Oracle Linux 8 STIG V1R1

View as one page
STIG ID Title
OL08-00-030180 The OL 8 audit package must be installed.
OL08-00-030181 OL 8 audit records must contain information to establish what type of events occurred, the source of events, where events occurred, and the outcome of events.
OL08-00-010000 OL 8 must be a vendor-supported release.
OL08-00-010001 The OL 8 operating system must implement the Endpoint Security for Linux Threat Prevention tool.
OL08-00-010010 OL 8 vendor-packaged system security patches and updates must be installed and up to date.
OL08-00-010020 OL 8 must implement NIST FIPS-validated cryptography for the following: to provision digital signatures, to generate cryptographic hashes, and to protect data requiring data-at-rest protections in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.
OL08-00-010030 All OL 8 local disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at-rest protection.
OL08-00-010040 OL 8 must display the Standard Mandatory DoD Notice and Consent Banner before granting local or remote access to the system via an SSH logon.
OL08-00-010049 OL 8 must display a banner before granting local or remote access to the system via a graphical user logon.
OL08-00-010050 OL 8 must display the Standard Mandatory DoD Notice and Consent Banner before granting local or remote access to the system via a graphical user logon.
OL08-00-010060 OL 8 must display the Standard Mandatory DoD Notice and Consent Banner before granting local or remote access to the system via a command line user logon.
OL08-00-010070 All OL 8 remote access methods must be monitored.
OL08-00-010090 OL 8, for PKI-based authentication, must validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor.
OL08-00-010100 OL 8, for certificate-based authentication, must enforce authorized access to the corresponding private key.
OL08-00-010110 OL 8 must encrypt all stored passwords with a FIPS 140-2 approved cryptographic hashing algorithm.
OL08-00-010120 OL 8 must employ FIPS 140-2 approved cryptographic hashing algorithms for all stored passwords.
OL08-00-010130 The OL 8 password-auth file must be configured to use a sufficient number of hashing rounds.
OL08-00-010131 The OL 8 system-auth file must be configured to use a sufficient number of hashing rounds.
OL08-00-010140 OL 8 operating systems booted with United Extensible Firmware Interface (UEFI) must require authentication upon booting into single-user mode and maintenance.
OL08-00-010141 OL 8 operating systems booted with United Extensible Firmware Interface (UEFI) must have a unique name for the grub superusers account when booting into single-user mode and maintenance.
OL08-00-010149 OL 8 operating systems booted with a BIOS must have a unique name for the grub superusers account when booting into single-user and maintenance modes.
OL08-00-010150 OL 8 operating systems booted with a BIOS must require authentication upon booting into single-user and maintenance modes.
OL08-00-010151 OL 8 operating systems must require authentication upon booting into rescue mode.
OL08-00-010152 OL 8 operating systems must require authentication upon booting into emergency mode.
OL08-00-010159 The OL 8 "pam_unix.so" module must be configured in the system-auth file to use a FIPS 140-2 approved cryptographic hashing algorithm for system authentication.
OL08-00-010160 The OL 8 "pam_unix.so" module must be configured in the password-auth file to use a FIPS 140-2 approved cryptographic hashing algorithm for system authentication.
OL08-00-010161 OL 8 must prevent system daemons from using Kerberos for authentication.
OL08-00-010162 The krb5-workstation package must not be installed on OL 8.
OL08-00-010163 The krb5-server package must not be installed on OL 8.
OL08-00-010170 OL 8 must use a Linux Security Module configured to enforce limits on system services.
OL08-00-010171 OL 8 must have the "policycoreutils" package installed.
OL08-00-010180 All OL 8 public directories must be owned by root or a system account to prevent unauthorized and unintended information from being transferred via shared system resources.
OL08-00-010190 A sticky bit must be set on all OL 8 public directories to prevent unauthorized and unintended information transferred via shared system resources.
OL08-00-010200 OL 8 must be configured so that all network connections associated with SSH traffic are terminate after a period of inactivity.
OL08-00-010201 OL 8 must be configured so that all network connections associated with SSH traffic are terminated at the end of the session or after 10 minutes of inactivity.
OL08-00-010210 The OL 8 "/var/log/messages" file must have mode 0640 or less permissive.
OL08-00-010220 The OL 8 "/var/log/messages" file must be owned by root.
OL08-00-010230 The OL 8 "/var/log/messages" file must be group-owned by root.
OL08-00-010240 The OL 8 "/var/log" directory must have mode 0755 or less permissive.
OL08-00-010250 The OL 8 "/var/log" directory must be owned by root.
OL08-00-010260 The OL 8 "/var/log" directory must be group-owned by root.
OL08-00-010287 The OL 8 SSH daemon must be configured to use system-wide crypto policies.
OL08-00-010290 The OL 8 SSH server must be configured to use only Message Authentication Codes (MACs) employing FIPS 140-2 validated cryptographic hash algorithms.
OL08-00-010291 The OL 8 SSH server must be configured to use only ciphers employing FIPS 140-2 validated cryptographic algorithms.
OL08-00-010292 The OL 8 SSH server must be configured to use strong entropy.
OL08-00-010293 The OL 8 operating system must implement DoD-approved encryption in the OpenSSL package.
OL08-00-010294 The OL 8 operating system must implement DoD-approved TLS encryption in the OpenSSL package.
OL08-00-010295 The OL 8 operating system must implement DoD-approved TLS encryption in the GnuTLS package.
OL08-00-010300 OL 8 system commands must have mode 0755 or less permissive.
OL08-00-010310 OL 8 system commands must be owned by root.
OL08-00-010320 OL 8 system commands must be group-owned by root.
OL08-00-010330 OL 8 library files must have mode "0755" or less permissive.
OL08-00-010340 OL 8 library files must be owned by root.
OL08-00-010350 OL 8 library files must be group-owned by root.
OL08-00-010360 The OL 8 file integrity tool must notify the System Administrator (SA) when changes to the baseline configuration or anomalies in the operation of any security functions are discovered within an organizationally defined frequency.
OL08-00-010370 YUM must be configured to prevent the installation of patches, service packs, device drivers, or OL 8 system components that have not been digitally signed using a certificate that is recognized and approved by the organization.
OL08-00-010371 OL 8 must prevent the installation of software, patches, service packs, device drivers, or operating system components of local packages without verification they have been digitally signed using a certificate that is issued by a Certificate Authority (CA) that is recognized and approved by the organization.
OL08-00-010372 OL 8 must prevent the loading of a new kernel for later execution.
OL08-00-010373 OL 8 must enable kernel parameters to enforce Discretionary Access Control (DAC) on symlinks.
OL08-00-010374 OL 8 must enable kernel parameters to enforce Discretionary Access Control (DAC) on hardlinks.
OL08-00-010375 OL 8 must restrict access to the kernel message buffer.
OL08-00-010376 OL 8 must prevent kernel profiling by unprivileged users.
OL08-00-010380 OL 8 must require users to provide a password for privilege escalation.
OL08-00-010381 OL 8 must require users to reauthenticate for privilege escalation and changing roles.
OL08-00-010382 OL 8 must restrict privilege elevation to authorized personnel.
OL08-00-010383 OL 8 must use the invoking user's password for privilege escalation when using "sudo".
OL08-00-010384 OL 8 must require re-authentication when using the "sudo" command.
OL08-00-010390 OL 8 must have the package required for multifactor authentication installed.
OL08-00-010400 OL 8 must implement certificate status checking for multifactor authentication.
OL08-00-010410 OL 8 must accept Personal Identity Verification (PIV) credentials.
OL08-00-010420 OL 8 must implement non-executable data to protect its memory from unauthorized code execution.
OL08-00-010421 OL 8 must clear the page allocator to prevent use-after-free attacks.
OL08-00-010422 OL 8 must disable virtual syscalls.
OL08-00-010423 OL 8 must clear SLUB/SLAB objects to prevent use-after-free attacks.
OL08-00-010424 OL 8 must not let Meltdown and Spectre exploit critical vulnerabilities in modern processors.
OL08-00-010430 OL 8 must implement address space layout randomization (ASLR) to protect its memory from unauthorized code execution.
OL08-00-010440 YUM must remove all software components after updated versions have been installed on OL 8.
OL08-00-010450 OL 8 must enable the SELinux targeted policy.
OL08-00-010460 There must be no "shosts.equiv" files on the OL 8 operating system.
OL08-00-010470 There must be no ".shosts" files on the OL 8 operating system.
OL08-00-010471 OL 8 must enable the hardware random number generator entropy gatherer service.
OL08-00-010472 OL 8 must have the packages required to use the hardware random number generator entropy gatherer service.
OL08-00-010480 The OL 8 SSH public host key files must have mode "0644" or less permissive.
OL08-00-010490 The OL 8 SSH private host key files must have mode "0600" or less permissive.
OL08-00-010500 The OL 8 SSH daemon must perform strict mode checking of home directory configuration files.
OL08-00-010510 The OL 8 SSH daemon must not allow compression or must only allow compression after successful authentication.
OL08-00-010520 The OL 8 SSH daemon must not allow authentication using known host's authentication.
OL08-00-010521 The OL 8 SSH daemon must not allow Kerberos authentication, except to fulfill documented and validated mission requirements.
OL08-00-010522 The OL 8 SSH daemon must not allow GSSAPI authentication, except to fulfill documented and validated mission requirements.
OL08-00-010540 OL 8 must use a separate file system for "/var".
OL08-00-010541 OL 8 must use a separate file system for "/var/log".
OL08-00-010542 OL 8 must use a separate file system for the system audit data path.
OL08-00-010543 OL 8 must use a separate file system for "/tmp".
OL08-00-010544 OL 8 must use a separate file system for /var/tmp.
OL08-00-010550 OL 8 must not permit direct logons to the root account using remote access via SSH.
OL08-00-010560 The auditd service must be running in OL 8.
OL08-00-010561 OL 8 must have the rsyslog service enabled and active.
OL08-00-010570 OL 8 must prevent files with the setuid and setgid bit set from being executed on file systems that contain user home directories.
OL08-00-010571 OL 8 must prevent files with the setuid and setgid bit set from being executed on the /boot directory.
OL08-00-010572 OL 8 must prevent files with the setuid and setgid bit set from being executed on the /boot/efi directory.
OL08-00-010580 OL 8 must prevent special devices on non-root local partitions.
OL08-00-010590 OL 8 file systems that contain user home directories must not execute binary files.
OL08-00-010600 OL 8 file systems must not interpret character or block special devices from untrusted file systems.
OL08-00-010610 OL 8 file systems must not execute binary files on removable media.
OL08-00-010620 OL 8 must prevent files with the setuid and setgid bit set from being executed on file systems that are used with removable media.
OL08-00-010630 OL 8 file systems must not execute binary files that are imported via Network File System (NFS).
OL08-00-010640 OL 8 file systems must not interpret character or block special devices that are imported via NFS.
OL08-00-010650 OL 8 must prevent files with the setuid and setgid bit set from being executed on file systems that are imported via Network File System (NFS).
OL08-00-010660 Local OL 8 initialization files must not execute world-writable programs.
OL08-00-010670 OL 8 must disable kernel dumps unless needed.
OL08-00-010671 OL 8 must disable the "kernel.core_pattern".
OL08-00-010672 OL 8 must disable acquiring, saving, and processing core dumps.
OL08-00-010673 OL 8 must disable core dumps for all users.
OL08-00-010674 OL 8 must disable storing core dumps.
OL08-00-010675 OL 8 must disable core dump backtraces.
OL08-00-010680 For OL 8 systems using Domain Name Servers (DNS) resolution, at least two name servers must be configured.
OL08-00-010690 Executable search paths within the initialization files of all local interactive OL 8 users must only contain paths that resolve to the system default or the user's home directory.
OL08-00-010700 All OL 8 world-writable directories must be owned by root, sys, bin, or an application user.
OL08-00-010710 All OL 8 world-writable directories must be group-owned by root, sys, bin, or an application group.
OL08-00-010720 All OL 8 local interactive users must have a home directory assigned in the "/etc/passwd" file.
OL08-00-010730 All OL 8 local interactive user home directories must have mode "0750" or less permissive.
OL08-00-010731 All OL 8 local interactive user home directory files must have mode "0750" or less permissive.
OL08-00-010740 All OL 8 local interactive user home directories must be group-owned by the home directory owner's primary group.
OL08-00-010741 OL 8 must be configured so that all files and directories contained in local interactive user home directories are group-owned by a group of which the home directory owner is a member.
OL08-00-010750 All OL 8 local interactive user home directories defined in the "/etc/passwd" file must exist.
OL08-00-010760 All OL 8 local interactive user accounts must be assigned a home directory upon creation.
OL08-00-010770 All OL 8 local initialization files must have mode "0740" or less permissive.
OL08-00-010780 All OL 8 files and directories must have a valid owner.
OL08-00-010790 All OL 8 files and directories must have a valid group owner.
OL08-00-010800 A separate OL 8 filesystem must be used for user home directories (such as "/home" or an equivalent).
OL08-00-010820 Unattended or automatic logon via the OL 8 graphical user interface must not be allowed.
OL08-00-010830 OL 8 must not allow users to override SSH environment variables.
OL08-00-020000 OL 8 temporary user accounts must be provisioned with an expiration time of 72 hours or less.
OL08-00-020010 OL 8 systems below version 8.2 must automatically lock an account when three unsuccessful logon attempts occur.
OL08-00-020011 OL 8 systems, versions 8.2 and above, must automatically lock an account when three unsuccessful logon attempts occur.
OL08-00-020012 OL 8 systems below version 8.2 must automatically lock an account when three unsuccessful logon attempts occur during a 15-minute time period.
OL08-00-020013 OL 8 systems, versions 8.2 and above, must automatically lock an account when three unsuccessful logon attempts occur during a 15-minute time period.
OL08-00-020014 OL 8 systems below version 8.2 must automatically lock an account until the locked account is released by an administrator when three unsuccessful logon attempts occur during a 15-minute time period.
OL08-00-020015 OL 8 systems, versions 8.2 and above, must automatically lock an account until the locked account is released by an administrator when three unsuccessful logon attempts occur during a 15-minute time period.
OL08-00-020016 OL 8 systems below version 8.2 must ensure account lockouts persist.
OL08-00-020017 OL 8 systems, versions 8.2 and above, must ensure account lockouts persist.
OL08-00-020018 OL 8 systems below version 8.2 must prevent system messages from being presented when three unsuccessful logon attempts occur.
OL08-00-020019 OL 8 systems, versions 8.2 and above, must prevent system messages from being presented when three unsuccessful logon attempts occur.
OL08-00-020020 OL 8 systems below version 8.2 must log user name information when unsuccessful logon attempts occur.
OL08-00-020021 OL 8 systems, versions 8.2 and above, must log user name information when unsuccessful logon attempts occur.
OL08-00-020022 OL 8 systems below version 8.2 must include root when automatically locking an account until the locked account is released by an administrator when three unsuccessful logon attempts occur during a 15-minute time period.
OL08-00-020023 OL 8 systems, versions 8.2 and above, must include root when automatically locking an account until the locked account is released by an administrator when three unsuccessful logon attempts occur during a 15-minute time period.
OL08-00-020024 OL 8 must limit the number of concurrent sessions to 10 for all accounts and/or account types.
OL08-00-020025 OL 8 must configure the use of the pam_faillock.so module in the /etc/pam.d/system-auth file.
OL08-00-020026 OL 8 must configure the use of the pam_faillock.so module in the /etc/pam.d/password-auth file.
OL08-00-020027 OL 8 systems, versions 8.2 and above, must configure SELinux context type to allow the use of a non-default faillock tally directory.
OL08-00-020028 OL 8 systems below version 8.2 must configure SELinux context type to allow the use of a non-default faillock tally directory.
OL08-00-020030 OL 8 must enable a user session lock until that user reestablishes access using established identification and authentication procedures for graphical user sessions.
OL08-00-020031 OL 8 must initiate a session lock for graphical user interfaces when the screensaver is activated.
OL08-00-020032 OL 8 must disable the user list at logon for graphical user interfaces.
OL08-00-020039 OL 8 must have the tmux package installed.
OL08-00-020040 OL 8 must enable a user session lock until that user re-establishes access using established identification and authentication procedures for command line sessions.
OL08-00-020041 OL 8 must ensure session control is automatically started at shell initialization.
OL08-00-020042 OL 8 must prevent users from disabling session control mechanisms.
OL08-00-020043 OL 8 must enable a user session lock until that user reestablishes access using established identification and authentication procedures for command line sessions.
OL08-00-020050 OL 8 must be able to initiate directly a session lock for all connection types using smartcard when the smartcard is removed.
OL08-00-020060 OL 8 must automatically lock graphical user sessions after 15 minutes of inactivity.
OL08-00-020070 OL 8 must automatically lock command line user sessions after 15 minutes of inactivity.
OL08-00-020080 OL 8 must prevent a user from overriding the session lock-delay setting for the graphical user interface.
OL08-00-020081 OL 8 must prevent a user from overriding the session idle-delay setting for the graphical user interface.
OL08-00-020082 OL 8 must prevent a user from overriding the session lock-enabled setting for the graphical user interface.
OL08-00-020090 OL 8 must map the authenticated identity to the user or group account for PKI-based authentication.
OL08-00-020100 OL 8 must ensure a password complexity module is enabled.
OL08-00-020110 OL 8 must enforce password complexity by requiring that at least one uppercase character be used.
OL08-00-020120 OL 8 must enforce password complexity by requiring that at least one lowercase character be used.
OL08-00-020130 OL 8 must enforce password complexity by requiring that at least one numeric character be used.
OL08-00-020140 OL 8 must require the maximum number of repeating characters of the same character class be limited to four when passwords are changed.
OL08-00-020150 OL 8 must require the maximum number of repeating characters be limited to three when passwords are changed.
OL08-00-020160 OL 8 must require the change of at least four character classes when passwords are changed.
OL08-00-020170 OL 8 must require the change of at least 8 characters when passwords are changed.
OL08-00-020180 OL 8 passwords for new users or password changes must have a 24 hours/1 day minimum password lifetime restriction in "/etc/shadow".
OL08-00-020190 OL 8 passwords for new users or password changes must have a 24 hours/1 day minimum password lifetime restriction in "/etc/logins.def".
OL08-00-020200 OL 8 user account passwords must have a 60-day maximum password lifetime restriction.
OL08-00-020210 OL 8 user account passwords must be configured so that existing passwords are restricted to a 60-day maximum lifetime.
OL08-00-020220 OL 8 passwords must be prohibited from reuse for a minimum of five generations.
OL08-00-020230 OL 8 passwords must have a minimum of 15 characters.
OL08-00-020231 OL 8 passwords for new users must have a minimum of 15 characters.
OL08-00-020240 OL 8 duplicate User IDs (UIDs) must not exist for interactive users.
OL08-00-020250 OL 8 must implement multifactor authentication for access to interactive accounts.
OL08-00-020260 The OL 8 system-auth file must disable access to the system for account identifiers (individuals, groups, roles, and devices) with 35 days of inactivity.
OL08-00-020261 The OL 8 password-auth file must disable access to the system for account identifiers (individuals, groups, roles, and devices) with 35 days of inactivity.
OL08-00-020262 The OL 8 lastlog command must have a mode of "0750" or less permissive.
OL08-00-020263 The OL 8 lastlog command must be owned by root.
OL08-00-020264 The OL 8 lastlog command must be group-owned by root.
OL08-00-020270 OL 8 emergency accounts must be automatically removed or disabled after the crisis is resolved or within 72 hours.
OL08-00-020280 All OL 8 passwords must contain at least one special character.
OL08-00-020290 OL 8 must prohibit the use of cached authentications after one day.
OL08-00-020300 OL 8 must prevent the use of dictionary words for passwords.
OL08-00-020310 OL 8 must enforce a delay of at least four seconds between logon prompts following a failed logon attempt.
OL08-00-020320 OL 8 must not have unnecessary accounts.
OL08-00-020330 OL 8 must not allow accounts configured with blank or null passwords.
OL08-00-020331 OL 8 must not allow blank or null passwords in the system-auth file.
OL08-00-020332 OL 8 must not allow blank or null passwords in the password-auth file.
OL08-00-020340 OL 8 must display the date and time of the last successful account logon upon logon.
OL08-00-020350 OL 8 must display the date and time of the last successful account logon upon an SSH logon.
OL08-00-020351 OL 8 default permissions must be defined in such a way that all authenticated users can read and modify only their own files.
OL08-00-020352 OL 8 must set the umask value to 077 for all local interactive user accounts.
OL08-00-020353 OL 8 must define default permissions for logon and non-logon shells.
OL08-00-030000 The OL 8 audit system must be configured to audit the execution of privileged functions and prevent all software from executing at higher privilege levels than users executing the software.
OL08-00-030010 Cron logging must be implemented in OL 8.
OL08-00-030020 The OL 8 System Administrator (SA) and Information System Security Officer (ISSO) (at a minimum) must be alerted of an audit processing failure event.
OL08-00-030030 The OL 8 Information System Security Officer (ISSO) and System Administrator (SA) (at a minimum) must have mail aliases to be notified of an audit processing failure.
OL08-00-030040 The OL 8 System must take appropriate action when an audit processing failure occurs.
OL08-00-030050 The OL 8 System Administrator (SA) and Information System Security Officer (ISSO) (at a minimum) must be alerted when the audit storage volume is full.
OL08-00-030060 The OL 8 audit system must take appropriate action when the audit storage volume is full.
OL08-00-030061 The OL 8 audit system must audit local events.
OL08-00-030062 OL 8 must label all offloaded audit logs before sending them to the central log server.
OL08-00-030063 OL 8 must resolve audit information before writing to disk.
OL08-00-030070 OL 8 audit logs must have a mode of "0600" or less permissive to prevent unauthorized read access.
OL08-00-030080 OL 8 audit logs must be owned by root to prevent unauthorized read access.
OL08-00-030090 OL 8 audit logs must be group-owned by root to prevent unauthorized read access.
OL08-00-030100 The OL 8 audit log directory must be owned by root to prevent unauthorized read access.
OL08-00-030110 The OL 8 audit log directory must be group-owned by root to prevent unauthorized read access.
OL08-00-030120 The OL 8 audit log directory must have a mode of 0700 or less permissive to prevent unauthorized read access.
OL08-00-030121 The OL 8 audit system must protect auditing rules from unauthorized change.
OL08-00-030122 The OL 8 audit system must protect logon UIDs from unauthorized change.
OL08-00-030130 OL 8 must generate audit records for all account creation events that affect "/etc/shadow".
OL08-00-030140 OL 8 must generate audit records for all account creation events that affect "/etc/security/opasswd".
OL08-00-030150 OL 8 must generate audit records for all account creation events that affect "/etc/passwd".
OL08-00-030160 OL 8 must generate audit records for all account creation events that affect "/etc/gshadow".
OL08-00-030170 OL 8 must generate audit records for all account creation events that affect "/etc/group".
OL08-00-030171 OL 8 must generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/sudoers".
OL08-00-030172 OL 8 must generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/sudoers.d/".
OL08-00-030190 OL 8 must generate audit records for any use of the "su" command.
OL08-00-030200 The OL 8 audit system must be configured to audit any use of the "lremovexattr" system call.
OL08-00-030210 The OL 8 audit system must be configured to audit any use of the "removexattr" system call.
OL08-00-030220 The OL 8 audit system must be configured to audit any use of the "lsetxattr" system call.
OL08-00-030230 The OL 8 audit system must be configured to audit any use of the "fsetxattr" system call.
OL08-00-030240 The OL 8 audit system must be configured to audit any use of the "fremovexattr" system call.
OL08-00-030250 OL 8 must generate audit records for any use of the "chage" command.
OL08-00-030260 OL 8 must generate audit records for any uses of the "chcon" command.
OL08-00-030270 The OL 8 audit system must be configured to audit any use of the "setxattr" system call.
OL08-00-030280 OL 8 must generate audit records for any use of the "ssh-agent" command.
OL08-00-030290 OL 8 must generate audit records for any use of the "passwd" command.
OL08-00-030300 OL 8 must generate audit records for any use of the "mount" command.
OL08-00-030301 OL 8 must generate audit records for any use of the "umount" command.
OL08-00-030302 OL 8 must generate audit records for any use of the "mount" syscall.
OL08-00-030310 OL 8 must generate audit records for any use of the "unix_update" command.
OL08-00-030311 OL 8 must generate audit records for any use of the "postdrop" command.
OL08-00-030312 OL 8 must generate audit records for any use of the "postqueue" command.
OL08-00-030313 OL 8 must generate audit records for any use of the "semanage" command.
OL08-00-030314 OL 8 must generate audit records for any use of the "setfiles" command.
OL08-00-030315 OL 8 must generate audit records for any use of the "userhelper" command.
OL08-00-030316 OL 8 must generate audit records for any use of the "setsebool" command.
OL08-00-030317 OL 8 must generate audit records for any use of the "unix_chkpwd" command.
OL08-00-030320 OL 8 must generate audit records for any use of the "ssh-keysign" command.
OL08-00-030330 OL 8 must generate audit records for any use of the "setfacl" command.
OL08-00-030340 OL 8 must generate audit records for any use of the "pam_timestamp_check" command.
OL08-00-030350 OL 8 must generate audit records for any use of the "newgrp" command.
OL08-00-030360 OL 8 must generate audit records for any use of the "init_module" syscall.
OL08-00-030361 OL 8 must generate audit records for any use of the "rename" command.
OL08-00-030362 OL 8 must generate audit records for any use of the "renameat" syscall.
OL08-00-030363 OL 8 must generate audit records for any use of the "rmdir" syscall.
OL08-00-030364 OL 8 must generate audit records for any use of the "unlink" command.
OL08-00-030365 OL 8 must generate audit records for any use of the "unlinkat" syscall.
OL08-00-030370 OL 8 must generate audit records for any use of the "gpasswd" command.
OL08-00-030380 OL 8 must generate audit records for any use of the "finit_module" syscall.
OL08-00-030390 OL 8 must generate audit records for any use of the delete_module syscall.
OL08-00-030400 OL 8 must generate audit records for any use of the "crontab" command.
OL08-00-030410 OL 8 must generate audit records for any use of the "chsh" command.
OL08-00-030420 OL 8 must generate audit records for any use of the "truncate" syscall.
OL08-00-030430 OL 8 must generate audit records for any use of the "openat" system call.
OL08-00-030440 OL 8 must generate audit records for any use of the "open" system call.
OL08-00-030450 OL 8 must generate audit records for any use of the "open_by_handle_at" system call.
OL08-00-030460 OL 8 must generate audit records for any use of the "ftruncate" system call.
OL08-00-030470 OL 8 must generate audit records for any use of the "creat" system call.
OL08-00-030480 OL 8 must generate audit records for any use of the "chown" command.
OL08-00-030490 OL 8 must generate audit records for any use of the "chmod" command.
OL08-00-030500 OL 8 must generate audit records for any use of the "lchown" system call.
OL08-00-030510 OL 8 must generate audit records for any use of the "fchownat" system call.
OL08-00-030520 OL 8 must generate audit records for any use of the "fchown" system call.
OL08-00-030530 OL 8 must generate audit records for any use of the "fchmodat" system call.
OL08-00-030540 OL 8 must generate audit records for any use of the "fchmod" system call.
OL08-00-030550 OL 8 must generate audit records for any use of the "sudo" command.
OL08-00-030560 OL 8 must generate audit records for any use of the "usermod" command.
OL08-00-030570 OL 8 must generate audit records for any use of the "chacl" command.
OL08-00-030580 OL 8 must generate audit records for any use of the "kmod" command.
OL08-00-030590 OL 8 must generate audit records for any attempted modifications to the "faillock" log file.
OL08-00-030600 OL 8 must generate audit records for any attempted modifications to the "lastlog" file.
OL08-00-030601 OL 8 must enable auditing of processes that start prior to the audit daemon.
OL08-00-030602 OL 8 must allocate an "audit_backlog_limit" of sufficient size to capture processes that start prior to the audit daemon.
OL08-00-030603 OL 8 must enable Linux audit logging for the USBGuard daemon.
OL08-00-030610 OL 8 must allow only the Information System Security Manager (ISSM) (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited.
OL08-00-030620 OL 8 audit tools must have a mode of "0755" or less permissive.
OL08-00-030630 OL 8 audit tools must be owned by root.
OL08-00-030640 OL 8 audit tools must be group-owned by root.
OL08-00-030650 OL 8 must use cryptographic mechanisms to protect the integrity of audit tools.
OL08-00-030660 OL 8 must allocate audit record storage capacity to store at least one week of audit records when audit records are not immediately sent to a central audit record storage facility.
OL08-00-030670 OL 8 must have the packages required for offloading audit logs installed.
OL08-00-030680 OL 8 must have the packages required for encrypting offloaded audit logs installed.
OL08-00-030690 The OL 8 audit records must be offloaded onto a different system or storage media from the system being audited.
OL08-00-030700 OL 8 must take appropriate action when the internal event queue is full.
OL08-00-030710 OL 8 must encrypt the transfer of audit records offloaded onto a different system or media from the system being audited.
OL08-00-030720 OL 8 must authenticate the remote logging server for offloading audit logs.
OL08-00-030730 OL 8 must take action when allocated audit record storage volume reaches 75 percent of the repository maximum audit record storage capacity.
OL08-00-030731 OL 8 must notify the System Administrator (SA) and Information System Security Officer (ISSO) (at a minimum) when allocated audit record storage volume 75 percent utilization.
OL08-00-030740 OL 8 must compare internal information system clocks at least every 24 hours with a server synchronized to an authoritative time source, such as the United States Naval Observatory (USNO) time servers, or a time server designated for the appropriate DoD network (NIPRNet/SIPRNet), and/or the Global Positioning System (GPS).
OL08-00-030741 OL 8 must disable the chrony daemon from acting as a server.
OL08-00-030742 OL 8 must disable network management of the chrony daemon.
OL08-00-040000 OL 8 must not have the telnet-server package installed.
OL08-00-040001 OL 8 must not have any automated bug reporting tools installed.
OL08-00-040002 OL 8 must not have the sendmail package installed.
OL08-00-040004 OL 8 must enable mitigations against processor-based vulnerabilities.
OL08-00-040010 OL 8 must not have the rsh-server package installed.
OL08-00-040020 OL 8 must cover or disable the built-in or attached camera when not in use.
OL08-00-040021 OL 8 must not have the asynchronous transfer mode (ATM) kernel module installed if not required for operational support.
OL08-00-040022 OL 8 must not have the Controller Area Network (CAN) kernel module installed if not required for operational support.
OL08-00-040023 OL 8 must not have the stream control transmission protocol (SCTP) kernel module installed if not required for operational support.
OL08-00-040024 OL 8 must disable the transparent inter-process communication (TIPC) protocol.
OL08-00-040025 OL 8 must disable mounting of cramfs.
OL08-00-040026 OL 8 must disable IEEE 1394 (FireWire) Support.
OL08-00-040030 OL 8 must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services as defined in the Ports, Protocols, and Services Management (PPSM) Category Assignments List (CAL) and vulnerability assessments.
OL08-00-040070 The OL 8 file system automounter must be disabled unless required.
OL08-00-040080 OL 8 must be configured to disable the ability to use USB mass storage devices.
OL08-00-040081 OL 8 must be configured to disable USB mass storage.
OL08-00-040090 An OL 8 firewall must employ a deny-all, allow-by-exception policy for allowing connections to other systems.
OL08-00-040100 A firewall must be installed on OL 8.
OL08-00-040101 A firewall must be active on OL 8.
OL08-00-040110 OL 8 wireless network adapters must be disabled.
OL08-00-040111 OL 8 Bluetooth must be disabled.
OL08-00-040120 OL 8 must mount "/dev/shm" with the "nodev" option.
OL08-00-040121 OL 8 must mount "/dev/shm" with the "nosuid" option.
OL08-00-040122 OL 8 must mount "/dev/shm" with the "noexec" option.
OL08-00-040123 OL 8 must mount "/tmp" with the "nodev" option.
OL08-00-040124 OL 8 must mount "/tmp" with the "nosuid" option.
OL08-00-040125 OL 8 must mount "/tmp" with the "noexec" option.
OL08-00-040126 OL 8 must mount "/var/log" with the "nodev" option.
OL08-00-040127 OL 8 must mount "/var/log" with the "nosuid" option.
OL08-00-040128 OL 8 must mount "/var/log" with the "noexec" option.
OL08-00-040129 OL 8 must mount "/var/log/audit" with the "nodev" option.
OL08-00-040130 OL 8 must mount "/var/log/audit" with the "nosuid" option.
OL08-00-040131 OL 8 must mount "/var/log/audit" with the "noexec" option.
OL08-00-040132 OL 8 must mount "/var/tmp" with the "nodev" option.
OL08-00-040133 OL 8 must mount "/var/tmp" with the "nosuid" option.
OL08-00-040134 OL 8 must mount "/var/tmp" with the "noexec" option.
OL08-00-040135 The OL 8 "fapolicy" module must be installed.
OL08-00-040136 The OL 8 "fapolicy" module must be enabled.
OL08-00-040137 The OL 8 fapolicy module must be configured to employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs.
OL08-00-040139 OL 8 must have the USBGuard installed.
OL08-00-040140 OL 8 must block unauthorized peripherals before establishing a connection.
OL08-00-040141 OL 8 must enable the USBGuard.
OL08-00-040150 A firewall must be able to protect against or limit the effects of denial-of-service (DoS) attacks by ensuring OL 8 can implement rate-limiting measures on impacted network interfaces.
OL08-00-040159 All OL 8 networked systems must have SSH installed.
OL08-00-040160 All OL 8 networked systems must have and implement SSH to protect the confidentiality and integrity of transmitted and received information, as well as information during preparation for transmission.
OL08-00-040161 OL 8 must force a frequent session key renegotiation for SSH connections to the server.
OL08-00-040170 The x86 Ctrl-Alt-Delete key sequence must be disabled on OL 8.
OL08-00-040171 The x86 Ctrl-Alt-Delete key sequence in OL 8 must be disabled if a graphical user interface is installed.
OL08-00-040172 OL 8 must disable the systemd Ctrl-Alt-Delete burst key sequence.
OL08-00-040180 OL 8 must disable the debug-shell systemd service.
OL08-00-040190 The Trivial File Transfer Protocol (TFTP) server package must not be installed if not required for OL 8 operational support.
OL08-00-040200 The root account must be the only account having unrestricted access to the OL 8 system.
OL08-00-040209 OL 8 must prevent IPv4 Internet Control Message Protocol (ICMP) redirect messages from being accepted.
OL08-00-040210 OL 8 must prevent IPv6 Internet Control Message Protocol (ICMP) redirect messages from being accepted.
OL08-00-040220 OL 8 must not send Internet Control Message Protocol (ICMP) redirects.
OL08-00-040230 OL 8 must not respond to Internet Control Message Protocol (ICMP) echoes sent to a broadcast address.
OL08-00-040239 OL 8 must not forward IPv4 source-routed packets.
OL08-00-040240 OL 8 must not forward IPv6 source-routed packets.
OL08-00-040249 OL 8 must not forward IPv4 source-routed packets by default.
OL08-00-040250 OL 8 must not forward IPv6 source-routed packets by default.
OL08-00-040260 OL 8 must not perform packet forwarding unless the system is a router.
OL08-00-040261 OL 8 must not accept router advertisements on all IPv6 interfaces.
OL08-00-040262 OL 8 must not accept router advertisements on all IPv6 interfaces by default.
OL08-00-040270 OL 8 must not allow interfaces to perform Internet Control Message Protocol (ICMP) redirects by default.
OL08-00-040279 OL 8 must ignore IPv4 Internet Control Message Protocol (ICMP) redirect messages.
OL08-00-040280 OL 8 must ignore IPv6 Internet Control Message Protocol (ICMP) redirect messages.
OL08-00-040281 OL 8 must disable access to the network "bpf" syscall from unprivileged processes.
OL08-00-040282 OL 8 must restrict the use of "ptrace" to descendant processes.
OL08-00-040283 OL 8 must restrict exposed kernel pointer addresses access.
OL08-00-040284 OL 8 must disable the use of user namespaces.
OL08-00-040285 OL 8 must use reverse path filtering on all IPv4 interfaces.
OL08-00-040286 OL 8 must enable hardening for the Berkeley Packet Filter Just-in-time compiler.
OL08-00-040290 OL 8 must be configured to prevent unrestricted mail relaying.
OL08-00-040300 The OL 8 file integrity tool must be configured to verify extended attributes.
OL08-00-040310 The OL 8 file integrity tool must be configured to verify Access Control Lists (ACLs).
OL08-00-040320 The graphical display manager must not be installed on OL 8 unless approved.
OL08-00-040330 OL 8 network interfaces must not be in promiscuous mode.
OL08-00-040340 OL 8 remote X connections for interactive users must be disabled unless to fulfill documented and validated mission requirements.
OL08-00-040341 The OL 8 SSH daemon must prevent remote hosts from connecting to the proxy display.
OL08-00-040350 If the Trivial File Transfer Protocol (TFTP) server is required, the OL 8 TFTP daemon must be configured to operate in secure mode.
OL08-00-040360 A File Transfer Protocol (FTP) server package must not be installed unless mission essential on OL 8.
OL08-00-040370 OL 8 must not have the "gssproxy" package installed if not required for operational support.
OL08-00-040380 OL 8 must not have the "iprutils" package installed if not required for operational support.
OL08-00-040390 OL 8 must not have the "tuned" package installed if not required for operational support.
OL08-00-040400 OL 8 must prevent non-privileged users from executing privileged functions, including disabling, circumventing, or altering implemented security safeguards/countermeasures.