Ubuntu 20.04 STIG V1R6

The Ubuntu operating system must provision temporary user accounts with an expiration time of 72 hours or less.

Vulnerability Discussion

If temporary user accounts remain active when no longer needed or for an excessive period, these accounts may be used to gain unauthorized access. To mitigate this risk, automated termination of all temporary accounts must be set upon account creation.

Temporary accounts are established as part of normal account activation procedures when there is a need for short-term accounts without the demand for immediacy in account activation.

If temporary accounts are used, the operating system must be configured to automatically terminate these types of accounts after a DoD-defined time period of 72 hours.

To address access requirements, many operating systems may be integrated with enterprise-level authentication/access mechanisms that meet or exceed access control policy requirements.

Check

Verify that the Ubuntu operating system expires temporary user accounts within 72 hours or less.

For every existing temporary account, run the following command to obtain its account expiration information:

$ sudo chage -l system_account_name | grep expires

Password expires : Aug 07, 2019
Account expires : Aug 07, 2019

Verify that each of these accounts has an expiration date set within 72 hours of account creation.

If any temporary account does not expire within 72 hours of that account's creation, this is a finding.

Fix

If a temporary account must be created, configure the system to terminate the account after a 72-hour time period with the following command to set an expiration date on it.

Substitute "system_account_name" with the account to be created.

$ sudo chage -E $(date -d "+3 days" +%F) system_account_name

The Ubuntu operating system must enable the graphical user logon banner to display the Standard Mandatory DoD Notice and Consent Banner before granting local access to the system via a graphical user logon.

Vulnerability Discussion

Display of a standardized and approved use notification before granting access to the Ubuntu operating system ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.

System use notifications are required only for access via logon interfaces with human users and are not required when such human interfaces do not exist.

The banner must be formatted in accordance with applicable DoD policy. Use the following verbiage for operating systems that can accommodate banners of 1300 characters:

"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.

By using this IS (which includes any device attached to this IS), you consent to the following conditions:

-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.

-At any time, the USG may inspect and seize data stored on this IS.

-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.

-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.

-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details."

Use the following verbiage for operating systems that have severe limitations on the number of characters that can be displayed in the banner:

"I've read & consent to terms in IS user agreem't."

Check

Verify the Ubuntu operating system is configured to display the Standard Mandatory DoD Notice and Consent Banner before granting access to the operating system via a graphical user logon.

Note: If the system does not have a graphical user interface installed, this requirement is Not Applicable.

Check that the operating banner message for the graphical user logon is enabled with the following command:

$ grep ^banner-message-enable /etc/gdm3/greeter.dconf-defaults

banner-message-enable=true

If the line is commented out or set to "false", this is a finding.

Fix

Edit the "/etc/gdm3/greeter.dconf-defaults" file.

Look for the "banner-message-enable" parameter under the "[org/gnome/login-screen]" section and uncomment it (remove the leading "#" characters):

Note: The lines are all near the bottom of the file but not adjacent to each other.

[org/gnome/login-screen]

banner-message-enable=true

Update the GDM with the new configuration:

$ sudo dconf update
$ sudo systemctl restart gdm3

Configure the Ubuntu operating system to implement multifactor authentication by installing the required packages.

Install the "libpam-pkcs11" package on the system with the following command:

$ sudo apt install libpam-pkcs11

The Ubuntu operating system must accept Personal Identity Verification (PIV) credentials.

Vulnerability Discussion

The use of PIV credentials facilitates standardization and reduces the risk of unauthorized access.

DoD has mandated the use of the CAC to support identity management and personal authentication for systems covered under Homeland Security Presidential Directive (HSPD) 12, as well as making the CAC a primary component of layered protection for national security systems.

Check

Verify the Ubuntu operating system accepts PIV credentials.

Verify the "opensc-pcks11" package is installed on the system with the following command:

$ dpkg -l | grep opensc-pkcs11

ii opensc-pkcs11:amd64 0.15.0-1Ubuntu1 amd64 Smart card utilities with support for PKCS#15 compatible cards

If the "opensc-pcks11" package is not installed, this is a finding.

Fix

Configure the Ubuntu operating system to accept PIV credentials.

Install the "opensc-pkcs11" package using the following command:

$ sudo apt-get install opensc-pkcs11

The Ubuntu operating system must be configured so that the audit log directory is not write-accessible by unauthorized users.

Vulnerability Discussion

If audit information were to become compromised, then forensic analysis and discovery of the true source of potentially malicious system activity is impossible to achieve.

To ensure the veracity of audit information, the operating system must protect audit information from unauthorized deletion. This requirement can be achieved through multiple methods, which will depend upon system architecture and design.

Audit information includes all information (e.g., audit records, audit settings, audit reports) needed to successfully audit information system activity.

Check

Verify that the audit log directory has a mode of "0750" or less permissive.

Determine where the audit logs are stored with the following command:

$ sudo grep -iw ^log_file /etc/audit/auditd.conf
log_file = /var/log/audit/audit.log

Using the path of the directory containing the audit logs, determine if the directory has a mode of "0750" or less by using the following command:

$ sudo stat -c "%n %a" /var/log/audit /var/log/audit/*
/var/log/audit 750
/var/log/audit/audit.log 600

If the audit log directory has a mode more permissive than "0750", this is a finding.

Fix

Configure the audit log directory to have a mode of "0750" or less permissive.

Determine where the audit logs are stored with the following command:

$ sudo grep -iw ^log_file /etc/audit/auditd.conf
log_file = /var/log/audit/audit.log

Using the path of the directory containing the audit logs, configure the audit log directory to have a mode of "0750" or less permissive by
using the following command:

$ sudo chmod -R g-w,o-rwx /var/log/audit

The Ubuntu operating system must be configured so that audit configuration files are not write-accessible by unauthorized users.

The Ubuntu operating system must generate audit records for any use of the setxattr, fsetxattr, lsetxattr, removexattr, fremovexattr, and lremovexattr system calls.

The Ubuntu operating system must produce audit records and reports containing information to establish when, where, what type, the source, and the outcome for all DoD-defined auditable events and actions in near real time.

The Ubuntu operating system must have directories that contain system commands set to a mode of 0755 or less permissive.

Vulnerability Discussion

Protecting audit information also includes identifying and protecting the tools used to view and manipulate log data. Therefore, protecting audit tools is necessary to prevent unauthorized operation on audit information.

Operating systems providing tools to interface with audit information will leverage user permissions and roles identifying the user accessing the tools and the corresponding rights the user has in order to make access decisions regarding the deletion of audit tools.

Audit tools include, but are not limited to, vendor-provided and open source audit tools needed to successfully view and manipulate audit information system activity and records. Audit tools include custom queries and report generators.

Check

Verify the system commands directories have mode 0755 or less permissive:

/bin
/sbin
/usr/bin
/usr/sbin
/usr/local/bin
/usr/local/sbin

Check that the system command directories have mode 0755 or less permissive with the following command:

$ find /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin -perm /022 -type d -exec stat -c "%n %a" '{}' \;

If any directories are found to be group-writable or world-writable, this is a finding.

Fix

The Ubuntu operating system must be configured to preserve log records from failure events.

Vulnerability Discussion

Failure to a known state can address safety or security in accordance with the mission/business needs of the organization. Failure to a known secure state helps prevent a loss of confidentiality, integrity, or availability in the event of a failure of the information system or a component of the system.

Preserving operating system state information helps to facilitate operating system restart and return to the operational mode of the organization with least disruption to mission/business processes.

Check

Verify the log service is configured to collect system failure events.

Check that the log service is installed properly with the following command:

$ dpkg -l | grep rsyslog

ii rsyslog 8.32.0-1ubuntu4 amd64 reliable system and kernel logging daemon

If the "rsyslog" package is not installed, this is a finding.

Check that the log service is enabled with the following command:

$ systemctl is-enabled rsyslog

enabled

If the command above returns "disabled", this is a finding.

Check that the log service is properly running and active on the system with the following command:

$ systemctl is-active rsyslog

active

If the command above returns "inactive", this is a finding.

Fix

Configure the log service to collect failure events.

Install the log service (if the log service is not already installed) with the following command:

$ sudo apt-get install rsyslog

Enable the log service with the following command:

$ sudo systemctl enable --now rsyslog

The Ubuntu operating system must have an application firewall installed in order to control remote access methods.

Vulnerability Discussion

Remote access services, such as those providing remote access to network devices and information systems, which lack automated control capabilities, increase risk and make remote user access management difficult at best.

Remote access is access to DoD nonpublic information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless.

Ubuntu operating system functionality (e.g., RDP) must be capable of taking enforcement action if the audit reveals unauthorized activity. Automated control of remote access sessions allows organizations to ensure ongoing compliance with remote access policies by enforcing connection rules of remote access applications on a variety of information system components (e.g., servers, workstations, notebook computers, smartphones, and tablets).

Check

Verify that the Uncomplicated Firewall is installed with the following command:

$ dpkg -l | grep ufw

ii ufw 0.36-6

If the "ufw" package is not installed, ask the System Administrator if another application firewall is installed.

If no application firewall is installed, this is a finding.

Fix

Install the Uncomplicated Firewall by using the following command:

$ sudo apt-get install ufw

The Ubuntu operating system must configure the uncomplicated firewall to rate-limit impacted network interfaces.

Vulnerability Discussion

Denial of service (DoS) is a condition when a resource is not available for legitimate users. When this occurs, the organization either cannot accomplish its mission or must operate at degraded capacity.

This requirement addresses the configuration of the operating system to mitigate the impact of DoS attacks that have occurred or are ongoing on system availability. For each system, known and potential DoS attacks must be identified and solutions for each type implemented. A variety of technologies exist to limit or, in some cases, eliminate the effects of DoS attacks (e.g., limiting processes or establishing memory partitions). Employing increased capacity and bandwidth, combined with service redundancy, may reduce the susceptibility to some DoS attacks.

Check

Verify an application firewall is configured to rate limit any connection to the system.

Check all the services listening to the ports with the following command:

$ sudo ss -l46ut

Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port Process
tcp LISTEN 0 128 [::]:ssh [::]:*

For each entry, verify that the Uncomplicated Firewall is configured to rate limit the service ports with the following command:

$ sudo ufw status

Status: active

To Action From
-- ------ ----
22/tcp LIMIT Anywhere
22/tcp (v6) LIMIT Anywhere (v6)

If any port with a state of "LISTEN" is not marked with the "LIMIT" action, this is a finding.

Fix

Configure the application firewall to protect against or limit the effects of DoS attacks by ensuring the Ubuntu operating system is implementing rate-limiting measures on impacted network interfaces.

Check all the services listening to the ports with the following command:

$ sudo ss -l46ut

Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port Process
tcp LISTEN 0 128 [::]:ssh [::]:*

For each service with a port listening to connections, run the following command, replacing "[service]" with the service that needs to be rate limited.

$ sudo ufw limit [service]

Rate-limiting can also be done on an interface. An example of adding a rate-limit on the eth0 interface follows:

$ sudo ufw limit in on eth0

The Ubuntu operating system must implement non-executable data to protect its memory from unauthorized code execution.

Vulnerability Discussion

Some adversaries launch attacks with the intent of executing code in non-executable regions of memory or in memory locations that are prohibited. Security safeguards employed to protect memory include, for example, data execution prevention and address space layout randomization. Data execution prevention safeguards can either be hardware-enforced or software-enforced with hardware providing the greater strength of mechanism.

Examples of attacks are buffer overflow attacks.

Check

Verify the NX (no-execution) bit flag is set on the system with the following commands:

$ dmesg | grep -i "execute disable"
[ 0.000000] NX (Execute Disable) protection: active

If "dmesg" does not show "NX (Execute Disable) protection: active", check the cpuinfo settings with the following command:

$ grep flags /proc/cpuinfo | grep -w nx | sort -u
flags : fpu vme de pse tsc ms nx rdtscp lm constant_tsc

If "flags" does not contain the "nx" flag, this is a finding.

Fix

Configure the Ubuntu operating system to enable NX.

If "nx" is not showing up in "/proc/cpuinfo", and the system's BIOS setup configuration permits toggling the No Execution bit, set it to "enable".

Vulnerability Discussion

Unauthorized changes to the baseline configuration could make the system vulnerable to various attacks or allow unauthorized access to the Ubuntu operating system. Changes to Ubuntu operating system configurations can have unintended side effects, some of which may be relevant to security.

Detecting such changes and providing an automated response can help avoid unintended, negative consequences that could ultimately affect the security state of the Ubuntu operating system. The Ubuntu operating system's IMO/ISSO and SAs must be notified via email and/or monitoring system trap when there is an unauthorized modification of a configuration item.

Check

Verify that Advanced Intrusion Detection Environment (AIDE) notifies the System Administrator
when anomalies in the operation of any security functions are discovered with the following command:

$ sudo grep SILENTREPORTS /etc/default/aide

SILENTREPORTS=no

If SILENTREPORTS is uncommented and set to "yes", this is a finding.

The Ubuntu operating system must disable the x86 Ctrl-Alt-Delete key sequence if a graphical user interface is installed.

Vulnerability Discussion

A locally logged-on user who presses Ctrl-Alt-Delete, when at the console, can reboot the system. If accidentally pressed, as could happen in the case of a mixed OS environment, this can create the risk of short-term loss of availability of systems due to unintentional reboot. In the graphical environment, risk of unintentional reboot from the Ctrl-Alt-Delete sequence is reduced because the user will be prompted before any action is taken.

Check

Verify the Ubuntu operating system is not configured to reboot the system when Ctrl-Alt-Delete is pressed when using a graphical user interface.

Check that the "logout" target is not bound to an action with the following command:

# grep logout /etc/dconf/db/local.d/*

logout=''

If the "logout" key is bound to an action, is commented out, or is missing, this is a finding.

Fix

Configure the system to disable the Ctrl-Alt-Delete sequence when using a graphical user interface by creating or editing the /etc/dconf/db/local.d/00-disable-CAD file.

Add the setting to disable the Ctrl-Alt-Delete sequence for the graphical user interface:

[org/gnome/settings-daemon/plugins/media-keys]
logout=''

Update the dconf settings:

# dconf update

Vulnerability Discussion

If an account has an empty password, anyone could log on and run commands with the privileges of that account. Accounts with empty passwords should never be used in operational environments.

Check

To verify that null passwords cannot be used, run the following command:

$ grep nullok /etc/pam.d/common-password

If this produces any output, it may be possible to log on with accounts with empty passwords.

If null passwords can be used, this is a finding.

Fix

If an account is configured for password authentication but does not have an assigned password, it may be possible to log on to the account without authenticating.

Remove any instances of the "nullok" option in "/etc/pam.d/common-password" to prevent logons with empty passwords.