| OL08-00-030180 |
The OL 8 audit package must be installed. |
| OL08-00-030181 |
OL 8 audit records must contain information to establish what type of events occurred, the source of events, where events occurred, and the outcome of events. |
| OL08-00-010000 |
OL 8 must be a vendor-supported release. |
| OL08-00-010001 |
The OL 8 operating system must implement the Endpoint Security for Linux Threat Prevention tool. |
| OL08-00-010010 |
OL 8 vendor-packaged system security patches and updates must be installed and up to date. |
| OL08-00-010020 |
OL 8 must implement NIST FIPS-validated cryptography for the following: To provision digital signatures, to generate cryptographic hashes, and to protect data requiring data-at-rest protections in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards. |
| OL08-00-010030 |
All OL 8 local disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at-rest protection. |
| OL08-00-010040 |
OL 8 must display the Standard Mandatory DoD Notice and Consent Banner before granting local or remote access to the system via an SSH logon. |
| OL08-00-010049 |
OL 8 must display a banner before granting local or remote access to the system via a graphical user logon. |
| OL08-00-010050 |
OL 8 must display the Standard Mandatory DoD Notice and Consent Banner before granting local or remote access to the system via a graphical user logon. |
| OL08-00-010060 |
OL 8 must display the Standard Mandatory DoD Notice and Consent Banner before granting local or remote access to the system via a command line user logon. |
| OL08-00-010070 |
All OL 8 remote access methods must be monitored. |
| OL08-00-010090 |
OL 8, for PKI-based authentication, must validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor. |
| OL08-00-010100 |
OL 8, for certificate-based authentication, must enforce authorized access to the corresponding private key. |
| OL08-00-010110 |
OL 8 must encrypt all stored passwords with a FIPS 140-2 approved cryptographic hashing algorithm. |
| OL08-00-010120 |
OL 8 must employ FIPS 140-2 approved cryptographic hashing algorithms for all stored passwords. |
| OL08-00-010130 |
The OL 8 shadow password suite must be configured to use a sufficient number of hashing rounds. |
| OL08-00-010140 |
OL 8 operating systems booted with United Extensible Firmware Interface (UEFI) must require authentication upon booting into single-user mode and maintenance. |
| OL08-00-010141 |
OL 8 operating systems booted with United Extensible Firmware Interface (UEFI) must have a unique name for the grub superusers account when booting into single-user mode and maintenance. |
| OL08-00-010149 |
OL 8 operating systems booted with a BIOS must have a unique name for the grub superusers account when booting into single-user and maintenance modes. |
| OL08-00-010150 |
OL 8 operating systems booted with a BIOS must require authentication upon booting into single-user and maintenance modes. |
| OL08-00-010151 |
OL 8 operating systems must require authentication upon booting into rescue mode. |
| OL08-00-010152 |
OL 8 operating systems must require authentication upon booting into emergency mode. |
| OL08-00-010159 |
The OL 8 "pam_unix.so" module must be configured in the system-auth file to use a FIPS 140-2 approved cryptographic hashing algorithm for system authentication. |
| OL08-00-010160 |
The OL 8 "pam_unix.so" module must be configured in the password-auth file to use a FIPS 140-2 approved cryptographic hashing algorithm for system authentication. |
| OL08-00-010161 |
OL 8 must prevent system daemons from using Kerberos for authentication. |
| OL08-00-010162 |
The krb5-workstation package must not be installed on OL 8. |
| OL08-00-010163 |
The krb5-server package must not be installed on OL 8. |
| OL08-00-010170 |
OL 8 must use a Linux Security Module configured to enforce limits on system services. |
| OL08-00-010171 |
OL 8 must have the "policycoreutils" package installed. |
| OL08-00-010190 |
A sticky bit must be set on all OL 8 public directories to prevent unauthorized and unintended information transferred via shared system resources. |
| OL08-00-010200 |
OL 8 must be configured so that all network connections associated with SSH traffic are terminate after a period of inactivity. |
| OL08-00-010201 |
OL 8 must be configured so that all network connections associated with SSH traffic are terminated at the end of the session or after 10 minutes of inactivity. |
| OL08-00-010210 |
The OL 8 "/var/log/messages" file must have mode 0640 or less permissive. |
| OL08-00-010220 |
The OL 8 "/var/log/messages" file must be owned by root. |
| OL08-00-010230 |
The OL 8 "/var/log/messages" file must be group-owned by root. |
| OL08-00-010240 |
The OL 8 "/var/log" directory must have mode 0755 or less permissive. |
| OL08-00-010250 |
The OL 8 "/var/log" directory must be owned by root. |
| OL08-00-010260 |
The OL 8 "/var/log" directory must be group-owned by root. |
| OL08-00-010287 |
The OL 8 SSH daemon must be configured to use system-wide crypto policies. |
| OL08-00-010290 |
The OL 8 SSH server must be configured to use only Message Authentication Codes (MACs) employing FIPS 140-2 validated cryptographic hash algorithms. |
| OL08-00-010291 |
The OL 8 SSH server must be configured to use only ciphers employing FIPS 140-2 validated cryptographic algorithms. |
| OL08-00-010292 |
The OL 8 SSH server must be configured to use strong entropy. |
| OL08-00-010293 |
The OL 8 operating system must implement DoD-approved encryption in the OpenSSL package. |
| OL08-00-010294 |
The OL 8 operating system must implement DoD-approved TLS encryption in the OpenSSL package. |
| OL08-00-010295 |
The OL 8 operating system must implement DoD-approved TLS encryption in the GnuTLS package. |
| OL08-00-010300 |
OL 8 system commands must have mode 755 or less permissive. |
| OL08-00-010310 |
OL 8 system commands must be owned by root. |
| OL08-00-010320 |
OL 8 system commands must be group-owned by root or a system account. |
| OL08-00-010330 |
OL 8 library files must have mode 755 or less permissive. |
| OL08-00-010340 |
OL 8 library files must be owned by root. |
| OL08-00-010350 |
OL 8 library files must be group-owned by root. |
| OL08-00-010360 |
The OL 8 file integrity tool must notify the System Administrator (SA) when changes to the baseline configuration or anomalies in the operation of any security functions are discovered within an organizationally defined frequency. |
| OL08-00-010370 |
YUM must be configured to prevent the installation of patches, service packs, device drivers, or OL 8 system components that have not been digitally signed using a certificate that is recognized and approved by the organization. |
| OL08-00-010371 |
OL 8 must prevent the installation of software, patches, service packs, device drivers, or operating system components of local packages without verification they have been digitally signed using a certificate that is issued by a Certificate Authority (CA) that is recognized and approved by the organization. |
| OL08-00-010372 |
OL 8 must prevent the loading of a new kernel for later execution. |
| OL08-00-010373 |
OL 8 must enable kernel parameters to enforce Discretionary Access Control (DAC) on symlinks. |
| OL08-00-010374 |
OL 8 must enable kernel parameters to enforce Discretionary Access Control (DAC) on hardlinks. |
| OL08-00-010375 |
OL 8 must restrict access to the kernel message buffer. |
| OL08-00-010376 |
OL 8 must prevent kernel profiling by unprivileged users. |
| OL08-00-010380 |
OL 8 must require users to provide a password for privilege escalation. |
| OL08-00-010381 |
OL 8 must require users to reauthenticate for privilege escalation and changing roles. |
| OL08-00-010382 |
OL 8 must restrict privilege elevation to authorized personnel. |
| OL08-00-010383 |
OL 8 must use the invoking user's password for privilege escalation when using "sudo". |
| OL08-00-010384 |
OL 8 must require re-authentication when using the "sudo" command. |
| OL08-00-010390 |
OL 8 must have the package required for multifactor authentication installed. |
| OL08-00-010400 |
OL 8 must implement certificate status checking for multifactor authentication. |
| OL08-00-010410 |
OL 8 must accept Personal Identity Verification (PIV) credentials. |
| OL08-00-010420 |
OL 8 must implement non-executable data to protect its memory from unauthorized code execution. |
| OL08-00-010421 |
OL 8 must clear the page allocator to prevent use-after-free attacks. |
| OL08-00-010422 |
OL 8 must disable virtual syscalls. |
| OL08-00-010423 |
OL 8 must clear SLUB/SLAB objects to prevent use-after-free attacks. |
| OL08-00-010424 |
OL 8 must not let Meltdown and Spectre exploit critical vulnerabilities in modern processors. |
| OL08-00-010430 |
OL 8 must implement address space layout randomization (ASLR) to protect its memory from unauthorized code execution. |
| OL08-00-010440 |
YUM must remove all software components after updated versions have been installed on OL 8. |
| OL08-00-010450 |
OL 8 must enable the SELinux targeted policy. |
| OL08-00-010460 |
There must be no "shosts.equiv" files on the OL 8 operating system. |
| OL08-00-010470 |
There must be no ".shosts" files on the OL 8 operating system. |
| OL08-00-010471 |
OL 8 must enable the hardware random number generator entropy gatherer service. |
| OL08-00-010472 |
OL 8 must have the packages required to use the hardware random number generator entropy gatherer service. |
| OL08-00-010480 |
The OL 8 SSH public host key files must have mode "0644" or less permissive. |
| OL08-00-010490 |
The OL 8 SSH private host key files must have mode "0600" or less permissive. |
| OL08-00-010500 |
The OL 8 SSH daemon must perform strict mode checking of home directory configuration files. |
| OL08-00-010510 |
The OL 8 SSH daemon must not allow compression or must only allow compression after successful authentication. |
| OL08-00-010520 |
The OL 8 SSH daemon must not allow authentication using known host's authentication. |
| OL08-00-010521 |
The OL 8 SSH daemon must not allow Kerberos authentication, except to fulfill documented and validated mission requirements. |
| OL08-00-010522 |
The OL 8 SSH daemon must not allow GSSAPI authentication, except to fulfill documented and validated mission requirements. |
| OL08-00-010540 |
OL 8 must use a separate file system for "/var". |
| OL08-00-010541 |
OL 8 must use a separate file system for "/var/log". |
| OL08-00-010542 |
OL 8 must use a separate file system for the system audit data path. |
| OL08-00-010543 |
OL 8 must use a separate file system for "/tmp". |
| OL08-00-010544 |
OL 8 must use a separate file system for /var/tmp. |
| OL08-00-010550 |
OL 8 must not permit direct logons to the root account using remote access via SSH. |
| OL08-00-010561 |
OL 8 must have the rsyslog service enabled and active. |
| OL08-00-010570 |
OL 8 must prevent files with the setuid and setgid bit set from being executed on file systems that contain user home directories. |
| OL08-00-010571 |
OL 8 must prevent files with the setuid and setgid bit set from being executed on the /boot directory. |
| OL08-00-010572 |
OL 8 must prevent files with the setuid and setgid bit set from being executed on the /boot/efi directory. |
| OL08-00-010580 |
OL 8 must prevent special devices on non-root local partitions. |
| OL08-00-010590 |
OL 8 file systems that contain user home directories must not execute binary files. |
| OL08-00-010600 |
OL 8 file systems must not interpret character or block special devices from untrusted file systems. |
| OL08-00-010610 |
OL 8 file systems must not execute binary files on removable media. |
| OL08-00-010620 |
OL 8 must prevent files with the setuid and setgid bit set from being executed on file systems that are used with removable media. |
| OL08-00-010630 |
OL 8 file systems must not execute binary files that are imported via Network File System (NFS). |
| OL08-00-010640 |
OL 8 file systems must not interpret character or block special devices that are imported via NFS. |
| OL08-00-010650 |
OL 8 must prevent files with the setuid and setgid bit set from being executed on file systems that are imported via Network File System (NFS). |
| OL08-00-010660 |
Local OL 8 initialization files must not execute world-writable programs. |
| OL08-00-010670 |
OL 8 must disable kernel dumps unless needed. |
| OL08-00-010671 |
OL 8 must disable the "kernel.core_pattern". |
| OL08-00-010672 |
OL 8 must disable acquiring, saving, and processing core dumps. |
| OL08-00-010673 |
OL 8 must disable core dumps for all users. |
| OL08-00-010674 |
OL 8 must disable storing core dumps. |
| OL08-00-010675 |
OL 8 must disable core dump backtraces. |
| OL08-00-010680 |
For OL 8 systems using Domain Name Servers (DNS) resolution, at least two name servers must be configured. |
| OL08-00-010690 |
Executable search paths within the initialization files of all local interactive OL 8 users must only contain paths that resolve to the system default or the user's home directory. |
| OL08-00-010700 |
All OL 8 world-writable directories must be owned by root, sys, bin, or an application user. |
| OL08-00-010710 |
All OL 8 world-writable directories must be group-owned by root, sys, bin, or an application group. |
| OL08-00-010720 |
All OL 8 local interactive users must have a home directory assigned in the "/etc/passwd" file. |
| OL08-00-010730 |
All OL 8 local interactive user home directories must have mode "0750" or less permissive. |
| OL08-00-010731 |
All OL 8 local interactive user home directory files must have mode "0750" or less permissive. |
| OL08-00-010740 |
All OL 8 local interactive user home directories must be group-owned by the home directory owner's primary group. |
| OL08-00-010741 |
OL 8 must be configured so that all files and directories contained in local interactive user home directories are group-owned by a group of which the home directory owner is a member. |
| OL08-00-010750 |
All OL 8 local interactive user home directories defined in the "/etc/passwd" file must exist. |
| OL08-00-010760 |
All OL 8 local interactive user accounts must be assigned a home directory upon creation. |
| OL08-00-010770 |
All OL 8 local initialization files must have mode "0740" or less permissive. |
| OL08-00-010780 |
All OL 8 files and directories must have a valid owner. |
| OL08-00-010790 |
All OL 8 files and directories must have a valid group owner. |
| OL08-00-010800 |
A separate OL 8 filesystem must be used for user home directories (such as "/home" or an equivalent). |
| OL08-00-010820 |
Unattended or automatic logon via the OL 8 graphical user interface must not be allowed. |
| OL08-00-010830 |
OL 8 must not allow users to override SSH environment variables. |
| OL08-00-020000 |
OL 8 temporary user accounts must be provisioned with an expiration time of 72 hours or less. |
| OL08-00-020010 |
OL 8 systems below version 8.2 must automatically lock an account when three unsuccessful logon attempts occur. |
| OL08-00-020011 |
OL 8 systems, versions 8.2 and above, must automatically lock an account when three unsuccessful logon attempts occur. |
| OL08-00-020012 |
OL 8 systems below version 8.2 must automatically lock an account when three unsuccessful logon attempts occur during a 15-minute time period. |
| OL08-00-020013 |
OL 8 systems, versions 8.2 and above, must automatically lock an account when three unsuccessful logon attempts occur during a 15-minute time period. |
| OL08-00-020014 |
OL 8 systems below version 8.2 must automatically lock an account until the locked account is released by an administrator when three unsuccessful logon attempts occur during a 15-minute time period. |
| OL08-00-020015 |
OL 8 systems, versions 8.2 and above, must automatically lock an account until the locked account is released by an administrator when three unsuccessful logon attempts occur during a 15-minute time period. |
| OL08-00-020016 |
OL 8 systems below version 8.2 must ensure account lockouts persist. |
| OL08-00-020017 |
OL 8 systems, versions 8.2 and above, must ensure account lockouts persist. |
| OL08-00-020018 |
OL 8 systems below version 8.2 must prevent system messages from being presented when three unsuccessful logon attempts occur. |
| OL08-00-020019 |
OL 8 systems, versions 8.2 and above, must prevent system messages from being presented when three unsuccessful logon attempts occur. |
| OL08-00-020020 |
OL 8 systems below version 8.2 must log user name information when unsuccessful logon attempts occur. |
| OL08-00-020021 |
OL 8 systems, versions 8.2 and above, must log user name information when unsuccessful logon attempts occur. |
| OL08-00-020022 |
OL 8 systems below version 8.2 must include root when automatically locking an account until the locked account is released by an administrator when three unsuccessful logon attempts occur during a 15-minute time period. |
| OL08-00-020023 |
OL 8 systems, versions 8.2 and above, must include root when automatically locking an account until the locked account is released by an administrator when three unsuccessful logon attempts occur during a 15-minute time period. |
| OL08-00-020024 |
OL 8 must limit the number of concurrent sessions to 10 for all accounts and/or account types. |
| OL08-00-020025 |
OL 8 must configure the use of the pam_faillock.so module in the /etc/pam.d/system-auth file. |
| OL08-00-020026 |
OL 8 must configure the use of the pam_faillock.so module in the /etc/pam.d/password-auth file. |
| OL08-00-020027 |
OL 8 systems, versions 8.2 and above, must configure SELinux context type to allow the use of a non-default faillock tally directory. |
| OL08-00-020028 |
OL 8 systems below version 8.2 must configure SELinux context type to allow the use of a non-default faillock tally directory. |
| OL08-00-020030 |
OL 8 must enable a user session lock until that user reestablishes access using established identification and authentication procedures for graphical user sessions. |
| OL08-00-020031 |
OL 8 must initiate a session lock for graphical user interfaces when the screensaver is activated. |
| OL08-00-020032 |
OL 8 must disable the user list at logon for graphical user interfaces. |
| OL08-00-020039 |
OL 8 must have the tmux package installed. |
| OL08-00-020040 |
OL 8 must enable a user session lock until that user re-establishes access using established identification and authentication procedures for command line sessions. |
| OL08-00-020041 |
OL 8 must ensure session control is automatically started at shell initialization. |
| OL08-00-020042 |
OL 8 must prevent users from disabling session control mechanisms. |
| OL08-00-020043 |
OL 8 must enable a user session lock until that user reestablishes access using established identification and authentication procedures for command line sessions. |
| OL08-00-020050 |
OL 8 must be able to initiate directly a session lock for all connection types using smartcard when the smartcard is removed. |
| OL08-00-020060 |
OL 8 must automatically lock graphical user sessions after 15 minutes of inactivity. |
| OL08-00-020070 |
OL 8 must automatically lock command line user sessions after 15 minutes of inactivity. |
| OL08-00-020080 |
OL 8 must prevent a user from overriding the session lock-delay setting for the graphical user interface. |
| OL08-00-020081 |
OL 8 must prevent a user from overriding the session idle-delay setting for the graphical user interface. |
| OL08-00-020082 |
OL 8 must prevent a user from overriding the session lock-enabled setting for the graphical user interface. |
| OL08-00-020090 |
OL 8 must map the authenticated identity to the user or group account for PKI-based authentication. |
| OL08-00-020100 |
OL 8 must ensure the password complexity module is enabled in the password-auth file. |
| OL08-00-020110 |
OL 8 must enforce password complexity by requiring that at least one uppercase character be used. |
| OL08-00-020120 |
OL 8 must enforce password complexity by requiring that at least one lowercase character be used. |
| OL08-00-020130 |
OL 8 must enforce password complexity by requiring that at least one numeric character be used. |
| OL08-00-020140 |
OL 8 must require the maximum number of repeating characters of the same character class be limited to four when passwords are changed. |
| OL08-00-020150 |
OL 8 must require the maximum number of repeating characters be limited to three when passwords are changed. |
| OL08-00-020160 |
OL 8 must require the change of at least four character classes when passwords are changed. |
| OL08-00-020170 |
OL 8 must require the change of at least 8 characters when passwords are changed. |
| OL08-00-020180 |
OL 8 passwords for new users or password changes must have a 24 hours/1 day minimum password lifetime restriction in "/etc/shadow". |
| OL08-00-020190 |
OL 8 passwords for new users or password changes must have a 24 hours/1 day minimum password lifetime restriction in "/etc/logins.def". |
| OL08-00-020200 |
OL 8 user account passwords must have a 60-day maximum password lifetime restriction. |
| OL08-00-020210 |
OL 8 user account passwords must be configured so that existing passwords are restricted to a 60-day maximum lifetime. |
| OL08-00-020220 |
OL 8 must be configured in the password-auth file to prohibit password reuse for a minimum of five generations. |
| OL08-00-020230 |
OL 8 passwords must have a minimum of 15 characters. |
| OL08-00-020231 |
OL 8 passwords for new users must have a minimum of 15 characters. |
| OL08-00-020240 |
OL 8 duplicate User IDs (UIDs) must not exist for interactive users. |
| OL08-00-020250 |
OL 8 must implement multifactor authentication for access to interactive accounts. |
| OL08-00-020260 |
The OL 8 system-auth file must disable access to the system for account identifiers (individuals, groups, roles, and devices) with 35 days of inactivity. |
| OL08-00-020261 |
The OL 8 password-auth file must disable access to the system for account identifiers (individuals, groups, roles, and devices) with 35 days of inactivity. |
| OL08-00-020262 |
The OL 8 lastlog command must have a mode of "0750" or less permissive. |
| OL08-00-020263 |
The OL 8 lastlog command must be owned by root. |
| OL08-00-020264 |
The OL 8 lastlog command must be group-owned by root. |
| OL08-00-020270 |
OL 8 emergency accounts must be automatically removed or disabled after the crisis is resolved or within 72 hours. |
| OL08-00-020280 |
All OL 8 passwords must contain at least one special character. |
| OL08-00-020290 |
OL 8 must prohibit the use of cached authentications after one day. |
| OL08-00-020300 |
OL 8 must prevent the use of dictionary words for passwords. |
| OL08-00-020310 |
OL 8 must enforce a delay of at least four seconds between logon prompts following a failed logon attempt. |
| OL08-00-020320 |
OL 8 must not have unnecessary accounts. |
| OL08-00-020330 |
OL 8 must not allow accounts configured with blank or null passwords. |
| OL08-00-020331 |
OL 8 must not allow blank or null passwords in the system-auth file. |
| OL08-00-020332 |
OL 8 must not allow blank or null passwords in the password-auth file. |
| OL08-00-020340 |
OL 8 must display the date and time of the last successful account logon upon logon. |
| OL08-00-020350 |
OL 8 must display the date and time of the last successful account logon upon an SSH logon. |
| OL08-00-020351 |
OL 8 default permissions must be defined in such a way that all authenticated users can read and modify only their own files. |
| OL08-00-020352 |
OL 8 must set the umask value to 077 for all local interactive user accounts. |
| OL08-00-020353 |
OL 8 must define default permissions for logon and non-logon shells. |
| OL08-00-030000 |
The OL 8 audit system must be configured to audit the execution of privileged functions and prevent all software from executing at higher privilege levels than users executing the software. |
| OL08-00-030010 |
Cron logging must be implemented in OL 8. |
| OL08-00-030020 |
The OL 8 System Administrator (SA) and Information System Security Officer (ISSO) (at a minimum) must be alerted of an audit processing failure event. |
| OL08-00-030030 |
The OL 8 Information System Security Officer (ISSO) and System Administrator (SA) (at a minimum) must have mail aliases to be notified of an audit processing failure. |
| OL08-00-030040 |
The OL 8 System must take appropriate action when an audit processing failure occurs. |
| OL08-00-030060 |
The OL 8 audit system must take appropriate action when the audit storage volume is full. |
| OL08-00-030061 |
The OL 8 audit system must audit local events. |
| OL08-00-030062 |
OL 8 must label all offloaded audit logs before sending them to the central log server. |
| OL08-00-030063 |
OL 8 must resolve audit information before writing to disk. |
| OL08-00-030070 |
OL 8 audit logs must have a mode of "0600" or less permissive to prevent unauthorized read access. |
| OL08-00-030080 |
OL 8 audit logs must be owned by root to prevent unauthorized read access. |
| OL08-00-030090 |
OL 8 audit logs must be group-owned by root to prevent unauthorized read access. |
| OL08-00-030100 |
The OL 8 audit log directory must be owned by root to prevent unauthorized read access. |
| OL08-00-030110 |
The OL 8 audit log directory must be group-owned by root to prevent unauthorized read access. |
| OL08-00-030120 |
The OL 8 audit log directory must have a mode of 0700 or less permissive to prevent unauthorized read access. |
| OL08-00-030121 |
The OL 8 audit system must protect auditing rules from unauthorized change. |
| OL08-00-030122 |
The OL 8 audit system must protect logon UIDs from unauthorized change. |
| OL08-00-030130 |
OL 8 must generate audit records for all account creation events that affect "/etc/shadow". |
| OL08-00-030140 |
OL 8 must generate audit records for all account creation events that affect "/etc/security/opasswd". |
| OL08-00-030150 |
OL 8 must generate audit records for all account creation events that affect "/etc/passwd". |
| OL08-00-030160 |
OL 8 must generate audit records for all account creation events that affect "/etc/gshadow". |
| OL08-00-030170 |
OL 8 must generate audit records for all account creation events that affect "/etc/group". |
| OL08-00-030171 |
OL 8 must generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/sudoers". |
| OL08-00-030172 |
OL 8 must generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/sudoers.d/". |
| OL08-00-030190 |
OL 8 must generate audit records for any use of the "su" command. |
| OL08-00-030200 |
The OL 8 audit system must be configured to audit any use of the "setxattr", "fsetxattr", "lsetxattr", "removexattr", "fremovexattr", and "lremovexattr" system calls. |
| OL08-00-030250 |
OL 8 must generate audit records for any use of the "chage" command. |
| OL08-00-030260 |
OL 8 must generate audit records for any uses of the "chcon" command. |
| OL08-00-030270 |
The OL 8 audit system must be configured to audit any use of the "setxattr" system call. |
| OL08-00-030280 |
OL 8 must generate audit records for any use of the "ssh-agent" command. |
| OL08-00-030290 |
OL 8 must generate audit records for any use of the "passwd" command. |
| OL08-00-030300 |
OL 8 must generate audit records for any use of the "mount" command. |
| OL08-00-030301 |
OL 8 must generate audit records for any use of the "umount" command. |
| OL08-00-030302 |
OL 8 must generate audit records for any use of the "mount" syscall. |
| OL08-00-030310 |
OL 8 must generate audit records for any use of the "unix_update" command. |
| OL08-00-030311 |
OL 8 must generate audit records for any use of the "postdrop" command. |
| OL08-00-030312 |
OL 8 must generate audit records for any use of the "postqueue" command. |
| OL08-00-030313 |
OL 8 must generate audit records for any use of the "semanage" command. |
| OL08-00-030314 |
OL 8 must generate audit records for any use of the "setfiles" command. |
| OL08-00-030315 |
OL 8 must generate audit records for any use of the "userhelper" command. |
| OL08-00-030316 |
OL 8 must generate audit records for any use of the "setsebool" command. |
| OL08-00-030317 |
OL 8 must generate audit records for any use of the "unix_chkpwd" command. |
| OL08-00-030320 |
OL 8 must generate audit records for any use of the "ssh-keysign" command. |
| OL08-00-030330 |
OL 8 must generate audit records for any use of the "setfacl" command. |
| OL08-00-030340 |
OL 8 must generate audit records for any use of the "pam_timestamp_check" command. |
| OL08-00-030350 |
OL 8 must generate audit records for any use of the "newgrp" command. |
| OL08-00-030360 |
OL 8 must generate audit records for any use of the "init_module" and "finit_module" system calls. |
| OL08-00-030361 |
OL 8 must generate audit records for any use of the "rename", "unlink", "rmdir", "renameat", and "unlinkat" system calls. |
| OL08-00-030370 |
OL 8 must generate audit records for any use of the "gpasswd" command. |
| OL08-00-030390 |
OL 8 must generate audit records for any use of the delete_module syscall. |
| OL08-00-030400 |
OL 8 must generate audit records for any use of the "crontab" command. |
| OL08-00-030410 |
OL 8 must generate audit records for any use of the "chsh" command. |
| OL08-00-030420 |
OL 8 must generate audit records for any use of the "truncate", "ftruncate", "creat", "open", "openat", and "open_by_handle_at" system calls. |
| OL08-00-030480 |
OL 8 must generate audit records for any use of the "chown", "fchown", "fchownat", and "lchown" system calls. |
| OL08-00-030490 |
OL 8 must generate audit records for any use of the "chmod", "fchmod", and "fchmodat" system calls. |
| OL08-00-030550 |
OL 8 must generate audit records for any use of the "sudo" command. |
| OL08-00-030560 |
OL 8 must generate audit records for any use of the "usermod" command. |
| OL08-00-030570 |
OL 8 must generate audit records for any use of the "chacl" command. |
| OL08-00-030580 |
OL 8 must generate audit records for any use of the "kmod" command. |
| OL08-00-030590 |
OL 8 must generate audit records for any attempted modifications to the "faillock" log file. |
| OL08-00-030600 |
OL 8 must generate audit records for any attempted modifications to the "lastlog" file. |
| OL08-00-030601 |
OL 8 must enable auditing of processes that start prior to the audit daemon. |
| OL08-00-030602 |
OL 8 must allocate an "audit_backlog_limit" of sufficient size to capture processes that start prior to the audit daemon. |
| OL08-00-030603 |
OL 8 must enable Linux audit logging for the USBGuard daemon. |
| OL08-00-030610 |
OL 8 must allow only the Information System Security Manager (ISSM) (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited. |
| OL08-00-030620 |
OL 8 audit tools must have a mode of "0755" or less permissive. |
| OL08-00-030630 |
OL 8 audit tools must be owned by root. |
| OL08-00-030640 |
OL 8 audit tools must be group-owned by root. |
| OL08-00-030650 |
OL 8 must use cryptographic mechanisms to protect the integrity of audit tools. |
| OL08-00-030660 |
OL 8 must allocate audit record storage capacity to store at least one week of audit records when audit records are not immediately sent to a central audit record storage facility. |
| OL08-00-030670 |
OL 8 must have the packages required for offloading audit logs installed. |
| OL08-00-030680 |
OL 8 must have the packages required for encrypting offloaded audit logs installed. |
| OL08-00-030690 |
The OL 8 audit records must be offloaded onto a different system or storage media from the system being audited. |
| OL08-00-030700 |
OL 8 must take appropriate action when the internal event queue is full. |
| OL08-00-030710 |
OL 8 must encrypt the transfer of audit records offloaded onto a different system or media from the system being audited. |
| OL08-00-030720 |
OL 8 must authenticate the remote logging server for offloading audit logs. |
| OL08-00-030730 |
OL 8 must take action when allocated audit record storage volume reaches 75 percent of the repository maximum audit record storage capacity. |
| OL08-00-030731 |
OL 8 must notify the System Administrator (SA) and Information System Security Officer (ISSO) (at a minimum) when allocated audit record storage volume 75 percent utilization. |
| OL08-00-030740 |
OL 8 must compare internal information system clocks at least every 24 hours with a server synchronized to an authoritative time source, such as the United States Naval Observatory (USNO) time servers, or a time server designated for the appropriate DoD network (NIPRNet/SIPRNet), and/or the Global Positioning System (GPS). |
| OL08-00-030741 |
OL 8 must disable the chrony daemon from acting as a server. |
| OL08-00-030742 |
OL 8 must disable network management of the chrony daemon. |
| OL08-00-040000 |
OL 8 must not have the telnet-server package installed. |
| OL08-00-040001 |
OL 8 must not have any automated bug reporting tools installed. |
| OL08-00-040002 |
OL 8 must not have the sendmail package installed. |
| OL08-00-040004 |
OL 8 must enable mitigations against processor-based vulnerabilities. |
| OL08-00-040010 |
OL 8 must not have the rsh-server package installed. |
| OL08-00-040020 |
OL 8 must cover or disable the built-in or attached camera when not in use. |
| OL08-00-040021 |
OL 8 must not have the asynchronous transfer mode (ATM) kernel module installed if not required for operational support. |
| OL08-00-040022 |
OL 8 must not have the Controller Area Network (CAN) kernel module installed if not required for operational support. |
| OL08-00-040023 |
OL 8 must not have the stream control transmission protocol (SCTP) kernel module installed if not required for operational support. |
| OL08-00-040024 |
OL 8 must disable the transparent inter-process communication (TIPC) protocol. |
| OL08-00-040025 |
OL 8 must disable mounting of cramfs. |
| OL08-00-040026 |
OL 8 must disable IEEE 1394 (FireWire) Support. |
| OL08-00-040030 |
OL 8 must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services as defined in the Ports, Protocols, and Services Management (PPSM) Category Assignments List (CAL) and vulnerability assessments. |
| OL08-00-040070 |
The OL 8 file system automounter must be disabled unless required. |
| OL08-00-040080 |
OL 8 must be configured to disable the ability to use USB mass storage devices. |
| OL08-00-040090 |
An OL 8 firewall must employ a deny-all, allow-by-exception policy for allowing connections to other systems. |
| OL08-00-040100 |
A firewall must be installed on OL 8. |
| OL08-00-040101 |
A firewall must be active on OL 8. |
| OL08-00-040110 |
OL 8 wireless network adapters must be disabled. |
| OL08-00-040111 |
OL 8 Bluetooth must be disabled. |
| OL08-00-040120 |
OL 8 must mount "/dev/shm" with the "nodev" option. |
| OL08-00-040121 |
OL 8 must mount "/dev/shm" with the "nosuid" option. |
| OL08-00-040122 |
OL 8 must mount "/dev/shm" with the "noexec" option. |
| OL08-00-040123 |
OL 8 must mount "/tmp" with the "nodev" option. |
| OL08-00-040124 |
OL 8 must mount "/tmp" with the "nosuid" option. |
| OL08-00-040125 |
OL 8 must mount "/tmp" with the "noexec" option. |
| OL08-00-040126 |
OL 8 must mount "/var/log" with the "nodev" option. |
| OL08-00-040127 |
OL 8 must mount "/var/log" with the "nosuid" option. |
| OL08-00-040128 |
OL 8 must mount "/var/log" with the "noexec" option. |
| OL08-00-040129 |
OL 8 must mount "/var/log/audit" with the "nodev" option. |
| OL08-00-040130 |
OL 8 must mount "/var/log/audit" with the "nosuid" option. |
| OL08-00-040131 |
OL 8 must mount "/var/log/audit" with the "noexec" option. |
| OL08-00-040132 |
OL 8 must mount "/var/tmp" with the "nodev" option. |
| OL08-00-040133 |
OL 8 must mount "/var/tmp" with the "nosuid" option. |
| OL08-00-040134 |
OL 8 must mount "/var/tmp" with the "noexec" option. |
| OL08-00-040135 |
The OL 8 "fapolicy" module must be installed. |
| OL08-00-040136 |
The OL 8 "fapolicy" module must be enabled. |
| OL08-00-040137 |
The OL 8 fapolicy module must be configured to employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs. |
| OL08-00-040139 |
OL 8 must have the USBGuard installed. |
| OL08-00-040140 |
OL 8 must block unauthorized peripherals before establishing a connection. |
| OL08-00-040141 |
OL 8 must enable the USBGuard. |
| OL08-00-040150 |
A firewall must be able to protect against or limit the effects of denial-of-service (DoS) attacks by ensuring OL 8 can implement rate-limiting measures on impacted network interfaces. |
| OL08-00-040159 |
All OL 8 networked systems must have SSH installed. |
| OL08-00-040160 |
All OL 8 networked systems must have and implement SSH to protect the confidentiality and integrity of transmitted and received information, as well as information during preparation for transmission. |
| OL08-00-040161 |
OL 8 must force a frequent session key renegotiation for SSH connections to the server. |
| OL08-00-040170 |
The x86 Ctrl-Alt-Delete key sequence must be disabled on OL 8. |
| OL08-00-040171 |
The x86 Ctrl-Alt-Delete key sequence in OL 8 must be disabled if a graphical user interface is installed. |
| OL08-00-040172 |
OL 8 must disable the systemd Ctrl-Alt-Delete burst key sequence. |
| OL08-00-040180 |
OL 8 must disable the debug-shell systemd service. |
| OL08-00-040190 |
The Trivial File Transfer Protocol (TFTP) server package must not be installed if not required for OL 8 operational support. |
| OL08-00-040200 |
The root account must be the only account having unrestricted access to the OL 8 system. |
| OL08-00-040209 |
OL 8 must prevent IPv4 Internet Control Message Protocol (ICMP) redirect messages from being accepted. |
| OL08-00-040210 |
OL 8 must prevent IPv6 Internet Control Message Protocol (ICMP) redirect messages from being accepted. |
| OL08-00-040220 |
OL 8 must not send Internet Control Message Protocol (ICMP) redirects. |
| OL08-00-040230 |
OL 8 must not respond to Internet Control Message Protocol (ICMP) echoes sent to a broadcast address. |
| OL08-00-040239 |
OL 8 must not forward IPv4 source-routed packets. |
| OL08-00-040240 |
OL 8 must not forward IPv6 source-routed packets. |
| OL08-00-040249 |
OL 8 must not forward IPv4 source-routed packets by default. |
| OL08-00-040250 |
OL 8 must not forward IPv6 source-routed packets by default. |
| OL08-00-040260 |
OL 8 must not enable IPv6 packet forwarding unless the system is a router. |
| OL08-00-040261 |
OL 8 must not accept router advertisements on all IPv6 interfaces. |
| OL08-00-040262 |
OL 8 must not accept router advertisements on all IPv6 interfaces by default. |
| OL08-00-040270 |
OL 8 must not allow interfaces to perform Internet Control Message Protocol (ICMP) redirects by default. |
| OL08-00-040279 |
OL 8 must ignore IPv4 Internet Control Message Protocol (ICMP) redirect messages. |
| OL08-00-040280 |
OL 8 must ignore IPv6 Internet Control Message Protocol (ICMP) redirect messages. |
| OL08-00-040281 |
OL 8 must disable access to the network "bpf" syscall from unprivileged processes. |
| OL08-00-040282 |
OL 8 must restrict the use of "ptrace" to descendant processes. |
| OL08-00-040283 |
OL 8 must restrict exposed kernel pointer addresses access. |
| OL08-00-040284 |
OL 8 must disable the use of user namespaces. |
| OL08-00-040285 |
OL 8 must use reverse path filtering on all IPv4 interfaces. |
| OL08-00-040286 |
OL 8 must enable hardening for the Berkeley Packet Filter Just-in-time compiler. |
| OL08-00-040290 |
OL 8 must be configured to prevent unrestricted mail relaying. |
| OL08-00-040300 |
The OL 8 file integrity tool must be configured to verify extended attributes. |
| OL08-00-040310 |
The OL 8 file integrity tool must be configured to verify Access Control Lists (ACLs). |
| OL08-00-040320 |
The graphical display manager must not be installed on OL 8 unless approved. |
| OL08-00-040330 |
OL 8 network interfaces must not be in promiscuous mode. |
| OL08-00-040340 |
OL 8 remote X connections for interactive users must be disabled unless to fulfill documented and validated mission requirements. |
| OL08-00-040341 |
The OL 8 SSH daemon must prevent remote hosts from connecting to the proxy display. |
| OL08-00-040350 |
If the Trivial File Transfer Protocol (TFTP) server is required, the OL 8 TFTP daemon must be configured to operate in secure mode. |
| OL08-00-040360 |
A File Transfer Protocol (FTP) server package must not be installed unless mission essential on OL 8. |
| OL08-00-040370 |
OL 8 must not have the "gssproxy" package installed if not required for operational support. |
| OL08-00-040380 |
OL 8 must not have the "iprutils" package installed if not required for operational support. |
| OL08-00-040390 |
OL 8 must not have the "tuned" package installed if not required for operational support. |
| OL08-00-040400 |
OL 8 must prevent non-privileged users from executing privileged functions, including disabling, circumventing, or altering implemented security safeguards/countermeasures. |
| OL08-00-010121 |
The OL 8 operating system must not have accounts configured with blank or null passwords. |
| OL08-00-010331 |
OL 8 library directories must have mode 755 or less permissive. |
| OL08-00-010341 |
OL 8 library directories must be owned by root. |
| OL08-00-010351 |
OL 8 library directories must be group-owned by root or a system account. |
| OL08-00-010359 |
The OL 8 operating system must use a file integrity tool to verify correct operation of all security functions. |
| OL08-00-010379 |
OL 8 must specify the default "include" directory for the /etc/sudoers file. |
| OL08-00-010385 |
The OL 8 operating system must not be configured to bypass password requirements for privilege escalation. |
| OL08-00-020101 |
OL 8 must ensure the password complexity module is enabled in the system-auth file. |
| OL08-00-020102 |
OL 8 systems below version 8.4 must ensure the password complexity module in the system-auth file is configured for three retries or less. |
| OL08-00-020103 |
OL 8 systems below version 8.4 must ensure the password complexity module in the password-auth file is configured for three retries or less. |
| OL08-00-020104 |
OL 8 systems, version 8.4 and above, must ensure the password complexity module is configured for three retries or less. |
| OL08-00-020221 |
OL 8 must be configured in the system-auth file to prohibit password reuse for a minimum of five generations. |
| OL08-00-040259 |
OL 8 must not enable IPv4 packet forwarding unless the system is a router. |
| OL08-00-040321 |
The graphical display manager must not be the default target on OL 8 unless approved. |