RHEL-09-211045: Red Hat Enterprise Linux 9 Security Technical Implementation Guide :: Version 1, Release: 2 Benchmark Date: 24 Jan 2024
Updated on 2024-04-05
All fix and check commands must be run as root.
The fix snippets listed later make use of the following helper functions:
# paste this block in before running the later fix commands
utils.add_if_missing() {
[[ $# -eq 2 ]] || return
[[ $1 != "${1%/*}" && ! -d ${1%/*} ]] && mkdir -p "${1%/*}"
grep -qsF -- "$2" "$1" || printf '%s\n' "$2" >>"$1"
}
utils.set_sysctl_option() {
[[ $# -eq 2 ]] || return
[[ $(sysctl -n "$1") == "$2" ]] ||
utils.add_if_missing /etc/sysctl.d/99-sysctl.conf "$1 = $2"
}
utils.set_ssh_option() {
[[ $# -eq 1 ]] || return
grep -qrsE -- "^$1" /etc/ssh/sshd_config /etc/ssh/sshd_config.d/* ||
utils.add_if_missing /etc/ssh/sshd_config.d/99-stig.conf "$1"
}
utils.blacklist_kernel_module() {
[[ $# -eq 1 ]] || return
utils.add_if_missing "/etc/modprobe.d/$1.conf" \
"$(printf 'install %s /bin/false\nblacklist %s' "$1" "$1")"
}
utils.add_audit_rule() {
[[ $# -eq 1 ]] || return
grep -qrs -- "$1" /etc/audit/audit.rules /etc/audit/rules.d/* ||
utils.add_if_missing /etc/audit/rules.d/stig.rules "$1"
}
utils.add_kernel_cmdline() {
[[ $# -eq 1 ]] || return
awk -i inplace -v p="$1" '
/CMDLINE/ && $0 !~ p {gsub(/(["'\''])$/, " "p"&")} 1
' /etc/default/grub
grubby --update-kernel=ALL --args="$1"
}
utils.ensure_package_installed() {
[[ $# -eq 1 ]] || return
rpm --quiet -q $1 || dnf -qy install $1
}
utils.ensure_package_removed() {
[[ $# -eq 1 ]] || return
rpm --quiet -q $1 && dnf -qy remove $1
}
utils.get_config_option() {
[[ $# -ge 2 ]] || return
local c='#' a d i=0 r1 r2
while [[ $# -gt 2 ]]; do
[[ $1 == -d ]] && d=$2 && shift 2
[[ $1 == -i ]] && i=1 && shift
done
[[ $# -eq 2 ]] || return
[[ $i -eq 1 ]] && a=$c c=''
r1="^[ \t]*(|${c:-}+.*)$"
r2="^[ \t${a:-}]*${2}[ \t]*${d:-[ \t]+}[ \t]*([^${c:-$a}]*).*$"
awk -v r1="$r1" -v r2="$r2" '$0 !~ r1 && $0 ~ r2 {match($0, r2, m);
gsub(/^[ \t]*|[ \t]*$/, "", m[1]); print m[1]; exit}' "$1"
}
utils.set_config_option() {
[[ $# -ge 3 ]] || return
local a c='#' a d i o r1 r2
while [[ $# -gt 3 ]]; do
[[ $1 == -a ]] && a=1 && shift
[[ $1 == -d ]] && d=$2 && shift 2
[[ $1 == -i ]] && i='-i' && shift
done
[[ $# -eq 3 ]] || return
[[ -f $1 ]] && o=$(utils.get_config_option -d "$d" ${i:-} "$1" "$2")
[[ ${a:-} || ! ${o:-} ]] &&
utils.add_if_missing "$1" "${2}${d:- }${3}" && return
[[ ${i:-} ]] && a=$c c=''
r1="^[ \t]*(|${c:-}+.*)$"
r2="^([ \t${a:-}]*)(${2}[ \t]*${d:-[ \t]+}[ \t]*)([^${c:-$a}]*)(.*)$"
awk -i inplace -v r1="$r1" -v r2="$r2" -v new="$3" '
$0 !~ r1 && $0 ~ r2 && c == 0 {
match($0, r2, m); gsub($0, m[2] new m[4]); c = 1
} 1' "$1"
}RHEL 9 must be a vendor-supported release.
. /etc/os-release && echo $NAME $VERSION # RHEL 9.xThe systemd Ctrl-Alt-Delete burst key sequence in RHEL 9 must be disabled.
utils.add_if_missing /etc/systemd/system.conf.d/stig.conf 'CtrlAltDelBurstAction=none'The x86 Ctrl-Alt-Delete key sequence must be disabled on RHEL 9.
systemctl mask --now ctrl-alt-del.targetRHEL 9 must require a unique superusers name upon booting into single-user and maintenance modes.
# superuser name is rootRHEL 9 must check the GPG signature of software packages originating from external software repositories before installation.
utils.set_config_option -d = /etc/dnf/dnf.conf gpgcheck 1RHEL 9 must check the GPG signature of locally installed software packages before installation.
utils.set_config_option -d = /etc/dnf/dnf.conf localpkg_gpgcheck 1RHEL 9 must have GPG signature verification enabled for all software repositories.
sed -i 's/gpgcheck\s*=.*/gpgcheck=1/g' /etc/yum.repos.d/*RHEL 9 must not have a File Transfer Protocol (FTP) server package installed.
# not installed in baseline
utils.ensure_package_removed vsftpdRHEL 9 must not have a Trivial File Transfer Protocol (TFTP) server package installed.
# not installed in baseline
utils.ensure_package_removed tftpRHEL 9 local disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at rest protection.
# Not applicable to VMsThere must be no shosts.equiv files on RHEL 9.
find / -name shosts.equiv -deleteThere must be no .shosts files on RHEL 9.
find / -name .shosts -deleteRHEL 9 SSHD must not allow blank passwords.
utils.set_ssh_option 'PermitEmptyPasswords no'RHEL 9 must enable the Pluggable Authentication Module (PAM) interface for SSHD.
utils.set_ssh_option 'UsePAM yes'RHEL 9 must not allow unattended or automatic logon via the graphical user interface.
# no graphical interface installedThe root account must be the only account having unrestricted access to RHEL 9 system.
awk -F: '$3 == 0 {print $1}' /etc/passwd # only rootRHEL 9 must use a Linux Security Module configured to enforce limits on system services.
sed -i 's/SELINUX\s*=.*/SELINUX=enforcing/g' /etc/selinux/configRHEL 9 must not allow blank or null passwords.
# managed by authselect
# TODO: add authselect command to validateRHEL 9 must enable FIPS mode.
fips-mode-setup --enableRHEL 9 crypto policy files must match files shipped with the operating system.
rpm -V crypto-policies # no outputRHEL 9 must implement DOD-approved TLS encryption in the GnuTLS package.
update-crypto-policies --show # FIPSRHEL 9 vendor packaged system security patches and updates must be installed and up to date.
# install updates
dnf -y updateRHEL 9 must display the Standard Mandatory DOD Notice and Consent Banner before granting local or remote access to the system via a command line user logon.
cat <<'EOF' >/etc/issue
US Department of Defense Warning Statement
You are accessing a U.S. Government (USG) Information System (IS) that is
provided for USG-authorized use only. By using this IS (which includes any
device attached to this IS), you consent to the following conditions:
-The USG routinely intercepts and monitors communications on this IS for
purposes including, but not limited to, penetration testing, COMSEC monitoring,
network operations and defense, personnel misconduct (PM), law enforcement
(LE), and counterintelligence (CI) investigations.
-At any time, the USG may inspect and seize data stored on this IS.
-Communications using, or data stored on, this IS are not private, are subject
to routine monitoring, interception, and search, and may be disclosed or used
for any USG-authorized purpose.
-This IS includes security measures (e.g., authentication and access controls)
to protect USG interests -- not for your personal benefit or privacy.
-Notwithstanding the above, using this IS does not constitute consent to PM, LE
or CI investigative searching or monitoring of the content of privileged
communications, or work product, related to personal representation or services
by attorneys, psychotherapists, or clergy, and their assistants. Such
communications and work product are private and confidential. See User
Agreement for details.
EOFRHEL 9 must implement the Endpoint Security for Linux Threat Prevention tool.
# not implemented in baselineThe graphical display manager must not be the default target on RHEL 9 unless approved.
systemctl set-default multi-user.targetRHEL 9 systemd-journald service must be enabled.
# enabled by default
systemctl -q is-active systemd-journald || systemctl enable --now systemd-journaldRHEL 9 debug-shell systemd service must be disabled.
# disabled by default
systemctl -q is-active debug-shell && systemctl disable --now debug-shellRHEL 9 must require a boot loader superuser password.
grub2-set-password
# Follow the prompts to set passwordRHEL 9 must disable the ability of systemd to spawn an interactive boot process.
# not enabled by default
grubby --info=ALL | awk '/args/ && /systemd.confirm_spawn/'RHEL 9 /boot/grub2/grub.cfg file must be group-owned by root.
# owned by root by default
chown root:root /boot/grub2/grub.cfgRHEL 9 /boot/grub2/grub.cfg file must be owned by root.
# owned by root by default
chown root:root /boot/grub2/grub.cfgRHEL 9 must disable virtual system calls.
utils.add_kernel_cmdline 'vsyscall=none'RHEL 9 must clear the page allocator to prevent use-after-free attacks.
utils.add_kernel_cmdline 'page_poison=1'RHEL 9 must clear SLUB/SLAB objects to prevent use-after-free attacks.
utils.add_kernel_cmdline 'slub_debug=P'RHEL 9 must restrict access to the kernel message buffer.
utils.set_sysctl_option kernel.dmesg_restrict 1RHEL 9 must prevent kernel profiling by nonprivileged users.
utils.set_sysctl_option kernel.perf_event_paranoid 2RHEL 9 must prevent the loading of a new kernel for later execution.
utils.set_sysctl_option kernel.kexec_load_disabled 1RHEL 9 must restrict exposed kernel pointer addresses access.
utils.set_sysctl_option kernel.kptr_restrict 1RHEL 9 must enable kernel parameters to enforce discretionary access control on hardlinks.
utils.set_sysctl_option fs.protected_hardlinks 1RHEL 9 must enable kernel parameters to enforce discretionary access control on symlinks.
utils.set_sysctl_option fs.protected_symlinks 1RHEL 9 must disable the kernel.core_pattern.
utils.set_sysctl_option kernel.core_pattern '|/bin/false'RHEL 9 must be configured to disable the Asynchronous Transfer Mode kernel module.
utils.blacklist_kernel_module atmRHEL 9 must be configured to disable the Controller Area Network kernel module.
utils.blacklist_kernel_module canRHEL 9 must be configured to disable the FireWire kernel module.
utils.blacklist_kernel_module firewire-coreRHEL 9 must disable the Stream Control Transmission Protocol (SCTP) kernel module.
utils.blacklist_kernel_module sctpRHEL 9 must disable the Transparent Inter Process Communication (TIPC) kernel module.
utils.blacklist_kernel_module tipcRHEL 9 must implement address space layout randomization (ASLR) to protect its memory from unauthorized code execution.
utils.set_sysctl_option kernel.randomize_va_space 2RHEL 9 must disable access to network bpf system call from nonprivileged processes.
utils.set_sysctl_option kernel.unprivileged_bpf_disabled 1RHEL 9 must restrict usage of ptrace to descendant processes.
utils.set_sysctl_option kernel.yama.ptrace_scope 1RHEL 9 must disable core dump backtraces.
utils.add_if_missing /etc/systemd/coredump.conf.d/stig.conf 'ProcessSizeMax=0'RHEL 9 must disable storing core dumps.
utils.add_if_missing /etc/systemd/coredump.conf.d/stig.conf 'Storage=none'RHEL 9 must disable core dumps for all users.
utils.add_if_missing '/etc/security/limits.d/stig.conf' '* hard core 0'RHEL 9 must disable acquiring, saving, and processing core dumps.
systemctl mask --now systemd-coredump.socketRHEL 9 must disable the use of user namespaces.
# Ignore this if containers are used
utils.set_sysctl_option user.max_user_namespaces 0RHEL 9 must implement nonexecutable data to protect its memory from unauthorized code execution.
# enabled by default
dmesg | grep '[NX|DX]*protection'The kdump service on RHEL 9 must be disabled.
systemctl mask --now kdumpRHEL 9 must ensure cryptographic verification of vendor software packages.
# Correct keys installed for Rocky Linux system
rpm -q --queryformat "%{SUMMARY}\n" gpg-pubkeyRHEL 9 must be configured so that the cryptographic hashes of system files match vendor values.
rpm -Va --noconfig | awk '$1 ~ /..5/ && $2 != "c"'RHEL 9 subscription-manager package must be installed.
# not applicable to RHEL derivativesRHEL 9 must not have the sendmail package installed.
# not installed in baseline
utils.ensure_package_removed sendmailRHEL 9 must not have the nfs-utils package installed.
# not installed in baseline
utils.ensure_package_removed nfs-utilsRHEL 9 must not have the ypserv package installed.
# not installed in baseline
utils.ensure_package_removed ypservRHEL 9 must not have the rsh-server package installed.
# not installed in baseline
utils.ensure_package_removed rsh-serverRHEL 9 must not have the telnet-server package installed.
# not installed in baseline
utils.ensure_package_removed telnet-serverRHEL 9 must not have the gssproxy package installed.
# not installed in baseline
utils.ensure_package_removed gssproxyRHEL 9 must not have the iprutils package installed.
# not installed in baseline
utils.ensure_package_removed iprutilsRHEL 9 must not have the tuned package installed.
# not installed in baseline
utils.ensure_package_removed tunedRHEL 9 must not have the quagga package installed.
# not installed in baseline
utils.ensure_package_removed quaggaA graphical display manager must not be installed on RHEL 9 unless approved.
# not installed in baseline
dnf list --installed "xorg*common"RHEL 9 must have the openssl-pkcs11 package installed.
utils.ensure_package_installed openssl-pkcs11RHEL 9 must have the gnutls-utils package installed.
utils.ensure_package_installed gnutls-utilsRHEL 9 must have the nss-tools package installed.
utils.ensure_package_installed nss-toolsRHEL 9 must have the rng-tools package installed.
utils.ensure_package_installed rng-toolsRHEL 9 must have the s-nail package installed.
utils.ensure_package_installed s-nailA separate RHEL 9 file system must be used for user home directories (such as /home or an equivalent).
# Already implemented during install
mountpoint /homeRHEL 9 must use a separate file system for /tmp.
# Already implemented during install
mountpoint /tmpRHEL 9 must use a separate file system for /var/tmp.
# Already implemented during install
mountpoint /var/tmpRHEL 9 file system automount function must be disabled unless required.
# not installed in baselineRHEL 9 must prevent device files from being interpreted on file systems that contain user home directories.
# Already implemented during install
mount | grep /homeRHEL 9 must prevent files with the setuid and setgid bit set from being executed on file systems that contain user home directories.
# Already implemented during install
mount | grep /homeRHEL 9 must prevent code from being executed on file systems that contain user home directories.
# Already implemented during install
mount | grep /homeRHEL 9 must be configured so that the Network File System (NFS) is configured to use RPCSEC_GSS.
# no NFS mounts presentRHEL 9 must prevent special devices on file systems that are imported via Network File System (NFS).
# no NFS mounts presentRHEL 9 must prevent code from being executed on file systems that are imported via Network File System (NFS).
# no NFS mounts presentRHEL 9 must prevent files with the setuid and setgid bit set from being executed on file systems that are imported via Network File System (NFS).
# no NFS mounts presentRHEL 9 must prevent code from being executed on file systems that are used with removable media.
# no removable media mounts presentRHEL 9 must prevent special devices on file systems that are used with removable media.
# no removable media mounts presentRHEL 9 must prevent files with the setuid and setgid bit set from being executed on file systems that are used with removable media.
# no removable media mounts presentRHEL 9 must mount /boot with the nodev option.
mount | grep /bootRHEL 9 must prevent files with the setuid and setgid bit set from being executed on the /boot directory.
# Already implemented during install
mount | grep /homeRHEL 9 must prevent files with the setuid and setgid bit set from being executed on the /boot/efi directory.
# Already implemented during install
mount | grep /homeRHEL 9 must mount /dev/shm with the nodev option.
# Implemented by default
mount | grep /dev/shmRHEL 9 must mount /dev/shm with the noexec option.
# Implemented by default
mount | grep /dev/shmRHEL 9 must mount /dev/shm with the nosuid option.
# Implemented by default
mount | grep /dev/shmRHEL 9 must mount /tmp with the nodev option.
# Already implemented during install
mount | grep /tmpRHEL 9 must mount /tmp with the noexec option.
# Already implemented during install
mount | grep /tmpRHEL 9 must mount /tmp with the nosuid option.
# Already implemented during install
mount | grep /tmpRHEL 9 must mount /var with the nodev option.
# Already implemented during install
mount | grep /varRHEL 9 must mount /var/log with the nodev option.
# Already implemented during install
mount | grep /var/logRHEL 9 must mount /var/log with the noexec option.
# Already implemented during install
mount | grep /var/logRHEL 9 must mount /var/log with the nosuid option.
# Already implemented during install
mount | grep /var/logRHEL 9 must mount /var/log/audit with the nodev option.
# Already implemented during install
mount | grep /var/log/auditRHEL 9 must mount /var/log/audit with the noexec option.
# Already implemented during install
mount | grep /var/log/auditRHEL 9 must mount /var/log/audit with the nosuid option.
# Already implemented during install
mount | grep /var/log/auditRHEL 9 must mount /var/tmp with the nodev option.
# Already implemented during install
mount | grep /var/tmpRHEL 9 must mount /var/tmp with the noexec option.
# Already implemented during install
mount | grep /var/tmpRHEL 9 must mount /var/tmp with the nosuid option.
# Already implemented during install
mount | grep /var/tmpRHEL 9 must prevent special devices on non-root local partitions.
# Already implemented during install
mount | awk '$1 ~ /\/dev/ && $6 !~ /nodev/'RHEL 9 system commands must have mode 755 or less permissive.
# permissions correct by default
find -L /usr{/local,}/{s,}bin /usr/libexec -perm /022 -exec ls -l {} \;RHEL 9 library directories must have mode 755 or less permissive.
# permissions correct by default
find -L /usr/lib{64,} -perm /022 -type d -exec ls -l {} \;RHEL 9 library files must have mode 755 or less permissive.
# permissions correct by default
find -L /usr/lib{64,} -perm /022 -type f -exec ls -l {} \;RHEL 9 /var/log directory must have mode 0755 or less permissive.
# permissions correct by default
ls -ld /var/logRHEL 9 /var/log/messages file must have mode 0640 or less permissive.
# permissions correct by default
ls -la /var/log/messagesRHEL 9 audit tools must have a mode of 0755 or less permissive.
# permissions correct by default
ls -la /sbin/{auditctl,aureport,ausearch,autrace,auditd,rsyslogd,augenrules}RHEL 9 cron configuration directories must have a mode of 0700 or less permissive.
find /etc/cron* -type d -exec chmod 0700 {} \;All RHEL 9 local initialization files must have mode 0740 or less permissive.
awk -F: '$3 >= 1000 && $7 !~ /nologin/ {print $6}' /etc/passwd |
xargs -I_ find _ -maxdepth 1 -exec chmod g-w,o-rwx "{}" \;All RHEL 9 local interactive user home directories must have mode 0750 or less permissive.
awk -F: '$3 >= 1000 && $7 !~ /nologin/ {print $6}' /etc/passwd |
xargs -l chmod 0750RHEL 9 /etc/group file must have mode 0644 or less permissive to prevent unauthorized access.
# permissions correct by default
ls -alh /etc/{passwd,{g,}shadow,group}*RHEL 9 /etc/group- file must have mode 0644 or less permissive to prevent unauthorized access.
# permissions correct by default
ls -alh /etc/{passwd,{g,}shadow,group}*RHEL 9 /etc/gshadow file must have mode 0000 or less permissive to prevent unauthorized access.
# permissions correct by default
ls -alh /etc/{passwd,{g,}shadow,group}*RHEL 9 /etc/gshadow- file must have mode 0000 or less permissive to prevent unauthorized access.
# permissions correct by default
ls -alh /etc/{passwd,{g,}shadow,group}*RHEL 9 /etc/passwd file must have mode 0644 or less permissive to prevent unauthorized access.
# permissions correct by default
ls -alh /etc/{passwd,{g,}shadow,group}*RHEL 9 /etc/passwd- file must have mode 0644 or less permissive to prevent unauthorized access.
# permissions correct by default
ls -alh /etc/{passwd,{g,}shadow,group}*RHEL 9 /etc/shadow- file must have mode 0000 or less permissive to prevent unauthorized access.
# permissions correct by default
ls -alh /etc/{passwd,{g,}shadow,group}*RHEL 9 /etc/group file must be owned by root.
# permissions correct by default
ls -alh /etc/{passwd,{g,}shadow,group}*RHEL 9 /etc/group file must be group-owned by root.
# permissions correct by default
ls -alh /etc/{passwd,{g,}shadow,group}*RHEL 9 /etc/group- file must be owned by root.
# permissions correct by default
ls -alh /etc/{passwd,{g,}shadow,group}*RHEL 9 /etc/group- file must be group-owned by root.
# permissions correct by default
ls -alh /etc/{passwd,{g,}shadow,group}*RHEL 9 /etc/gshadow file must be owned by root.
# permissions correct by default
ls -alh /etc/{passwd,{g,}shadow,group}*RHEL 9 /etc/gshadow file must be group-owned by root.
# permissions correct by default
ls -alh /etc/{passwd,{g,}shadow,group}*RHEL 9 /etc/gshadow- file must be owned by root.
# permissions correct by default
ls -alh /etc/{passwd,{g,}shadow,group}*RHEL 9 /etc/gshadow- file must be group-owned by root.
# permissions correct by default
ls -alh /etc/{passwd,{g,}shadow,group}*RHEL 9 /etc/passwd file must be owned by root.
# permissions correct by default
ls -alh /etc/{passwd,{g,}shadow,group}*RHEL 9 /etc/passwd file must be group-owned by root.
# permissions correct by default
ls -alh /etc/{passwd,{g,}shadow,group}*RHEL 9 /etc/passwd- file must be owned by root.
# permissions correct by default
ls -alh /etc/{passwd,{g,}shadow,group}*RHEL 9 /etc/passwd- file must be group-owned by root.
# permissions correct by default
ls -alh /etc/{passwd,{g,}shadow,group}*RHEL 9 /etc/shadow file must be owned by root.
# permissions correct by default
ls -alh /etc/{passwd,{g,}shadow,group}*RHEL 9 /etc/shadow file must be group-owned by root.
# permissions correct by default
ls -alh /etc/{passwd,{g,}shadow,group}*RHEL 9 /etc/shadow- file must be owned by root.
# permissions correct by default
ls -alh /etc/{passwd,{g,}shadow,group}*RHEL 9 /etc/shadow- file must be group-owned by root.
# permissions correct by default
ls -alh /etc/{passwd,{g,}shadow,group}*RHEL 9 /var/log directory must be owned by root.
# permissions correct by default
ls -ld /var/logRHEL 9 /var/log directory must be group-owned by root.
# permissions correct by default
ls -ld /var/logRHEL 9 /var/log/messages file must be owned by root.
# permissions correct by default
ls -ld /var/log/messagesRHEL 9 /var/log/messages file must be group-owned by root.
# permissions correct by default
ls -ld /var/messagesRHEL 9 system commands must be owned by root.
# permissions correct by default
find -L /usr{/local,}/{s,}bin /usr/libexec ! -user root -exec ls -l {} \;RHEL 9 system commands must be group-owned by root or a system account.
# permissions correct by default
find -L /usr{/local,}/{s,}bin /usr/libexec ! -group root -exec ls -l {} \;RHEL 9 library files must be owned by root.
# permissions correct by default
find -L /usr/lib{64,} ! -user root -type f -exec ls -l {} \;RHEL 9 library files must be group-owned by root or a system account.
# permissions correct by default
find -L /usr/lib{64,} ! -group root -type f -exec ls -l {} \;RHEL 9 library directories must be owned by root.
# permissions correct by default
find -L /usr/lib{64,} ! -user root -type d -exec ls -l {} \;RHEL 9 library directories must be group-owned by root or a system account.
# permissions correct by default
find -L /usr/lib{64,} ! -group root -type d -exec ls -l {} \;RHEL 9 audit tools must be owned by root.
# permissions correct by default
ls -la /sbin/{auditctl,aureport,ausearch,autrace,auditd,rsyslogd,augenrules}RHEL 9 audit tools must be group-owned by root.
# permissions correct by default
ls -la /sbin/{auditctl,aureport,ausearch,autrace,auditd,rsyslogd,augenrules}RHEL 9 cron configuration files directory must be owned by root.
# permissions correct by default
ls -ld /etc/cron*RHEL 9 cron configuration files directory must be group-owned by root.
# permissions correct by default
ls -ld /etc/cron*All RHEL 9 world-writable directories must be owned by root, sys, bin, or an application user.
# permissions correct by default
df --local -P | awk '{if (NR!=1) print $6}' |
xargs -I_ find _ -xdev -type d -perm -0002 -uid +0 -printA sticky bit must be set on all RHEL 9 public directories.
# permissions correct by default
find / -type d \( -perm -0002 -a ! -perm -1000 \) -print 2>/dev/nullAll RHEL 9 local files and directories must have a valid group owner.
# All ownership valid in the baseline
df --local -P | awk '{if (NR!=1) print $6}' | xargs -I_ find _ -xdev -nogroupAll RHEL 9 local files and directories must have a valid owner.
# All ownership valid in the baseline
df --local -P | awk '{if (NR!=1) print $6}' | xargs -I_ find _ -xdev -nouserRHEL 9 must be configured so that all system device files are correctly labeled to prevent unauthorized modification.
# labels correct by default
find /dev -context *:device_t:* \( -type c -o -type b \) -printf "%p %Z\n"
find /dev -context *:unlabeled_t:* \( -type c -o -type b \) -printf "%p %Z\n"RHEL 9 /etc/crontab file must have mode 0600.
chmod 0600 /etc/crontabRHEL 9 /etc/shadow file must have mode 0000 to prevent unauthorized access.
# permissions correct by default
ls -alh /etc/{passwd,{g,}shadow,group}*RHEL 9 must have the firewalld package installed.
# installed by default
utils.ensure_package_installed firewalldThe firewalld service on RHEL 9 must be active.
# enabled by default
systemctl -q is-active firewalld || systemctl enable --now firewalldA RHEL 9 firewall must employ a deny-all, allow-by-exception policy for allowing connections to other systems.
# Correct zone for servers is work zone
firewall-cmd --list-allRHEL 9 must control remote access methods.
# Baseline configuration is secure
firewall-cmd --list-allRHEL 9 must protect against or limit the effects of denial-of-service (DoS) attacks by ensuring rate-limiting measures on impacted network interfaces are implemented.
utils.set_config_option -i -d = /etc/firewalld/firewalld.conf FirewallBackend nftablesRHEL 9 must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services, as defined in the Ports, Protocols, and Services Management (PPSM) Category Assignments List (CAL) and vulnerability assessments.
# only necessary services enabled by default
firewall-cmd --list-allRHEL 9 network interfaces must not be in promiscuous mode.
# correctly configured by default
ip link | grep -i promiscRHEL 9 must enable hardening for the Berkeley Packet Filter just-in-time compiler.
utils.set_sysctl_option net.core.bpf_jit_harden 2RHEL 9 must have the chrony package installed.
# installed by default
utils.ensure_package_installed chronyRHEL 9 chronyd service must be enabled.
# enabled by default
systemctl -q is-active chronyd || systemctl enable --now chronydRHEL 9 must securely compare internal information system clocks at least every 24 hours.
# Point to domain controllers
sed -i '/^server/d' /etc/chrony.conf
utils.add_if_missing /etc/chrony.conf 'server time.home.cpt.local iburst maxpoll 16'
utils.add_if_missing /etc/chrony.conf 'server time.kitX.cpt.local iburst maxpoll 16'RHEL 9 systems using Domain Name Servers (DNS) resolution must have at least two name servers configured.
# nameservers set via DHCP
grep nameserver /etc/resolv.confRHEL 9 must configure a DNS processing mode set be Network Manager.
utils.add_if_missing /etc/NetworkManager/conf.d/dns.conf $'[main]\ndns=none'RHEL 9 must not have unauthorized IP tunnels configured.
# IPsec tunnels not configuredRHEL 9 must be configured to prevent unrestricted mail relaying.
# Postfix is not installedIf the Trivial File Transfer Protocol (TFTP) server is required, RHEL 9 TFTP daemon must be configured to operate in secure mode.
# no tftp server installed
utils.ensure_package_removed tftp-serverRHEL 9 must forward mail from postmaster to the root account using a postfix alias.
# correctly configured by default
grep "postmaster:\s*root$" /etc/aliasesRHEL 9 libreswan package must be installed.
utils.ensure_package_installed libreswanRHEL 9 must be configured to use TCP syncookies.
utils.set_sysctl_option net.ipv4.tcp_syncookies 1RHEL 9 must ignore Internet Protocol version 4 (IPv4) Internet Control Message Protocol (ICMP) redirect messages.
utils.set_sysctl_option net.ipv4.conf.all.accept_redirects 0RHEL 9 must not forward Internet Protocol version 4 (IPv4) source-routed packets.
utils.set_sysctl_option net.ipv4.conf.all.accept_source_route 0RHEL 9 must log IPv4 packets with impossible addresses.
utils.set_sysctl_option net.ipv4.conf.all.log_martians 1RHEL 9 must log IPv4 packets with impossible addresses by default.
utils.set_sysctl_option net.ipv4.conf.default.log_martians 1RHEL 9 must use reverse path filtering on all IPv4 interfaces.
utils.set_sysctl_option net.ipv4.conf.all.rp_filter 1RHEL 9 must prevent IPv4 Internet Control Message Protocol (ICMP) redirect messages from being accepted.
utils.set_sysctl_option net.ipv4.conf.default.accept_redirects 0RHEL 9 must not forward IPv4 source-routed packets by default.
utils.set_sysctl_option net.ipv4.conf.default.accept_source_route 0RHEL 9 must use a reverse-path filter for IPv4 network traffic when possible by default.
utils.set_sysctl_option net.ipv4.conf.default.rp_filter 1RHEL 9 must not respond to Internet Control Message Protocol (ICMP) echoes sent to a broadcast address.
utils.set_sysctl_option net.ipv4.icmp_echo_ignore_broadcasts 1RHEL 9 must limit the number of bogus Internet Control Message Protocol (ICMP) response errors logs.
utils.set_sysctl_option net.ipv4.icmp_ignore_bogus_error_response 1RHEL 9 must not send Internet Control Message Protocol (ICMP) redirects.
utils.set_sysctl_option net.ipv4.conf.all.send_redirects 0RHEL 9 must not allow interfaces to perform Internet Control Message Protocol (ICMP) redirects by default.
utils.set_sysctl_option net.ipv4.conf.default.send_redirects 0RHEL 9 must not enable IPv4 packet forwarding unless the system is a router.
utils.set_sysctl_option net.ipv4.conf.all.forwarding 0RHEL 9 must not accept router advertisements on all IPv6 interfaces.
utils.set_sysctl_option net.ipv6.conf.all.accept_ra 0RHEL 9 must ignore IPv6 Internet Control Message Protocol (ICMP) redirect messages.
utils.set_sysctl_option net.ipv6.conf.all.accept_redirects 0RHEL 9 must not forward IPv6 source-routed packets.
utils.set_sysctl_option net.ipv6.conf.all.accept_source_route 0RHEL 9 must not enable IPv6 packet forwarding unless the system is a router.
utils.set_sysctl_option net.ipv6.conf.all.forwarding 0RHEL 9 must not accept router advertisements on all IPv6 interfaces by default.
utils.set_sysctl_option net.ipv6.conf.default.accept_ra 0RHEL 9 must prevent IPv6 Internet Control Message Protocol (ICMP) redirect messages from being accepted.
utils.set_sysctl_option net.ipv6.conf.default.accept_redirects 0RHEL 9 must not forward IPv6 source-routed packets by default.
utils.set_sysctl_option net.ipv6.conf.default.accept_source_route 0All RHEL 9 networked systems must have SSH installed.
# installed by default
utils.ensure_package_installed openssh-serverAll RHEL 9 networked systems must have and implement SSH to protect the confidentiality and integrity of transmitted and received information, as well as information during preparation for transmission.
# enabled by default
systemctl -q is-active sshd || systemctl enable --now sshdRHEL 9 must have the openssh-clients package installed.
# installed by default
utils.ensure_package_installed openssh-clientsRHEL 9 must display the Standard Mandatory DOD Notice and Consent Banner before granting local or remote access to the system via a SSH logon.
utils.set_ssh_option 'banner /etc/issue'RHEL 9 must log SSH connection attempts and failures to the server.
utils.set_ssh_option 'LogLevel VERBOSE'RHEL 9 SSHD must accept public key authentication.
utils.set_ssh_option 'PubkeyAuthentication yes'RHEL 9 must not permit direct logons to the root account using remote access via SSH.
utils.set_ssh_option 'PermitRootLogin no'RHEL 9 SSH daemon must be configured to use system-wide crypto policies.
# configured by default
grep Include /etc/ssh/sshd_config /etc/ssh/sshd_config.d/*RHEL 9 must implement DOD-approved encryption ciphers to protect the confidentiality of SSH client connections.
# configured by default
grep Include /etc/ssh/sshd_config /etc/ssh/sshd_config.d/*RHEL 9 must implement DOD-approved encryption ciphers to protect the confidentiality of SSH server connections.
# configured by default
grep Ciphers /etc/crypto-policies/back-ends/openssh.configRHEL 9 SSH client must be configured to use only Message Authentication Codes (MACs) employing FIPS 140-3 validated cryptographic hash algorithms.
# configured by default
grep MACs /etc/crypto-policies/back-ends/openssh.configRHEL 9 SSH server must be configured to use only Message Authentication Codes (MACs) employing FIPS 140-3 validated cryptographic hash algorithms.
# configured by default
grep MACs /etc/crypto-policies/back-ends/openssh.configRHEL 9 must not allow a noncertificate trusted host SSH logon to the system.
utils.set_ssh_option 'HostbasedAuthentication no'RHEL 9 must not allow users to override SSH environment variables.
utils.set_ssh_option 'PermitUserEnvironment no'RHEL 9 must force a frequent session key renegotiation for SSH connections to the server.
utils.set_ssh_option 'RekeyLimit 1G 1h'RHEL 9 must be configured so that all network connections associated with SSH traffic terminate after becoming unresponsive.
utils.set_ssh_option 'ClientAliveCountMax 1'RHEL 9 must be configured so that all network connections associated with SSH traffic are terminated after 10 minutes of becoming unresponsive.
utils.set_ssh_option 'ClientAliveInterval 600'RHEL 9 SSH server configuration file must be group-owned by root.
# permissions correct by default
ls -l /etc/ssh/sshd_configRHEL 9 SSH server configuration file must be owned by root.
# permissions correct by default
ls -l /etc/ssh/sshd_configRHEL 9 SSH server configuration file must have mode 0600 or less permissive.
# permissions correct by default
ls -l /etc/ssh/sshd_configRHEL 9 SSH private host key files must have mode 0640 or less permissive.
# permissions correct by default
ls -l /etc/ssh/*_keyRHEL 9 SSH public host key files must have mode 0644 or less permissive.
# permissions correct by default
ls -l /etc/ssh/*.pubRHEL 9 SSH daemon must not allow compression or must only allow compression after successful authentication.
utils.set_ssh_option 'Compression delayed'RHEL 9 SSH daemon must not allow GSSAPI authentication.
utils.set_ssh_option 'GSSAPIAuthentication no'RHEL 9 SSH daemon must not allow Kerberos authentication.
utils.set_ssh_option 'KerberosAuthentication no'RHEL 9 SSH daemon must not allow rhosts authentication.
utils.set_ssh_option 'IgnoreRhosts yes'RHEL 9 SSH daemon must not allow known hosts authentication.
utils.set_ssh_option 'IgnoreUserKnownHosts yes'RHEL 9 SSH daemon must disable remote X connections for interactive users.
utils.set_ssh_option 'X11forwarding no'RHEL 9 SSH daemon must perform strict mode checking of home directory configuration files.
utils.set_ssh_option 'StrictModes yes'RHEL 9 SSH daemon must display the date and time of the last successful account logon upon an SSH logon.
utils.set_ssh_option 'PrintLastLog yes'RHEL 9 SSH daemon must be configured to use privilege separation.
utils.set_ssh_option 'UsePrivilegeSeparation sandbox'RHEL 9 SSH daemon must prevent remote hosts from connecting to the proxy display.
utils.set_ssh_option 'X11UseLocalhost yes'RHEL 9 must display the Standard Mandatory DOD Notice and Consent Banner before granting local or remote access to the system via a graphical user logon.
# no graphical interface installedRHEL 9 must prevent a user from overriding the banner-message-enable setting for the graphical user interface.
# no graphical interface installedRHEL 9 must disable the graphical user interface automount function unless required.
# no graphical interface installedRHEL 9 must prevent a user from overriding the disabling of the graphical user interface automount function.
# no graphical interface installedRHEL 9 must disable the graphical user interface autorun function unless required.
# no graphical interface installedRHEL 9 must prevent a user from overriding the disabling of the graphical user interface autorun function.
# no graphical interface installedRHEL 9 must be able to initiate directly a session lock for all connection types using smart card when the smart card is removed.
# no graphical interface installedRHEL 9 must prevent a user from overriding the disabling of the graphical user smart card removal action.
# no graphical interface installedRHEL 9 must enable a user session lock until that user re-establishes access using established identification and authentication procedures for graphical user sessions.
# no graphical interface installedRHEL 9 must prevent a user from overriding the screensaver lock-enabled setting for the graphical user interface.
# no graphical interface installedRHEL 9 must automatically lock graphical user sessions after 15 minutes of inactivity.
# no graphical interface installedRHEL 9 must prevent a user from overriding the session idle-delay setting for the graphical user interface.
# no graphical interface installedRHEL 9 must initiate a session lock for graphical user interfaces when the screensaver is activated.
# no graphical interface installedRHEL 9 must prevent a user from overriding the session lock-delay setting for the graphical user interface.
# no graphical interface installedRHEL 9 must conceal, via the session lock, information previously visible on the display with a publicly viewable image.
# no graphical interface installedRHEL 9 effective dconf policy must match the policy keyfiles.
# no graphical interface installedRHEL 9 must disable the ability of a user to restart the system from the login screen.
# no graphical interface installedRHEL 9 must prevent a user from overriding the disable-restart-buttons setting for the graphical user interface.
# no graphical interface installedRHEL 9 must disable the ability of a user to accidentally press Ctrl-Alt-Del and cause a system to shut down or reboot.
# no graphical interface installedRHEL 9 must prevent a user from overriding the Ctrl-Alt-Del sequence settings for the graphical user interface.
# no graphical interface installedRHEL 9 must disable the user list at logon for graphical user interfaces.
# no graphical interface installedRHEL 9 must be configured to disable USB mass storage.
# storage controller disabled on baseline vm anyway
utils.blacklist_kernel_module usb-storageRHEL 9 must have the USBGuard package installed.
# USB controller not present in VMRHEL 9 must have the USBGuard package enabled.
# USB controller not present in VMRHEL 9 must block unauthorized peripherals before establishing a connection.
# USB controller not present in VMRHEL 9 Bluetooth must be disabled.
utils.blacklist_kernel_module bluetoothRHEL 9 wireless network adapters must be disabled.
# no wireless radios in a VMRHEL 9 user account passwords for new users or password changes must have a 60-day maximum password lifetime restriction in /etc/login.defs.
utils.set_config_option /etc/login.defs PASS_MAX_DAYS 60RHEL 9 user account passwords must have a 60-day maximum password lifetime restriction.
# correctly configured by default
awk -F: '$5 <= 0 {print $1 "" "" $5}' /etc/shadowAll RHEL 9 local interactive user accounts must be assigned a home directory upon creation.
utils.set_config_option /etc/login.defs CREATE_HOME yesRHEL 9 must set the umask value to 077 for all local interactive user accounts.
# no umask in user profiles by defaultRHEL 9 duplicate User IDs (UIDs) must not exist for interactive users.
# correctly configured by default
awk -F ":" 'list[$3]++ {print $1, $3}' /etc/passwdRHEL 9 system accounts must not have an interactive login shell.
# correctly configured by default
awk -F: '$3 < 1000 && $7 !~ /nologin/ {print $1 ":" $3 ":" $7}' /etc/passwdRHEL 9 must automatically expire temporary accounts within 72 hours.
# no temp accounts exist by defaultAll RHEL 9 interactive users must have a primary group that exists.
# correctly configured by default
pwck -qrRHEL 9 must disable account identifiers (individuals, groups, roles, and devices) after 35 days of inactivity.
useradd -D -f 35Executable search paths within the initialization files of all local interactive RHEL 9 users must only contain paths that resolve to the system default or the users home directory.
# correctly configured by default
grep -si path= /home/*/.*All RHEL 9 local interactive users must have a home directory assigned in the /etc/passwd file.
# correctly configured by default
awk -F: '$3 >= 1000 && $7 !~ /nologin/ {print $1, $3, $6}' /etc/passwdAll RHEL 9 local interactive user home directories defined in the /etc/passwd file must exist.
# correctly configured by default
pwck -rAll RHEL 9 local interactive user home directories must be group-owned by the home directory owner's primary group.
# correctly configured by default
awk -F: '$3 >= 1000 && $7 !~ /nologin/ {print $6}' /etc/passwdRHEL 9 must automatically lock an account when three unsuccessful logon attempts occur.
utils.set_config_option -i -d = /etc/security/faillock.conf deny 3RHEL 9 must automatically lock the root account until the root account is released by an administrator when three unsuccessful logon attempts occur during a 15-minute time period.
utils.set_config_option -i /etc/security/faillock.conf even_deny_root ''RHEL 9 must automatically lock an account when three unsuccessful logon attempts occur during a 15-minute time period.
utils.set_config_option -i -d = /etc/security/faillock.conf fail_interval 900RHEL 9 must maintain an account lock until the locked account is released by an administrator.
utils.set_config_option -i -d = /etc/security/faillock.conf unlock_time 0RHEL 9 must not have unauthorized accounts.
# correctly configured by default
awk -F: '$3 >= 1000 && $7 !~ /nologin/ {print $6}' /etc/passwdRHEL 9 must ensure account lockouts persist.
utils.set_config_option -i -d = /etc/security/faillock.conf dir /var/log/faillockRHEL 9 groups must have unique Group ID (GID).
# correctly configured by default
cut -d : -f 3 /etc/group | uniq -dLocal RHEL 9 initialization files must not execute world-writable programs.
# correctly configured by default
find /home -perm -002 -type f -name ".[^.]*" -exec ls -ld {} \;RHEL 9 must have the tmux package installed.
utils.ensure_package_installed tmuxRHEL 9 must ensure session control is automatically started at shell initialization.
cat <<'EOF' >/etc/profile.d/tmux.sh
#!/bin/bash │
[[ -n $PS1 && -z $TMUX && -z $DISPLAY && ! $(pstree -s $$) =~ tmux|sudo ]] && exec tmux new -As0
EOFRHEL 9 must enable a user session lock until that user re-establishes access using established identification and authentication procedures for command line sessions.
utils.add_if_missing /etc/tmux.conf 'set -g lock-command vlock'
utils.add_if_missing /etc/tmux.conf 'bind X lock-session'RHEL 9 must automatically lock command line user sessions after 15 minutes of inactivity.
utils.add_if_missing /etc/tmux.conf 'set -g lock-after-time 900'RHEL 9 must automatically exit interactive command shell user sessions after 15 minutes of inactivity.
utils.add_if_missing /etc/profile.d/tmout.sh $'#!/bin/bash\ndeclare -xr TMOUT=900'RHEL 9 must log username information when unsuccessful logon attempts occur.
utils.set_config_option -i /etc/security/faillock.conf audit ''RHEL 9 must enforce a delay of at least four seconds between logon prompts following a failed logon attempt.
utils.set_config_option /etc/login.defs FAIL_DELAY 4RHEL 9 must define default permissions for the bash shell.
# Don't edit /etc/bashrc directly, use drop-ins in /etc/profile.d/
utils.add_if_missing /etc/profile.d/umask.sh 'umask 077'RHEL 9 must define default permissions for the c shell.
# Don't edit /etc/csh.cshrc directly, use drop-ins in /etc/profile.d/
utils.add_if_missing /etc/profile.d/umask.csh 'umask 077'RHEL 9 must define default permissions for all authenticated users in such a way that the user can only read and modify their own files.
utils.set_config_option /etc/login.defs UMASK 077RHEL 9 must define default permissions for the system default profile.
# Don't edit /etc/profile directly, use drop-ins in /etc/profile.d/
utils.add_if_missing /etc/profile.d/umask.sh 'umask 077'RHEL 9 must terminate idle user sessions.
utils.add_if_missing /etc/systemd/logind.conf.d/stig.conf 'StopIdleSessionSec=900'RHEL 9 must enable the SELinux targeted policy.
# Targeted policy is default
grep SELINUXTYPE /etc/selinux/configRHEL 9 must configure SELinux context type to allow the use of a nondefault faillock tally directory.
dir='/var/log/faillock'
utils.set_config_option -i -d = /etc/security/faillock.conf dir "$dir"
semanage fcontext -a -t faillog_t "$dir(/.*)?"
mkdir -p "$dir" && restorecon -R "$dir"RHEL 9 must have policycoreutils package installed.
# installed by default
utils.ensure_package_installed policycoreutilsRHEL 9 policycoreutils-python-utils package must be installed.
utils.ensure_package_installed policycoreutils-python-utilsRHEL 9 must have the sudo package installed.
# installed by default
utils.ensure_package_installed sudoRHEL 9 must require reauthentication when using the "sudo" command.
utils.add_if_missing /etc/sudoers.d/01_stig 'Defaults timestamp_timeout=0'RHEL 9 must use the invoking user's password for privilege escalation when using "sudo".
utils.add_if_missing /etc/sudoers.d/01_stig $'Defaults !targetpw\nDefaults !rootpw\nDefaults !runaspw'RHEL 9 must require users to reauthenticate for privilege escalation.
# Configured correctly by default
grep -ir '!authenticate' /etc/sudoers /etc/sudoers.d/*RHEL 9 must restrict privilege elevation to authorized personnel.
# Configured correctly by default
grep -wE '^ALL' /etc/sudoers /etc/sudoers.d/*RHEL 9 must restrict the use of the "su" command.
sed -i -E 's/#auth(.+pam_wheel.so use_uid)/auth\1/' /etc/pam.d/suRHEL 9 fapolicy module must be installed.
utils.ensure_package_installed fapolicydRHEL 9 fapolicy module must be enabled.
systemctl -q is-active fapolicyd || systemctl enable --now fapolicydRHEL 9 must ensure the password complexity module in the system-auth file is configured for three retries or less.
...RHEL 9 must be configured in the password-auth file to prohibit password reuse for a minimum of five generations.
...RHEL 9 must be configured in the system-auth file to prohibit password reuse for a minimum of five generations.
...RHEL 9 must configure the use of the pam_faillock.so module in the /etc/pam.d/system-auth file.
...RHEL 9 must configure the use of the pam_faillock.so module in the /etc/pam.d/password-auth file.
...RHEL 9 must ensure the password complexity module is enabled in the password-auth file.
...RHEL 9 must ensure the password complexity module is enabled in the system-auth file.
...RHEL 9 password-auth must be configured to use a sufficient number of hashing rounds.
...RHEL 9 system-auth must be configured to use a sufficient number of hashing rounds.
...RHEL 9 must enforce password complexity rules for the root account.
utils.set_config_option -i /etc/security/pwquality.conf enforce_for_root ''RHEL 9 must enforce password complexity by requiring that at least one lowercase character be used.
utils.set_config_option -i -d = /etc/security/pwquality.conf lcredit '-1'RHEL 9 must enforce password complexity by requiring that at least one numeric character be used.
utils.set_config_option -i -d = /etc/security/pwquality.conf dcredit '-1'RHEL 9 passwords for new users or password changes must have a 24 hours minimum password lifetime restriction in /etc/login.defs.
utils.set_config_option /etc/login.defs PASS_MIN_DAYS 1RHEL 9 passwords must have a 24 hours minimum password lifetime restriction in /etc/shadow.
# Set correctly on the default account
awk -F: '$3 >= 1000 && $3 < 65534 {print $1}' /etc/passwd |
xargs -I{} awk -F: -v u="{}" '$1 == u {print $1 " " $4}' /etc/shadowRHEL 9 must require users to provide a password for privilege escalation.
# configured correctly by default
grep -ri nopasswd /etc/sudoers /etc/sudoers.d/*RHEL 9 passwords must be created with a minimum of 15 characters.
utils.set_config_option -i -d = /etc/security/pwquality.conf minlen '15'RHEL 9 passwords for new users must have a minimum of 15 characters.
utils.set_config_option /etc/login.defs PASS_MIN_LEN 15RHEL 9 must enforce password complexity by requiring that at least one special character be used.
utils.set_config_option -i -d = /etc/security/pwquality.conf ocredit '-1'RHEL 9 must prevent the use of dictionary words for passwords.
utils.set_config_option -i -d = /etc/security/pwquality.conf dictcheck 1RHEL 9 must enforce password complexity by requiring that at least one uppercase character be used.
utils.set_config_option -i -d = /etc/security/pwquality.conf ucredit '-1'RHEL 9 must require the change of at least eight characters when passwords are changed.
utils.set_config_option -i -d = /etc/security/pwquality.conf difok 8RHEL 9 must require the maximum number of repeating characters of the same character class be limited to four when passwords are changed.
utils.set_config_option -i -d = /etc/security/pwquality.conf maxclassrepeat 4RHEL 9 must require the maximum number of repeating characters be limited to three when passwords are changed.
utils.set_config_option -i -d = /etc/security/pwquality.conf maxrepeat 3RHEL 9 must require the change of at least four character classes when passwords are changed.
utils.set_config_option -i -d = /etc/security/pwquality.conf minclass 4RHEL 9 must be configured so that user and group account administration utilities are configured to store only encrypted representations of passwords.
utils.set_config_option -d = /etc/libuser.conf crypt_style sha512RHEL 9 must be configured to use the shadow file to store only encrypted representations of passwords.
utils.set_config_option /etc/login.defs ENCRYPT_METHOD SHA512RHEL 9 must not be configured to bypass password requirements for privilege escalation.
...RHEL 9 shadow password suite must be configured to use a sufficient number of hashing rounds.
utils.set_config_option /etc/login.defs SHA_CRYPT_MIN_ROUNDS 5000RHEL 9 must not have accounts configured with blank or null passwords.
# Configured correctly by default
awk -F: '!$2 {print $1}' /etc/shadowRHEL 9 must use the CAC smart card driver.
...RHEL 9 must enable certificate based smart card authentication.
...RHEL 9 must implement certificate status checking for multifactor authentication.
...RHEL 9 must have the pcsc-lite package installed.
utils.ensure_package_installed pcsc-liteThe pcscd service on RHEL 9 must be active.
# enabled by default (indirectly)
systemctl -q is-active pcscd.socket || systemctl enable --now pcscd.socketRHEL 9 must have the opensc package installed.
utils.ensure_package_installed openscRHEL 9, for PKI-based authentication, must enforce authorized access to the corresponding private key.
# no key files in baselineRHEL 9 must require authentication to access emergency mode.
# set by default
grep sulogin /usr/lib/systemd/system/emergency.serviceRHEL 9 must require authentication to access single-user mode.
# set by default
grep sulogin /usr/lib/systemd/system/rescue.serviceRHEL 9 must prevent system daemons from using Kerberos for authentication.
# No keytabs installed by default
ls -al /etc/*.keytabRHEL 9, for PKI-based authentication, must validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor.
...RHEL 9 must map the authenticated identity to the user or group account for PKI-based authentication.
...RHEL 9 must prohibit the use of cached authenticators after one day.
...RHEL 9 must have the AIDE package installed.
utils.ensure_package_installed aideRHEL 9 must routinely check the baseline configuration for unauthorized changes and notify the system administrator when anomalies in the operation of any security functions are discovered.
cat <<'EOF' >/etc/cron.daily/aide
#!/bin/bash
/usr/sbin/aide --check | /bin/mail -s "$HOSTNAME - Daily aide integrity check run" root@sysname.mil
EOFRHEL 9 must use a file integrity tool that is configured to use FIPS 140-3-approved cryptographic hashes for validating file contents and directories.
# configured by default
grep sha512 /etc/aide.confRHEL 9 must use cryptographic mechanisms to protect the integrity of audit tools.
cat <<'EOF' >>/etc/aide.conf
# STIG V-258137
/usr/sbin/auditctl p+i+n+u+g+s+b+acl+xattrs+sha512
/usr/sbin/auditd p+i+n+u+g+s+b+acl+xattrs+sha512
/usr/sbin/ausearch p+i+n+u+g+s+b+acl+xattrs+sha512
/usr/sbin/aureport p+i+n+u+g+s+b+acl+xattrs+sha512
/usr/sbin/autrace p+i+n+u+g+s+b+acl+xattrs+sha512
/usr/sbin/augenrules p+i+n+u+g+s+b+acl+xattrs+sha512
EOFRHEL 9 must have the rsyslog package installed.
# installed by default
utils.ensure_package_installed rsyslogRHEL 9 must have the packages required for encrypting offloaded audit logs installed.
# installed by default
utils.ensure_package_installed rsyslog-gnutlsThe rsyslog service on RHEL 9 must be active.
# enabled by default
systemctl -q is-active rsyslog || systemctl enable --now rsyslogRHEL 9 must be configured so that the rsyslog daemon does not accept log messages from other servers unless the server is being used for log aggregation.
# not enabled by default
grep -sE 'ModLoad|ServerRun' /etc/rsyslog.conf /etc/rsyslog.d/*All RHEL 9 remote access methods must be monitored.
utils.add_if_missing /etc/rsyslog.d/stig.conf 'auth.*;authpriv.*;daemon.* /var/log/secure'RHEL 9 must be configured to offload audit records onto a different system from the system being audited via syslog.
utils.set_config_option -d = /etc/audit/plugins.d/syslog.conf active yesRHEL 9 must authenticate the remote logging server for offloading audit logs via rsyslog.
...RHEL 9 must encrypt the transfer of audit records offloaded onto a different system or media from the system being audited via rsyslog.
...RHEL 9 must encrypt via the gtls driver the transfer of audit records offloaded onto a different system or media from the system being audited via rsyslog.
...RHEL 9 must be configured to forward audit records via TCP to a different system or media from the system being audited via rsyslog.
...RHEL 9 must use cron logging.
# configured correctly by default
grep -s cron /etc/rsyslog.conf /etc/rsyslog.d/*.confRHEL 9 audit package must be installed.
# installed by default
utils.ensure_package_installed auditRHEL 9 audit service must be enabled.
# enabled by default
systemctl -q is-active auditd || systemctl enable --now auditdRHEL 9 audit system must take appropriate action when an error writing to the audit storage volume occurs.
utils.set_config_option -d = /etc/audit/auditd.conf disk_error_action SYSLOGRHEL 9 audit system must take appropriate action when the audit storage volume is full.
utils.set_config_option -d = /etc/audit/auditd.conf disk_full_action SYSLOGRHEL 9 must allocate audit record storage capacity to store at least one week's worth of audit records.
df -h /var/log/auditRHEL 9 must take action when allocated audit record storage volume reaches 75 percent of the repository maximum audit record storage capacity.
utils.set_config_option -d = /etc/audit/auditd.conf space_left '25%'RHEL 9 must notify the system administrator (SA) and information system security officer (ISSO) (at a minimum) when allocated audit record storage volume 75 percent utilization.
utils.set_config_option -d = /etc/audit/auditd.conf space_left_action emailRHEL 9 must take action when allocated audit record storage volume reaches 95 percent of the audit record storage capacity.
utils.set_config_option -d = /etc/audit/auditd.conf admin_space_left '5%'RHEL 9 must take action when allocated audit record storage volume reaches 95 percent of the repository maximum audit record storage capacity.
utils.set_config_option -d = /etc/audit/auditd.conf admin_space_left_action singleRHEL 9 audit system must take appropriate action when the audit files have reached maximum size.
utils.set_config_option -d = /etc/audit/auditd.conf max_log_file_action ROTATERHEL 9 must label all offloaded audit logs before sending them to the central log server.
utils.set_config_option -d = /etc/audit/auditd.conf name_format hostnameRHEL 9 must take appropriate action when the internal event queue is full.
utils.set_config_option -d = /etc/audit/auditd.conf overflow_action syslogRHEL 9 System Administrator (SA) and/or information system security officer (ISSO) (at a minimum) must be alerted of an audit processing failure event.
utils.set_config_option -d = /etc/audit/auditd.conf action_mail_acct rootRHEL 9 audit system must audit local events.
utils.set_config_option -d = /etc/audit/auditd.conf local_events yesRHEL 9 audit logs must be group-owned by root or by a restricted logging group to prevent unauthorized read access.
# permissions correct by default
ls -l /var/log/audit/audit.logRHEL 9 audit log directory must be owned by root to prevent unauthorized read access.
# permissions correct by default
ls -ld /var/log/auditRHEL 9 audit logs file must have mode 0600 or less permissive to prevent unauthorized access to the audit log.
# permissions correct by default
ls -l /var/log/audit/audit.logRHEL 9 must periodically flush audit records to disk to prevent the loss of audit records.
utils.set_config_option -d = /etc/audit/auditd.conf freq 100RHEL 9 must produce audit records containing information to establish the identity of any individual or process associated with the event.
utils.set_config_option -d = /etc/audit/auditd.conf log_format ENRICHEDRHEL 9 must write audit records to disk.
utils.set_config_option -d = /etc/audit/auditd.conf write_logs yesRHEL 9 must allow only the information system security manager (ISSM) (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited.
# permissions correct by default
ls -l /etc/audit/auditd.conf /etc/audit/rules.d/*.rulesRHEL 9 /etc/audit/auditd.conf file must have 0640 or less permissive to prevent unauthorized access.
# permissions correct by default
ls -l /etc/audit/auditd.conf /etc/audit/rules.d/*.rulesRHEL 9 must have mail aliases to notify the information system security officer (ISSO) and system administrator (SA) (at a minimum) in the event of an audit processing failure.
# Postfix package is not installedRHEL 9 audispd-plugins package must be installed.
utils.ensure_package_installed audispd-pluginsRHEL 9 must audit uses of the "execve" system call.
utils.add_audit_rule '-a always,exit -F arch=b32 -S execve -C uid!=euid -F euid=0 -k execpriv '
utils.add_audit_rule '-a always,exit -F arch=b64 -S execve -C uid!=euid -F euid=0 -k execpriv'
utils.add_audit_rule '-a always,exit -F arch=b32 -S execve -C gid!=egid -F egid=0 -k execpriv'
utils.add_audit_rule '-a always,exit -F arch=b64 -S execve -C gid!=egid -F egid=0 -k execpriv'RHEL 9 must audit all uses of the chmod, fchmod, and fchmodat system calls.
utils.add_audit_rule '-a always,exit -F arch=b32 -S chmod,fchmod,fchmodat -F auid>=1000 -F auid!=unset -k perm_mod'
utils.add_audit_rule '-a always,exit -F arch=b64 -S chmod,fchmod,fchmodat -F auid>=1000 -F auid!=unset -k perm_mod'RHEL 9 must audit all uses of the chown, fchown, fchownat, and lchown system calls.
utils.add_audit_rule '-a always,exit -F arch=b32 -S chown,fchown,fchownat,lchown -F auid>=1000 -F auid!=unset -k perm_mod'
utils.add_audit_rule '-a always,exit -F arch=b64 -S chown,fchown,fchownat,lchown -F auid>=1000 -F auid!=unset -k perm_mod'RHEL 9 must audit all uses of the setxattr, fsetxattr, lsetxattr, removexattr, fremovexattr, and lremovexattr system calls.
utils.add_audit_rule '-a always,exit -F arch=b32 -S setxattr,fsetxattr,lsetxattr,removexattr,fremovexattr,lremovexattr -F auid>=1000 -F auid!=unset -k perm_mod'
utils.add_audit_rule '-a always,exit -F arch=b64 -S setxattr,fsetxattr,lsetxattr,removexattr,fremovexattr,lremovexattr -F auid>=1000 -F auid!=unset -k perm_mod'
utils.add_audit_rule '-a always,exit -F arch=b32 -S setxattr,fsetxattr,lsetxattr,removexattr,fremovexattr,lremovexattr -F auid=0 -k perm_mod'
utils.add_audit_rule '-a always,exit -F arch=b64 -S setxattr,fsetxattr,lsetxattr,removexattr,fremovexattr,lremovexattr -F auid=0 -k perm_mod'RHEL 9 must audit all uses of umount system calls.
utils.add_audit_rule '-a always,exit -F path=/usr/bin/umount -F perm=x -F auid>=1000 -F auid!=unset -k privileged-mount'RHEL 9 must audit all uses of the chacl command.
utils.add_audit_rule '-a always,exit -F path=/usr/bin/chacl -F perm=x -F auid>=1000 -F auid!=unset -k perm_mod'RHEL 9 must audit all uses of the setfacl command.
utils.add_audit_rule '-a always,exit -F path=/usr/bin/setfacl -F perm=x -F auid>=1000 -F auid!=unset -k perm_mod'RHEL 9 must audit all uses of the chcon command.
utils.add_audit_rule '-a always,exit -F path=/usr/bin/chcon -F perm=x -F auid>=1000 -F auid!=unset -k perm_mod'RHEL 9 must audit all uses of the semanage command.
utils.add_audit_rule '-a always,exit -F path=/usr/sbin/semanage -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update'RHEL 9 must audit all uses of the setfiles command.
utils.add_audit_rule '-a always,exit -F path=/usr/sbin/setfiles -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update'RHEL 9 must audit all uses of the setsebool command.
utils.add_audit_rule '-a always,exit -F path=/usr/sbin/setsebool -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged'RHEL 9 must audit all uses of the rename, unlink, rmdir, renameat, and unlinkat system calls.
utils.add_audit_rule '-a always,exit -F arch=b32 -S rename,unlink,rmdir,renameat,unlinkat -F auid>=1000 -F auid!=unset -k delete'
utils.add_audit_rule '-a always,exit -F arch=b64 -S rename,unlink,rmdir,renameat,unlinkat -F auid>=1000 -F auid!=unset -k delete'RHEL 9 must audit all uses of the truncate, ftruncate, creat, open, openat, and open_by_handle_at system calls.
utils.add_audit_rule '-a always,exit -F arch=b32 -S truncate,ftruncate,creat,open,openat,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -k perm_access'
utils.add_audit_rule '-a always,exit -F arch=b64 -S truncate,ftruncate,creat,open,openat,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -k perm_access'
utils.add_audit_rule '-a always,exit -F arch=b32 -S truncate,ftruncate,creat,open,openat,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -k perm_access'
utils.add_audit_rule '-a always,exit -F arch=b64 -S truncate,ftruncate,creat,open,openat,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -k perm_access'RHEL 9 must audit all uses of the delete_module system call.
utils.add_audit_rule '-a always,exit -F arch=b32 -S delete_module -F auid>=1000 -F auid!=unset -k module_chng'
utils.add_audit_rule '-a always,exit -F arch=b64 -S delete_module -F auid>=1000 -F auid!=unset -k module_chng'RHEL 9 must audit all uses of the init_module and finit_module system calls.
utils.add_audit_rule '-a always,exit -F arch=b32 -S init_module,finit_module -F auid>=1000 -F auid!=unset -k module_chng'
utils.add_audit_rule '-a always,exit -F arch=b64 -S init_module,finit_module -F auid>=1000 -F auid!=unset -k module_chng'RHEL 9 must audit all uses of the chage command.
utils.add_audit_rule '-a always,exit -F path=/usr/bin/chage -F perm=x -F auid>=1000 -F auid!=unset -k privileged-chage'RHEL 9 must audit all uses of the chsh command.
utils.add_audit_rule '-a always,exit -F path=/usr/bin/chsh -F perm=x -F auid>=1000 -F auid!=unset -k priv_cmd'RHEL 9 must audit all uses of the crontab command.
utils.add_audit_rule '-a always,exit -F path=/usr/bin/crontab -F perm=x -F auid>=1000 -F auid!=unset -k privileged-crontab'RHEL 9 must audit all uses of the gpasswd command.
utils.add_audit_rule '-a always,exit -F path=/usr/bin/gpasswd -F perm=x -F auid>=1000 -F auid!=unset -k privileged-gpasswd'RHEL 9 must audit all uses of the kmod command.
utils.add_audit_rule '-a always,exit -F path=/usr/bin/kmod -F perm=x -F auid>=1000 -F auid!=unset -k modules'RHEL 9 must audit all uses of the newgrp command.
utils.add_audit_rule '-a always,exit -F path=/usr/bin/newgrp -F perm=x -F auid>=1000 -F auid!=unset -k priv_cmd'RHEL 9 must audit all uses of the pam_timestamp_check command.
utils.add_audit_rule '-a always,exit -F path=/usr/sbin/pam_timestamp_check -F perm=x -F auid>=1000 -F auid!=unset -k privileged-pam_timestamp_check'RHEL 9 must audit all uses of the passwd command.
utils.add_audit_rule '-a always,exit -F path=/usr/bin/passwd -F perm=x -F auid>=1000 -F auid!=unset -k privileged-passwd'RHEL 9 must audit all uses of the postdrop command.
utils.add_audit_rule '-a always,exit -F path=/usr/sbin/postdrop -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update'RHEL 9 must audit all uses of the postqueue command.
utils.add_audit_rule '-a always,exit -F path=/usr/sbin/postqueue -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update'RHEL 9 must audit all uses of the ssh-agent command.
utils.add_audit_rule '-a always,exit -F path=/usr/bin/ssh-agent -F perm=x -F auid>=1000 -F auid!=unset -k privileged-ssh'RHEL 9 must audit all uses of the ssh-keysign command.
utils.add_audit_rule '-a always,exit -F path=/usr/libexec/openssh/ssh-keysign -F perm=x -F auid>=1000 -F auid!=unset -k privileged-ssh'RHEL 9 must audit all uses of the su command.
utils.add_audit_rule '-a always,exit -F path=/usr/bin/su -F perm=x -F auid>=1000 -F auid!=unset -k privileged-priv_change'RHEL 9 must audit all uses of the sudo command.
utils.add_audit_rule '-a always,exit -F path=/usr/bin/sudo -F perm=x -F auid>=1000 -F auid!=unset -k priv_cmd'RHEL 9 must audit all uses of the sudoedit command.
utils.add_audit_rule '-a always,exit -F path=/usr/bin/sudoedit -F perm=x -F auid>=1000 -F auid!=unset -k priv_cmd'RHEL 9 must audit all uses of the unix_chkpwd command.
utils.add_audit_rule '-a always,exit -F path=/usr/sbin/unix_chkpwd -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update'RHEL 9 must audit all uses of the unix_update command.
utils.add_audit_rule '-a always,exit -F path=/usr/sbin/unix_update -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update'RHEL 9 must audit all uses of the userhelper command.
utils.add_audit_rule '-a always,exit -F path=/usr/sbin/userhelper -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update'RHEL 9 must audit all uses of the usermod command.
utils.add_audit_rule '-a always,exit -F path=/usr/sbin/usermod -F perm=x -F auid>=1000 -F auid!=unset -k privileged-usermod'RHEL 9 must audit all uses of the mount command.
utils.add_audit_rule '-a always,exit -F path=/usr/bin/mount -F perm=x -F auid>=1000 -F auid!=unset -k privileged-mount'Successful/unsuccessful uses of the init command in RHEL 9 must generate an audit record.
utils.add_audit_rule '-a always,exit -F path=/usr/sbin/init -F perm=x -F auid>=1000 -F auid!=unset -k privileged-init'Successful/unsuccessful uses of the poweroff command in RHEL 9 must generate an audit record.
utils.add_audit_rule '-a always,exit -F path=/usr/sbin/poweroff -F perm=x -F auid>=1000 -F auid!=unset -k privileged-poweroff'Successful/unsuccessful uses of the reboot command in RHEL 9 must generate an audit record.
utils.add_audit_rule '-a always,exit -F path=/usr/sbin/reboot -F perm=x -F auid>=1000 -F auid!=unset -k privileged-reboot'Successful/unsuccessful uses of the shutdown command in RHEL 9 must generate an audit record.
utils.add_audit_rule '-a always,exit -F path=/usr/sbin/shutdown -F perm=x -F auid>=1000 -F auid!=unset -k privileged-shutdown'Successful/unsuccessful uses of the umount system call in RHEL 9 must generate an audit record.
utils.add_audit_rule '-a always,exit -F arch=b32 -S umount -F auid>=1000 -F auid!=unset -k privileged-umount'Successful/unsuccessful uses of the umount2 system call in RHEL 9 must generate an audit record.
utils.add_audit_rule '-a always,exit -F arch=b32 -S umount2 -F auid>=1000 -F auid!=unset -k perm_mod'
utils.add_audit_rule '-a always,exit -F arch=b64 -S umount2 -F auid>=1000 -F auid!=unset -k perm_mod'RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/sudoers.
utils.add_audit_rule '-w /etc/sudoers -p wa -k identity'RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/sudoers.d/ directory.
utils.add_audit_rule '-w /etc/sudoers.d/ -p wa -k identity'RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/group.
utils.add_audit_rule '-w /etc/group -p wa -k identity'RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/gshadow.
utils.add_audit_rule '-w /etc/gshadow -p wa -k identity'RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/opasswd.
utils.add_audit_rule '-w /etc/security/opasswd -p wa -k identity'RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/passwd.
utils.add_audit_rule '-w /etc/passwd -p wa -k identity'RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/shadow.
utils.add_audit_rule '-w /etc/shadow -p wa -k identity'RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /var/log/faillock.
utils.add_audit_rule '-w /var/log/faillock -p wa -k logins'RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /var/log/lastlog.
utils.add_audit_rule '-w /var/log/lastlog -p wa -k logins'RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /var/log/tallylog.
utils.add_audit_rule '-w /var/log/tallylog -p wa -k logins'RHEL 9 must take appropriate action when a critical audit processing failure occurs.
utils.add_audit_rule '-f 2'RHEL 9 audit system must protect logon UIDs from unauthorized change.
utils.add_audit_rule '--loginuid-immutable'RHEL 9 audit system must protect auditing rules from unauthorized change.
utils.add_audit_rule '-e 2'RHEL 9 must employ FIPS 140-3 approved cryptographic hashing algorithms for all stored passwords.
# configured correctly by default
awk -F: '$2 !~ /[!\*]+/ {print $2}' /etc/shadowRHEL 9 IP tunnels must use FIPS 140-2/140-3 approved cryptographic algorithms.
# IPsec service not installedRHEL 9 pam_unix.so module must be configured in the password-auth file to use a FIPS 140-3 approved cryptographic hashing algorithm for system authentication.
...RHEL 9 must have the crypto-policies package installed.
# installed by default
utils.ensure_package_installed crypto-policiesRHEL 9 crypto policy must not be overridden.
# default configuration
ls -l /etc/crypto-policies/back-ends/RHEL 9 must use mechanisms meeting the requirements of applicable federal laws, executive orders, directives, policies, regulations, standards, and guidance for authentication to a cryptographic module.
# configured correctly by default
ls -l /etc/crypto-policies/back-ends/krb5.configRHEL 9 must implement DOD-approved encryption in the OpenSSL package.
# configured correctly by default
grep -i opensslcnf.config /etc/pki/tls/openssl.cnfRHEL 9 must implement DOD-approved TLS encryption in the OpenSSL package.
# configured correctly by default
grep -i minprotocol /etc/crypto-policies/back-ends/opensslcnf.configRHEL 9 must implement a system-wide encryption policy.
update-crypto-policies --showRHEL 9 must implement DOD-approved encryption in the bind package.
# bind package is not installedRHEL 9 must enable the hardware random number generator entropy gatherer service.
# not applicable for FIPS mode systemRHEL 9 must enable mitigations against processor-based vulnerabilities.
# enabled by default
dmesg | grep 'page tables'
# to enable anyway
utils.add_kernel_cmdline 'pti=on'RHEL 9 must enable auditing of processes that start prior to the audit daemon.
# both should be set together, see: V-258173
utils.add_kernel_cmdline 'audit=1 audit_backlog_limit=8192'RHEL 9 must remove all software components after updated versions have been installed.
utils.set_config_option -d = /etc/dnf/dnf.conf clean_requirements_on_remove 1RHEL 9 must use a separate file system for /var.
# Already implemented during install
mountpoint /varRHEL 9 must use a separate file system for /var/log.
# Already implemented during install
mountpoint /var/logRHEL 9 must use a separate file system for the system audit data path.
# Already implemented during install
mountpoint /var/log/auditRHEL 9 must disable mounting of cramfs.
# cramfs was removed in RHEL 9
utils.blacklist_kernel_module cramfsRHEL 9 must disable the chrony daemon from acting as a server.
utils.set_config_option /etc/chrony.conf port 0RHEL 9 must disable network management of the chrony daemon.
utils.set_config_option /etc/chrony.conf cmdport 0RHEL 9 must enable Linux audit logging for the USBGuard daemon.
# no USB controller present in VMRHEL 9 must prevent users from disabling session control mechanisms.
sed -i '/tmux/d' /etc/shellsRHEL 9 must limit the number of concurrent sessions to ten for all accounts and/or account types.
utils.add_if_missing /etc/security/limits.d/stig.conf '* hard maxlogins 10'RHEL 9 must display the date and time of the last successful account logon upon logon.
# default behavior
grep pam_lastlog /etc/pam.d/postloginRHEL 9 must be configured so that the file integrity tool verifies Access Control Lists (ACLs).
# configured by default
grep acl /etc/aide.confRHEL 9 must be configured so that the file integrity tool verifies extended attributes.
# configured by default
grep xattrs /etc/aide.confRHEL 9 must allocate an audit_backlog_limit of sufficient size to capture processes that start prior to the audit daemon.
# both should be set together, see: V-257796
utils.add_kernel_cmdline 'audit=1 audit_backlog_limit=8192'