context type to allow the use of a non-default faillock tally directory.
# not applicable to RHEL > 8.2
RHEL 8 must not enable IPv4 packet forwarding unless the system is a router.
utils.set_sysctl_option net.ipv4.conf.all.forwarding 0
RHEL 8 library directories must have mode 755 or less permissive.
# permissions correct by default
find -L /usr/lib{64,} -perm /022 -type d -exec ls -l {} \;
RHEL 8 library directories must be owned by root.
# permissions correct by default
find -L /usr/lib{64,} ! -user root -type d -exec ls -l {} \;
RHEL 8 library directories must be group-owned by root or a system account.
# permissions correct by default
find -L /usr/lib{64,} ! -group root -type d -exec ls -l {} \;
The RHEL 8 operating system must use a file integrity tool to verify correct operation of all security functions.
utils.ensure_package_installed aide
RHEL 8 must specify the default "include" directory for the /etc/sudoers file.
# configured correctly by default
grep -r include /etc/sudoers.d
The RHEL 8 operating system must not be configured to bypass password requirements for privilege escalation.
# Rule not reviewed
RHEL 8 must ensure the password complexity module is enabled in the system-auth file.
# Rule not reviewed
RHEL 8 systems below version 8.4 must ensure the password complexity module in the system-auth file is configured for three retries or less.
# Rule not reviewed
RHEL 8 systems below version 8.4 must ensure the password complexity module in the password-auth file is configured for three retries or less.
# Rule not reviewed
RHEL 8 systems, version 8.4 and above, must ensure the password complexity module is configured for three retries or less.
utils.set_config_option -i -d = /etc/security/pwquality.conf retry 3
RHEL 8 must be configured in the system-auth file to prohibit password reuse for a minimum of five generations.
# Rule not reviewed
The graphical display manager must not be the default target on RHEL 8 unless approved.
systemctl set-default multi-user.target
RHEL 8 must prevent nonprivileged users from executing privileged functions, including disabling, circumventing, or altering implemented security safeguards/countermeasures.
# configured correctly in baseline
RHEL 8 SSH server must be configured to use only FIPS-validated key exchange algorithms.
# configured by default
grep KexAlgorithms /etc/crypto-policies/back-ends/openssh.config
RHEL 8 must ensure cryptographic verification of vendor software packages.
# Correct keys installed for Rocky Linux system
rpm -q --queryformat "%{SUMMARY}\n" gpg-pubkey
RHEL 8 must be configured to allow sending email notifications of unauthorized configuration changes to designated personnel.
utils.ensure_package_installed mailx
RHEL 8 must terminate idle user sessions.
utils.add_if_missing /etc/systemd/logind.conf.d/stig.conf 'StopIdleSessionSec=900'
RHEL 8 must have policycoreutils package installed.
utils.ensure_package_installed policycoreutils
RHEL 8 must ensure the SSH server uses strong entropy.
utils.add_if_missing /etc/sysconfig/sshd SSH_USE_STRONG_RNG=32
RHEL 8 must restrict access to the kernel message buffer.
utils.set_sysctl_option kernel.dmesg_restrict 1
RHEL 8 must prevent kernel profiling by unprivileged users.
utils.set_sysctl_option kernel.perf_event_paranoid 2
YUM must remove all software components after updated versions have been installed on RHEL 8.
utils.set_config_option -d = /etc/dnf/dnf.conf clean_requirements_on_remove 1
RHEL 8 must enable the hardware random number generator entropy gatherer service.
# not applicable for FIPS mode system
RHEL 8 must use a separate file system for /var.
# Already implemented during install
mountpoint /var
RHEL 8 must use a separate file system for /var/log.
# Already implemented during install
mountpoint /var/log
RHEL 8 must use a separate file system for the system audit data path.
# Already implemented during install
mountpoint /var/log/audit
RHEL 8 must limit the number of concurrent sessions to ten for all accounts and/or account types.
utils.add_if_missing /etc/security/limits.d/stig.conf '* hard maxlogins 10'
RHEL 8 must prevent users from disabling session control mechanisms.
sed -i '/tmux/d' /etc/shells
RHEL 8 must display the date and time of the last successful account logon upon logon.
# Rule not reviewed
RHEL 8 must resolve audit information before writing to disk.
utils.set_config_option -d = /etc/audit/auditd.conf log_format ENRICHED
RHEL 8 must enable auditing of processes that start prior to the audit daemon.
utils.add_kernel_cmdline 'audit=1 audit_backlog_limit=8192'
RHEL 8 must allocate an audit_backlog_limit of sufficient size to capture processes that start prior to the audit daemon.
utils.add_kernel_cmdline 'audit=1 audit_backlog_limit=8192'
RHEL 8 must enable Linux audit logging for the USBGuard daemon.
# no USB controller present in VM
RHEL 8 must disable the chrony daemon from acting as a server.
utils.set_config_option /etc/chrony.conf port 0
RHEL 8 must disable network management of the chrony daemon.
utils.set_config_option /etc/chrony.conf cmdport 0
RHEL 8 must enable mitigations against processor-based vulnerabilities.
# enabled by default
dmesg | grep 'page tables'
# to enable anyway
utils.add_kernel_cmdline 'pti=on'
RHEL 8 must disable the asynchronous transfer mode (ATM) protocol.
utils.blacklist_kernel_module atm
RHEL 8 must disable the controller area network (CAN) protocol.
utils.blacklist_kernel_module can
RHEL 8 must disable the stream control transmission protocol (SCTP).
utils.blacklist_kernel_module sctp
RHEL 8 must disable the transparent inter-process communication (TIPC) protocol.
utils.blacklist_kernel_module tipc
RHEL 8 must disable mounting of cramfs.
utils.blacklist_kernel_module cramfs
RHEL 8 must disable IEEE 1394 (FireWire) Support.
utils.blacklist_kernel_module firewire-core
The RHEL 8 file integrity tool must be configured to verify extended attributes.
# configured by default
grep xattrs /etc/aide.conf
The RHEL 8 file integrity tool must be configured to verify Access Control Lists (ACLs).
# configured by default
grep acl /etc/aide.conf
RHEL 8 must have the packages required to use the hardware random number generator entropy gatherer service.
utils.ensure_package_installed rng-tools